File manager - Edit - /home/u478019808/domains/bestandroidphones.store/public_html/static/img/logo/firewall.tar
Back
__pycache__/fw_types.cpython-39.pyc 0000644 00000005673 15025011705 0013254 0 ustar 00 a ���g� � @ s d gZ G dd � d e�ZdS )�LastUpdatedOrderedDictc @ sx e Zd Zd dd�Zdd� Zdd� Zdd � Zd d � Zd d � Zdd� Z dd� Z dd� Z dd� Z dd� Z dd� Zd dd�ZdS ) r Nc C s i | _ g | _|r| �|� d S �N)�_dict�_list�update)�self�x� r �5/usr/lib/python3.9/site-packages/firewall/fw_types.py�__init__ s z LastUpdatedOrderedDict.__init__c C s | j d d �= | j�� d S r )r r �clear�r r r r r s z LastUpdatedOrderedDict.clearc C s |� � D ]\}}|| |< qd S r )�items)r r �key�valuer r r r # s z LastUpdatedOrderedDict.updatec s � fdd�� j D �S )Nc s g | ]}|� | f�qS r r ��.0r r r r � <listcomp>( � z0LastUpdatedOrderedDict.items.<locals>.<listcomp>�r r r r r r ' s z LastUpdatedOrderedDict.itemsc C s" || j v r | j�|� | j |= d S r )r r �remove�r r r r r � __delitem__* s z"LastUpdatedOrderedDict.__delitem__c s& d� j jd�� fdd�� jD ��f S )Nz%s([%s])z, c s g | ]}d |� | f �qS )z(%r, %r)r r r r r r 1 r z3LastUpdatedOrderedDict.__repr__.<locals>.<listcomp>)� __class__�__name__�joinr r r r r �__repr__/ s �z LastUpdatedOrderedDict.__repr__c C s$ || j vr| j�|� || j |< d S r )r r �append�r r r r r r � __setitem__3 s z"LastUpdatedOrderedDict.__setitem__c C s$ t |�tkr| j| S | j| S d S r )�type�intr r r r r r � __getitem__8 s z"LastUpdatedOrderedDict.__getitem__c C s t | j�S r )�lenr r r r r �__len__> s z LastUpdatedOrderedDict.__len__c C s t | �S r )r r r r r �copyA s zLastUpdatedOrderedDict.copyc C s | j d d � S r r r r r r �keysD s zLastUpdatedOrderedDict.keysc s � fdd�� j D �S )Nc s g | ] }� | �qS r r r r r r r H r z1LastUpdatedOrderedDict.values.<locals>.<listcomp>r r r r r �valuesG s z LastUpdatedOrderedDict.valuesc C s || v r| | S || |< |S d S r r r r r r � setdefaultJ s z!LastUpdatedOrderedDict.setdefault)N)N)r � __module__� __qualname__r r r r r r r r! r# r$ r% r& r' r r r r r s N)�__all__�objectr r r r r �<module> s __pycache__/command.cpython-39.pyc 0000644 00000042757 15025011705 0013036 0 ustar 00 a ���g�^ � @ sf d Z dgZddlZddlmZ ddlmZ ddlmZ ddl m Z m Z m Z m Z mZ G dd� de�ZdS ) z<FirewallCommand class for command line client simplification�FirewallCommand� N)�errors)� FirewallError)� DBusException)� checkIPnMask� checkIP6nMask� check_mac� check_port�check_single_addressc @ s� e Zd Zd\dd�Zdd� Zdd� Zdd � Zd d � Zd d � Zd]dd�Z d^dd�Z d_dd�Z d`dd�Z dadd�Z dbdd�Zdcd d �Zddd d �Zded d!�Zdfd"d#�Zdgd$d%�Zdhd&d'�Zdid(d)�Zdjd*d+�Zdkd,d-�Zd.d/� Zdld1d2�Zdmd3d4�Zd5d6� Zd7d8� Z d9d:� Z d;d<� Z d=d>� Z d?d@� Z dg dAfdBdC�Z!dg fdDdE�Z"dg fdFdG�Z#dHdI� Z$dJdK� Z%dLdM� Z&dNdO� Z'dPdQ� Z(dRdS� Z)dTdU� Z*dVdW� Z+dXdY� Z,dZd[� Z-dS )nr Fc C s || _ || _d| _d | _d S �NT)�quiet�verbose�'_FirewallCommand__use_exception_handler�fw)�selfr r � r �4/usr/lib/python3.9/site-packages/firewall/command.py�__init__# s zFirewallCommand.__init__c C s || _ d S �N)r )r r r r r �set_fw) s zFirewallCommand.set_fwc C s || _ d S r �r �r �flagr r r � set_quiet, s zFirewallCommand.set_quietc C s | j S r r �r r r r � get_quiet/ s zFirewallCommand.get_quietc C s || _ d S r �r r r r r � set_verbose2 s zFirewallCommand.set_verbosec C s | j S r r r r r r � get_verbose5 s zFirewallCommand.get_verboseNc C s" |d ur | j s tj�|d � d S �N� )r �sys�stdout�write�r �msgr r r � print_msg8 s zFirewallCommand.print_msgc C s" |d ur | j s tj�|d � d S r )r r! �stderrr# r$ r r r �print_error_msg< s z FirewallCommand.print_error_msgc C s, d}d}t j�� r || | }| �|� d S )Nz[91mz[00m)r! r' �isattyr( )r r% ZFAILZENDr r r � print_warning@ s z FirewallCommand.print_warningr c C s, |dkr| � |� n | �|� t�|� d S )N� )r* r& r! �exit)r r% Z exit_coder r r �print_and_exitG s z FirewallCommand.print_and_exitc C s | � |d� d S )N� �r- r$ r r r �failR s zFirewallCommand.failc C s" |d ur | j r tj�|d � d S r )r r! r" r# r$ r r r �print_if_verboseU s z FirewallCommand.print_if_verbosec C s� | j d ur| j �� g } d} g } |D ]�} |d ur�z || �} W n� ty� } zlt�t|��}t|�dkrv| �d| � n| �d| |� || vr�| � |� | d7 } W Y d }~q$W Y d }~n d }~0 0 | � | � q$| D �]d} g }|d ur�||7 }t | t ��st | t ��s|� | � n|| 7 }|d u�r*||7 }| � � z ||� W n� ttf�y. } z�t |t��rx| �|�� � |�� }nt|�}t�|�}|tjtjtjtjfv �r�d}t|�dk�r�| �d| � n8|dk�r�| �d| � W Y d }~ d S | �d| |� || v�r| � |� | d7 } W Y d }~n d }~0 0 | �� q�| �s�t|�| k�sXd| v �r\d S t| �dk�rzt�| d � nt| �dk�r�t�tj� d S )Nr r+ � Warning: %s� Error: %s)r Z authorizeAll� Exceptionr �get_code�str�lenr* r- �append� isinstance�list�tuple� deactivate_exception_handlerr �fail_if_not_authorized� get_dbus_name�get_dbus_messager �ALREADY_ENABLED� NOT_ENABLED�ZONE_ALREADY_SET� ALREADY_SET�activate_exception_handlerr! r, Z UNKNOWN_ERROR)r Zcmd_type�option� action_method� query_method� parse_method�message� start_args�end_args�no_exit�items�_errorsZ _error_codes�itemr% �code� call_itemr r r Z__cmd_sequenceY st " � z FirewallCommand.__cmd_sequencec C s | j d||||||d� d S )N�add�rL �� _FirewallCommand__cmd_sequence�r rE rF rG rH rI rL r r r � add_sequence� s �z FirewallCommand.add_sequencec C s | j d||||||g|d� d S )NrR �rJ rL rT �r �xrE rF rG rH rI rL r r r �x_add_sequence� s �z FirewallCommand.x_add_sequencec C s$ | j d||||||g|g|d� d S )NrR )rJ rK rL rT ) r �zonerE rF rG rH rI �timeoutrL r r r �zone_add_timeout_sequence� s �z)FirewallCommand.zone_add_timeout_sequencec C s | j d||||||d� d S )N�removerS rT rV r r r �remove_sequence� s �z FirewallCommand.remove_sequencec C s | j d||||||g|d� d S )Nr_ rX rT rY r r r �x_remove_sequence� s �z!FirewallCommand.x_remove_sequencec C s* g }|D ]�}|d ur�z ||�}W nj t y� } zRt|�dkrX| �d| � W Y d } ~ qn t�t| ��} | �d| | � W Y d } ~ n d } ~ 0 0 |�|� q|D �]v}g } |d ur�| |7 } t|t �s�t|t �s�| �|� n| |7 } | � � z || � } W n� t �yv } zj| � | �� � t�| �� �} t|�dk�rN| �d| �� � W Y d } ~ q�n| �d| �� | � W Y d } ~ njd } ~ 0 t �y� } zHt�t| ��} t|�dk�r�| �d| � n| �d| | � W Y d } ~ n d } ~ 0 0 | �� t|�dk�r | �d|| d| f � q�| �| � q�|�s&t�d� d S )Nr+ r2 r3 z%s: %s)�no�yesr )r4 r7 r* r r5 r6 r- r8 r9 r: r; r< r r= r> r? rD r& �print_query_resultr! r, ) r rE rG rH rI rJ rL rM rO r% rP rQ �resr r r Z__query_sequence� sT & �& z FirewallCommand.__query_sequencec C s | j |||||d� d S )NrS �� _FirewallCommand__query_sequence)r rE rG rH rI rL r r r �query_sequence� s �z FirewallCommand.query_sequencec C s | j |||||g|d� d S )NrX rf )r rZ rE rG rH rI rL r r r �x_query_sequence� s �z FirewallCommand.x_query_sequencec C sB t |�s>t|�s>t|�s>|�d�r.t|�dks>ttjd| ��|S )Nzipset:� z8'%s' is no valid IPv4, IPv6 or MAC address, nor an ipset)r r r � startswithr7 r r � INVALID_ADDR�r �valuer r r � parse_source� s �� ��z FirewallCommand.parse_source�/c C sj z|� |�\}}W n" ty4 ttjd| ��Y n0 t|�sJttj|��|dvrbttjd| ��||fS )NzTbad port (most likely missing protocol), correct syntax is portid[-portid]%sprotocol�ZtcpZudpZsctpZdccp�''%s' not in {'tcp'|'udp'|'sctp'|'dccp'})�split� ValueErrorr r � INVALID_PORTr �INVALID_PROTOCOL)r rn � separator�port�protor r r � parse_port s � ��zFirewallCommand.parse_portc C s� d }d }d }d }d}d||d � v r�||d � � dd�d }|t|�d 7 }d||d � v rv||d � � dd�d } n ||d � } |t| �d 7 }|dkr�| }q|dkr�| }q|dkr�| }q|dkr�| }q|d kr�|r�qttjd | ��q|s�ttjd ��|�s ttjd ��|�s$|�s$ttjd ��t|��s:ttj|��|dv�rTttjd| ��|�rpt|��spttj|��|�r�td|��s�|�s�td|��s�ttj |��||||fS )Nr �=r+ �:rx ry �toport�toaddr�ifz invalid forward port arg '%s'z missing portzmissing protocolzmissing destinationrq rr �ipv4�ipv6) rs r7 r r ZINVALID_FORWARDr ru rv r rl ) r rn �compatrx Zprotocolr} r~ �i�opt�valr r r �parse_forward_port sZ � �� z"FirewallCommand.parse_forward_portc C sF |� d�}t|�dkr"|d dfS t|�dkr2|S ttjd| ��d S )Nr{ r+ r � r. zinvalid ipset option '%s')rs r7 r r ZINVALID_OPTION)r rn �argsr r r �parse_ipset_optionH s �z"FirewallCommand.parse_ipset_optionc C s. ddg}||vr*t tjd|d�|�f ��|S )Nr� r� �'invalid argument: %s (choose from '%s')�', '�r r Z INVALID_IPV�join�r rn Zipvsr r r �check_destination_ipvR s ��z%FirewallCommand.check_destination_ipvc C sB z|� dd�\}}W n ty2 ttjd��Y n0 | �|�|fS )Nr| r+ z(destination syntax is ipv:address[/mask])rs rt r r ZINVALID_DESTINATIONr� )r rn ZipvZ destinationr r r �parse_service_destinationZ s � z)FirewallCommand.parse_service_destinationc C s. g d�}||vr*t tjd|d�|�f ��|S )N)r� r� Zebr� r� r� r� r r r � check_ipvb s ��zFirewallCommand.check_ipvc C s. g d�}||vr*t tjd|d�|�f ��|S )N)r� r� r� r� r� r� r� r r r �check_helper_familyj s ��z#FirewallCommand.check_helper_familyc C sB |� d�sttjd| ��t|�dd��dk r>ttjd| ��|S )NZ nf_conntrack_z('%s' does not start with 'nf_conntrack_'r� r+ zModule name '%s' too short)rk r r ZINVALID_MODULEr7 �replacerm r r r � check_moduler s ��z FirewallCommand.check_moduleTc C s� |� � }|�� }|�� }|�� } |�� } |�� } |�� } |�� } |�� }|� � }|� � }|rv|� � }|� � }|� � }n,|�� }tt|�� | ��}|�� }|�� }dd� }g }|d ur�||kr�|�d� |s�|s�|s�|r�|r�|r�|�d� |�r|dd�|� }| �|� | j�r0| �d| � | �d| � |�rH| �d t|� � | �d | � |�st| �d |�rld nd � |�r�| �dd�|� � | �dd�|� � n(| �dd�|� � | �dd�|� � | �dd�t|�� � | �dd�dd� |D �� � | �dd�t| �� � |�s8| �d|�r0d nd � | �d| �rHd nd � | �d| �r`dnd d�d d� | D �� � | �d d�d d� | D �� � | �d d�| � � | �d!|�r�dnd d�t||d"�� � d S )#Nc S sd d}d}z| � |�}W n ty( Y n80 |t|�7 }t| ||| |d � � d� � �dd��}|S )Nr z priority=� �"r� )�indexrt r7 �intr� )Zrule�priorityZ search_strr� r r r �rich_rule_sorted_key� s *zDFirewallCommand.print_zone_policy_info.<locals>.rich_rule_sorted_key�defaultZactivez (%s)z, � summary: � description: z priority: z target: z icmp-block-inversion: %src rb z ingress-zones: r� z egress-zones: z interfaces: z sources: z services: � ports: c S s g | ]}d |d |d f �qS �z%s/%sr r+ r ��.0rx r r r � <listcomp>� s �z:FirewallCommand.print_zone_policy_info.<locals>.<listcomp>� protocols: z forward: %sz masquerade: %sz forward-ports: z r� c S s$ g | ] \}}}}d ||||f �qS )z$port=%s:proto=%s:toport=%s:toaddr=%sr )r� rx ry r} r~ r r r r� � s � �� source-ports: c S s g | ]}d |d |d f �qS r� r r� r r r r� � s �z icmp-blocks: z rich rules: )�key)Z getTargetZ getServices�getPorts� getProtocolsZ getMasqueradeZgetForwardPorts�getSourcePortsZ getIcmpBlocksZ getRichRules�getDescription�getShortZgetIngressZonesZgetEgressZonesZ getPriorityZgetIcmpBlockInversion�sorted�setZ getInterfacesZ getSourcesZ getForwardr8 r� r& r r6 )r r\ �settings� default_zone�extra_interfaces�isPolicy�targetZservices�ports� protocolsZ masqueradeZ forward_ports� source_portsZ icmp_blocksZrules� description�short_descriptionZ ingress_zonesZ egress_zonesr� Zicmp_block_inversionZ interfacesZsourcesZforwardr� Z attributesr r r �print_zone_policy_info| s� ��� �� �� ���z&FirewallCommand.print_zone_policy_infoc C s | j ||||dd� d S )NF�r� r� r� �r� )r r\ r� r� r� r r r �print_zone_info� s z FirewallCommand.print_zone_infoc C s | j ||||dd� d S )NTr� r� )r Zpolicyr� r� r� r r r �print_policy_info� s z!FirewallCommand.print_policy_infoc C s. |� � }|�� }|�� }|�� }|�� }|�� }|�� } |�� } |�� } | � |� | j rt| � d| � | � d| � | � dd� dd� |D �� � | � dd� |� � | � dd� d d� |D �� � | � d d� |� � | � d d� d d� |� � D �� � | � d d� t | �� � | � dd� t | �� � d S )Nr� r� r� r� c S s g | ]}d |d |d f �qS r� r r� r r r r� � s �z6FirewallCommand.print_service_info.<locals>.<listcomp>r� r� c S s g | ]}d |d |d f �qS r� r r� r r r r� � s �z modules: � destination: c S s g | ]\}}d ||f �qS )z%s:%sr �r� �k�vr r r r� � s �z includes: z helpers: )r� r� r� Z getModulesr� �getDestinationsr� Z getIncludesZ getHelpersr& r r� rM r� ) r Zservicer� r� r� r� �modulesr� � destinationsr� ZincludesZhelpersr r r �print_service_info� s< � �� ��z"FirewallCommand.print_service_infoc C sp |� � }|�� }|�� }t|�dkr,ddg}| �|� | jrX| �d| � | �d| � | �dd�|� � d S )Nr r� r� r� r� r� r� )r� r� r� r7 r& r r� )r Zicmptyper� r� r� r� r r r �print_icmptype_info� s z#FirewallCommand.print_icmptype_infoc C s� |� � }|�� }|�� }|�� }|�� }| �|� | jrT| �d| � | �d| � | �d| � | �dd�dd� |�� D �� � | �dd�|� � d S ) Nr� r� z type: z options: r� c S s$ g | ] \}}|r d ||f n|�qS )z%s=%sr r� r r r r� s �z4FirewallCommand.print_ipset_info.<locals>.<listcomp>z entries: ) ZgetTypeZ getOptionsZ getEntriesr� r� r& r r� rM )r Zipsetr� Z ipset_type�options�entriesr� r� r r r �print_ipset_info� s � z FirewallCommand.print_ipset_infoc C s� |� � }|�� }|�� }|�� }|�� }| �|� | jrT| �d| � | �d| � | �d| � | �d| � | �dd�dd� |D �� � d S ) Nr� r� z family: z module: r� r� c S s g | ]}d |d |d f �qS r� r r� r r r r� s �z5FirewallCommand.print_helper_info.<locals>.<listcomp>)r� Z getModuleZ getFamilyr� r� r& r r� )r �helperr� r� �moduleZfamilyr� r� r r r �print_helper_info s �z!FirewallCommand.print_helper_infoc C s |r| � d� n | � dd� d S )Nrc rb r+ r/ rm r r r rd s z"FirewallCommand.print_query_resultc C s\ | j s� | �|� t�t|��}|tjtjtjtj fv rH| � d| � n| � d| |� d S )Nr2 r3 ) r r= r r5 r6 r r@ rA rB rC r* r- )r �exception_messagerP r r r �exception_handler s �z!FirewallCommand.exception_handlerc C s d|v rd}| � |tj� d S )NZNotAuthorizedExceptionz`Authorization failed. Make sure polkit agent is running or run the application as superuser.)r- r ZNOT_AUTHORIZED)r r� r% r r r r= ' s z&FirewallCommand.fail_if_not_authorizedc C s d| _ d S )NF�r r r r r r< - s z,FirewallCommand.deactivate_exception_handlerc C s d| _ d S r r� r r r r rD 0 s z*FirewallCommand.activate_exception_handlerc C sn g }t � }t|�}|D ]J}|s" qb|�� }t|�dk s|d dv rDq||vr|�|� |�|� q|�� |S )Nr+ r )�#�;)r� �open�stripr7 r8 rR �close)r �filenamer� Z entries_set�f�liner r r �get_ipset_entries_from_file3 s z+FirewallCommand.get_ipset_entries_from_file)FF)N)N)N)Nr )N)N)NNF)F)F)F)F)F)NF)F)F)rp )F).�__name__� __module__� __qualname__r r r r r r r& r( r* r- r0 r1 rU rW r[ r^ r` ra rg rh ri ro rz r� r� r� r� r� r� r� r� r� r� r� r� r� r� rd r� r= r< rD r� r r r r r " sj � L � � � � � � 3 � � 2 O )�__doc__�__all__r! Zfirewallr Zfirewall.errorsr Zdbus.exceptionsr Zfirewall.functionsr r r r r �objectr r r r r �<module> s __pycache__/dbus_utils.cpython-39.pyc 0000644 00000014323 15025011705 0013561 0 ustar 00 a ���g�$ � @ s� g d �Z ddlZddlZddlmZ ddlmZ dd� Zdd� Zd d � Z d d � Z d d� Z dd� Z dd� Z d dd�Zdd� Zd dd�Zdd� Zdd � ZdS ) ) �command_of_pid� pid_of_sender� uid_of_sender� user_of_uid�context_of_sender�command_of_sender�user_of_sender�dbus_to_python�dbus_signature�%dbus_introspection_prepare_properties�!dbus_introspection_add_properties� N)�minidom)�logc C sd zJt d| d��(}|�� d �dd��� }W d � n1 s>0 Y W n ty^ Y dS 0 |S )z Get command for pid from /proc z/proc/%d/cmdline�rr � � N)�open� readlines�replace�strip� Exception)�pid�f�cmd� r �7/usr/lib/python3.9/site-packages/firewall/dbus_utils.pyr " s : r c C sD | � dd�}t�|d�}zt|�|��}W n ty> Y dS 0 |S )zV Get pid from sender string using org.freedesktop.DBus.GetConnectionUnixProcessID �org.freedesktop.DBus�/org/freedesktop/DBusN)� get_object�dbus� Interface�intZGetConnectionUnixProcessID� ValueError)�bus�sender�dbus_obj� dbus_ifacer r r r r + s r c C sD | � dd�}t�|d�}zt|�|��}W n ty> Y dS 0 |S )zU Get user id from sender string using org.freedesktop.DBus.GetConnectionUnixUser r r N)r r r r! ZGetConnectionUnixUserr" )r# r$ r% r& �uidr r r r 8 s r c C s, zt �| �}W n ty" Y dS 0 |d S )z Get user for uid from pwd Nr )�pwd�getpwuidr )r' Zpwsr r r r E s r c C sP | � dd�}t�|d�}z|�|�}W n ty: Y dS 0 d�ttt|���S )zk Get SELinux context from sender string using org.freedesktop.DBus.GetConnectionSELinuxSecurityContext r r N� ) r r r Z#GetConnectionSELinuxSecurityContextr �join�map�chrr )r# r$ r% r& �contextr r r r N s r c C s t t| |��S )z Return command of D-Bus sender )r r �r# r$ r r r r \ s r c C s t t| |��S )N)r r r/ r r r r a s r c C s` | d u r| }�n�t | tj�r(t| �}�nzt | tj�r@t| �}�nbt | tj�rXt| �}�nJt | tj�s�t | tj�s�t | tj �s�t | tj �s�t | tj �s�t | tj �s�t | tj �r�t| �}n�t | tj�r�t| �}n�t | tj�r�dd� | D �}n�t | tj��r tdd� | D ��}n�t | tj��r,dd� | �� D �}nvt | t��s�t | t��s�t | t��s�t | t��s�t | t��s�t | t��s�t | t��s�t | t��r�| }ntdt| � ��|d u�r\|tk�r�t |t��rF|tk�r�t |t��rF|tk�r�t |t��rF|tk�rt |t��rF|tk�rt |t��rF|tk�r0t |t��rF|tk�r\t |t��s\td|t|�|f ��|S )Nc S s g | ] }t |��qS r �r ��.0�xr r r � <listcomp>x � z"dbus_to_python.<locals>.<listcomp>c S s g | ] }t |��qS r r0 r1 r r r r4 z r5 c S s i | ]\}}t |�t |��qS r r0 )r2 �k�vr r r � <dictcomp>| r5 z"dbus_to_python.<locals>.<dictcomp>� Unhandled %sz%s is %s, expected %s) � isinstancer �Boolean�bool�String�str� ObjectPath�Byte�Int16�Int32�Int64�UInt16�UInt32�UInt64r! �Double�float�Array�Struct�tuple� Dictionary�items�bytes�list�dict� TypeError�repr�type)�objZ expected_typeZ python_objr r r r d s� � � � � � � ������� ������������r c C s$ t | tj�rdS t | tj�r dS t | tj�r0dS t | tj�r@dS t | tj�rPdS t | tj�r`dS t | tj�rpdS t | tj �r�dS t | tj �r�d S t | tj �r�d S t | tj �r�d S t | tj �r�t| j�d kr�d | j S d| j S n@t | tj�� r�d| j S t | tj��rd| j S tdt| � ��d S )N�b�s�o�y�n�ir3 �q�u�t�d� za(%s)za%sz(%s)za{%s}r9 )r: r r; r= r? r@ rA rB rC rD rE rF rG rI �lenZ signaturerJ rL rQ rR )rT r r r r � s> r c C s� |d u r i }t | d�s"t| di � t| d�}i ||< z| �|�}W n tyX i }Y n0 |�� D ]J\}}dt|�i|| |< ||v r�|| || | d< qbd|| | d< qbd S )N�_fw_dbus_propertiesrS �access�read)�hasattr�setattr�getattrZGetAllr rM r )rT � interfacerb �dip�_dict�key�valuer r r r � s r c C s� t �|�}t| d�r�|�d�D ]�}|�d�r |�d�|kr i }t| d�rRt| d�}||v r || �� D ]H\}}|�d�}|� d|� |� d|d � |� d|d � |� |� qfq t � |� � � |� � } |�� | S )Nra rg �name�propertyrS rb )r � parseStringrd �getElementsByTagName� hasAttribute� getAttributerf rM � createElement� setAttribute� appendChildr �debug10�toxml�unlink) rT �datarg �doc�noderh rj rk ZpropZnew_datar r r r � s( � r c C s> t �|�}||v r�|�d�D ]t}|�d�r |�d�|kr |�d�D ]L}|�d�rB|�d�|| v rB|�d�}|�dd� |�dd� |�|� qBq ||v �r |�d�D ]t}|�d�r�|�d�|kr�|�d�D ]L} | �d�r�| �d�|| v r�|�d�}|�dd� |�dd� | �|� q�q�t� |� � � |� � }|� � |S ) Nrg rl �method� annotationz org.freedesktop.DBus.Deprecatedrk �true�signal) r rn ro rp rq rr rs rt r ru rv rw ) rT rx rg Zdeprecated_methodsZdeprecated_signalsry rz Z method_noder| Z signal_noder r r �!dbus_introspection_add_deprecated� s> � � � � r )N)N)�__all__r r( Zxml.domr Zfirewall.core.loggerr r r r r r r r r r r r r r r r r �<module> s .# __pycache__/functions.cpython-39.opt-1.pyc 0000644 00000036125 15025011705 0014357 0 ustar 00 a ���g+J � @ s� g d �Z ddlZddlZddlZddlZddlZddlZddlZddlm Z ddl m Z m Z dd� e dd�D �Zdd � Zd d � ZdUd d�Zdd� Zdd� Zdd� Zdd� Zdd� Zdd� Zdd � Zd d � Zd d � Zd!d"� Zd#d$� Z d%d&� Z d'd(� Z d)d*� Z d+d,� Z d-d.� Z!d/d0� Z"d1d2� Z#d3d4� Z$d5d6� Z%d7d8� Z&d9d:� Z'd;d<� Z(d=d>� Z)d?d@� Z*dAdB� Z+dCdD� Z,dEdF� Z-dGdH� Z.dIdJ� Z/dKdL� Z0dMdN� Z1dOdP� Z2dQdR� Z3dSdT� Z4dS )V)!� getPortID� getPortRange�portStr�getServiceName�checkIP�checkIP6� checkIPnMask� checkIP6nMask� checkProtocol�checkInterface� checkUINT16� checkUINT32�firewalld_is_active�tempFile�readfile� writefile�enable_ip_forwarding� check_port� check_address�check_single_address� check_mac�uniqify� ppid_of_pid�max_zone_name_len� checkUser�checkUid� checkCommand� checkContext�joinArgs� splitArgs�max_policy_name_len�checkTcpMssClamp�stripNonPrintableCharacters� N)�log)�FIREWALLD_TEMPDIR�FIREWALLD_PIDFILEc C s" i | ]}|d kr|dk s|d�qS )� � N� )�.0�ir( r( �6/usr/lib/python3.9/site-packages/firewall/functions.py� <dictcomp>+ s r, � c C st t | t�r| }nT| r | �� } z t| �}W n: tyb zt�| �}W n tjy\ Y Y dS 0 Y n0 |dkrpdS |S )z� Check and Get port id from port string or port id using socket.getservbyname @param port port string or port id @return Port id if valid, -1 if port can not be found and -2 if port is too big ���� ���)� isinstance�int�strip� ValueError�socketZ getservbyname�error)�portZ_idr( r( r+ r 4 s r c C s� t | t�st | t�r| S t | t�s*| �� rDt| �}|dkr@|fS |S | �d�}t|�dkr�|d �� r�|d �� r�t|d �}t|d �}|dkr�|dkr�||k r�||fS ||kr�||fS |fS g }tt|�dd�D ]�}td� |d|� ��}d� ||d� �}t|�dk�rlt|�}|dk�r�|dk�r�||k �rD|� ||f� n&||k�r^|� ||f� n |� |f� q�|dkr�|� |f� |t|�kr� �q�q�t|�dk �r�dS t|�dk�r�dS |d S )aI Get port range for port range string or single port id @param ports an integer or port string or port range string @return Array containing start and end port id for a valid range or -1 if port can not be found and -2 if port is too big for integer input or -1 for invalid ranges or None if the range is ambiguous. r" �-� � r. N) r1 �tuple�listr2 �isdigitr �split�len�range�join�append)ZportsZid1�splitsZid2Zmatchedr* Zport2r( r( r+ r K sL $ r �:c C sX | dkr dS t | �}t|t�r*|dk r*dS t|�dkr>d| S d|d ||d f S dS )a Create port and port range string @param port port or port range int or [int, int] @param delimiter of the output string for port ranges, default ':' @return Port or port range string, empty string if port isn't specified, None if port or port range is not valid � r" Nr: z%sz%s%s%s)r r1 r2 r? )r7 Z delimiter�_ranger( r( r+ r � s r c C s t | �}t |�}t|�dkr�t|�dkr@t|d �t|d �kS t|�dkr�t|d �t|d �kr�t|d �t|d �kr�dS n|t|�dkr�t|�dkr�t|d �t|d �kr�t|d �t|d �kr�t|d �t|d �kr�t|d �t|d �kr�dS dS )Nr: r" r9 TF)r r? r )r7 r@ Z_portrF r( r( r+ �portInPortRange� s. �� ����rG c C sP t | �}t|�dkr$|d |d f}tt |�}ttdd� |�dd� d�}g }|D ]�}|d |d kr�|d |d kr�|�|� qP|d |d kr�|d |d k r�|d |d kr�|�|� |d |d f}qP|d |d krP|d |d krP|d |d krP|�|� |d |d f}qPttdd� |��}|d |d k�rF|d f}|g|fS )z� Coalesce a port range with existing list of port ranges @param new_range tuple/list/string @param ranges list of tuple/list/string @return tuple of (list of ranges added after coalescing, list of removed original ranges) r: r" c S s t | �dkr | d | d fS | S �Nr: r" �r? ��xr( r( r+ �<lambda>� � z#coalescePortRange.<locals>.<lambda>c S s | d S �Nr" r( rJ r( r( r+ rL � rM ��keyc S s | d | d kr| d fS | S �Nr" r: r( rJ r( r( r+ rL � rM �r r? �map�sortedrB r< )Z new_range�rangesZcoalesced_range�_ranges�removed_rangesr@ r( r( r+ �coalescePortRange� s. � � rX c C s� t | �} t| �dkr$| d | d f} tt |�}ttdd� |�dd� d�}g }g }|D �]@}| d |d kr�| d |d kr�|�|� qT| d |d kr�| d |d k r�| d |d kr�|�|� |�| d d |d f� qT| d |d k�r8| d |d k�r8| d |d k�r8|�|� |�|d | d d f� qT| d |d krT| d |d k rT|�|� |�|d | d d f� |�| d d |d f� qTttdd� |��}ttdd� |��}||fS ) z� break a port range from existing list of port ranges @param remove_range tuple/list/string @param ranges list of tuple/list/string @return tuple of (list of ranges added after breaking up, list of removed original ranges) r: r" c S s t | �dkr | d | d fS | S rH rI rJ r( r( r+ rL � rM z breakPortRange.<locals>.<lambda>c S s | d S rN r( rJ r( r( r+ rL � rM rO c S s | d | d kr| d fS | S rQ r( rJ r( r( r+ rL � rM c S s | d | d kr| d fS | S rQ r( rJ r( r( r+ rL � rM rR )Z remove_rangerU rV rW Z added_rangesr@ r( r( r+ �breakPortRange� s6 � $� rY c C s0 zt �t| �|�}W n t jy* Y dS 0 |S )z� Check and Get service name from port and proto string combination using socket.getservbyport @param port string or id @param protocol string @return Service name if port and protocol are valid, else None N)r5 Z getservbyportr2 r6 )r7 �proto�namer( r( r+ r � s r c C s. zt �t j| � W n t jy( Y dS 0 dS )zh Check IPv4 address. @param ip address string @return True if address is valid, else False FT)r5 � inet_ptonZAF_INETr6 ��ipr( r( r+ r s r c C s | � d�S )z� Normalize the IPv6 address This is mostly about converting URL-like IPv6 address to normal ones. e.g. [1234::4321] --> 1234:4321 z[])r3 r] r( r( r+ � normalizeIP6 s r_ c C s2 zt �t jt| �� W n t jy, Y dS 0 dS )zh Check IPv6 address. @param ip address string @return True if address is valid, else False FT)r5 r\ ZAF_INET6r_ r6 r] r( r( r+ r s r c C s� | � d�}|dkr<| d |� }| |d d � }|r6|sDdS n| }d }t|�sPdS |r�d|v rdt|�S z t|�}W n ty� Y dS 0 |dk s�|dkr�dS dS ) N�/r. r: F�.r" � T)�findr r2 r4 �r^ �index�addr�maskr* r( r( r+ r * s( r c C s | � t�S �N)� translate�NOPRINT_TRANS_TABLE)Zrule_strr( r( r+ r! B s r! c C s� | � d�}|dkr<| d |� }| |d d � }|r6|sDdS n| }d }t|�sPdS |r�z t|�}W n tyt Y dS 0 |dk s�|dkr�dS dS )Nr` r. r: Fr" � T)rc r r2 r4 rd r( r( r+ r E s$ r c C s` z t | �}W n: tyF zt�| � W n tjy@ Y Y dS 0 Y n0 |dk sX|dkr\dS dS )NFr" � T)r2 r4 r5 Zgetprotobynamer6 )Zprotocolr* r( r( r+ r [ s r c C s: | r6| � � r t| �dk r6dS n| dkr*dS | dkr6dS dS )Ni F�NoneTZpmtu)r= r2 )Ztcp_mss_clamp_valuer( r( r+ r j s r c C s0 | rt | �dkrdS dD ]}|| v r dS qdS )z� Check interface string @param interface string @return True if interface is valid (maximum 16 chars and does not contain ' ', '/', '!', ':', '*'), else False � F)� r` �!�*TrI )Ziface�chr( r( r+ r u s r c C s< zt | d�}W n ty" Y dS 0 |dkr8|dkr8dS dS )Nr" Fr/ T�r2 r4 ��valrK r( r( r+ r � s r c C s< zt | d�}W n ty" Y dS 0 |dkr8|dkr8dS dS )Nr" Fl �� Trs rt r( r( r+ r � s r c C s� t j�t�sdS z6ttd��} | �� }W d � n1 s:0 Y W n tyZ Y dS 0 t j�d| �spdS z:td| d��} | �� }W d � n1 s�0 Y W n ty� Y dS 0 d|v r�dS dS )zv Check if firewalld is active @return True if there is a firewalld pid file and the pid is used by firewalld F�rNz/proc/%sz/proc/%s/cmdlineZ firewalldT)�os�path�existsr% �open�readline� Exception)�fd�pidZcmdliner( r( r+ r � s" * * r c C sf z,t j�t�st �td� tjddtdd�W S ty` } z t� d| � � W Y d } ~ n d } ~ 0 0 d S )Ni� Zwtztemp.F)�mode�prefix�dir�deletez#Failed to create temporary file: %s) rw rx ry r$ �mkdir�tempfileZNamedTemporaryFiler| r# r6 )�msgr( r( r+ r � s �r c C st z8t | d��}|�� W d � W S 1 s,0 Y W n6 tyn } z t�d| |f � W Y d }~n d }~0 0 d S )Nrv z Failed to read file "%s": %s)rz � readlinesr| r# r6 )�filename�f�er( r( r+ r � s ,(r c C sv z8t | d��}|�|� W d � n1 s,0 Y W n8 typ } z t�d| |f � W Y d }~dS d }~0 0 dS )N�wz Failed to write to file "%s": %sFT)rz �writer| r# r6 )r� �liner� r� r( r( r+ r � s ,r c C s( | dkrt dd�S | dkr$t dd�S dS )N�ipv4z /proc/sys/net/ipv4/ip_forwardz1 �ipv6z&/proc/sys/net/ipv6/conf/all/forwardingF)r )�ipvr( r( r+ r � s r c C s | � dd�� dd�S )N�_r8 z nf-conntrack-rE )�replace)�moduler( r( r+ �get_nf_conntrack_short_name� s r� c C s� t | �}|dks<|dks<|d u s<t|�dkr�|d |d kr�|dkrTt�d| � nZ|dkrlt�d| � nB|d u r�t�d| � n*t|�dkr�|d |d kr�t�d | � d S d S ) Nr0 r. r9 r" r: z'%s': port > 65535z'%s': port is invalidz'%s': port is ambiguousz'%s': range start >= endFT)r r? r# Zdebug2)r7 rF r( r( r+ r � s �� r c C s( | dkrt |�S | dkr t|�S dS d S �Nr� r� F)r r �r� �sourcer( r( r+ r � s r c C s( | dkrt |�S | dkr t|�S dS d S r� )r r r� r( r( r+ r � s r c C sN t | �dkrJdD ]}| | dkr dS qdD ]}| | tjvr, dS q,dS dS )N� )r9 � � � � rD F) r" r: � � � � � � � � � rn T)r? �stringZ hexdigits)Zmacr* r( r( r+ r � s r c C s$ g }| D ]}||vr|� |� q|S rh )rB )Z_list�outputrK r( r( r+ r s r c C sH z.t �d| �}t|�� d �� �} |�� W n tyB Y dS 0 | S )z Get parent for pid z ps -o ppid -h -p %d 2>/dev/nullr" N)rw �popenr2 r� r3 �closer| )r~ r� r( r( r+ r s r c C sB ddl m} ddlm} ttt|�� ��}d|t| � td� S )z� iptables limits length of chain to (currently) 28 chars. The longest chain we create is POST_<policy>_allow, which leaves 28 - 11 = 17 chars for <policy>. r" )�POLICY_CHAIN_PREFIX�� SHORTCUTS� Z_allow)Zfirewall.core.ipXtablesr� �firewall.core.baser� �maxrS r? �values)r� r� �longest_shortcutr( r( r+ r s r c C s. ddl m} ttt| �� ��}d|td� S )z� Netfilter limits length of chain to (currently) 28 chars. The longest chain we create is POST_<zone>_allow, which leaves 28 - 11 = 17 chars for <zone>. r" r� r� Z__allow)r� r� r� rS r? r� )r� r� r( r( r+ r ' s r c C sR t | �dk s t | �t�d�kr"dS | D ]&}|tjvr&|tjvr&|dvr& dS q&dS )Nr: �SC_LOGIN_NAME_MAXF)ra r8 r� �$T)r? rw �sysconfr� � ascii_letters�digits)�user�cr( r( r+ r 1 s ��r c C sD t | t�r,z t| �} W n ty* Y dS 0 | dkr@| dkr@dS dS )NFr" i���T)r1 �strr2 r4 )�uidr( r( r+ r ; s r c C sH t | �dk st | �dkr dS dD ]}|| v r dS q | d dkrDdS dS )Nr: i F)�|� � r" r` TrI )Zcommandrr r( r( r+ r E s r c C s� | � d�}t|�dvrdS |d dkr>|d dd � dkr>dS |d dd � d krVdS |d dd � d krndS t|d �dk r�dS d S )NrD )r� r� Fr" �rootr0 Z_ur: Z_rr9 Z_tr� T)r> r? )�contextrC r( r( r+ r O s r c C s8 dt t�v r d�dd� | D ��S d�dd� | D ��S d S )N�quotero c s s | ]}t �|�V qd S rh )�shlexr� �r) �ar( r( r+ � <genexpr>c rM zjoinArgs.<locals>.<genexpr>c s s | ]}t �|�V qd S rh )�pipesr� r� r( r( r+ r� e rM )r� r� rA )�argsr( r( r+ r a s r c C s t �| �S rh )r� r> )Z_stringr( r( r+ r g s r )rD )5�__all__r5 rw Zos.pathr� r� r� r� Zfirewall.core.loggerr# Zfirewall.configr$ r% r@ rj r r r rG rX rY r r r_ r r r! r r r r r r r r r r r r� r r r r r r r r r r r r r r r( r( r( r+ �<module> sd � : &+ __pycache__/__init__.cpython-39.pyc 0000644 00000000220 15025011705 0013132 0 ustar 00 a ���g � @ s d S )N� r r r �5/usr/lib/python3.9/site-packages/firewall/__init__.py�<module> � __pycache__/fw_types.cpython-39.opt-1.pyc 0000644 00000005673 15025011705 0014213 0 ustar 00 a ���g� � @ s d gZ G dd � d e�ZdS )�LastUpdatedOrderedDictc @ sx e Zd Zd dd�Zdd� Zdd� Zdd � Zd d � Zd d � Zdd� Z dd� Z dd� Z dd� Z dd� Z dd� Zd dd�ZdS ) r Nc C s i | _ g | _|r| �|� d S �N)�_dict�_list�update)�self�x� r �5/usr/lib/python3.9/site-packages/firewall/fw_types.py�__init__ s z LastUpdatedOrderedDict.__init__c C s | j d d �= | j�� d S r )r r �clear�r r r r r s z LastUpdatedOrderedDict.clearc C s |� � D ]\}}|| |< qd S r )�items)r r �key�valuer r r r # s z LastUpdatedOrderedDict.updatec s � fdd�� j D �S )Nc s g | ]}|� | f�qS r r ��.0r r r r � <listcomp>( � z0LastUpdatedOrderedDict.items.<locals>.<listcomp>�r r r r r r ' s z LastUpdatedOrderedDict.itemsc C s" || j v r | j�|� | j |= d S r )r r �remove�r r r r r � __delitem__* s z"LastUpdatedOrderedDict.__delitem__c s& d� j jd�� fdd�� jD ��f S )Nz%s([%s])z, c s g | ]}d |� | f �qS )z(%r, %r)r r r r r r 1 r z3LastUpdatedOrderedDict.__repr__.<locals>.<listcomp>)� __class__�__name__�joinr r r r r �__repr__/ s �z LastUpdatedOrderedDict.__repr__c C s$ || j vr| j�|� || j |< d S r )r r �append�r r r r r r � __setitem__3 s z"LastUpdatedOrderedDict.__setitem__c C s$ t |�tkr| j| S | j| S d S r )�type�intr r r r r r � __getitem__8 s z"LastUpdatedOrderedDict.__getitem__c C s t | j�S r )�lenr r r r r �__len__> s z LastUpdatedOrderedDict.__len__c C s t | �S r )r r r r r �copyA s zLastUpdatedOrderedDict.copyc C s | j d d � S r r r r r r �keysD s zLastUpdatedOrderedDict.keysc s � fdd�� j D �S )Nc s g | ] }� | �qS r r r r r r r H r z1LastUpdatedOrderedDict.values.<locals>.<listcomp>r r r r r �valuesG s z LastUpdatedOrderedDict.valuesc C s || v r| | S || |< |S d S r r r r r r � setdefaultJ s z!LastUpdatedOrderedDict.setdefault)N)N)r � __module__� __qualname__r r r r r r r r! r# r$ r% r& r' r r r r r s N)�__all__�objectr r r r r �<module> s __pycache__/command.cpython-39.opt-1.pyc 0000644 00000042757 15025011705 0013775 0 ustar 00 a ���g�^ � @ sf d Z dgZddlZddlmZ ddlmZ ddlmZ ddl m Z m Z m Z m Z mZ G dd� de�ZdS ) z<FirewallCommand class for command line client simplification�FirewallCommand� N)�errors)� FirewallError)� DBusException)� checkIPnMask� checkIP6nMask� check_mac� check_port�check_single_addressc @ s� e Zd Zd\dd�Zdd� Zdd� Zdd � Zd d � Zd d � Zd]dd�Z d^dd�Z d_dd�Z d`dd�Z dadd�Z dbdd�Zdcd d �Zddd d �Zded d!�Zdfd"d#�Zdgd$d%�Zdhd&d'�Zdid(d)�Zdjd*d+�Zdkd,d-�Zd.d/� Zdld1d2�Zdmd3d4�Zd5d6� Zd7d8� Z d9d:� Z d;d<� Z d=d>� Z d?d@� Z dg dAfdBdC�Z!dg fdDdE�Z"dg fdFdG�Z#dHdI� Z$dJdK� Z%dLdM� Z&dNdO� Z'dPdQ� Z(dRdS� Z)dTdU� Z*dVdW� Z+dXdY� Z,dZd[� Z-dS )nr Fc C s || _ || _d| _d | _d S �NT)�quiet�verbose�'_FirewallCommand__use_exception_handler�fw)�selfr r � r �4/usr/lib/python3.9/site-packages/firewall/command.py�__init__# s zFirewallCommand.__init__c C s || _ d S �N)r )r r r r r �set_fw) s zFirewallCommand.set_fwc C s || _ d S r �r �r �flagr r r � set_quiet, s zFirewallCommand.set_quietc C s | j S r r �r r r r � get_quiet/ s zFirewallCommand.get_quietc C s || _ d S r �r r r r r � set_verbose2 s zFirewallCommand.set_verbosec C s | j S r r r r r r � get_verbose5 s zFirewallCommand.get_verboseNc C s" |d ur | j s tj�|d � d S �N� )r �sys�stdout�write�r �msgr r r � print_msg8 s zFirewallCommand.print_msgc C s" |d ur | j s tj�|d � d S r )r r! �stderrr# r$ r r r �print_error_msg< s z FirewallCommand.print_error_msgc C s, d}d}t j�� r || | }| �|� d S )Nz[91mz[00m)r! r' �isattyr( )r r% ZFAILZENDr r r � print_warning@ s z FirewallCommand.print_warningr c C s, |dkr| � |� n | �|� t�|� d S )N� )r* r& r! �exit)r r% Z exit_coder r r �print_and_exitG s z FirewallCommand.print_and_exitc C s | � |d� d S )N� �r- r$ r r r �failR s zFirewallCommand.failc C s" |d ur | j r tj�|d � d S r )r r! r" r# r$ r r r �print_if_verboseU s z FirewallCommand.print_if_verbosec C s� | j d ur| j �� g } d} g } |D ]�} |d ur�z || �} W n� ty� } zlt�t|��}t|�dkrv| �d| � n| �d| |� || vr�| � |� | d7 } W Y d }~q$W Y d }~n d }~0 0 | � | � q$| D �]d} g }|d ur�||7 }t | t ��st | t ��s|� | � n|| 7 }|d u�r*||7 }| � � z ||� W n� ttf�y. } z�t |t��rx| �|�� � |�� }nt|�}t�|�}|tjtjtjtjfv �r�d}t|�dk�r�| �d| � n8|dk�r�| �d| � W Y d }~ d S | �d| |� || v�r| � |� | d7 } W Y d }~n d }~0 0 | �� q�| �s�t|�| k�sXd| v �r\d S t| �dk�rzt�| d � nt| �dk�r�t�tj� d S )Nr r+ � Warning: %s� Error: %s)r Z authorizeAll� Exceptionr �get_code�str�lenr* r- �append� isinstance�list�tuple� deactivate_exception_handlerr �fail_if_not_authorized� get_dbus_name�get_dbus_messager �ALREADY_ENABLED� NOT_ENABLED�ZONE_ALREADY_SET� ALREADY_SET�activate_exception_handlerr! r, Z UNKNOWN_ERROR)r Zcmd_type�option� action_method� query_method� parse_method�message� start_args�end_args�no_exit�items�_errorsZ _error_codes�itemr% �code� call_itemr r r Z__cmd_sequenceY st " � z FirewallCommand.__cmd_sequencec C s | j d||||||d� d S )N�add�rL �� _FirewallCommand__cmd_sequence�r rE rF rG rH rI rL r r r � add_sequence� s �z FirewallCommand.add_sequencec C s | j d||||||g|d� d S )NrR �rJ rL rT �r �xrE rF rG rH rI rL r r r �x_add_sequence� s �z FirewallCommand.x_add_sequencec C s$ | j d||||||g|g|d� d S )NrR )rJ rK rL rT ) r �zonerE rF rG rH rI �timeoutrL r r r �zone_add_timeout_sequence� s �z)FirewallCommand.zone_add_timeout_sequencec C s | j d||||||d� d S )N�removerS rT rV r r r �remove_sequence� s �z FirewallCommand.remove_sequencec C s | j d||||||g|d� d S )Nr_ rX rT rY r r r �x_remove_sequence� s �z!FirewallCommand.x_remove_sequencec C s* g }|D ]�}|d ur�z ||�}W nj t y� } zRt|�dkrX| �d| � W Y d } ~ qn t�t| ��} | �d| | � W Y d } ~ n d } ~ 0 0 |�|� q|D �]v}g } |d ur�| |7 } t|t �s�t|t �s�| �|� n| |7 } | � � z || � } W n� t �yv } zj| � | �� � t�| �� �} t|�dk�rN| �d| �� � W Y d } ~ q�n| �d| �� | � W Y d } ~ njd } ~ 0 t �y� } zHt�t| ��} t|�dk�r�| �d| � n| �d| | � W Y d } ~ n d } ~ 0 0 | �� t|�dk�r | �d|| d| f � q�| �| � q�|�s&t�d� d S )Nr+ r2 r3 z%s: %s)�no�yesr )r4 r7 r* r r5 r6 r- r8 r9 r: r; r< r r= r> r? rD r& �print_query_resultr! r, ) r rE rG rH rI rJ rL rM rO r% rP rQ �resr r r Z__query_sequence� sT & �& z FirewallCommand.__query_sequencec C s | j |||||d� d S )NrS �� _FirewallCommand__query_sequence)r rE rG rH rI rL r r r �query_sequence� s �z FirewallCommand.query_sequencec C s | j |||||g|d� d S )NrX rf )r rZ rE rG rH rI rL r r r �x_query_sequence� s �z FirewallCommand.x_query_sequencec C sB t |�s>t|�s>t|�s>|�d�r.t|�dks>ttjd| ��|S )Nzipset:� z8'%s' is no valid IPv4, IPv6 or MAC address, nor an ipset)r r r � startswithr7 r r � INVALID_ADDR�r �valuer r r � parse_source� s �� ��z FirewallCommand.parse_source�/c C sj z|� |�\}}W n" ty4 ttjd| ��Y n0 t|�sJttj|��|dvrbttjd| ��||fS )NzTbad port (most likely missing protocol), correct syntax is portid[-portid]%sprotocol�ZtcpZudpZsctpZdccp�''%s' not in {'tcp'|'udp'|'sctp'|'dccp'})�split� ValueErrorr r � INVALID_PORTr �INVALID_PROTOCOL)r rn � separator�port�protor r r � parse_port s � ��zFirewallCommand.parse_portc C s� d }d }d }d }d}d||d � v r�||d � � dd�d }|t|�d 7 }d||d � v rv||d � � dd�d } n ||d � } |t| �d 7 }|dkr�| }q|dkr�| }q|dkr�| }q|dkr�| }q|d kr�|r�qttjd | ��q|s�ttjd ��|�s ttjd ��|�s$|�s$ttjd ��t|��s:ttj|��|dv�rTttjd| ��|�rpt|��spttj|��|�r�td|��s�|�s�td|��s�ttj |��||||fS )Nr �=r+ �:rx ry �toport�toaddr�ifz invalid forward port arg '%s'z missing portzmissing protocolzmissing destinationrq rr �ipv4�ipv6) rs r7 r r ZINVALID_FORWARDr ru rv r rl ) r rn �compatrx Zprotocolr} r~ �i�opt�valr r r �parse_forward_port sZ � �� z"FirewallCommand.parse_forward_portc C sF |� d�}t|�dkr"|d dfS t|�dkr2|S ttjd| ��d S )Nr{ r+ r � r. zinvalid ipset option '%s')rs r7 r r ZINVALID_OPTION)r rn �argsr r r �parse_ipset_optionH s �z"FirewallCommand.parse_ipset_optionc C s. ddg}||vr*t tjd|d�|�f ��|S )Nr� r� �'invalid argument: %s (choose from '%s')�', '�r r Z INVALID_IPV�join�r rn Zipvsr r r �check_destination_ipvR s ��z%FirewallCommand.check_destination_ipvc C sB z|� dd�\}}W n ty2 ttjd��Y n0 | �|�|fS )Nr| r+ z(destination syntax is ipv:address[/mask])rs rt r r ZINVALID_DESTINATIONr� )r rn ZipvZ destinationr r r �parse_service_destinationZ s � z)FirewallCommand.parse_service_destinationc C s. g d�}||vr*t tjd|d�|�f ��|S )N)r� r� Zebr� r� r� r� r r r � check_ipvb s ��zFirewallCommand.check_ipvc C s. g d�}||vr*t tjd|d�|�f ��|S )N)r� r� r� r� r� r� r� r r r �check_helper_familyj s ��z#FirewallCommand.check_helper_familyc C sB |� d�sttjd| ��t|�dd��dk r>ttjd| ��|S )NZ nf_conntrack_z('%s' does not start with 'nf_conntrack_'r� r+ zModule name '%s' too short)rk r r ZINVALID_MODULEr7 �replacerm r r r � check_moduler s ��z FirewallCommand.check_moduleTc C s� |� � }|�� }|�� }|�� } |�� } |�� } |�� } |�� } |�� }|� � }|� � }|rv|� � }|� � }|� � }n,|�� }tt|�� | ��}|�� }|�� }dd� }g }|d ur�||kr�|�d� |s�|s�|s�|r�|r�|r�|�d� |�r|dd�|� }| �|� | j�r0| �d| � | �d| � |�rH| �d t|� � | �d | � |�st| �d |�rld nd � |�r�| �dd�|� � | �dd�|� � n(| �dd�|� � | �dd�|� � | �dd�t|�� � | �dd�dd� |D �� � | �dd�t| �� � |�s8| �d|�r0d nd � | �d| �rHd nd � | �d| �r`dnd d�d d� | D �� � | �d d�d d� | D �� � | �d d�| � � | �d!|�r�dnd d�t||d"�� � d S )#Nc S sd d}d}z| � |�}W n ty( Y n80 |t|�7 }t| ||| |d � � d� � �dd��}|S )Nr z priority=� �"r� )�indexrt r7 �intr� )Zrule�priorityZ search_strr� r r r �rich_rule_sorted_key� s *zDFirewallCommand.print_zone_policy_info.<locals>.rich_rule_sorted_key�defaultZactivez (%s)z, � summary: � description: z priority: z target: z icmp-block-inversion: %src rb z ingress-zones: r� z egress-zones: z interfaces: z sources: z services: � ports: c S s g | ]}d |d |d f �qS �z%s/%sr r+ r ��.0rx r r r � <listcomp>� s �z:FirewallCommand.print_zone_policy_info.<locals>.<listcomp>� protocols: z forward: %sz masquerade: %sz forward-ports: z r� c S s$ g | ] \}}}}d ||||f �qS )z$port=%s:proto=%s:toport=%s:toaddr=%sr )r� rx ry r} r~ r r r r� � s � �� source-ports: c S s g | ]}d |d |d f �qS r� r r� r r r r� � s �z icmp-blocks: z rich rules: )�key)Z getTargetZ getServices�getPorts� getProtocolsZ getMasqueradeZgetForwardPorts�getSourcePortsZ getIcmpBlocksZ getRichRules�getDescription�getShortZgetIngressZonesZgetEgressZonesZ getPriorityZgetIcmpBlockInversion�sorted�setZ getInterfacesZ getSourcesZ getForwardr8 r� r& r r6 )r r\ �settings� default_zone�extra_interfaces�isPolicy�targetZservices�ports� protocolsZ masqueradeZ forward_ports� source_portsZ icmp_blocksZrules� description�short_descriptionZ ingress_zonesZ egress_zonesr� Zicmp_block_inversionZ interfacesZsourcesZforwardr� Z attributesr r r �print_zone_policy_info| s� ��� �� �� ���z&FirewallCommand.print_zone_policy_infoc C s | j ||||dd� d S )NF�r� r� r� �r� )r r\ r� r� r� r r r �print_zone_info� s z FirewallCommand.print_zone_infoc C s | j ||||dd� d S )NTr� r� )r Zpolicyr� r� r� r r r �print_policy_info� s z!FirewallCommand.print_policy_infoc C s. |� � }|�� }|�� }|�� }|�� }|�� }|�� } |�� } |�� } | � |� | j rt| � d| � | � d| � | � dd� dd� |D �� � | � dd� |� � | � dd� d d� |D �� � | � d d� |� � | � d d� d d� |� � D �� � | � d d� t | �� � | � dd� t | �� � d S )Nr� r� r� r� c S s g | ]}d |d |d f �qS r� r r� r r r r� � s �z6FirewallCommand.print_service_info.<locals>.<listcomp>r� r� c S s g | ]}d |d |d f �qS r� r r� r r r r� � s �z modules: � destination: c S s g | ]\}}d ||f �qS )z%s:%sr �r� �k�vr r r r� � s �z includes: z helpers: )r� r� r� Z getModulesr� �getDestinationsr� Z getIncludesZ getHelpersr& r r� rM r� ) r Zservicer� r� r� r� �modulesr� � destinationsr� ZincludesZhelpersr r r �print_service_info� s< � �� ��z"FirewallCommand.print_service_infoc C sp |� � }|�� }|�� }t|�dkr,ddg}| �|� | jrX| �d| � | �d| � | �dd�|� � d S )Nr r� r� r� r� r� r� )r� r� r� r7 r& r r� )r Zicmptyper� r� r� r� r r r �print_icmptype_info� s z#FirewallCommand.print_icmptype_infoc C s� |� � }|�� }|�� }|�� }|�� }| �|� | jrT| �d| � | �d| � | �d| � | �dd�dd� |�� D �� � | �dd�|� � d S ) Nr� r� z type: z options: r� c S s$ g | ] \}}|r d ||f n|�qS )z%s=%sr r� r r r r� s �z4FirewallCommand.print_ipset_info.<locals>.<listcomp>z entries: ) ZgetTypeZ getOptionsZ getEntriesr� r� r& r r� rM )r Zipsetr� Z ipset_type�options�entriesr� r� r r r �print_ipset_info� s � z FirewallCommand.print_ipset_infoc C s� |� � }|�� }|�� }|�� }|�� }| �|� | jrT| �d| � | �d| � | �d| � | �d| � | �dd�dd� |D �� � d S ) Nr� r� z family: z module: r� r� c S s g | ]}d |d |d f �qS r� r r� r r r r� s �z5FirewallCommand.print_helper_info.<locals>.<listcomp>)r� Z getModuleZ getFamilyr� r� r& r r� )r �helperr� r� �moduleZfamilyr� r� r r r �print_helper_info s �z!FirewallCommand.print_helper_infoc C s |r| � d� n | � dd� d S )Nrc rb r+ r/ rm r r r rd s z"FirewallCommand.print_query_resultc C s\ | j s� | �|� t�t|��}|tjtjtjtj fv rH| � d| � n| � d| |� d S )Nr2 r3 ) r r= r r5 r6 r r@ rA rB rC r* r- )r �exception_messagerP r r r �exception_handler s �z!FirewallCommand.exception_handlerc C s d|v rd}| � |tj� d S )NZNotAuthorizedExceptionz`Authorization failed. Make sure polkit agent is running or run the application as superuser.)r- r ZNOT_AUTHORIZED)r r� r% r r r r= ' s z&FirewallCommand.fail_if_not_authorizedc C s d| _ d S )NF�r r r r r r< - s z,FirewallCommand.deactivate_exception_handlerc C s d| _ d S r r� r r r r rD 0 s z*FirewallCommand.activate_exception_handlerc C sn g }t � }t|�}|D ]J}|s" qb|�� }t|�dk s|d dv rDq||vr|�|� |�|� q|�� |S )Nr+ r )�#�;)r� �open�stripr7 r8 rR �close)r �filenamer� Z entries_set�f�liner r r �get_ipset_entries_from_file3 s z+FirewallCommand.get_ipset_entries_from_file)FF)N)N)N)Nr )N)N)NNF)F)F)F)F)F)NF)F)F)rp )F).�__name__� __module__� __qualname__r r r r r r r& r( r* r- r0 r1 rU rW r[ r^ r` ra rg rh ri ro rz r� r� r� r� r� r� r� r� r� r� r� r� r� r� rd r� r= r< rD r� r r r r r " sj � L � � � � � � 3 � � 2 O )�__doc__�__all__r! Zfirewallr Zfirewall.errorsr Zdbus.exceptionsr Zfirewall.functionsr r r r r �objectr r r r r �<module> s __pycache__/functions.cpython-39.pyc 0000644 00000036125 15025011705 0013420 0 ustar 00 a ���g+J � @ s� g d �Z ddlZddlZddlZddlZddlZddlZddlZddlm Z ddl m Z m Z dd� e dd�D �Zdd � Zd d � ZdUd d�Zdd� Zdd� Zdd� Zdd� Zdd� Zdd� Zdd � Zd d � Zd d � Zd!d"� Zd#d$� Z d%d&� Z d'd(� Z d)d*� Z d+d,� Z d-d.� Z!d/d0� Z"d1d2� Z#d3d4� Z$d5d6� Z%d7d8� Z&d9d:� Z'd;d<� Z(d=d>� Z)d?d@� Z*dAdB� Z+dCdD� Z,dEdF� Z-dGdH� Z.dIdJ� Z/dKdL� Z0dMdN� Z1dOdP� Z2dQdR� Z3dSdT� Z4dS )V)!� getPortID� getPortRange�portStr�getServiceName�checkIP�checkIP6� checkIPnMask� checkIP6nMask� checkProtocol�checkInterface� checkUINT16� checkUINT32�firewalld_is_active�tempFile�readfile� writefile�enable_ip_forwarding� check_port� check_address�check_single_address� check_mac�uniqify� ppid_of_pid�max_zone_name_len� checkUser�checkUid� checkCommand� checkContext�joinArgs� splitArgs�max_policy_name_len�checkTcpMssClamp�stripNonPrintableCharacters� N)�log)�FIREWALLD_TEMPDIR�FIREWALLD_PIDFILEc C s" i | ]}|d kr|dk s|d�qS )� � N� )�.0�ir( r( �6/usr/lib/python3.9/site-packages/firewall/functions.py� <dictcomp>+ s r, � c C st t | t�r| }nT| r | �� } z t| �}W n: tyb zt�| �}W n tjy\ Y Y dS 0 Y n0 |dkrpdS |S )z� Check and Get port id from port string or port id using socket.getservbyname @param port port string or port id @return Port id if valid, -1 if port can not be found and -2 if port is too big ���� ���)� isinstance�int�strip� ValueError�socketZ getservbyname�error)�portZ_idr( r( r+ r 4 s r c C s� t | t�st | t�r| S t | t�s*| �� rDt| �}|dkr@|fS |S | �d�}t|�dkr�|d �� r�|d �� r�t|d �}t|d �}|dkr�|dkr�||k r�||fS ||kr�||fS |fS g }tt|�dd�D ]�}td� |d|� ��}d� ||d� �}t|�dk�rlt|�}|dk�r�|dk�r�||k �rD|� ||f� n&||k�r^|� ||f� n |� |f� q�|dkr�|� |f� |t|�kr� �q�q�t|�dk �r�dS t|�dk�r�dS |d S )aI Get port range for port range string or single port id @param ports an integer or port string or port range string @return Array containing start and end port id for a valid range or -1 if port can not be found and -2 if port is too big for integer input or -1 for invalid ranges or None if the range is ambiguous. r" �-� � r. N) r1 �tuple�listr2 �isdigitr �split�len�range�join�append)ZportsZid1�splitsZid2Zmatchedr* Zport2r( r( r+ r K sL $ r �:c C sX | dkr dS t | �}t|t�r*|dk r*dS t|�dkr>d| S d|d ||d f S dS )a Create port and port range string @param port port or port range int or [int, int] @param delimiter of the output string for port ranges, default ':' @return Port or port range string, empty string if port isn't specified, None if port or port range is not valid � r" Nr: z%sz%s%s%s)r r1 r2 r? )r7 Z delimiter�_ranger( r( r+ r � s r c C s t | �}t |�}t|�dkr�t|�dkr@t|d �t|d �kS t|�dkr�t|d �t|d �kr�t|d �t|d �kr�dS n|t|�dkr�t|�dkr�t|d �t|d �kr�t|d �t|d �kr�t|d �t|d �kr�t|d �t|d �kr�dS dS )Nr: r" r9 TF)r r? r )r7 r@ Z_portrF r( r( r+ �portInPortRange� s. �� ����rG c C sP t | �}t|�dkr$|d |d f}tt |�}ttdd� |�dd� d�}g }|D ]�}|d |d kr�|d |d kr�|�|� qP|d |d kr�|d |d k r�|d |d kr�|�|� |d |d f}qP|d |d krP|d |d krP|d |d krP|�|� |d |d f}qPttdd� |��}|d |d k�rF|d f}|g|fS )z� Coalesce a port range with existing list of port ranges @param new_range tuple/list/string @param ranges list of tuple/list/string @return tuple of (list of ranges added after coalescing, list of removed original ranges) r: r" c S s t | �dkr | d | d fS | S �Nr: r" �r? ��xr( r( r+ �<lambda>� � z#coalescePortRange.<locals>.<lambda>c S s | d S �Nr" r( rJ r( r( r+ rL � rM ��keyc S s | d | d kr| d fS | S �Nr" r: r( rJ r( r( r+ rL � rM �r r? �map�sortedrB r< )Z new_range�rangesZcoalesced_range�_ranges�removed_rangesr@ r( r( r+ �coalescePortRange� s. � � rX c C s� t | �} t| �dkr$| d | d f} tt |�}ttdd� |�dd� d�}g }g }|D �]@}| d |d kr�| d |d kr�|�|� qT| d |d kr�| d |d k r�| d |d kr�|�|� |�| d d |d f� qT| d |d k�r8| d |d k�r8| d |d k�r8|�|� |�|d | d d f� qT| d |d krT| d |d k rT|�|� |�|d | d d f� |�| d d |d f� qTttdd� |��}ttdd� |��}||fS ) z� break a port range from existing list of port ranges @param remove_range tuple/list/string @param ranges list of tuple/list/string @return tuple of (list of ranges added after breaking up, list of removed original ranges) r: r" c S s t | �dkr | d | d fS | S rH rI rJ r( r( r+ rL � rM z breakPortRange.<locals>.<lambda>c S s | d S rN r( rJ r( r( r+ rL � rM rO c S s | d | d kr| d fS | S rQ r( rJ r( r( r+ rL � rM c S s | d | d kr| d fS | S rQ r( rJ r( r( r+ rL � rM rR )Z remove_rangerU rV rW Z added_rangesr@ r( r( r+ �breakPortRange� s6 � $� rY c C s0 zt �t| �|�}W n t jy* Y dS 0 |S )z� Check and Get service name from port and proto string combination using socket.getservbyport @param port string or id @param protocol string @return Service name if port and protocol are valid, else None N)r5 Z getservbyportr2 r6 )r7 �proto�namer( r( r+ r � s r c C s. zt �t j| � W n t jy( Y dS 0 dS )zh Check IPv4 address. @param ip address string @return True if address is valid, else False FT)r5 � inet_ptonZAF_INETr6 ��ipr( r( r+ r s r c C s | � d�S )z� Normalize the IPv6 address This is mostly about converting URL-like IPv6 address to normal ones. e.g. [1234::4321] --> 1234:4321 z[])r3 r] r( r( r+ � normalizeIP6 s r_ c C s2 zt �t jt| �� W n t jy, Y dS 0 dS )zh Check IPv6 address. @param ip address string @return True if address is valid, else False FT)r5 r\ ZAF_INET6r_ r6 r] r( r( r+ r s r c C s� | � d�}|dkr<| d |� }| |d d � }|r6|sDdS n| }d }t|�sPdS |r�d|v rdt|�S z t|�}W n ty� Y dS 0 |dk s�|dkr�dS dS ) N�/r. r: F�.r" � T)�findr r2 r4 �r^ �index�addr�maskr* r( r( r+ r * s( r c C s | � t�S �N)� translate�NOPRINT_TRANS_TABLE)Zrule_strr( r( r+ r! B s r! c C s� | � d�}|dkr<| d |� }| |d d � }|r6|sDdS n| }d }t|�sPdS |r�z t|�}W n tyt Y dS 0 |dk s�|dkr�dS dS )Nr` r. r: Fr" � T)rc r r2 r4 rd r( r( r+ r E s$ r c C s` z t | �}W n: tyF zt�| � W n tjy@ Y Y dS 0 Y n0 |dk sX|dkr\dS dS )NFr" � T)r2 r4 r5 Zgetprotobynamer6 )Zprotocolr* r( r( r+ r [ s r c C s: | r6| � � r t| �dk r6dS n| dkr*dS | dkr6dS dS )Ni F�NoneTZpmtu)r= r2 )Ztcp_mss_clamp_valuer( r( r+ r j s r c C s0 | rt | �dkrdS dD ]}|| v r dS qdS )z� Check interface string @param interface string @return True if interface is valid (maximum 16 chars and does not contain ' ', '/', '!', ':', '*'), else False � F)� r` �!�*TrI )Ziface�chr( r( r+ r u s r c C s< zt | d�}W n ty" Y dS 0 |dkr8|dkr8dS dS )Nr" Fr/ T�r2 r4 ��valrK r( r( r+ r � s r c C s< zt | d�}W n ty" Y dS 0 |dkr8|dkr8dS dS )Nr" Fl �� Trs rt r( r( r+ r � s r c C s� t j�t�sdS z6ttd��} | �� }W d � n1 s:0 Y W n tyZ Y dS 0 t j�d| �spdS z:td| d��} | �� }W d � n1 s�0 Y W n ty� Y dS 0 d|v r�dS dS )zv Check if firewalld is active @return True if there is a firewalld pid file and the pid is used by firewalld F�rNz/proc/%sz/proc/%s/cmdlineZ firewalldT)�os�path�existsr% �open�readline� Exception)�fd�pidZcmdliner( r( r+ r � s" * * r c C sf z,t j�t�st �td� tjddtdd�W S ty` } z t� d| � � W Y d } ~ n d } ~ 0 0 d S )Ni� Zwtztemp.F)�mode�prefix�dir�deletez#Failed to create temporary file: %s) rw rx ry r$ �mkdir�tempfileZNamedTemporaryFiler| r# r6 )�msgr( r( r+ r � s �r c C st z8t | d��}|�� W d � W S 1 s,0 Y W n6 tyn } z t�d| |f � W Y d }~n d }~0 0 d S )Nrv z Failed to read file "%s": %s)rz � readlinesr| r# r6 )�filename�f�er( r( r+ r � s ,(r c C sv z8t | d��}|�|� W d � n1 s,0 Y W n8 typ } z t�d| |f � W Y d }~dS d }~0 0 dS )N�wz Failed to write to file "%s": %sFT)rz �writer| r# r6 )r� �liner� r� r( r( r+ r � s ,r c C s( | dkrt dd�S | dkr$t dd�S dS )N�ipv4z /proc/sys/net/ipv4/ip_forwardz1 �ipv6z&/proc/sys/net/ipv6/conf/all/forwardingF)r )�ipvr( r( r+ r � s r c C s | � dd�� dd�S )N�_r8 z nf-conntrack-rE )�replace)�moduler( r( r+ �get_nf_conntrack_short_name� s r� c C s� t | �}|dks<|dks<|d u s<t|�dkr�|d |d kr�|dkrTt�d| � nZ|dkrlt�d| � nB|d u r�t�d| � n*t|�dkr�|d |d kr�t�d | � d S d S ) Nr0 r. r9 r" r: z'%s': port > 65535z'%s': port is invalidz'%s': port is ambiguousz'%s': range start >= endFT)r r? r# Zdebug2)r7 rF r( r( r+ r � s �� r c C s( | dkrt |�S | dkr t|�S dS d S �Nr� r� F)r r �r� �sourcer( r( r+ r � s r c C s( | dkrt |�S | dkr t|�S dS d S r� )r r r� r( r( r+ r � s r c C sN t | �dkrJdD ]}| | dkr dS qdD ]}| | tjvr, dS q,dS dS )N� )r9 � � � � rD F) r" r: � � � � � � � � � rn T)r? �stringZ hexdigits)Zmacr* r( r( r+ r � s r c C s$ g }| D ]}||vr|� |� q|S rh )rB )Z_list�outputrK r( r( r+ r s r c C sH z.t �d| �}t|�� d �� �} |�� W n tyB Y dS 0 | S )z Get parent for pid z ps -o ppid -h -p %d 2>/dev/nullr" N)rw �popenr2 r� r3 �closer| )r~ r� r( r( r+ r s r c C sB ddl m} ddlm} ttt|�� ��}d|t| � td� S )z� iptables limits length of chain to (currently) 28 chars. The longest chain we create is POST_<policy>_allow, which leaves 28 - 11 = 17 chars for <policy>. r" )�POLICY_CHAIN_PREFIX�� SHORTCUTS� Z_allow)Zfirewall.core.ipXtablesr� �firewall.core.baser� �maxrS r? �values)r� r� �longest_shortcutr( r( r+ r s r c C s. ddl m} ttt| �� ��}d|td� S )z� Netfilter limits length of chain to (currently) 28 chars. The longest chain we create is POST_<zone>_allow, which leaves 28 - 11 = 17 chars for <zone>. r" r� r� Z__allow)r� r� r� rS r? r� )r� r� r( r( r+ r ' s r c C sR t | �dk s t | �t�d�kr"dS | D ]&}|tjvr&|tjvr&|dvr& dS q&dS )Nr: �SC_LOGIN_NAME_MAXF)ra r8 r� �$T)r? rw �sysconfr� � ascii_letters�digits)�user�cr( r( r+ r 1 s ��r c C sD t | t�r,z t| �} W n ty* Y dS 0 | dkr@| dkr@dS dS )NFr" i���T)r1 �strr2 r4 )�uidr( r( r+ r ; s r c C sH t | �dk st | �dkr dS dD ]}|| v r dS q | d dkrDdS dS )Nr: i F)�|� � r" r` TrI )Zcommandrr r( r( r+ r E s r c C s� | � d�}t|�dvrdS |d dkr>|d dd � dkr>dS |d dd � d krVdS |d dd � d krndS t|d �dk r�dS d S )NrD )r� r� Fr" �rootr0 Z_ur: Z_rr9 Z_tr� T)r> r? )�contextrC r( r( r+ r O s r c C s8 dt t�v r d�dd� | D ��S d�dd� | D ��S d S )N�quotero c s s | ]}t �|�V qd S rh )�shlexr� �r) �ar( r( r+ � <genexpr>c rM zjoinArgs.<locals>.<genexpr>c s s | ]}t �|�V qd S rh )�pipesr� r� r( r( r+ r� e rM )r� r� rA )�argsr( r( r+ r a s r c C s t �| �S rh )r� r> )Z_stringr( r( r+ r g s r )rD )5�__all__r5 rw Zos.pathr� r� r� r� Zfirewall.core.loggerr# Zfirewall.configr$ r% r@ rj r r r rG rX rY r r r_ r r r! r r r r r r r r r r r r� r r r r r r r r r r r r r r r( r( r( r+ �<module> sd � : &+ __pycache__/errors.cpython-39.opt-1.pyc 0000644 00000007350 15025011705 0013661 0 ustar 00 a ���g, � @ s� d Z dZdZdZdZdZdZdZdZd Z d Z d Z d Z d Z dZdZdZdZdZdZdZdZdZdZdZdZdZdZd Z d Z d Z d Z d Z d!Z!d"Z"d#Z#d$Z$d%Z%d&Z&d'Z'd(Z(d)Z)d*Z*d+Z+d,Z,d-Z-d.Z.d/Z/d0Z0d1Z1d2Z2d3Z3d4Z4d5Z5d6Z6d7Z7d8Z8d9Z9d:Z:d;Z;d<Z<d=Z=d>Z>d?Z?d@Z@dAZAdBZBdCZCdDZDdEZEdFZFdGZGdHZHdIZIdJZJdKZKdLZLdMZMdNZNdOZOdPZPdQZQdRZRdSZSdTdUlTZTG dVdW� dWeU�ZVeTjWeVjX ZYdXdY� eZeY�D �eV_[dZdY� eVj[D �eV_\dUS )[� � � � � � � � � � � � � � � � � � � � � � �! �" �# �$ �% �& �d �e �f �g �h �i �j �k �l �m �n �o �p �q �r �s �t �u �v �w �x �y �z �{ �| �} �~ � � � � � � � � � � � � � � � � � �� �� �� �� �� �� �� �� � � � � � Nc @ s6 e Zd Zd dd�Zdd� Zdd� Zdd � Zee�ZdS ) � FirewallErrorNc C s || _ || _d S )N)�code�msg)�selfrW rX � rZ �3/usr/lib/python3.9/site-packages/firewall/errors.py�__init__q s zFirewallError.__init__c C s d| j | j| jf S )Nz %s(%r, %r))� __class__rW rX �rY rZ rZ r[ �__repr__u s zFirewallError.__repr__c C s( | j r d| j| j | j f S | j| j S )Nz%s: %s)rX �errorsrW r^ rZ rZ r[ �__str__x s zFirewallError.__str__c C sV | d ur(d| v r(| � d�}| d |� }n| }ztj| }W n tyP t}Y n0 |S )N�:)�indexrV �codes�KeyError� UNKNOWN_ERROR)rX �idxZecoderW rZ rZ r[ �get_code} s zFirewallError.get_code)N)�__name__� __module__� __qualname__r\ r_ ra rh � staticmethodrZ rZ rZ r[ rV p s rV c C s4 i | ],}|� d �sttt|��tkrtt|�|�qS )�_)� startswith�type�getattr�mod�int)�.0ZvarnamerZ rZ r[ � <dictcomp>� s �rt c C s i | ]}t j| |�qS rZ )rV r` )rs rW rZ rZ r[ rt � s �)]ZALREADY_ENABLEDZ NOT_ENABLEDZCOMMAND_FAILEDZ NO_IPV6_NATZ PANIC_MODEZZONE_ALREADY_SETZUNKNOWN_INTERFACEZ ZONE_CONFLICTZ BUILTIN_CHAINZEBTABLES_NO_REJECTZNOT_OVERLOADABLEZ NO_DEFAULTSZ BUILTIN_ZONEZBUILTIN_SERVICEZBUILTIN_ICMPTYPEZ NAME_CONFLICTZ NAME_MISMATCHZ PARSE_ERRORZ ACCESS_DENIEDZUNKNOWN_SOURCEZRT_TO_PERM_FAILEDZIPSET_WITH_TIMEOUTZ BUILTIN_IPSETZ ALREADY_SETZMISSING_IMPORTZ DBUS_ERRORZBUILTIN_HELPERZ NOT_APPLIEDZINVALID_ACTIONZINVALID_SERVICEZ INVALID_PORTZINVALID_PROTOCOLZINVALID_INTERFACEZ INVALID_ADDRZINVALID_FORWARDZINVALID_ICMPTYPEZ INVALID_TABLEZ INVALID_CHAINZINVALID_TARGETZ INVALID_IPVZ INVALID_ZONEZINVALID_PROPERTYZ INVALID_VALUEZINVALID_OBJECTZ INVALID_NAMEZINVALID_FILENAMEZINVALID_DIRECTORYZ INVALID_TYPEZINVALID_SETTINGZINVALID_DESTINATIONZ INVALID_RULEZ INVALID_LIMITZINVALID_FAMILYZINVALID_LOG_LEVELZINVALID_AUDIT_TYPEZ INVALID_MARKZINVALID_CONTEXTZINVALID_COMMANDZ INVALID_USERZ INVALID_UIDZINVALID_MODULEZINVALID_PASSTHROUGHZ INVALID_MACZ INVALID_IPSETZ INVALID_ENTRYZINVALID_OPTIONZINVALID_HELPERZINVALID_PRIORITYZINVALID_POLICYZINVALID_LOG_PREFIXZINVALID_NFLOG_GROUPZINVALID_NFLOG_QUEUEZ MISSING_TABLEZ MISSING_CHAINZ MISSING_PORTZMISSING_PROTOCOLZ MISSING_ADDRZ MISSING_NAMEZMISSING_SETTINGZMISSING_FAMILYZRUNNING_BUT_FAILEDZ NOT_RUNNINGZNOT_AUTHORIZEDrf �sys� ExceptionrV �modulesrj rq �dirr` rd rZ rZ rZ r[ �<module> s� �� __pycache__/client.cpython-39.pyc 0000644 00000407725 15025011705 0012676 0 ustar 00 a ���g� � @ s� d dl mZ d dlZd dlZd dlmZ d dlmZm Z m Z d dl m Z d dl mZ d dlmZmZmZ d dlmZ d d lmZ d dlZd dlZdad ad d � ZG d d� de�ZG dd� de�Z G dd� de�Z G dd� de�Z G dd� de�Z G dd� de�Z G dd� de�Z!G dd � d e�Z"G d d � d e�Z#G d d � d e�Z$G d!d"� d"e�Z%G d#d$� d$e�Z&G d%d&� d&e�Z'G d'd(� d(e�Z(G d)d*� d*e�Z)G d+d,� d,e�Z*G d-d.� d.e�Z+G d/d0� d0e�Z,dS )1� )�GLibN)�config)�DEFAULT_ZONE_TARGET�DEFAULT_POLICY_TARGET�DEFAULT_POLICY_PRIORITY��dbus_to_python)� Rich_Rule)�normalize_ipset_entry� check_entry_overlaps_existing� check_for_overlapping_entries)�errors)� FirewallErrorFc s t �� �� fdd��}|S )z#Decorator to handle exceptions c s d}|�s z� | i |��W S t jjy� } zd|�� }|�� }tsD� d|v rVtd� n0d|v rht|� n d}|rzt|� n tt|�� W Y d }~ndd }~0 ty� } z ts�� n tt|�� W Y d }~n.d }~0 ty� ts� n tt � � � Y n0 t s�q qd S )NFZNotAuthorizedExceptionzorg.freedesktop.DBus.ErrorT) �dbus� exceptions� DBusException�get_dbus_messageZ get_dbus_name�exception_handler�strr � Exception� traceback� format_exc�not_authorized_loop)�args�kwargsZ authorized�eZ dbus_messageZ dbus_name��func� �3/usr/lib/python3.9/site-packages/firewall/client.py�_impl- s6 z handle_exceptions.<locals>._impl)� functools�wraps)r r r r r �handle_exceptions* s !r# c @ s� e Zd Zed�dd��Zedd� �Zedd� �Zedd � �Zed d � �Zed d � �Z edd� �Z edd� �Z edd� �Z edd� �Z edd� �Zedd� �Zedd� �Zed d � �Zed d � �Zed d!� �Zed"d#� �Zed$d%� �Zed&d'� �Zed(d)� �Zed*d+� �Zed,d-� �Zed.d/� �Zed0d1� �Zed2d3� �Z ed4d5� �Z ed6d7� �Z ed8d9� �Z ed:d;� �Z ed<d=� �Z!ed>d?� �Z"ed@dA� �Z#edBdC� �Z$edDdE� �Z%edFdG� �Z&edHdI� �Z'edJdK� �Z(edLdM� �Z)edNdO� �Z*edPdQ� �Z+edRdS� �Z,edTdU� �Z-edVdW� �Z.edXdY� �Z/edZd[� �Z0ed\d]� �Z1ed^d_� �Z2ed`da� �Z3edbdc� �Z4eddde� �Z5edfdg� �Z6edhdi� �Z7edjdk� �Z8edldm� �Z9edndo� �Z:edpdq� �Z;edrds� �Z<edtdu� �Z=edvdw� �Z>edxdy� �Z?edzd{� �Z@ed|d}� �ZAed~d� �ZBed�d�� �ZCed�d�� �ZDed�d�� �ZEed�d�� �ZFed�d�� �ZGed�d�� �ZHed�d�� �ZIed�d�� �ZJed�d�� �ZKed�d�� �ZLed�d�� �ZMed�d�� �ZNdS )��FirewallClientZoneSettingsNc C s� ddddt g g g dg g g g g g ddg| _g d�| _g d�| _|r~t|t�rjt|�D ]\}}|| | j|< qRt|t�r~| �|� d S )N� F)�version�short� description�UNUSED�target�services�ports� icmp_blocks� masquerade� forward_ports� interfaces�sourcesZ rules_str� protocols� source_portsZicmp_block_inversion�forward)�sr5 r5 �br5 r5 �(ss)r5 r6 �(ssss)r5 r5 r5 r5 r7 r6 r6 ) r �settings� settings_name�settings_dbus_type� isinstance�list� enumerate�dict�setSettingsDict��selfr9 �i�vr r r �__init__T s � z#FirewallClientZoneSettings.__init__c C s d| j | jf S �Nz%s(%r)�� __class__r9 �rB r r r �__repr__k s z#FirewallClientZoneSettings.__repr__c C s2 i }t | j| j�D ]\}}|dkr$q|||< q|S )Nr) ��zipr: r9 �rB r9 �key�valuer r r �getSettingsDicto s z*FirewallClientZoneSettings.getSettingsDictc C s$ |D ]}|| | j | j�|�< qd S �N�r9 r: �index�rB r9 rN r r r r@ w s z*FirewallClientZoneSettings.setSettingsDictc C sx i }t | j| j| j�D ]\\}}}|dkr*qt|�tu rJtj||d�||< qt|�tu rjtj ||d�||< q|||< q|S )Nr) �Z signature� rL r: r9 r; �typer= r �Arrayr? � Dictionary�rB r9 rN rO �sigr r r �getSettingsDbusDict{ s z.FirewallClientZoneSettings.getSettingsDbusDictc C s$ | � � }|d= |d= |d= |d= |S �Nr& r' r( r* )rP �rB r9 r r r �getRuntimeSettingsDict� s z1FirewallClientZoneSettings.getRuntimeSettingsDictc C s$ | � � }|d= |d= |d= |d= |S r] �r\ r^ r r r �getRuntimeSettingsDbusDict� s z5FirewallClientZoneSettings.getRuntimeSettingsDbusDictc C s | j d S �Nr �r9 rI r r r � getVersion� s z%FirewallClientZoneSettings.getVersionc C s || j d< d S rb rc �rB r& r r r � setVersion� s z%FirewallClientZoneSettings.setVersionc C s | j d S �N� rc rI r r r �getShort� s z#FirewallClientZoneSettings.getShortc C s || j d< d S rg rc �rB r' r r r �setShort� s z#FirewallClientZoneSettings.setShortc C s | j d S �N� rc rI r r r �getDescription� s z)FirewallClientZoneSettings.getDescriptionc C s || j d< d S rl rc �rB r( r r r �setDescription� s z)FirewallClientZoneSettings.setDescriptionc C s | j d tkr| j d S dS )N� �default)r9 r rI r r r � getTarget� s z$FirewallClientZoneSettings.getTargetc C s |dkr |nt | jd< d S )Nrr rq )r r9 �rB r* r r r � setTarget� s z$FirewallClientZoneSettings.setTargetc C s | j d S �N� rc rI r r r � getServices� s z&FirewallClientZoneSettings.getServicesc C s || j d< d S rv rc �rB r+ r r r � setServices� s z&FirewallClientZoneSettings.setServicesc C s0 || j d vr | j d �|� n ttj|��d S rv �r9 �appendr r �ALREADY_ENABLED�rB �servicer r r � addService� s z%FirewallClientZoneSettings.addServicec C s0 || j d v r | j d �|� n ttj|��d S rv �r9 �remover r � NOT_ENABLEDr~ r r r � removeService� s z(FirewallClientZoneSettings.removeServicec C s || j d v S rv rc r~ r r r � queryService� s z'FirewallClientZoneSettings.queryServicec C s | j d S �N� rc rI r r r �getPorts� s z#FirewallClientZoneSettings.getPortsc C s || j d< d S r� rc �rB r, r r r �setPorts� s z#FirewallClientZoneSettings.setPortsc C s@ ||f| j d vr(| j d �||f� nttjd||f ��d S �Nr� �'%s:%s'r{ �rB �port�protocolr r r �addPort� s �z"FirewallClientZoneSettings.addPortc C s@ ||f| j d v r(| j d �||f� nttjd||f ��d S r� r� r� r r r � removePort� s �z%FirewallClientZoneSettings.removePortc C s ||f| j d v S r� rc r� r r r � queryPort� s z$FirewallClientZoneSettings.queryPortc C s | j d S �N� rc rI r r r � getProtocols� s z'FirewallClientZoneSettings.getProtocolsc C s || j d< d S r� rc �rB r2 r r r � setProtocols� s z'FirewallClientZoneSettings.setProtocolsc C s0 || j d vr | j d �|� n ttj|��d S r� r{ �rB r� r r r � addProtocol� s z&FirewallClientZoneSettings.addProtocolc C s0 || j d v r | j d �|� n ttj|��d S r� r� r� r r r �removeProtocol� s z)FirewallClientZoneSettings.removeProtocolc C s || j d v S r� rc r� r r r � queryProtocol� s z(FirewallClientZoneSettings.queryProtocolc C s | j d S �N� rc rI r r r �getSourcePorts� s z)FirewallClientZoneSettings.getSourcePortsc C s || j d< d S r� rc r� r r r �setSourcePorts s z)FirewallClientZoneSettings.setSourcePortsc C s@ ||f| j d vr(| j d �||f� nttjd||f ��d S �Nr� r� r{ r� r r r � addSourcePort s �z(FirewallClientZoneSettings.addSourcePortc C s@ ||f| j d v r(| j d �||f� nttjd||f ��d S r� r� r� r r r �removeSourcePort s �z+FirewallClientZoneSettings.removeSourcePortc C s ||f| j d v S r� rc r� r r r �querySourcePort s z*FirewallClientZoneSettings.querySourcePortc C s | j d S �N� rc rI r r r � getIcmpBlocks s z(FirewallClientZoneSettings.getIcmpBlocksc C s || j d< d S r� rc �rB Z icmpblocksr r r � setIcmpBlocks s z(FirewallClientZoneSettings.setIcmpBlocksc C s0 || j d vr | j d �|� n ttj|��d S r� r{ �rB Zicmptyper r r � addIcmpBlock s z'FirewallClientZoneSettings.addIcmpBlockc C s0 || j d v r | j d �|� n ttj|��d S r� r� r� r r r �removeIcmpBlock" s z*FirewallClientZoneSettings.removeIcmpBlockc C s || j d v S r� rc r� r r r �queryIcmpBlock( s z)FirewallClientZoneSettings.queryIcmpBlockc C s | j d S �N� rc rI r r r �getIcmpBlockInversion, s z0FirewallClientZoneSettings.getIcmpBlockInversionc C s || j d< d S r� rc )rB �flagr r r �setIcmpBlockInversion/ s z0FirewallClientZoneSettings.setIcmpBlockInversionc C s& | j d sd| j d< n ttjd��d S )Nr� T�icmp-block-inversion�r9 r r r} rI r r r �addIcmpBlockInversion2 s z0FirewallClientZoneSettings.addIcmpBlockInversionc C s& | j d rd| j d< n ttjd��d S )Nr� Fr� �r9 r r r� rI r r r �removeIcmpBlockInversion8 s z3FirewallClientZoneSettings.removeIcmpBlockInversionc C s | j d S r� rc rI r r r �queryIcmpBlockInversion> s z2FirewallClientZoneSettings.queryIcmpBlockInversionc C s | j d S �N� rc rI r r r � getForwardB s z%FirewallClientZoneSettings.getForwardc C s || j d< d S r� rc �rB r4 r r r � setForwardE s z%FirewallClientZoneSettings.setForwardc C s& | j d sd| j d< n ttjd��d S )Nr� Tr4 r� rI r r r � addForwardH s z%FirewallClientZoneSettings.addForwardc C s& | j d rd| j d< n ttjd��d S )Nr� Fr4 r� rI r r r � removeForwardN s z(FirewallClientZoneSettings.removeForwardc C s | j d S r� rc rI r r r � queryForwardT s z'FirewallClientZoneSettings.queryForwardc C s | j d S �N� rc rI r r r � getMasqueradeX s z(FirewallClientZoneSettings.getMasqueradec C s || j d< d S r� rc �rB r. r r r � setMasquerade[ s z(FirewallClientZoneSettings.setMasqueradec C s& | j d sd| j d< n ttjd��d S )Nr� Tr. r� rI r r r � addMasquerade^ s z(FirewallClientZoneSettings.addMasqueradec C s& | j d rd| j d< n ttjd��d S )Nr� Fr. r� rI r r r �removeMasqueraded s z+FirewallClientZoneSettings.removeMasqueradec C s | j d S r� rc rI r r r �queryMasqueradej s z*FirewallClientZoneSettings.queryMasqueradec C s | j d S �N� rc rI r r r �getForwardPortsn s z*FirewallClientZoneSettings.getForwardPortsc C s || j d< d S r� rc r� r r r �setForwardPortsq s z*FirewallClientZoneSettings.setForwardPortsc C sd |d u r d}|d u rd}||||f| j d vrH| j d �||||f� nttjd||||f ��d S �Nr% r� � '%s:%s:%s:%s'r{ �rB r� r� Zto_portZto_addrr r r �addForwardPortt s �z)FirewallClientZoneSettings.addForwardPortc C sd |d u r d}|d u rd}||||f| j d v rH| j d �||||f� nttjd||||f ��d S r� r� r� r r r �removeForwardPort s �z,FirewallClientZoneSettings.removeForwardPortc C s. |d u r d}|d u rd}||||f| j d v S )Nr% r� rc r� r r r �queryForwardPort� s z+FirewallClientZoneSettings.queryForwardPortc C s | j d S �N� rc rI r r r � getInterfaces� s z(FirewallClientZoneSettings.getInterfacesc C s || j d< d S r� rc �rB r0 r r r � setInterfaces� s z(FirewallClientZoneSettings.setInterfacesc C s0 || j d vr | j d �|� n ttj|��d S r� r{ �rB � interfacer r r � addInterface� s z'FirewallClientZoneSettings.addInterfacec C s0 || j d v r | j d �|� n ttj|��d S r� r� r� r r r �removeInterface� s z*FirewallClientZoneSettings.removeInterfacec C s || j d v S r� rc r� r r r �queryInterface� s z)FirewallClientZoneSettings.queryInterfacec C s | j d S �N� rc rI r r r � getSources� s z%FirewallClientZoneSettings.getSourcesc C s || j d< d S r� rc �rB r1 r r r � setSources� s z%FirewallClientZoneSettings.setSourcesc C s0 || j d vr | j d �|� n ttj|��d S r� r{ �rB �sourcer r r � addSource� s z$FirewallClientZoneSettings.addSourcec C s0 || j d v r | j d �|� n ttj|��d S r� r� r� r r r � removeSource� s z'FirewallClientZoneSettings.removeSourcec C s || j d v S r� rc r� r r r � querySource� s z&FirewallClientZoneSettings.querySourcec C s | j d S )N� rc rI r r r � getRichRules� s z'FirewallClientZoneSettings.getRichRulesc C s dd� |D �}|| j d< d S )Nc S s g | ]}t t|d ���qS ��Zrule_str�r r ��.0�rr r r � <listcomp>� � z;FirewallClientZoneSettings.setRichRules.<locals>.<listcomp>r� rc �rB Zrulesr r r � setRichRules� s z'FirewallClientZoneSettings.setRichRulesc C s> t t|d��}|| jd vr.| jd �|� n ttj|��d S �Nr� r� �r r r9 r| r r r} �rB �ruler r r � addRichRule� s z&FirewallClientZoneSettings.addRichRulec C s> t t|d��}|| jd v r.| jd �|� n ttj|��d S r� �r r r9 r� r r r� r� r r r �removeRichRule� s z)FirewallClientZoneSettings.removeRichRulec C s t t|d��}|| jd v S r� �r r r9 r� r r r � queryRichRule� s z(FirewallClientZoneSettings.queryRichRule)N)O�__name__� __module__� __qualname__r# rE rJ rP r@ r\ r_ ra rd rf ri rk rn rp rs ru rx rz r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r r r r r$ S s, r$ c @ s� e Zd Zdd� Zedd� �Zedd� �Zedd� �Zed d � �Zed d � �Z ed d� �Z edd� �Z edd� �Z edd� �Z edd� �Zedd� �Zedd� �Zedd � �Zed d � �Zed d � �Zed!d"� �Zed#d$� �Zed%d&� �Zed'd(� �Zed)d*� �Zed+d,� �Zed-d.� �Zed/d0� �Zed1d2� �Z ed3d4� �Z ed5d6� �Z ed7d8� �Z ed9d:� �Z ed;d<� �Z!ed=d>� �Z"ed?d@� �Z#edAdB� �Z$edCdD� �Z%edEdF� �Z&edGdH� �Z'edIdJ� �Z(edKdL� �Z)edMdN� �Z*edOdP� �Z+edQdR� �Z,edSdT� �Z-edUdV� �Z.edWdX� �Z/edYdZ� �Z0ed[d\� �Z1ed]d^� �Z2ed_d`� �Z3edadb� �Z4edcdd� �Z5ededf� �Z6edgdh� �Z7edidj� �Z8edkdl� �Z9edmdn� �Z:edodp� �Z;edqdr� �Z<edsdt� �Z=edudv� �Z>edwdx� �Z?edydz� �Z@ed{d|� �ZAed}d~� �ZBedd�� �ZCed�d�� �ZDed�d�� �ZEed�d�� �ZFed�d�� �ZGed�d�� �ZHed�d�� �ZIed�d�� �ZJed�d�� �ZKed�d�� �ZLed�d�� �ZMed�d�� �ZNed�d�� �ZOed�d�� �ZPd�S )��FirewallClientConfigZonec C sL || _ || _| j �tjj|�| _tj| jtjjd�| _ tj| jdd�| _ d S �N��dbus_interface� org.freedesktop.DBus.Properties) �bus�path� get_objectr r �DBUS_INTERFACE�dbus_obj� Interface�DBUS_INTERFACE_CONFIG_ZONE�fw_zone� fw_properties�rB r r r r r rE � s ��z!FirewallClientConfigZone.__init__c C s t | j�tjj|��S rQ )r r �Getr r r �rB �propr r r � get_property� s �z%FirewallClientConfigZone.get_propertyc C s t | j�tjj��S rQ )r r �GetAllr r r rI r r r �get_properties� s �z'FirewallClientConfigZone.get_propertiesc C s | j �tjj||� d S rQ )r �Setr r r �rB r rO r r r � set_property� s �z%FirewallClientConfigZone.set_propertyc C s t t| j�� ��S rQ )r$ r r � getSettings2rI r r r � getSettings� s z$FirewallClientConfigZone.getSettingsc C s | j �|�� � d S rQ )r �update2r\ r^ r r r �update� s z FirewallClientConfigZone.updatec C s | j �� d S rQ )r � loadDefaultsrI r r r r � s z%FirewallClientConfigZone.loadDefaultsc C s | j �� d S rQ )r r� rI r r r r� s z FirewallClientConfigZone.removec C s | j �|� d S rQ )r �rename�rB �namer r r r s z FirewallClientConfigZone.renamec C s | j �� S rQ )r rd rI r r r rd s z#FirewallClientConfigZone.getVersionc C s | j �|� d S rQ )r rf re r r r rf s z#FirewallClientConfigZone.setVersionc C s | j �� S rQ )r ri rI r r r ri s z!FirewallClientConfigZone.getShortc C s | j �|� d S rQ )r rk rj r r r rk s z!FirewallClientConfigZone.setShortc C s | j �� S rQ )r rn rI r r r rn ! s z'FirewallClientConfigZone.getDescriptionc C s | j �|� d S rQ )r rp ro r r r rp % s z'FirewallClientConfigZone.setDescriptionc C s | j �� S rQ )r rs rI r r r rs + s z"FirewallClientConfigZone.getTargetc C s | j �|� d S rQ )r ru rt r r r ru / s z"FirewallClientConfigZone.setTargetc C s | j �� S rQ )r rx rI r r r rx 5 s z$FirewallClientConfigZone.getServicesc C s | j �|� d S rQ )r rz ry r r r rz 9 s z$FirewallClientConfigZone.setServicesc C s | j �|� d S rQ )r r� r~ r r r r� = s z#FirewallClientConfigZone.addServicec C s | j �|� d S rQ )r r� r~ r r r r� A s z&FirewallClientConfigZone.removeServicec C s | j �|�S rQ )r r� r~ r r r r� E s z%FirewallClientConfigZone.queryServicec C s | j �� S rQ )r r� rI r r r r� K s z!FirewallClientConfigZone.getPortsc C s | j �|� d S rQ )r r� r� r r r r� O s z!FirewallClientConfigZone.setPortsc C s | j �||� d S rQ )r r� r� r r r r� S s z FirewallClientConfigZone.addPortc C s | j �||� d S rQ )r r� r� r r r r� W s z#FirewallClientConfigZone.removePortc C s | j �||�S rQ )r r� r� r r r r� [ s z"FirewallClientConfigZone.queryPortc C s | j �� S rQ )r r� rI r r r r� a s z%FirewallClientConfigZone.getProtocolsc C s | j �|� d S rQ )r r� r� r r r r� e s z%FirewallClientConfigZone.setProtocolsc C s | j �|� d S rQ )r r� r� r r r r� i s z$FirewallClientConfigZone.addProtocolc C s | j �|� d S rQ )r r� r� r r r r� m s z'FirewallClientConfigZone.removeProtocolc C s | j �|�S rQ )r r� r� r r r r� q s z&FirewallClientConfigZone.queryProtocolc C s | j �� S rQ )r r� rI r r r r� w s z'FirewallClientConfigZone.getSourcePortsc C s | j �|� d S rQ )r r� r� r r r r� { s z'FirewallClientConfigZone.setSourcePortsc C s | j �||� d S rQ )r r� r� r r r r� s z&FirewallClientConfigZone.addSourcePortc C s | j �||� d S rQ )r r� r� r r r r� � s z)FirewallClientConfigZone.removeSourcePortc C s | j �||�S rQ )r r� r� r r r r� � s z(FirewallClientConfigZone.querySourcePortc C s | j �� S rQ )r r� rI r r r r� � s z&FirewallClientConfigZone.getIcmpBlocksc C s | j �|� d S rQ )r r� )rB Z icmptypesr r r r� � s z&FirewallClientConfigZone.setIcmpBlocksc C s | j �|� d S rQ )r r� r� r r r r� � s z%FirewallClientConfigZone.addIcmpBlockc C s | j �|� d S rQ )r r� r� r r r r� � s z(FirewallClientConfigZone.removeIcmpBlockc C s | j �|�S rQ )r r� r� r r r r� � s z'FirewallClientConfigZone.queryIcmpBlockc C s | j �� S rQ )r r� rI r r r r� � s z.FirewallClientConfigZone.getIcmpBlockInversionc C s | j �|� d S rQ )r r� )rB Z inversionr r r r� � s z.FirewallClientConfigZone.setIcmpBlockInversionc C s | j �� d S rQ )r r� rI r r r r� � s z.FirewallClientConfigZone.addIcmpBlockInversionc C s | j �� d S rQ )r r� rI r r r r� � s z1FirewallClientConfigZone.removeIcmpBlockInversionc C s | j �� S rQ )r r� rI r r r r� � s z0FirewallClientConfigZone.queryIcmpBlockInversionc C s | j �� d S �Nr4 �r r rI r r r r� � s z#FirewallClientConfigZone.getForwardc C s | j �d|i� d S r �r r r� r r r r� � s z#FirewallClientConfigZone.setForwardc C s | j �ddi� d S �Nr4 Tr rI r r r r� � s z#FirewallClientConfigZone.addForwardc C s | j �ddi� d S �Nr4 Fr rI r r r r� � s z&FirewallClientConfigZone.removeForwardc C s | j �� d S r r rI r r r r� � s z%FirewallClientConfigZone.queryForwardc C s | j �� S rQ )r r� rI r r r r� � s z&FirewallClientConfigZone.getMasqueradec C s | j �|� d S rQ )r r� r� r r r r� � s z&FirewallClientConfigZone.setMasqueradec C s | j �� d S rQ )r r� rI r r r r� � s z&FirewallClientConfigZone.addMasqueradec C s | j �� d S rQ )r r� rI r r r r� � s z)FirewallClientConfigZone.removeMasqueradec C s | j �� S rQ )r r� rI r r r r� � s z(FirewallClientConfigZone.queryMasqueradec C s | j �� S rQ )r r� rI r r r r� � s z(FirewallClientConfigZone.getForwardPortsc C s | j �|� d S rQ )r r� r� r r r r� � s z(FirewallClientConfigZone.setForwardPortsc C s. |d u r d}|d u rd}| j �||||� d S �Nr% )r r� �rB r� r� �toport�toaddrr r r r� � s z'FirewallClientConfigZone.addForwardPortc C s. |d u r d}|d u rd}| j �||||� d S r# )r r� r$ r r r r� � s z*FirewallClientConfigZone.removeForwardPortc C s* |d u r d}|d u rd}| j �||||�S r# )r r� r$ r r r r� � s z)FirewallClientConfigZone.queryForwardPortc C s | j �� S rQ )r r� rI r r r r� s z&FirewallClientConfigZone.getInterfacesc C s | j �|� d S rQ )r r� r� r r r r� s z&FirewallClientConfigZone.setInterfacesc C s | j �|� d S rQ )r r� r� r r r r� s z%FirewallClientConfigZone.addInterfacec C s | j �|� d S rQ )r r� r� r r r r� s z(FirewallClientConfigZone.removeInterfacec C s | j �|�S rQ )r r� r� r r r r� s z'FirewallClientConfigZone.queryInterfacec C s | j �� S rQ )r r� rI r r r r� s z#FirewallClientConfigZone.getSourcesc C s | j �|� d S rQ )r r� r� r r r r� ! s z#FirewallClientConfigZone.setSourcesc C s | j �|� d S rQ )r r� r� r r r r� % s z"FirewallClientConfigZone.addSourcec C s | j �|� d S rQ )r r� r� r r r r� ) s z%FirewallClientConfigZone.removeSourcec C s | j �|�S rQ )r r� r� r r r r� - s z$FirewallClientConfigZone.querySourcec C s | j �� S rQ )r r� rI r r r r� 3 s z%FirewallClientConfigZone.getRichRulesc C s | j �|� d S rQ )r r� r� r r r r� 7 s z%FirewallClientConfigZone.setRichRulesc C s | j �|� d S rQ )r r� r� r r r r� ; s z$FirewallClientConfigZone.addRichRulec C s | j �|� d S rQ )r r� r� r r r r� ? s z'FirewallClientConfigZone.removeRichRulec C s | j �|�S rQ )r r� r� r r r r� C s z&FirewallClientConfigZone.queryRichRuleN)Qr� r� r� rE r# r r r r r r r� r rd rf ri rk rn rp rs ru rx rz r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r r r r r� � s2 r� c @ s" e Zd Zed�dd��Zedd� �Zedd� �Zedd � �Zed d � �Zd d � Z edd� �Z edd� �Z edd� �Z edd� �Z edd� �Zedd� �Zedd� �Zed d � �Zed d � �Zed d!� �Zed"d#� �Zed$d%� �Zed&d'� �Zed(d)� �Zed*d+� �Zed,d-� �Zed.d/� �Zed0d1� �Zed2d3� �Z ed4d5� �Z ed6d7� �Z ed8d9� �Z ed:d;� �Z ed<d=� �Z!ed>d?� �Z"ed@dA� �Z#edBdC� �Z$edDdE� �Z%edFdG� �Z&edHdI� �Z'edJdK� �Z(edLdM� �Z)edNdO� �Z*edPdQ� �Z+edRdS� �Z,edTdU� �Z-edVdW� �Z.edXdY� �Z/edZd[� �Z0ed\d]� �Z1ed^d_� �Z2ed`da� �Z3edbdc� �Z4eddde� �Z5edfdg� �Z6edhdi� �Z7edjdk� �Z8edldm� �Z9edndo� �Z:edpdq� �Z;edrds� �Z<edtdu� �Z=edvdw� �Z>edxdy� �Z?edzd{� �Z@ed|d}� �ZAed~d� �ZBed�d�� �ZCed�d�� �ZDed�d�� �ZEdS )�� FirewallClientPolicySettingsNc C sB dg g g g dg t g g g dg tdd�| _g d�| _|r>| �|� d S )Nr% F)r( � egress_zonesr/ r- � ingress_zonesr. r, �priorityr2 � rich_rulesr+ r' r3 r* r& )r5 r5 r8 r5 r5 r6 r7 rC r5 r5 r5 r5 r7 r5 r5 )r r r9 r; r@ r^ r r r rE H s& � z%FirewallClientPolicySettings.__init__c C s d| j | jf S rF rG rI r r r rJ b s z%FirewallClientPolicySettings.__repr__c C s | j S rQ rc rI r r r rP f s z,FirewallClientPolicySettings.getSettingsDictc C s |D ]}|| | j |< qd S rQ rc rT r r r r@ i s z,FirewallClientPolicySettings.setSettingsDictc C sr i }t | j| j�D ]Z\}}| j| }t|�tu rDtj||d�||< qt|�tu rdtj||d�||< q|||< q|S �NrU ) rL r9 r; rW r= r rX r? rY )rB r9 rN r[ rO r r r r\ m s z0FirewallClientPolicySettings.getSettingsDbusDictc C s | � � }dD ] }||= q |S )N)r& r' r( r* r` rT r r r ra y s z7FirewallClientPolicySettings.getRuntimeSettingsDbusDictc C s | j d S �Nr& rc rI r r r rd s z'FirewallClientPolicySettings.getVersionc C s || j d< d S r- rc re r r r rf � s z'FirewallClientPolicySettings.setVersionc C s | j d S �Nr' rc rI r r r ri � s z%FirewallClientPolicySettings.getShortc C s || j d< d S r. rc rj r r r rk � s z%FirewallClientPolicySettings.setShortc C s | j d S �Nr( rc rI r r r rn � s z+FirewallClientPolicySettings.getDescriptionc C s || j d< d S r/ rc ro r r r rp � s z+FirewallClientPolicySettings.setDescriptionc C s | j d S �Nr* rc rI r r r rs � s z&FirewallClientPolicySettings.getTargetc C s || j d< d S r0 rc rt r r r ru � s z&FirewallClientPolicySettings.setTargetc C s | j d S �Nr+ rc rI r r r rx � s z(FirewallClientPolicySettings.getServicesc C s || j d< d S r1 rc ry r r r rz � s z(FirewallClientPolicySettings.setServicesc C s0 || j d vr | j d �|� n ttj|��d S r1 r{ r~ r r r r� � s z'FirewallClientPolicySettings.addServicec C s0 || j d v r | j d �|� n ttj|��d S r1 r� r~ r r r r� � s z*FirewallClientPolicySettings.removeServicec C s || j d v S r1 rc r~ r r r r� � s z)FirewallClientPolicySettings.queryServicec C s | j d S �Nr, rc rI r r r r� � s z%FirewallClientPolicySettings.getPortsc C s || j d< d S r2 rc r� r r r r� � s z%FirewallClientPolicySettings.setPortsc C s@ ||f| j d vr(| j d �||f� nttjd||f ��d S �Nr, r� r{ r� r r r r� � s �z$FirewallClientPolicySettings.addPortc C s@ ||f| j d v r(| j d �||f� nttjd||f ��d S r3 r� r� r r r r� � s �z'FirewallClientPolicySettings.removePortc C s ||f| j d v S r2 rc r� r r r r� � s z&FirewallClientPolicySettings.queryPortc C s | j d S �Nr2 rc rI r r r r� � s z)FirewallClientPolicySettings.getProtocolsc C s || j d< d S r4 rc r� r r r r� � s z)FirewallClientPolicySettings.setProtocolsc C s0 || j d vr | j d �|� n ttj|��d S r4 r{ r� r r r r� � s z(FirewallClientPolicySettings.addProtocolc C s0 || j d v r | j d �|� n ttj|��d S r4 r� r� r r r r� � s z+FirewallClientPolicySettings.removeProtocolc C s || j d v S r4 rc r� r r r r� � s z*FirewallClientPolicySettings.queryProtocolc C s | j d S �Nr3 rc rI r r r r� � s z+FirewallClientPolicySettings.getSourcePortsc C s || j d< d S r5 rc r� r r r r� � s z+FirewallClientPolicySettings.setSourcePortsc C s@ ||f| j d vr(| j d �||f� nttjd||f ��d S �Nr3 r� r{ r� r r r r� � s �z*FirewallClientPolicySettings.addSourcePortc C s@ ||f| j d v r(| j d �||f� nttjd||f ��d S r6 r� r� r r r r� � s �z-FirewallClientPolicySettings.removeSourcePortc C s ||f| j d v S r5 rc r� r r r r� � s z,FirewallClientPolicySettings.querySourcePortc C s | j d S �Nr- rc rI r r r r� � s z*FirewallClientPolicySettings.getIcmpBlocksc C s || j d< d S r7 rc r� r r r r� � s z*FirewallClientPolicySettings.setIcmpBlocksc C s0 || j d vr | j d �|� n ttj|��d S r7 r{ r� r r r r� � s z)FirewallClientPolicySettings.addIcmpBlockc C s0 || j d v r | j d �|� n ttj|��d S r7 r� r� r r r r� s z,FirewallClientPolicySettings.removeIcmpBlockc C s || j d v S r7 rc r� r r r r� s z+FirewallClientPolicySettings.queryIcmpBlockc C s | j d S �Nr. rc rI r r r r� s z*FirewallClientPolicySettings.getMasqueradec C s || j d< d S r8 rc r� r r r r� s z*FirewallClientPolicySettings.setMasqueradec C s& | j d sd| j d< n ttjd��d S )Nr. Tr� rI r r r r� s z*FirewallClientPolicySettings.addMasqueradec C s& | j d rd| j d< n ttjd��d S )Nr. Fr� rI r r r r� s z-FirewallClientPolicySettings.removeMasqueradec C s | j d S r8 rc rI r r r r� s z,FirewallClientPolicySettings.queryMasqueradec C s | j d S �Nr/ rc rI r r r r� # s z,FirewallClientPolicySettings.getForwardPortsc C s || j d< d S r9 rc r� r r r r� & s z,FirewallClientPolicySettings.setForwardPortsc C sd |d u r d}|d u rd}||||f| j d vrH| j d �||||f� nttjd||||f ��d S �Nr% r/ r� r{ r� r r r r� ) s �z+FirewallClientPolicySettings.addForwardPortc C sd |d u r d}|d u rd}||||f| j d v rH| j d �||||f� nttjd||||f ��d S r: r� r� r r r r� 4 s �z.FirewallClientPolicySettings.removeForwardPortc C s. |d u r d}|d u rd}||||f| j d v S )Nr% r/ rc r� r r r r� ? s z-FirewallClientPolicySettings.queryForwardPortc C s | j d S )Nr+ rc rI r r r r� G s z)FirewallClientPolicySettings.getRichRulesc C s dd� |D �}|| j d< d S )Nc S s g | ]}t t|d ���qS r� r� r� r r r r� L r� z=FirewallClientPolicySettings.setRichRules.<locals>.<listcomp>r+ rc r� r r r r� J s z)FirewallClientPolicySettings.setRichRulesc C s> t t|d��}|| jd vr.| jd �|� n ttj|��d S �Nr� r+ r� r� r r r r� N s z(FirewallClientPolicySettings.addRichRulec C s> t t|d��}|| jd v r.| jd �|� n ttj|��d S r; r� r� r r r r� U s z+FirewallClientPolicySettings.removeRichRulec C s t t|d��}|| jd v S r; r� r� r r r r� \ s z*FirewallClientPolicySettings.queryRichRulec C s | j d S �Nr) rc rI r r r �getIngressZonesa s z,FirewallClientPolicySettings.getIngressZonesc C s || j d< d S r< rc )rB r) r r r �setIngressZonesd s z,FirewallClientPolicySettings.setIngressZonesc C s0 || j d vr | j d �|� n ttj|��d S r< r{ �rB Z ingress_zoner r r �addIngressZoneg s z+FirewallClientPolicySettings.addIngressZonec C s0 || j d v r | j d �|� n ttj|��d S r< r� r? r r r �removeIngressZonem s z.FirewallClientPolicySettings.removeIngressZonec C s || j d v S r< rc r? r r r �queryIngressZones s z-FirewallClientPolicySettings.queryIngressZonec C s | j d S �Nr( rc rI r r r �getEgressZonesw s z+FirewallClientPolicySettings.getEgressZonesc C s || j d< d S rC rc )rB r( r r r �setEgressZonesz s z+FirewallClientPolicySettings.setEgressZonesc C s0 || j d vr | j d �|� n ttj|��d S rC r{ �rB Z egress_zoner r r � addEgressZone} s z*FirewallClientPolicySettings.addEgressZonec C s0 || j d v r | j d �|� n ttj|��d S rC r� rF r r r �removeEgressZone� s z-FirewallClientPolicySettings.removeEgressZonec C s || j d v S rC rc rF r r r �queryEgressZone� s z,FirewallClientPolicySettings.queryEgressZonec C s | j d S �Nr* rc rI r r r � getPriority� s z(FirewallClientPolicySettings.getPriorityc C s t |�| jd< d S rJ )�intr9 )rB r* r r r � setPriority� s z(FirewallClientPolicySettings.setPriority)N)Fr� r� r� r# rE rJ rP r@ r\ ra rd rf ri rk rn rp rs ru rx rz r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r= r> r@ rA rB rD rE rG rH rI rK rM r r r r r' G s r' c @ st e Zd Zdd� Zedd� �Zedd� �Zedd� �Zed d � �Zed d � �Z ed d� �Z edd� �Z edd� �Z dS )�FirewallClientConfigPolicyc C sL || _ || _| j �tjj|�| _tj| jtjjd�| _ tj| jdd�| _ d S r� ) r r r r r r r r � DBUS_INTERFACE_CONFIG_POLICY� fw_policyr r r r r rE � s ��z#FirewallClientConfigPolicy.__init__c C s t | j�tjj|��S rQ )r r r r r rO r r r r r � s �z'FirewallClientConfigPolicy.get_propertyc C s t | j�tjj��S rQ )r r r r r rO rI r r r r � s �z)FirewallClientConfigPolicy.get_propertiesc C s | j �tjj||� d S rQ )r r r r rO r r r r r � s �z'FirewallClientConfigPolicy.set_propertyc C s t t| j�� ��S rQ )r' r rP r rI r r r r � s z&FirewallClientConfigPolicy.getSettingsc C s | j �|�� � d S rQ )rP r r\ r^ r r r r � s z!FirewallClientConfigPolicy.updatec C s | j �� d S rQ )rP r rI r r r r � s z'FirewallClientConfigPolicy.loadDefaultsc C s | j �� d S rQ )rP r� rI r r r r� � s z!FirewallClientConfigPolicy.removec C s | j �|� d S rQ )rP r r r r r r � s z!FirewallClientConfigPolicy.renameN) r� r� r� rE r# r r r r r r r� r r r r r rN � s" rN c @ s8 e Zd Zed^dd��Zedd� �Zedd� �Zedd � �Zed d � �Zed d � �Z edd� �Z edd� �Z edd� �Z edd� �Z edd� �Zedd� �Zedd� �Zed d � �Zed d � �Zed d!� �Zed"d#� �Zed$d%� �Zed&d'� �Zed(d)� �Zed*d+� �Zed,d-� �Zed.d/� �Zed0d1� �Zed2d3� �Z ed4d5� �Z ed6d7� �Z ed8d9� �Z ed:d;� �Z ed<d=� �Z!ed>d?� �Z"ed@dA� �Z#edBdC� �Z$edDdE� �Z%ed_dFdG��Z&edHdI� �Z'edJdK� �Z(edLdM� �Z)edNdO� �Z*edPdQ� �Z+edRdS� �Z,edTdU� �Z-edVdW� �Z.edXdY� �Z/edZd[� �Z0ed\d]� �Z1dS )`� FirewallClientServiceSettingsNc C sz dddg g i g g g g g | _ g d�| _g d�| _|rvt|�tu r`t|�D ]\}}|| | j |< qFnt|�tu rv| �|� d S )Nr% ) r& r' r( r, �modules� destinationr2 r3 �includes�helpers) r5 r5 r5 r7 r5 �ssr5 r7 r5 r5 )r9 r: r; rW r= r> r? r@ rA r r r rE � s z&FirewallClientServiceSettings.__init__c C s d| j | jf S rF rG rI r r r rJ � s z&FirewallClientServiceSettings.__repr__c C s( i }t | j| j�D ]\}}|||< q|S rQ rK rM r r r rP � s z-FirewallClientServiceSettings.getSettingsDictc C s$ |D ]}|| | j | j�|�< qd S rQ rR rT r r r r@ � s z-FirewallClientServiceSettings.setSettingsDictc C sn i }t | j| j| j�D ]R\}}}t|�tu r@tj||d�||< qt|�tu r`tj ||d�||< q|||< q|S r, rV rZ r r r r\ � s z1FirewallClientServiceSettings.getSettingsDbusDictc C s | j d S rb rc rI r r r rd � s z(FirewallClientServiceSettings.getVersionc C s || j d< d S rb rc re r r r rf � s z(FirewallClientServiceSettings.setVersionc C s | j d S rg rc rI r r r ri � s z&FirewallClientServiceSettings.getShortc C s || j d< d S rg rc rj r r r rk � s z&FirewallClientServiceSettings.setShortc C s | j d S rl rc rI r r r rn � s z,FirewallClientServiceSettings.getDescriptionc C s || j d< d S rl rc ro r r r rp s z,FirewallClientServiceSettings.setDescriptionc C s | j d S �N� rc rI r r r r� s z&FirewallClientServiceSettings.getPortsc C s || j d< d S rW rc r� r r r r� s z&FirewallClientServiceSettings.setPortsc C s@ ||f| j d vr(| j d �||f� nttjd||f ��d S �NrX r� r{ r� r r r r� s �z%FirewallClientServiceSettings.addPortc C s@ ||f| j d v r(| j d �||f� nttjd||f ��d S rY r� r� r r r r� s �z(FirewallClientServiceSettings.removePortc C s ||f| j d v S rW rc r� r r r r� s z'FirewallClientServiceSettings.queryPortc C s | j d S r� rc rI r r r r� s z*FirewallClientServiceSettings.getProtocolsc C s || j d< d S r� rc r� r r r r� s z*FirewallClientServiceSettings.setProtocolsc C s0 || j d vr | j d �|� n ttj|��d S r� r{ r� r r r r� " s z)FirewallClientServiceSettings.addProtocolc C s0 || j d v r | j d �|� n ttj|��d S r� r� r� r r r r� ( s z,FirewallClientServiceSettings.removeProtocolc C s || j d v S r� rc r� r r r r� . s z+FirewallClientServiceSettings.queryProtocolc C s | j d S r� rc rI r r r r� 2 s z,FirewallClientServiceSettings.getSourcePortsc C s || j d< d S r� rc r� r r r r� 5 s z,FirewallClientServiceSettings.setSourcePortsc C s@ ||f| j d vr(| j d �||f� nttjd||f ��d S �Nr� r� r{ r� r r r r� 8 s �z+FirewallClientServiceSettings.addSourcePortc C s@ ||f| j d v r(| j d �||f� nttjd||f ��d S rZ r� r� r r r r� ? s �z.FirewallClientServiceSettings.removeSourcePortc C s ||f| j d v S r� rc r� r r r r� F s z-FirewallClientServiceSettings.querySourcePortc C s | j d S �Nrq rc rI r r r � getModulesJ s z(FirewallClientServiceSettings.getModulesc C s || j d< d S r[ rc �rB rR r r r � setModulesM s z(FirewallClientServiceSettings.setModulesc C s0 || j d vr | j d �|� n ttj|��d S r[ r{ �rB �moduler r r � addModuleP s z'FirewallClientServiceSettings.addModulec C s0 || j d v r | j d �|� n ttj|��d S r[ r� r_ r r r � removeModuleV s z*FirewallClientServiceSettings.removeModulec C s || j d v S r[ rc r_ r r r � queryModule\ s z)FirewallClientServiceSettings.queryModulec C s | j d S rv rc rI r r r �getDestinations` s z-FirewallClientServiceSettings.getDestinationsc C s || j d< d S rv rc �rB Z destinationsr r r �setDestinationsc s z-FirewallClientServiceSettings.setDestinationsc C sH || j d vs | j d | |kr0|| j d |< nttjd||f ��d S �Nrw r� r� �rB Z dest_type�addressr r r �setDestinationf s ��z,FirewallClientServiceSettings.setDestinationc C s^ || j d v rJ|d ur<| j d | |kr<ttjd||f ��| j d |= nttjd| ��d S )Nrw r� z'%s'r� rh r r r �removeDestinationn s �z/FirewallClientServiceSettings.removeDestinationc C s || j d v o || j d | kS rv rc rh r r r �queryDestinationw s �z.FirewallClientServiceSettings.queryDestinationc C s | j d S r� rc rI r r r � getIncludes| s z)FirewallClientServiceSettings.getIncludesc C s || j d< d S r� rc �rB rT r r r � setIncludes s z)FirewallClientServiceSettings.setIncludesc C s0 || j d vr | j d �|� n ttj|��d S r� r{ �rB Zincluder r r � addInclude� s z(FirewallClientServiceSettings.addIncludec C s0 || j d v r | j d �|� n ttj|��d S r� r� rp r r r � removeInclude� s z+FirewallClientServiceSettings.removeIncludec C s || j d v S r� rc rp r r r � queryInclude� s z*FirewallClientServiceSettings.queryIncludec C s | j d S r� rc rI r r r � getHelpers� s z(FirewallClientServiceSettings.getHelpersc C s || j d< d S r� rc )rB rU r r r � setHelpers� s z(FirewallClientServiceSettings.setHelpersc C s0 || j d vr | j d �|� n ttj|��d S r� r{ �rB �helperr r r � addHelper� s z'FirewallClientServiceSettings.addHelperc C s0 || j d v r | j d �|� n ttj|��d S r� r� rv r r r � removeHelper� s z*FirewallClientServiceSettings.removeHelperc C s || j d v S r� rc rv r r r � queryHelper� s z)FirewallClientServiceSettings.queryHelper)N)N)2r� r� r� r# rE rJ rP r@ r\ rd rf ri rk rn rp r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r\ r^ ra rb rc rd rf rj rk rl rm ro rq rr rs rt ru rx ry rz r r r r rQ � s� rQ c @ s� e Zd Zed*dd��Zedd� �Zedd� �Zedd � �Zed d � �Zed d � �Z edd� �Z edd� �Z edd� �Z edd� �Z edd� �Zedd� �Zedd� �Zed d � �Zed d � �Zed d!� �Zed"d#� �Zed$d%� �Zed&d'� �Zed(d)� �ZdS )+�FirewallClientIPSetSettingsNc C s" |r || _ nddddi g g| _ d S r# rc r^ r r r rE � s z$FirewallClientIPSetSettings.__init__c C s d| j | jf S rF rG rI r r r rJ � s z$FirewallClientIPSetSettings.__repr__c C s | j d S rb rc rI r r r rd � s z&FirewallClientIPSetSettings.getVersionc C s || j d< d S rb rc re r r r rf � s z&FirewallClientIPSetSettings.setVersionc C s | j d S rg rc rI r r r ri � s z$FirewallClientIPSetSettings.getShortc C s || j d< d S rg rc rj r r r rk � s z$FirewallClientIPSetSettings.setShortc C s | j d S rl rc rI r r r rn � s z*FirewallClientIPSetSettings.getDescriptionc C s || j d< d S rl rc ro r r r rp � s z*FirewallClientIPSetSettings.setDescriptionc C s | j d S rW rc rI r r r �getType� s z#FirewallClientIPSetSettings.getTypec C s || j d< d S rW rc )rB Z ipset_typer r r �setType� s z#FirewallClientIPSetSettings.setTypec C s | j d S r[ rc rI r r r � getOptions� s z&FirewallClientIPSetSettings.getOptionsc C s || j d< d S r[ rc )rB �optionsr r r � setOptions� s z&FirewallClientIPSetSettings.setOptionsc C sP || j d vs | j d | |kr0|| j d |< n ttj|rFd||f n|��d S )Nrq z'%s=%s'r� �rB rN rO r r r � addOption� s ��z%FirewallClientIPSetSettings.addOptionc C s, || j d v r | j d |= n ttj|��d S r[ r� )rB rN r r r � removeOption� s z(FirewallClientIPSetSettings.removeOptionc C s || j d v o | j d | |kS r[ rc r� r r r � queryOption� s z'FirewallClientIPSetSettings.queryOptionc C s | j d S rv rc rI r r r � getEntries� s z&FirewallClientIPSetSettings.getEntriesc C s@ d| j d v r*| j d d dkr*ttj��t|� || j d< d S �N�timeoutrq �0rw )r9 r r �IPSET_WITH_TIMEOUTr �rB �entriesr r r � setEntries� s � z&FirewallClientIPSetSettings.setEntriesc C sr d| j d v r*| j d d dkr*ttj��t|�}|| j d vrbt|| j d � | j d �|� n ttj|��d S r� )r9 r r r� r r r| r} �rB �entryr r r �addEntry� s � z$FirewallClientIPSetSettings.addEntryc C sb d| j d v r*| j d d dkr*ttj��t|�}|| j d v rR| j d �|� n ttj|��d S r� )r9 r r r� r r� r� r� r r r � removeEntry� s � z'FirewallClientIPSetSettings.removeEntryc C s@ d| j d v r*| j d d dkr*ttj��t|�}|| j d v S r� )r9 r r r� r r� r r r � queryEntry s � z&FirewallClientIPSetSettings.queryEntry)N)r� r� r� r# rE rJ rd rf ri rk rn rp r| r} r~ r� r� r� r� r� r� r� r� r� r r r r r{ � sP r{ c @ s� e Zd Zedd� �Zedd� �Zedd� �Zedd� �Zed d � �Zed d � �Z ed d� �Z edd� �Z edd� �Z edd� �Z edd� �Zedd� �Zedd� �Zedd � �Zed d � �Zed d � �Zed!d"� �Zed#d$� �Zed%d&� �Zed'd(� �Zd)S )*�FirewallClientConfigIPSetc C sL || _ || _| j �tjj|�| _tj| jtjjd�| _ tj| jdd�| _ d S r� ) r r r r r r r r �DBUS_INTERFACE_CONFIG_IPSET�fw_ipsetr r r r r rE s ��z"FirewallClientConfigIPSet.__init__c C s t | j�tjj|��S rQ )r r r r r r� r r r r r s �z&FirewallClientConfigIPSet.get_propertyc C s t | j�tjj��S rQ )r r r r r r� rI r r r r # s �z(FirewallClientConfigIPSet.get_propertiesc C s | j �tjj||� d S rQ )r r r r r� r r r r r ( s �z&FirewallClientConfigIPSet.set_propertyc C s t tt| j�� ���S rQ )r{ r= r r� r rI r r r r - s �z%FirewallClientConfigIPSet.getSettingsc C s | j �t|j�� d S rQ )r� r �tupler9 r^ r r r r 2 s z FirewallClientConfigIPSet.updatec C s | j �� d S rQ )r� r rI r r r r 6 s z&FirewallClientConfigIPSet.loadDefaultsc C s | j �� d S rQ )r� r� rI r r r r� : s z FirewallClientConfigIPSet.removec C s | j �|� d S rQ )r� r r r r r r > s z FirewallClientConfigIPSet.renamec C s | j �� S rQ )r� rd rI r r r rd D s z$FirewallClientConfigIPSet.getVersionc C s | j �|� d S rQ )r� rf re r r r rf H s z$FirewallClientConfigIPSet.setVersionc C s | j �� S rQ )r� ri rI r r r ri N s z"FirewallClientConfigIPSet.getShortc C s | j �|� d S rQ )r� rk rj r r r rk R s z"FirewallClientConfigIPSet.setShortc C s | j �� S rQ )r� rn rI r r r rn X s z(FirewallClientConfigIPSet.getDescriptionc C s | j �|� d S rQ )r� rp ro r r r rp \ s z(FirewallClientConfigIPSet.setDescriptionc C s | j �� S rQ �r� r� rI r r r r� b s z$FirewallClientConfigIPSet.getEntriesc C s | j �|� d S rQ �r� r� r� r r r r� f s z$FirewallClientConfigIPSet.setEntriesc C s | j �|� d S rQ �r� r� r� r r r r� j s z"FirewallClientConfigIPSet.addEntryc C s | j �|� d S rQ �r� r� r� r r r r� n s z%FirewallClientConfigIPSet.removeEntryc C s | j �|�S rQ )r� r� r� r r r r� r s z$FirewallClientConfigIPSet.queryEntryN)r� r� r� r# rE r r r r r r r� r rd rf ri rk rn rp r� r� r� r� r� r r r r r� sP r� c @ s� e Zd Zed$dd��Zedd� �Zedd� �Zedd � �Zed d � �Zed d � �Z edd� �Z edd� �Z edd� �Z edd� �Z edd� �Zedd� �Zedd� �Zed d � �Zed d � �Zed d!� �Zed"d#� �ZdS )%� FirewallClientHelperSettingsNc C s" |r || _ ndddddg g| _ d S r# rc r^ r r r rE y s z%FirewallClientHelperSettings.__init__c C s d| j | jf S rF rG rI r r r rJ � s z%FirewallClientHelperSettings.__repr__c C s | j d S rb rc rI r r r rd � s z'FirewallClientHelperSettings.getVersionc C s || j d< d S rb rc re r r r rf � s z'FirewallClientHelperSettings.setVersionc C s | j d S rg rc rI r r r ri � s z%FirewallClientHelperSettings.getShortc C s || j d< d S rg rc rj r r r rk � s z%FirewallClientHelperSettings.setShortc C s | j d S rl rc rI r r r rn � s z+FirewallClientHelperSettings.getDescriptionc C s || j d< d S rl rc ro r r r rp � s z+FirewallClientHelperSettings.setDescriptionc C s | j d S rW rc rI r r r � getFamily� s z&FirewallClientHelperSettings.getFamilyc C s |d u rd| j d< || j d< d S )Nr% rX rc �rB �ipvr r r � setFamily� s z&FirewallClientHelperSettings.setFamilyc C s | j d S r[ rc rI r r r � getModule� s z&FirewallClientHelperSettings.getModulec C s || j d< d S r[ rc r_ r r r � setModule� s z&FirewallClientHelperSettings.setModulec C s | j d S rv rc rI r r r r� � s z%FirewallClientHelperSettings.getPortsc C s || j d< d S rv rc r� r r r r� � s z%FirewallClientHelperSettings.setPortsc C s@ ||f| j d vr(| j d �||f� nttjd||f ��d S rg r{ r� r r r r� � s �z$FirewallClientHelperSettings.addPortc C s@ ||f| j d v r(| j d �||f� nttjd||f ��d S rg r� r� r r r r� � s �z'FirewallClientHelperSettings.removePortc C s ||f| j d v S rv rc r� r r r r� � s z&FirewallClientHelperSettings.queryPort)N)r� r� r� r# rE rJ rd rf ri rk rn rp r� r� r� r� r� r� r� r� r� r r r r r� x sD r� c @ s, e Zd Zedd� �Zedd� �Zedd� �Zedd� �Zed d � �Zed d � �Z ed d� �Z edd� �Z edd� �Z edd� �Z edd� �Zedd� �Zedd� �Zedd � �Zed d � �Zed d � �Zed!d"� �Zed#d$� �Zed%d&� �Zed'd(� �Zed)d*� �Zed+d,� �Zed-d.� �Zed/d0� �Zd1S )2�FirewallClientConfigHelperc C sL || _ || _| j �tjj|�| _tj| jtjjd�| _ tj| jdd�| _ d S r� ) r r r r r r r r � DBUS_INTERFACE_CONFIG_HELPER� fw_helperr r r r r rE � s ��z#FirewallClientConfigHelper.__init__c C s t | j�tjj|��S rQ )r r r r r r� r r r r r � s �z'FirewallClientConfigHelper.get_propertyc C s t | j�tjj��S rQ )r r r r r r� rI r r r r � s �z)FirewallClientConfigHelper.get_propertiesc C s | j �tjj||� d S rQ )r r r r r� r r r r r � s �z'FirewallClientConfigHelper.set_propertyc C s t tt| j�� ���S rQ )r� r= r r� r rI r r r r � s �z&FirewallClientConfigHelper.getSettingsc C s | j �t|j�� d S rQ )r� r r� r9 r^ r r r r � s z!FirewallClientConfigHelper.updatec C s | j �� d S rQ )r� r rI r r r r � s z'FirewallClientConfigHelper.loadDefaultsc C s | j �� d S rQ )r� r� rI r r r r� � s z!FirewallClientConfigHelper.removec C s | j �|� d S rQ )r� r r r r r r � s z!FirewallClientConfigHelper.renamec C s | j �� S rQ )r� rd rI r r r rd � s z%FirewallClientConfigHelper.getVersionc C s | j �|� d S rQ )r� rf re r r r rf � s z%FirewallClientConfigHelper.setVersionc C s | j �� S rQ )r� ri rI r r r ri � s z#FirewallClientConfigHelper.getShortc C s | j �|� d S rQ )r� rk rj r r r rk s z#FirewallClientConfigHelper.setShortc C s | j �� S rQ )r� rn rI r r r rn s z)FirewallClientConfigHelper.getDescriptionc C s | j �|� d S rQ )r� rp ro r r r rp s z)FirewallClientConfigHelper.setDescriptionc C s | j �� S rQ )r� r� rI r r r r� s z#FirewallClientConfigHelper.getPortsc C s | j �|� d S rQ )r� r� r� r r r r� s z#FirewallClientConfigHelper.setPortsc C s | j �||� d S rQ )r� r� r� r r r r� s z"FirewallClientConfigHelper.addPortc C s | j �||� d S rQ )r� r� r� r r r r� s z%FirewallClientConfigHelper.removePortc C s | j �||�S rQ )r� r� r� r r r r� # s z$FirewallClientConfigHelper.queryPortc C s | j �� S rQ )r� r� rI r r r r� ) s z$FirewallClientConfigHelper.getFamilyc C s$ |d u r| j �d� | j �|� d S r# )r� r� r� r r r r� - s z$FirewallClientConfigHelper.setFamilyc C s | j �� S rQ )r� r� rI r r r r� 5 s z$FirewallClientConfigHelper.getModulec C s | j �|� d S rQ )r� r� r_ r r r r� 9 s z$FirewallClientConfigHelper.setModuleN) r� r� r� r# rE r r r r r r r� r rd rf ri rk rn rp r� r� r� r� r� r� r� r� r� r r r r r� � s` r� c @ s6 e Zd Zedd� �Zedd� �Zedd� �Zedd� �Zed d � �Zed d � �Z ed d� �Z edd� �Z edd� �Z edd� �Z edd� �Zedd� �Zedd� �Zedd � �Zed d � �Zed d � �Zed!d"� �Zed#d$� �Zed%d&� �Zed'd(� �Zed)d*� �Zed+d,� �Zed-d.� �Zed/d0� �Zed1d2� �Z ed3d4� �Z ed5d6� �Z ed7d8� �Z ed9d:� �Z ed;d<� �Z!ed=d>� �Z"ed?d@� �Z#edAdB� �Z$edCdD� �Z%edEdF� �Z&edGdH� �Z'edIdJ� �Z(edKdL� �Z)edMdN� �Z*ed^dPdQ��Z+edRdS� �Z,edTdU� �Z-edVdW� �Z.edXdY� �Z/edZd[� �Z0ed\d]� �Z1dOS )_�FirewallClientConfigServicec C sL || _ || _| j �tjj|�| _tj| jtjjd�| _ tj| jdd�| _ d S r� ) r r r r r r r r � DBUS_INTERFACE_CONFIG_SERVICE� fw_servicer r r r r rE @ s ��z$FirewallClientConfigService.__init__c C s t | j�tjj|��S rQ )r r r r r r� r r r r r K s �z(FirewallClientConfigService.get_propertyc C s t | j�tjj��S rQ )r r r r r r� rI r r r r P s �z*FirewallClientConfigService.get_propertiesc C s | j �tjj||� d S rQ )r r r r r� r r r r r U s �z(FirewallClientConfigService.set_propertyc C s t t| j�� ��S rQ )rQ r r� r rI r r r r Z s �z'FirewallClientConfigService.getSettingsc C s | j �|�� � d S rQ )r� r r\ r^ r r r r _ s z"FirewallClientConfigService.updatec C s | j �� d S rQ )r� r rI r r r r c s z(FirewallClientConfigService.loadDefaultsc C s | j �� d S rQ )r� r� rI r r r r� g s z"FirewallClientConfigService.removec C s | j �|� d S rQ )r� r r r r r r k s z"FirewallClientConfigService.renamec C s | j �� S rQ )r� rd rI r r r rd q s z&FirewallClientConfigService.getVersionc C s | j �|� d S rQ )r� rf re r r r rf u s z&FirewallClientConfigService.setVersionc C s | j �� S rQ )r� ri rI r r r ri { s z$FirewallClientConfigService.getShortc C s | j �|� d S rQ )r� rk rj r r r rk s z$FirewallClientConfigService.setShortc C s | j �� S rQ )r� rn rI r r r rn � s z*FirewallClientConfigService.getDescriptionc C s | j �|� d S rQ )r� rp ro r r r rp � s z*FirewallClientConfigService.setDescriptionc C s | j �� S rQ )r� r� rI r r r r� � s z$FirewallClientConfigService.getPortsc C s | j �|� d S rQ )r� r� r� r r r r� � s z$FirewallClientConfigService.setPortsc C s | j �||� d S rQ )r� r� r� r r r r� � s z#FirewallClientConfigService.addPortc C s | j �||� d S rQ )r� r� r� r r r r� � s z&FirewallClientConfigService.removePortc C s | j �||�S rQ )r� r� r� r r r r� � s z%FirewallClientConfigService.queryPortc C s | j �� S rQ )r� r� rI r r r r� � s z(FirewallClientConfigService.getProtocolsc C s | j �|� d S rQ )r� r� r� r r r r� � s z(FirewallClientConfigService.setProtocolsc C s | j �|� d S rQ )r� r� r� r r r r� � s z'FirewallClientConfigService.addProtocolc C s | j �|� d S rQ )r� r� r� r r r r� � s z*FirewallClientConfigService.removeProtocolc C s | j �|�S rQ )r� r� r� r r r r� � s z)FirewallClientConfigService.queryProtocolc C s | j �� S rQ )r� r� rI r r r r� � s z*FirewallClientConfigService.getSourcePortsc C s | j �|� d S rQ )r� r� r� r r r r� � s z*FirewallClientConfigService.setSourcePortsc C s | j �||� d S rQ )r� r� r� r r r r� � s z)FirewallClientConfigService.addSourcePortc C s | j �||� d S rQ )r� r� r� r r r r� � s z,FirewallClientConfigService.removeSourcePortc C s | j �||�S rQ )r� r� r� r r r r� � s z+FirewallClientConfigService.querySourcePortc C s | j �� S rQ )r� r\ rI r r r r\ � s z&FirewallClientConfigService.getModulesc C s | j �|� d S rQ )r� r^ r] r r r r^ � s z&FirewallClientConfigService.setModulesc C s | j �|� d S rQ )r� ra r_ r r r ra � s z%FirewallClientConfigService.addModulec C s | j �|� d S rQ )r� rb r_ r r r rb � s z(FirewallClientConfigService.removeModulec C s | j �|�S rQ )r� rc r_ r r r rc � s z'FirewallClientConfigService.queryModulec C s | j �� S rQ )r� rd rI r r r rd � s z+FirewallClientConfigService.getDestinationsc C s | j �|� d S rQ )r� rf re r r r rf � s z+FirewallClientConfigService.setDestinationsc C s | j �|�S rQ )r� �getDestination�rB rS r r r r� � s z*FirewallClientConfigService.getDestinationc C s | j �||� d S rQ )r� rj �rB rS ri r r r rj � s z*FirewallClientConfigService.setDestinationNc C s: |d ur*| � |�|kr*ttjd||f ��| j�|� d S )Nr� )r� r r r� r� rk r� r r r rk � s �z-FirewallClientConfigService.removeDestinationc C s | j �||�S rQ )r� rl r� r r r rl � s z,FirewallClientConfigService.queryDestinationc C s | j �� S rQ )r� rm rI r r r rm s z'FirewallClientConfigService.getIncludesc C s | j �|� d S rQ )r� ro rn r r r ro s z'FirewallClientConfigService.setIncludesc C s | j �|� d S rQ )r� rq rp r r r rq s z&FirewallClientConfigService.addIncludec C s | j �|� d S rQ )r� rr rp r r r rr s z)FirewallClientConfigService.removeIncludec C s | j �|�S rQ )r� rs rp r r r rs s z(FirewallClientConfigService.queryInclude)N)2r� r� r� r# rE r r r r r r r� r rd rf ri rk rn rp r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r\ r^ ra rb rc rd rf r� rj rk rl rm ro rq rr rs r r r r r� ? s� r� c @ s� e Zd Zed dd��Zedd� �Zedd� �Zedd � �Zed d � �Zed d � �Z edd� �Z edd� �Z edd� �Z edd� �Z edd� �Zedd� �Zedd� �ZdS ) � FirewallClientIcmpTypeSettingsNc C s |r || _ ndddg g| _ d S r# rc r^ r r r rE s z'FirewallClientIcmpTypeSettings.__init__c C s d| j | jf S rF rG rI r r r rJ # s z'FirewallClientIcmpTypeSettings.__repr__c C s | j d S rb rc rI r r r rd ' s z)FirewallClientIcmpTypeSettings.getVersionc C s || j d< d S rb rc re r r r rf * s z)FirewallClientIcmpTypeSettings.setVersionc C s | j d S rg rc rI r r r ri . s z'FirewallClientIcmpTypeSettings.getShortc C s || j d< d S rg rc rj r r r rk 1 s z'FirewallClientIcmpTypeSettings.setShortc C s | j d S rl rc rI r r r rn 5 s z-FirewallClientIcmpTypeSettings.getDescriptionc C s || j d< d S rl rc ro r r r rp 8 s z-FirewallClientIcmpTypeSettings.setDescriptionc C s | j d S rW rc rI r r r rd < s z.FirewallClientIcmpTypeSettings.getDestinationsc C s || j d< d S rW rc re r r r rf ? s z.FirewallClientIcmpTypeSettings.setDestinationsc C sH | j d sttj|��n,|| j d vr8| j d �|� n ttj|��d S rW )r9 r r r} r| r� r r r �addDestinationB s z-FirewallClientIcmpTypeSettings.addDestinationc C s\ || j d v r | j d �|� n8| j d sL| �ttddg�t|g� �� n ttj|��d S )NrX Zipv4Zipv6)r9 r� rf r= �setr r r� r� r r r rk K s � z0FirewallClientIcmpTypeSettings.removeDestinationc C s | j d p|| j d v S rW rc r� r r r rl V s �z/FirewallClientIcmpTypeSettings.queryDestination)N)r� r� r� r# rE rJ rd rf ri rk rn rp rd rf r� rk rl r r r r r� s4 r� c @ s� e Zd Zedd� �Zedd� �Zedd� �Zedd� �Zed d � �Zed d � �Z ed d� �Z edd� �Z edd� �Z edd� �Z edd� �Zedd� �Zedd� �Zedd � �Zed d � �Zed d � �Zed!d"� �Zed#d$� �Zed%d&� �Zed'd(� �Zd)S )*� FirewallClientConfigIcmpTypec C sL || _ || _| j �tjj|�| _tj| jtjjd�| _ tj| jdd�| _ d S r� ) r r r r r r r r � DBUS_INTERFACE_CONFIG_ICMPTYPE� fw_icmptyper r r r r rE _ s ��z%FirewallClientConfigIcmpType.__init__c C s t | j�tjj|��S rQ )r r r r r r� r r r r r j s �z)FirewallClientConfigIcmpType.get_propertyc C s t | j�tjj��S rQ )r r r r r r� rI r r r r o s �z+FirewallClientConfigIcmpType.get_propertiesc C s | j �tjj||� d S rQ )r r r r r� r r r r r t s �z)FirewallClientConfigIcmpType.set_propertyc C s t tt| j�� ���S rQ )r� r= r r� r rI r r r r y s �z(FirewallClientConfigIcmpType.getSettingsc C s | j �t|j�� d S rQ )r� r r� r9 r^ r r r r ~ s z#FirewallClientConfigIcmpType.updatec C s | j �� d S rQ )r� r rI r r r r � s z)FirewallClientConfigIcmpType.loadDefaultsc C s | j �� d S rQ )r� r� rI r r r r� � s z#FirewallClientConfigIcmpType.removec C s | j �|� d S rQ )r� r r r r r r � s z#FirewallClientConfigIcmpType.renamec C s | j �� S rQ )r� rd rI r r r rd � s z'FirewallClientConfigIcmpType.getVersionc C s | j �|� d S rQ )r� rf re r r r rf � s z'FirewallClientConfigIcmpType.setVersionc C s | j �� S rQ )r� ri rI r r r ri � s z%FirewallClientConfigIcmpType.getShortc C s | j �|� d S rQ )r� rk rj r r r rk � s z%FirewallClientConfigIcmpType.setShortc C s | j �� S rQ )r� rn rI r r r rn � s z+FirewallClientConfigIcmpType.getDescriptionc C s | j �|� d S rQ )r� rp ro r r r rp � s z+FirewallClientConfigIcmpType.setDescriptionc C s | j �� S rQ )r� rd rI r r r rd � s z,FirewallClientConfigIcmpType.getDestinationsc C s | j �|� d S rQ )r� rf re r r r rf � s z,FirewallClientConfigIcmpType.setDestinationsc C s | j �|� d S rQ )r� r� r� r r r r� � s z+FirewallClientConfigIcmpType.addDestinationc C s | j �|� d S rQ )r� rk r� r r r rk � s z.FirewallClientConfigIcmpType.removeDestinationc C s | j �|�S rQ )r� rl r� r r r rl � s z-FirewallClientConfigIcmpType.queryDestinationN)r� r� r� r# rE r r r r r r r� r rd rf ri rk rn rp rd rf r� rk rl r r r r r� ^ sP r� c @ s e Zd Zed.dd��Zedd� �Zedd� �Zedd � �Zed d � �Zed d � �Z edd� �Z edd� �Z edd� �Z edd� �Z edd� �Zedd� �Zedd� �Zed d � �Zed d � �Zed d!� �Zed"d#� �Zed$d%� �Zed&d'� �Zed(d)� �Zed*d+� �Zed,d-� �ZdS )/�'FirewallClientPoliciesLockdownWhitelistNc C s |r || _ ng g g g g| _ d S rQ rc r^ r r r rE � s z0FirewallClientPoliciesLockdownWhitelist.__init__c C s d| j | jf S rF rG rI r r r rJ � s z0FirewallClientPoliciesLockdownWhitelist.__repr__c C s | j d S rb rc rI r r r � getCommands� s z3FirewallClientPoliciesLockdownWhitelist.getCommandsc C s || j d< d S rb rc )rB Zcommandsr r r � setCommands� s z3FirewallClientPoliciesLockdownWhitelist.setCommandsc C s" || j d vr | j d �|� d S rb �r9 r| �rB Zcommandr r r � addCommand� s z2FirewallClientPoliciesLockdownWhitelist.addCommandc C s" || j d v r | j d �|� d S rb �r9 r� r� r r r � removeCommand� s z5FirewallClientPoliciesLockdownWhitelist.removeCommandc C s || j d v S rb rc r� r r r � queryCommand� s z4FirewallClientPoliciesLockdownWhitelist.queryCommandc C s | j d S rg rc rI r r r � getContexts� s z3FirewallClientPoliciesLockdownWhitelist.getContextsc C s || j d< d S rg rc )rB Zcontextsr r r � setContexts� s z3FirewallClientPoliciesLockdownWhitelist.setContextsc C s" || j d vr | j d �|� d S rg r� �rB �contextr r r � addContext� s z2FirewallClientPoliciesLockdownWhitelist.addContextc C s" || j d v r | j d �|� d S rg r� r� r r r � removeContext� s z5FirewallClientPoliciesLockdownWhitelist.removeContextc C s || j d v S rg rc r� r r r � queryContext� s z4FirewallClientPoliciesLockdownWhitelist.queryContextc C s | j d S rl rc rI r r r �getUsers� s z0FirewallClientPoliciesLockdownWhitelist.getUsersc C s || j d< d S rl rc )rB Zusersr r r �setUsers� s z0FirewallClientPoliciesLockdownWhitelist.setUsersc C s" || j d vr | j d �|� d S rl r� �rB �userr r r �addUser� s z/FirewallClientPoliciesLockdownWhitelist.addUserc C s" || j d v r | j d �|� d S rl r� r� r r r � removeUser� s z2FirewallClientPoliciesLockdownWhitelist.removeUserc C s || j d v S rl rc r� r r r � queryUser s z1FirewallClientPoliciesLockdownWhitelist.queryUserc C s | j d S rW rc rI r r r �getUids s z/FirewallClientPoliciesLockdownWhitelist.getUidsc C s || j d< d S rW rc �rB Zuidsr r r �setUids s z/FirewallClientPoliciesLockdownWhitelist.setUidsc C s" || j d vr | j d �|� d S rW r� �rB �uidr r r �addUid s z.FirewallClientPoliciesLockdownWhitelist.addUidc C s" || j d v r | j d �|� d S rW r� r� r r r � removeUid s z1FirewallClientPoliciesLockdownWhitelist.removeUidc C s || j d v S rW rc r� r r r �queryUid s z0FirewallClientPoliciesLockdownWhitelist.queryUid)N)r� r� r� r# rE rJ r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r r r r r� � sX r� c @ s� e Zd Zedd� �Zedd� �Zedd� �Zedd� �Zed d � �Zed d � �Z ed d� �Z edd� �Z edd� �Z edd� �Z edd� �Zedd� �Zedd� �Zedd � �Zed d � �Zed d � �Zed!d"� �Zed#d$� �Zed%d&� �Zed'd(� �Zd)S )*� FirewallClientConfigPoliciesc C s8 || _ | j �tjjtjj�| _tj| jtjjd�| _ d S �Nr ) r r r r r �DBUS_PATH_CONFIGr r � DBUS_INTERFACE_CONFIG_POLICIES� fw_policies�rB r r r r rE s ��z%FirewallClientConfigPolicies.__init__c C s t tt| j�� ���S rQ )r� r= r r� �getLockdownWhitelistrI r r r r� % s �z1FirewallClientConfigPolicies.getLockdownWhitelistc C s | j �t|j�� d S rQ )r� �setLockdownWhitelistr� r9 r^ r r r r� * s z1FirewallClientConfigPolicies.setLockdownWhitelistc C s | j �|� d S rQ �r� �addLockdownWhitelistCommandr� r r r r� 0 s z8FirewallClientConfigPolicies.addLockdownWhitelistCommandc C s | j �|� d S rQ �r� � removeLockdownWhitelistCommandr� r r r r� 4 s z;FirewallClientConfigPolicies.removeLockdownWhitelistCommandc C s t | j�|��S rQ �r r� � queryLockdownWhitelistCommandr� r r r r� 8 s z:FirewallClientConfigPolicies.queryLockdownWhitelistCommandc C s t | j�� �S rQ �r r� � getLockdownWhitelistCommandsrI r r r r� < s z9FirewallClientConfigPolicies.getLockdownWhitelistCommandsc C s | j �|� d S rQ �r� �addLockdownWhitelistContextr� r r r r� B s z8FirewallClientConfigPolicies.addLockdownWhitelistContextc C s | j �|� d S rQ �r� � removeLockdownWhitelistContextr� r r r r� F s z;FirewallClientConfigPolicies.removeLockdownWhitelistContextc C s t | j�|��S rQ �r r� � queryLockdownWhitelistContextr� r r r r� J s z:FirewallClientConfigPolicies.queryLockdownWhitelistContextc C s t | j�� �S rQ �r r� � getLockdownWhitelistContextsrI r r r r� N s z9FirewallClientConfigPolicies.getLockdownWhitelistContextsc C s | j �|� d S rQ �r� �addLockdownWhitelistUserr� r r r r� T s z5FirewallClientConfigPolicies.addLockdownWhitelistUserc C s | j �|� d S rQ �r� �removeLockdownWhitelistUserr� r r r r� X s z8FirewallClientConfigPolicies.removeLockdownWhitelistUserc C s t | j�|��S rQ �r r� �queryLockdownWhitelistUserr� r r r r� \ s z7FirewallClientConfigPolicies.queryLockdownWhitelistUserc C s t | j�� �S rQ �r r� �getLockdownWhitelistUsersrI r r r r� ` s z6FirewallClientConfigPolicies.getLockdownWhitelistUsersc C s t | j�� �S rQ �r r� �getLockdownWhitelistUidsrI r r r r� f s z5FirewallClientConfigPolicies.getLockdownWhitelistUidsc C s | j �|� d S rQ )r� �setLockdownWhitelistUidsr� r r r r� j s z5FirewallClientConfigPolicies.setLockdownWhitelistUidsc C s | j �|� d S rQ �r� �addLockdownWhitelistUidr� r r r r� n s z4FirewallClientConfigPolicies.addLockdownWhitelistUidc C s | j �|� d S rQ �r� �removeLockdownWhitelistUidr� r r r r� r s z7FirewallClientConfigPolicies.removeLockdownWhitelistUidc C s t | j�|��S rQ �r r� �queryLockdownWhitelistUidr� r r r r� v s z6FirewallClientConfigPolicies.queryLockdownWhitelistUidN)r� r� r� r# rE r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r r r r r� sP r� c @ s e Zd Zed.dd��Zedd� �Zedd� �Zedd � �Zed d � �Zed d � �Z edd� �Z edd� �Z edd� �Z edd� �Z edd� �Zedd� �Zedd� �Zed d � �Zed d � �Zed d!� �Zed"d#� �Zed$d%� �Zed&d'� �Zed(d)� �Zed*d+� �Zed,d-� �ZdS )/�FirewallClientDirectNc C s |r || _ n g g g g| _ d S rQ rc r^ r r r rE } s z FirewallClientDirect.__init__c C s d| j | jf S rF rG rI r r r rJ � s z FirewallClientDirect.__repr__c C s | j d S rb rc rI r r r � getAllChains� s z!FirewallClientDirect.getAllChainsc s � �fdd�| j d D �S )Nc s, g | ]$}|d � kr|d �kr|d �qS )r rh rm r �r� r� �r� �tabler r r� � s �z2FirewallClientDirect.getChains.<locals>.<listcomp>r rc �rB r� r� r r� r � getChains� s z FirewallClientDirect.getChainsc C s || j d< d S rb rc )rB Zchainsr r r � setAllChains� s z!FirewallClientDirect.setAllChainsc C s, |||f}|| j d vr(| j d �|� d S rb r� �rB r� r� �chain�idxr r r �addChain� s z FirewallClientDirect.addChainc C s, |||f}|| j d v r(| j d �|� d S rb r� r r r r � removeChain� s z FirewallClientDirect.removeChainc C s |||f}|| j d v S rb rc r r r r � queryChain� s z FirewallClientDirect.queryChainc C s | j d S rg rc rI r r r � getAllRules� s z FirewallClientDirect.getAllRulesc s � ��fdd�| j d D �S )Nc s< g | ]4}|d �kr|d �kr|d � kr|dd� �qS )r rh rm rX Nr r� �r r� r� r r r� � s �z1FirewallClientDirect.getRules.<locals>.<listcomp>rh rc �rB r� r� r r r r �getRules� s z FirewallClientDirect.getRulesc C s || j d< d S rg rc r� r r r � setAllRules� s z FirewallClientDirect.setAllRulesc C s0 |||||f}|| j d vr,| j d �|� d S rg r� �rB r� r� r r* r r r r r �addRule� s z FirewallClientDirect.addRulec C s0 |||||f}|| j d v r,| j d �|� d S rg r� r r r r � removeRule� s z FirewallClientDirect.removeRulec C sL t | jd �D ]8}|d |kr|d |kr|d |kr| jd �|� qd S )Nrh r rm )r= r9 r� r r r r � removeRules� s $z FirewallClientDirect.removeRulesc C s |||||f}|| j d v S rg rc r r r r � queryRule� s z FirewallClientDirect.queryRulec C s | j d S rl rc rI r r r �getAllPassthroughs� s z'FirewallClientDirect.getAllPassthroughsc C s || j d< d S rl rc )rB Z passthroughsr r r �setAllPassthroughs� s z'FirewallClientDirect.setAllPassthroughsc C s g | j d< d S rl rc rI r r r �removeAllPassthroughs� s z*FirewallClientDirect.removeAllPassthroughsc s � fdd�| j d D �S )Nc s g | ]}|d � kr|d �qS )r rh r r� �r� r r r� � s �z8FirewallClientDirect.getPassthroughs.<locals>.<listcomp>rm rc r� r r r �getPassthroughs� s z$FirewallClientDirect.getPassthroughsc C s* ||f}|| j d vr&| j d �|� d S rl r� �rB r� r r r r r �addPassthrough� s z#FirewallClientDirect.addPassthroughc C s* ||f}|| j d v r&| j d �|� d S rl r� r r r r �removePassthrough� s z&FirewallClientDirect.removePassthroughc C s ||f}|| j d v S rl rc r r r r �queryPassthrough� s z%FirewallClientDirect.queryPassthrough)N)r� r� r� r# rE rJ r� r� r� r r r r r r r r r r r r r r r r r r r r r r� | sX r� c @ s� e Zd Zedd� �Zedd� �Zedd� �Zedd� �Zed d � �Zed d � �Z ed d� �Z edd� �Z edd� �Z edd� �Z edd� �Zedd� �Zedd� �Zedd � �Zed d � �Zed d � �Zed!d"� �Zed#d$� �Zed%d&� �Zd'S )(�FirewallClientConfigDirectc C s8 || _ | j �tjjtjj�| _tj| jtjjd�| _ d S r� ) r r r r r r� r r � DBUS_INTERFACE_CONFIG_DIRECT� fw_directr� r r r rE � s ��z#FirewallClientConfigDirect.__init__c C s t tt| j�� ���S rQ )r� r= r r r rI r r r r � s �z&FirewallClientConfigDirect.getSettingsc C s | j �t|j�� d S rQ )r r r� r9 r^ r r r r � s z!FirewallClientConfigDirect.updatec C s | j �|||� d S rQ �r r r r r r r � s z#FirewallClientConfigDirect.addChainc C s | j �|||� d S rQ �r r r r r r r � s z&FirewallClientConfigDirect.removeChainc C s t | j�|||��S rQ �r r r r r r r r � s z%FirewallClientConfigDirect.queryChainc C s t | j�||��S rQ �r r r� r� r r r r� � s z$FirewallClientConfigDirect.getChainsc C s t | j�� �S rQ �r r r� rI r r r r� s z'FirewallClientConfigDirect.getAllChainsc C s | j �|||||� d S rQ �r r �rB r� r� r r* r r r r r s z"FirewallClientConfigDirect.addRulec C s | j �|||||� d S rQ �r r r" r r r r s z%FirewallClientConfigDirect.removeRulec C s | j �|||� d S rQ �r r r r r r r s z&FirewallClientConfigDirect.removeRulesc C s t | j�|||||��S rQ �r r r r" r r r r s z$FirewallClientConfigDirect.queryRulec C s t | j�|||��S rQ �r r r r r r r r s z#FirewallClientConfigDirect.getRulesc C s t | j�� �S rQ �r r r rI r r r r s z&FirewallClientConfigDirect.getAllRulesc C s | j �||� d S rQ �r r �rB r� r r r r r # s z)FirewallClientConfigDirect.addPassthroughc C s | j �||� d S rQ �r r r) r r r r ' s z,FirewallClientConfigDirect.removePassthroughc C s t | j�||��S rQ �r r r r) r r r r + s z+FirewallClientConfigDirect.queryPassthroughc C s t | j�|��S rQ �r r r r� r r r r / s z*FirewallClientConfigDirect.getPassthroughsc C s t | j�� �S rQ �r r r rI r r r r 3 s z-FirewallClientConfigDirect.getAllPassthroughsN)r� r� r� r# rE r r r r r r� r� r r r r r r r r r r r r r r r r � sL r c @ s� e Zd Zedd� �Zedd� �Zedd� �Zedd� �Zed d � �Zed d � �Z ed d� �Z edd� �Z edd� �Z edd� �Z edd� �Zedd� �Zedd� �Zedd � �Zed d � �Zed d � �Zed!d"� �Zed#d$� �Zed%d&� �Zed'd(� �Zed)d*� �Zed+d,� �Zed-d.� �Zed/d0� �Zed1d2� �Z ed3d4� �Z ed5d6� �Z ed7d8� �Z ed9d:� �Z ed;d<� �Z!ed=d>� �Z"ed?d@� �Z#edAdB� �Z$edCdD� �Z%edEdF� �Z&edGdH� �Z'edIdJ� �Z(edKdL� �Z)dMS )N�FirewallClientConfigc C sb || _ | j �tjjtjj�| _tj| jtjjd�| _ tj| jdd�| _ t | j �| _ t | j �| _d S r� )r r r r r r� r r �DBUS_INTERFACE_CONFIG� fw_configr r� � _policiesr �_directr� r r r rE : s ��� z FirewallClientConfig.__init__c C s t | j�tjj|��S rQ )r r r r r r/ r r r r r I s �z!FirewallClientConfig.get_propertyc C s t | j�tjj��S rQ )r r r r r r/ rI r r r r N s �z#FirewallClientConfig.get_propertiesc C s | j �tjj||� d S rQ )r r r r r/ r r r r r S s z!FirewallClientConfig.set_propertyc C s t | j�� �S rQ )r r0 � getIPSetNamesrI r r r r3 Y s z"FirewallClientConfig.getIPSetNamesc C s t | j�� �S rQ )r r0 � listIPSetsrI r r r r4 ] s z FirewallClientConfig.listIPSetsc C s t | j|�S rQ )r� r �rB r r r r �getIPSeta s z FirewallClientConfig.getIPSetc C s t | j�|��}t| j|�S rQ )r r0 �getIPSetByNamer� r �rB r r r r r r7 e s z#FirewallClientConfig.getIPSetByNamec C s> t |t�r | j�|t|j��}n| j�|t|��}t| j|�S rQ )r< r{ r0 �addIPSetr� r9 r� r �rB r r9 r r r r r9 j s z FirewallClientConfig.addIPSetc C s t | j�� �S rQ )r r0 � getZoneNamesrI r r r r; t s z!FirewallClientConfig.getZoneNamesc C s t | j�� �S rQ )r r0 � listZonesrI r r r r< x s z FirewallClientConfig.listZonesc C s t | j|�S rQ )r� r r5 r r r �getZone| s z FirewallClientConfig.getZonec C s t | j�|��}t| j|�S rQ )r r0 � getZoneByNamer� r r8 r r r r> � s z"FirewallClientConfig.getZoneByNamec C s t | j�|��S rQ )r r0 �getZoneOfInterface)rB Zifacer r r r? � s z'FirewallClientConfig.getZoneOfInterfacec C s t | j�|��S rQ )r r0 �getZoneOfSourcer� r r r r@ � s z$FirewallClientConfig.getZoneOfSourcec C s^ t |t�r | j�||�� �}n4t |t�r8| j�||�}n| j�|t|d d� ��}t| j |�S r� ) r< r$ r0 ZaddZone2r\ r? �addZoner� r� r r: r r r rA � s z FirewallClientConfig.addZonec C s t | j�� �S rQ )r r0 �getPolicyNamesrI r r r rB � s z#FirewallClientConfig.getPolicyNamesc C s t | j�� �S rQ )r r0 � listPoliciesrI r r r rC � s z!FirewallClientConfig.listPoliciesc C s t | j|�S rQ )rN r r5 r r r � getPolicy� s z FirewallClientConfig.getPolicyc C s t | j�|��}t| j|�S rQ )r r0 �getPolicyByNamerN r r8 r r r rE � s z$FirewallClientConfig.getPolicyByNamec C s8 t |t�r | j�||�� �}n| j�||�}t| j|�S rQ )r< r' r0 � addPolicyr\ rN r r: r r r rF � s z FirewallClientConfig.addPolicyc C s t | j�� �S rQ )r r0 �getServiceNamesrI r r r rG � s z$FirewallClientConfig.getServiceNamesc C s t | j�� �S rQ )r r0 � listServicesrI r r r rH � s z!FirewallClientConfig.listServicesc C s t | j|�S rQ )r� r r5 r r r � getService� s z FirewallClientConfig.getServicec C s t | j�|��}t| j|�S rQ )r r0 �getServiceByNamer� r r8 r r r rJ � s z%FirewallClientConfig.getServiceByNamec C s` t |t�r | j�||�� �}n6t|�tu r:| j�||�}n| j�|t|d d� ��}t | j |�S r� ) r< rQ r0 Z addService2r\ rW r? r� r� r� r r: r r r r� � s z FirewallClientConfig.addServicec C s t | j�� �S rQ )r r0 �getIcmpTypeNamesrI r r r rK � s z%FirewallClientConfig.getIcmpTypeNamesc C s t | j�� �S rQ )r r0 � listIcmpTypesrI r r r rL � s z"FirewallClientConfig.listIcmpTypesc C s t | j|�S rQ )r� r r5 r r r � getIcmpType� s z FirewallClientConfig.getIcmpTypec C s t | j�|��}t| j|�S rQ )r r0 �getIcmpTypeByNamer� r r8 r r r rN � s z&FirewallClientConfig.getIcmpTypeByNamec C s> t |t�r | j�|t|j��}n| j�|t|��}t| j|�S rQ )r< r� r0 � addIcmpTyper� r9 r� r r: r r r rO � s z FirewallClientConfig.addIcmpTypec C s | j S rQ )r1 rI r r r �policies� s z FirewallClientConfig.policiesc C s | j S rQ )r2 rI r r r �direct� s zFirewallClientConfig.directc C s t | j�� �S rQ )r r0 �getHelperNamesrI r r r rR � s z#FirewallClientConfig.getHelperNamesc C s t | j�� �S rQ )r r0 � listHelpersrI r r r rS � s z FirewallClientConfig.listHelpersc C s t | j|�S rQ )r� r r5 r r r � getHelper s z FirewallClientConfig.getHelperc C s t | j�|��}t| j|�S rQ )r r0 �getHelperByNamer� r r8 r r r rU s z$FirewallClientConfig.getHelperByNamec C s> t |t�r | j�|t|j��}n| j�|t|��}t| j|�S rQ )r< r� r0 rx r� r9 r� r r: r r r rx s z FirewallClientConfig.addHelperN)*r� r� r� r# rE r r r r3 r4 r6 r7 r9 r; r< r= r> r? r@ rA rB rC rD rE rF rG rH rI rJ r� rK rL rM rN rO rP rQ rR rS rT rU rx r r r r r. 9 s� r. c @ s� e Zd Ze�d dd��Zedd� �Zedd � �Zed d � �Zed d � �Zedd� �Z edd� �Z edd� �Z edd� �Z edd� �Z edd� �Zedd� �Zed d � �Zed d � �Zed d!� �Zed"d#� �Zed$d%� �Zed&d'� �Zed(d)� �Zed*d+� �Zed,d-� �Zed.d/� �Zed0d1� �Zed2d3� �Zed4d5� �Z ed6d7� �Z ed8d9� �Z ed:d;� �Z ed<d=� �Z ed>d?� �Z!ed@dA� �Z"edBdC� �Z#edDdE� �Z$edFdG� �Z%edHdI� �Z&edJdK� �Z'edLdM� �Z(edNdO� �Z)edPdQ� �Z*edRdS� �Z+edTdU� �Z,edVdW� �Z-edXdY� �Z.edZd[� �Z/ed\d]� �Z0ed^d_� �Z1ed`da� �Z2edbdc� �Z3eddde� �Z4edfdg� �Z5edhdi� �Z6edjdk� �Z7edldm� �Z8edndo� �Z9edpdq� �Z:edrds� �Z;edtdu� �Z<edvdw� �Z=edxdy� �Z>edzd{� �Z?ed|d}� �Z@ed~d� �ZAed�d�� �ZBed�d�� �ZCed�d�� �ZDe�d d�d���ZEed�d�� �ZFed�d�� �ZGed�d�� �ZHe�d d�d���ZIed�d�� �ZJed�d�� �ZKed�d�� �ZLe�d d�d���ZMed�d�� �ZNed�d�� �ZOed�d�� �ZPe�d d�d���ZQed�d�� �ZRed�d�� �ZSed�d�� �ZTed�d�� �ZUed�d�� �ZVed�d�� �ZWe�d!d�d���ZXed�d�� �ZYed�d�� �ZZe�d"d�d���Z[ed�d�� �Z\ed�d�� �Z]ed�d�� �Z^e�d#d�d���Z_ed�d�� �Z`ed�d�� �Zaed�d�� �Zbe�d$d�dÄ�Zced�dń �Zded�dDŽ �Zeed�dɄ �Zfed�d˄ �Zged�d̈́ �Zhed�dτ �Zied�dф �Zjed�dӄ �Zked�dՄ �Zled�dׄ �Zmed�dل �Zned�dۄ �Zoed�d݄ �Zped�d߄ �Zqed�d� �Zred�d� �Zsed�d� �Zted�d� �Zued�d� �Zved�d� �Zwed�d� �Zxed�d� �Zyed�d� �Zzed�d� �Z{ed�d�� �Z|ed�d�� �Z}ed�d�� �Z~ed�d�� �Zed�d�� �Z�ed�d�� �Z�e�d �d� �Z�e�d�d� �Z�e�d�d� �Z�e�d�d� �Z�e�d�d � �Z�e�d �d � �Z�e�d �d � �Z�e�d�d� �Z�e�d�d� �Z�e�d�d� �Z�e�d�d� �Z�e�d�d� �Z�e�d�d� �Z�e�d�d� �Z�dS (% �FirewallClientNr Tc P C s� |s^t jjjdd� zt �� | _W qd t jjyZ } z tt j |� � ��W Y d }~qdd }~0 0 n|| _| jj | j ddtj jd� tj jtj jtj jtj jtj jtj jtj jtj jtj jtj jtj jtj jtj jtj j tj j fD ] }| jj | j |dddd � q�i | _ d d d d ddddddddddddddd d d d d d!d"d#d$d%d&d&d'd(d)d*d+d,d-d.d/d0d1d2d3d4d5d6d7d8d9d:d;d<d=d>d?d@dAdBdCdDdEdFdGdHdIdJdKdLdMdNdOdPdQdRdSdTdUdVdWdX�O| _ | �!� || _"|dYk�r�t#�$|| j%� n| �%� d S )ZNT)Zset_as_defaultZNameOwnerChangedzorg.freedesktop.DBus)Zhandler_functionZ signal_namer Zarg0r� �memberr )r Zinterface_keywordZmember_keywordZ path_keyword�connection-changed�connection-established�connection-lostZLogDeniedChangedZDefaultZoneChangedZPanicModeEnabledZPanicModeDisabledZReloadedZ ServiceAddedZServiceRemovedZ PortAddedZ PortRemovedZSourcePortAddedZSourcePortRemovedZ ProtocolAddedZProtocolRemovedZMasqueradeAddedZMasqueradeRemovedZForwardPortAddedZForwardPortRemovedZIcmpBlockAddedZIcmpBlockRemovedZIcmpBlockInversionAddedZIcmpBlockInversionRemovedZ RichRuleAddedZRichRuleRemovedZInterfaceAddedZInterfaceRemovedZZoneOfInterfaceChangedZ SourceAddedZ SourceRemovedZZoneOfSourceChangedZ ZoneUpdatedZ PolicyUpdatedZ EntryAddedZ EntryRemovedZ ChainAddedZ ChainRemovedZ RuleAddedZ RuleRemovedZPassthroughAddedZPassthroughRemovedzconfig:direct:UpdatedZLockdownEnabledZLockdownDisabledZ LockdownWhitelistCommandAddedZ LockdownWhitelistCommandRemovedZ LockdownWhitelistContextAddedZ LockdownWhitelistContextRemovedZLockdownWhitelistUidAddedZLockdownWhitelistUidRemovedZLockdownWhitelistUserAddedZ LockdownWhitelistUserRemovedz(config:policies:LockdownWhitelistUpdatedzconfig:IPSetAddedzconfig:IPSetUpdatedzconfig:IPSetRemovedzconfig:IPSetRenamedzconfig:ZoneAddedzconfig:ZoneUpdatedzconfig:ZoneRemovedzconfig:ZoneRenamedzconfig:PolicyAddedzconfig:PolicyUpdatedzconfig:PolicyRemovedzconfig:PolicyRenamedzconfig:ServiceAddedzconfig:ServiceUpdatedzconfig:ServiceRemovedzconfig:ServiceRenamedzconfig:IcmpTypeAddedzconfig:IcmpTypeUpdatedzconfig:IcmpTypeRemovedzconfig:IcmpTypeRenamedzconfig:HelperAddedzconfig:HelperUpdatedzconfig:HelperRemovedzconfig:HelperRenamed)OrX rY rZ zlog-denied-changedzdefault-zone-changedzpanic-mode-enabledzpanic-mode-disabledZreloadedz service-addedzservice-removedz port-addedz port-removedzsource-port-addedzsource-port-removedzprotocol-addedzprotocol-removedzmasquerade-addedzmasquerade-removedzforward-port-addedzforward-port-removedzicmp-block-addedzicmp-block-removedzicmp-block-inversion-addedz icmp-block-inversion-removedzrichrule-addedzrichrule-removedzinterface-addedzinterface-removedz zone-changedzzone-of-interface-changedz source-addedzsource-removedzzone-of-source-changedz zone-updatedzpolicy-updatedzipset-entry-addedzipset-entry-removedzdirect:chain-addedzdirect:chain-removedzdirect:rule-addedzdirect:rule-removedzdirect:passthrough-addedzdirect:passthrough-removedzconfig:direct:updatedzlockdown-enabledzlockdown-disabledz lockdown-whitelist-command-addedz"lockdown-whitelist-command-removedz lockdown-whitelist-context-addedz"lockdown-whitelist-context-removedz lockdown-whitelist-uid-addedz lockdown-whitelist-uid-removedz lockdown-whitelist-user-addedz lockdown-whitelist-user-removedz*config:policies:lockdown-whitelist-updatedzconfig:ipset-addedzconfig:ipset-updatedzconfig:ipset-removedzconfig:ipset-renamedzconfig:zone-addedzconfig:zone-updatedzconfig:zone-removedzconfig:zone-renamedzconfig:policy-addedzconfig:policy-updatedzconfig:policy-removedzconfig:policy-renamedzconfig:service-addedzconfig:service-updatedzconfig:service-removedzconfig:service-renamedzconfig:icmptype-addedzconfig:icmptype-updatedzconfig:icmptype-removedzconfig:icmptype-renamedzconfig:helper-addedzconfig:helper-updatedzconfig:helper-removedzconfig:helper-renamedr )&r ZmainloopZglibZ DBusGMainLoopZ SystemBusr r r r r Z DBUS_ERRORr Zadd_signal_receiver�_dbus_connection_changedr r �DBUS_INTERFACE_IPSET�DBUS_INTERFACE_ZONE�DBUS_INTERFACE_POLICY�DBUS_INTERFACE_DIRECT�DBUS_INTERFACE_POLICIESr/ r� r rO r� r� r r� r� �_signal_receiver� _callback� _callbacks� _init_vars�quietr Ztimeout_add_seconds�_connection_established)rB r �waitre r r� r r r rE s� � �� ��Y zFirewallClient.__init__c C s: d | _ d | _d | _d | _d | _d | _d | _d | _d| _d S )NF) �fwr� r rP r� r r �_config� connectedrI r r r rd � s zFirewallClient._init_varsc C s t S rQ �r rI r r r �getExceptionHandler� s z"FirewallClient.getExceptionHandlerc C s |a d S rQ rk )rB Zhandlerr r r �setExceptionHandler� s z"FirewallClient.setExceptionHandlerc C s t S rQ �r rI r r r �getNotAuthorizedLoop� s z#FirewallClient.getNotAuthorizedLoopc C s |a d S rQ rn )rB �enabler r r �setNotAuthorizedLoop� s z#FirewallClient.setNotAuthorizedLoopc G s0 || j v r ||f| j| j | < n td| ��d S )NzUnknown callback name '%s')rc rb � ValueError)rB r �callbackr r r r �connect� s zFirewallClient.connectc C s* |t jjkrd S |r | �� n| �� d S rQ )r r r rf �_connection_lost)rB r Z old_ownerZ new_ownerr r r r[ � s z'FirewallClient._dbus_connection_changedc C sd z�| j �tjjtjj�| _tj| jtjjd�| _tj| jtjj d�| _ tj| jtjj d�| _ tj| jtjj d�| _tj| jtjjd�| _tj| jtjjd�| _tj| jdd�| _W nv tjjy� } z"| js�td|�� � W Y d }~d S d }~0 t�y( } z | j�std|� W Y d }~d S d }~0 0 t| j �| _d| _ | j dtjjd� | j dtjjd� d S ) Nr r r r TrY �rW r� rX ) r r r r r Z DBUS_PATHr r rh r\ r� r] r r^ rP r_ r r` r� r r r re �printr r r. ri rj ra )rB r r r r rf � sX �� ��� ��� ��z&FirewallClient._connection_establishedc C s0 | � � | jdtjjd� | jdtjjd� d S )NrZ rv rX )rd ra r r r rI r r r ru � s ��z FirewallClient._connection_lostc O s� d|vsd|vrd S |d }|d }|� tjj�r:d| }|� tjj�rRd| }n�|� tjj�rjd| }n�|� tjj�r�d| }np|� tjj�r�d| }nX|� tjj�r�d| }n@|tjj kr�d | }n*|tjj kr�d | }n|tjj kr�d | }d }| j D ]2}| j | |kr�| j | | j v r�| j | j | }q�|d u �r>d S d d � |D �}z(|d �rf|�|d � |d |� W n. t�y� } zt|� W Y d }~n d }~0 0 d S )NrW r� z config:Zonez config:Policyz config:IPSetzconfig:Servicezconfig:IcmpTypez config:Helperzconfig:zconfig:policies:zconfig:direct:c S s g | ] }t |��qS r r )r� �argr r r r� % r� z3FirewallClient._signal_receiver.<locals>.<listcomp>rh r )� startswithr r r rO r� r� r� r� r/ r� r rc rb �extendr rw ) rB r r �signalr� �cbrs Zcb_args�msgr r r ra � sJ � z FirewallClient._signal_receiverc C s | j S rQ )ri rI r r r r / s zFirewallClient.configc C s | j �� d S rQ )rh �reloadrI r r r r~ 3 s zFirewallClient.reloadc C s | j �� d S rQ )rh �resetToDefaultsrI r r r r 7 s z FirewallClient.resetToDefaultsc C s | j �� d S rQ )rh ZcompleteReloadrI r r r �complete_reload; s z FirewallClient.complete_reloadc C s | j �� d S rQ )rh �runtimeToPermanentrI r r r r� ? s z!FirewallClient.runtimeToPermanentc C s | j �� d S rQ )rh �checkPermanentConfigrI r r r r� C s z#FirewallClient.checkPermanentConfigc C s t | j�tjj|��S rQ )r r r r r r r r r r r G s �zFirewallClient.get_propertyc C s t | j�tjj��S rQ )r r r r r r rI r r r r L s �z FirewallClient.get_propertiesc C s | j �tjj||� d S rQ )r r r r r r r r r r Q s zFirewallClient.set_propertyc C s | j �� d S rQ )rh �enablePanicModerI r r r r� W s z FirewallClient.enablePanicModec C s | j �� d S rQ )rh �disablePanicModerI r r r r� [ s z FirewallClient.disablePanicModec C s t | j�� �S rQ )r rh �queryPanicModerI r r r r� _ s z FirewallClient.queryPanicModec C s t t| j�|���S rQ )r$ r r �getZoneSettings2�rB �zoner r r �getZoneSettingse s z FirewallClient.getZoneSettingsc C s t | j�� �S rQ )r r� � getIPSetsrI r r r r� i s zFirewallClient.getIPSetsc C s t tt| j�|����S rQ )r{ r= r r� �getIPSetSettings�rB �ipsetr r r r� m s �z FirewallClient.getIPSetSettingsc C s | j �||� d S rQ r� �rB r� r� r r r r� r s zFirewallClient.addEntryc C s | j �|�S rQ r� r� r r r r� v s zFirewallClient.getEntriesc C s | j �||�S rQ r� )rB r� r� r r r r� z s zFirewallClient.setEntriesc C s | j �||� d S rQ r� r� r r r r� ~ s zFirewallClient.removeEntryc C s t | j�||��S rQ )r r� r� r� r r r r� � s zFirewallClient.queryEntryc C s t | j�� �S rQ )r rh rH rI r r r rH � s zFirewallClient.listServicesc C s t t| j�|���S rQ )rQ r rh ZgetServiceSettings2r~ r r r �getServiceSettings� s �z!FirewallClient.getServiceSettingsc C s t | j�� �S rQ )r rh rL rI r r r rL � s z FirewallClient.listIcmpTypesc C s t tt| j�|����S rQ )r� r= r rh �getIcmpTypeSettingsr� r r r r� � s �z"FirewallClient.getIcmpTypeSettingsc C s t | j�� �S rQ )r rh rt rI r r r rt � s zFirewallClient.getHelpersc C s t tt| j�|����S rQ )r� r= r rh �getHelperSettingsrv r r r r� � s �z FirewallClient.getHelperSettingsc C s t | j�� �S rQ )r rh �getAutomaticHelpersrI r r r r� � s z"FirewallClient.getAutomaticHelpersc C s | j �|� d S rQ )rh �setAutomaticHelpers�rB rO r r r r� � s z"FirewallClient.setAutomaticHelpersc C s t | j�� �S rQ )r rh � getLogDeniedrI r r r r� � s zFirewallClient.getLogDeniedc C s | j �|� d S rQ )rh � setLogDeniedr� r r r r� � s zFirewallClient.setLogDeniedc C s t | j�� �S rQ )r rh �getDefaultZonerI r r r r� � s z FirewallClient.getDefaultZonec C s | j �|� d S rQ )rh �setDefaultZoner� r r r r� � s z FirewallClient.setDefaultZonec C s | j �||�� � d S rQ )r �setZoneSettings2ra )rB r� r9 r r r �setZoneSettings� s z FirewallClient.setZoneSettingsc C s t | j�� �S rQ )r r �getZonesrI r r r r� � s zFirewallClient.getZonesc C s t | j�� �S rQ )r r �getActiveZonesrI r r r r� � s z FirewallClient.getActiveZonesc C s t | j�|��S rQ )r r r? r� r r r r? � s z!FirewallClient.getZoneOfInterfacec C s t | j�|��S rQ )r r r@ r� r r r r@ � s z FirewallClient.getZoneOfSourcec C s t | j�|��S rQ )r r � isImmutabler� r r r r� � s zFirewallClient.isImmutablec C s t t| j�|���S rQ )r' r rP �getPolicySettings�rB �policyr r r r� � s z FirewallClient.getPolicySettingsc C s | j �||�� � d S rQ )rP �setPolicySettingsra )rB r� r9 r r r r� � s z FirewallClient.setPolicySettingsc C s t | j�� �S rQ )r rP � getPoliciesrI r r r r� � s zFirewallClient.getPoliciesc C s t | j�� �S rQ )r rP �getActivePoliciesrI r r r r� � s z FirewallClient.getActivePoliciesc C s t | j�|��S rQ )r rP r� r� r r r �isPolicyImmutable� s z FirewallClient.isPolicyImmutablec C s t | j�||��S rQ )r r r� �rB r� r� r r r r� � s zFirewallClient.addInterfacec C s t | j�||��S rQ )r r � changeZoner� r r r r� � s zFirewallClient.changeZonec C s t | j�||��S rQ )r r �changeZoneOfInterfacer� r r r r� � s �z$FirewallClient.changeZoneOfInterfacec C s t | j�|��S rQ )r r r� r� r r r r� � s z FirewallClient.getInterfacesc C s t | j�||��S rQ )r r r� r� r r r r� s z FirewallClient.queryInterfacec C s t | j�||��S rQ )r r r� r� r r r r� s z FirewallClient.removeInterfacec C s t | j�||��S rQ )r r r� �rB r� r� r r r r� s zFirewallClient.addSourcec C s t | j�||��S rQ )r r �changeZoneOfSourcer� r r r r� s z!FirewallClient.changeZoneOfSourcec C s t | j�|��S rQ )r r r� r� r r r r� s zFirewallClient.getSourcesc C s t | j�||��S rQ )r r r� r� r r r r� s zFirewallClient.querySourcec C s t | j�||��S rQ )r r r� r� r r r r� s zFirewallClient.removeSourcec C s t | j�|||��S rQ )r r r� )rB r� r� r� r r r r� " s zFirewallClient.addRichRulec C s t | j�|��S rQ )r r r� r� r r r r� & s zFirewallClient.getRichRulesc C s t | j�||��S rQ )r r r� �rB r� r� r r r r� * s z FirewallClient.queryRichRulec C s t | j�||��S rQ )r r r� r� r r r r� . s z FirewallClient.removeRichRulec C s t | j�|||��S rQ )r r r� )rB r� r r� r r r r� 4 s zFirewallClient.addServicec C s t | j�|��S rQ )r r rx r� r r r rx 8 s zFirewallClient.getServicesc C s t | j�||��S rQ )r r r� �rB r� r r r r r� < s zFirewallClient.queryServicec C s t | j�||��S rQ )r r r� r� r r r r� @ s z FirewallClient.removeServicec C s t | j�||||��S rQ )r r r� �rB r� r� r� r� r r r r� F s zFirewallClient.addPortc C s t | j�|��S rQ )r r r� r� r r r r� J s zFirewallClient.getPortsc C s t | j�|||��S rQ )r r r� �rB r� r� r� r r r r� N s zFirewallClient.queryPortc C s t | j�|||��S rQ )r r r� r� r r r r� R s zFirewallClient.removePortc C s t | j�|||��S rQ )r r r� )rB r� r� r� r r r r� X s zFirewallClient.addProtocolc C s t | j�|��S rQ )r r r� r� r r r r� \ s zFirewallClient.getProtocolsc C s t | j�||��S rQ )r r r� �rB r� r� r r r r� ` s z FirewallClient.queryProtocolc C s t | j�||��S rQ )r r r� r� r r r r� d s z FirewallClient.removeProtocolc C s | j �|ddi� d S r! �r r� r� r r r r� j s zFirewallClient.addForwardc C s t | j�|��d S r )r r r� r� r r r r� n s zFirewallClient.queryForwardc C s | j �|ddi� d S r" r� r� r r r r� r s z FirewallClient.removeForwardc C s t | j�||��S rQ )r r r� )rB r� r� r r r r� x s z FirewallClient.addMasqueradec C s t | j�|��S rQ )r r r� r� r r r r� | s z FirewallClient.queryMasqueradec C s t | j�|��S rQ )r r r� r� r r r r� � s z FirewallClient.removeMasqueradec C s2 |d u r d}|d u rd}t | j�||||||��S r# )r r r� )rB r� r� r� r% r& r� r r r r� � s �z FirewallClient.addForwardPortc C s t | j�|��S rQ )r r r� r� r r r r� � s z FirewallClient.getForwardPortsc C s0 |d u r d}|d u rd}t | j�|||||��S r# )r r r� �rB r� r� r� r% r& r r r r� � s �z FirewallClient.queryForwardPortc C s0 |d u r d}|d u rd}t | j�|||||��S r# )r r r� r� r r r r� � s �z FirewallClient.removeForwardPortc C s t | j�||||��S rQ )r r r� r� r r r r� � s �z FirewallClient.addSourcePortc C s t | j�|��S rQ )r r r� r� r r r r� � s z FirewallClient.getSourcePortsc C s t | j�|||��S rQ )r r r� r� r r r r� � s z FirewallClient.querySourcePortc C s t | j�|||��S rQ )r r r� r� r r r r� � s �z FirewallClient.removeSourcePortc C s t | j�|||��S rQ )r r r� )rB r� �icmpr� r r r r� � s zFirewallClient.addIcmpBlockc C s t | j�|��S rQ )r r r� r� r r r r� � s z FirewallClient.getIcmpBlocksc C s t | j�||��S rQ )r r r� �rB r� r� r r r r� � s z FirewallClient.queryIcmpBlockc C s t | j�||��S rQ )r r r� r� r r r r� � s z FirewallClient.removeIcmpBlockc C s t | j�|��S rQ )r r r� r� r r r r� � s z$FirewallClient.addIcmpBlockInversionc C s t | j�|��S rQ )r r r� r� r r r r� � s z&FirewallClient.queryIcmpBlockInversionc C s t | j�|��S rQ )r r r� r� r r r r� � s z'FirewallClient.removeIcmpBlockInversionc C s | j �|||� d S rQ r r r r r r � s zFirewallClient.addChainc C s | j �|||� d S rQ r r r r r r � s zFirewallClient.removeChainc C s t | j�|||��S rQ r r r r r r � s zFirewallClient.queryChainc C s t | j�||��S rQ r r� r r r r� � s zFirewallClient.getChainsc C s t | j�� �S rQ r rI r r r r� � s zFirewallClient.getAllChainsc C s | j �|||||� d S rQ r! r" r r r r � s zFirewallClient.addRulec C s | j �|||||� d S rQ r# r" r r r r � s zFirewallClient.removeRulec C s | j �|||� d S rQ r$ r r r r r � s zFirewallClient.removeRulesc C s t | j�|||||��S rQ r% r" r r r r s zFirewallClient.queryRulec C s t | j�|||��S rQ r& r r r r r s zFirewallClient.getRulesc C s t | j�� �S rQ r' rI r r r r s zFirewallClient.getAllRulesc C s t | j�||��S rQ )r r � passthroughr) r r r r� s zFirewallClient.passthroughc C s t | j�� �S rQ r- rI r r r r s z!FirewallClient.getAllPassthroughsc C s | j �� d S rQ )r r rI r r r r s z$FirewallClient.removeAllPassthroughsc C s t | j�|��S rQ r, r� r r r r s z FirewallClient.getPassthroughsc C s | j �||� d S rQ r( r) r r r r ! s z FirewallClient.addPassthroughc C s | j �||� d S rQ r* r) r r r r % s z FirewallClient.removePassthroughc C s t | j�||��S rQ r+ r) r r r r ) s z FirewallClient.queryPassthroughc C s | j �� d S rQ )r� �enableLockdownrI r r r r� / s z FirewallClient.enableLockdownc C s | j �� d S rQ )r� �disableLockdownrI r r r r� 3 s z FirewallClient.disableLockdownc C s t | j�� �S rQ )r r� � queryLockdownrI r r r r� 7 s z FirewallClient.queryLockdownc C s | j �|� d S rQ r� r� r r r r� ? s z*FirewallClient.addLockdownWhitelistCommandc C s t | j�� �S rQ r� rI r r r r� C s z+FirewallClient.getLockdownWhitelistCommandsc C s t | j�|��S rQ r� r� r r r r� G s z,FirewallClient.queryLockdownWhitelistCommandc C s | j �|� d S rQ r� r� r r r r� K s z-FirewallClient.removeLockdownWhitelistCommandc C s | j �|� d S rQ r� r� r r r r� Q s z*FirewallClient.addLockdownWhitelistContextc C s t | j�� �S rQ r� rI r r r r� U s z+FirewallClient.getLockdownWhitelistContextsc C s t | j�|��S rQ r� r� r r r r� Y s z,FirewallClient.queryLockdownWhitelistContextc C s | j �|� d S rQ r� r� r r r r� ] s z-FirewallClient.removeLockdownWhitelistContextc C s | j �|� d S rQ r� r� r r r r� c s z&FirewallClient.addLockdownWhitelistUidc C s t | j�� �S rQ r� rI r r r r� g s z'FirewallClient.getLockdownWhitelistUidsc C s t | j�|��S rQ r� r� r r r r� k s z(FirewallClient.queryLockdownWhitelistUidc C s | j �|� d S rQ r� r� r r r r� o s z)FirewallClient.removeLockdownWhitelistUidc C s | j �|� d S rQ r� r� r r r r� u s z'FirewallClient.addLockdownWhitelistUserc C s t | j�� �S rQ r� rI r r r r� y s z(FirewallClient.getLockdownWhitelistUsersc C s t | j�|��S rQ r� r� r r r r� } s z)FirewallClient.queryLockdownWhitelistUserc C s | j �|� d S rQ r� r� r r r r� � s z*FirewallClient.removeLockdownWhitelistUserc C s | j �� dS )z( Authorize once for all polkit actions. N)rh � authorizeAllrI r r r r� � s zFirewallClient.authorizeAll)Nr T)r )r )r )r )r )r )r )r )�r� r� r� r# rE rd rl rm ro rq rt r[ rf ru ra r r~ r r� r� r� r r r r� r� r� r� r� r� r� r� r� r� r� rH r� rL r� rt r� r� r� r� r� r� r� r� r� r� r? r@ r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� rx r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r r r r� r� r r r r r r r� r r r r r r r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r r r r rV s4 % / � rV )-Z gi.repositoryr Zdbus.mainloop.glibr r! Zfirewallr Zfirewall.core.baser r r Zfirewall.dbus_utilsr Zfirewall.core.richr Zfirewall.core.ipsetr r r r Zfirewall.errorsr r r r r# �objectr$ r� r' rN rQ r{ r� r� r� r� r� r� r� r� r� r r. rV r r r r �<module> sT ) n O0 ghfK| ]CgVab[ [ __pycache__/errors.cpython-39.pyc 0000644 00000007350 15025011705 0012722 0 ustar 00 a ���g, � @ s� d Z dZdZdZdZdZdZdZdZd Z d Z d Z d Z d Z dZdZdZdZdZdZdZdZdZdZdZdZdZdZd Z d Z d Z d Z d Z d!Z!d"Z"d#Z#d$Z$d%Z%d&Z&d'Z'd(Z(d)Z)d*Z*d+Z+d,Z,d-Z-d.Z.d/Z/d0Z0d1Z1d2Z2d3Z3d4Z4d5Z5d6Z6d7Z7d8Z8d9Z9d:Z:d;Z;d<Z<d=Z=d>Z>d?Z?d@Z@dAZAdBZBdCZCdDZDdEZEdFZFdGZGdHZHdIZIdJZJdKZKdLZLdMZMdNZNdOZOdPZPdQZQdRZRdSZSdTdUlTZTG dVdW� dWeU�ZVeTjWeVjX ZYdXdY� eZeY�D �eV_[dZdY� eVj[D �eV_\dUS )[� � � � � � � � � � � � � � � � � � � � � � �! �" �# �$ �% �& �d �e �f �g �h �i �j �k �l �m �n �o �p �q �r �s �t �u �v �w �x �y �z �{ �| �} �~ � � � � � � � � � � � � � � � � � �� �� �� �� �� �� �� �� � � � � � Nc @ s6 e Zd Zd dd�Zdd� Zdd� Zdd � Zee�ZdS ) � FirewallErrorNc C s || _ || _d S )N)�code�msg)�selfrW rX � rZ �3/usr/lib/python3.9/site-packages/firewall/errors.py�__init__q s zFirewallError.__init__c C s d| j | j| jf S )Nz %s(%r, %r))� __class__rW rX �rY rZ rZ r[ �__repr__u s zFirewallError.__repr__c C s( | j r d| j| j | j f S | j| j S )Nz%s: %s)rX �errorsrW r^ rZ rZ r[ �__str__x s zFirewallError.__str__c C sV | d ur(d| v r(| � d�}| d |� }n| }ztj| }W n tyP t}Y n0 |S )N�:)�indexrV �codes�KeyError� UNKNOWN_ERROR)rX �idxZecoderW rZ rZ r[ �get_code} s zFirewallError.get_code)N)�__name__� __module__� __qualname__r\ r_ ra rh � staticmethodrZ rZ rZ r[ rV p s rV c C s4 i | ],}|� d �sttt|��tkrtt|�|�qS )�_)� startswith�type�getattr�mod�int)�.0ZvarnamerZ rZ r[ � <dictcomp>� s �rt c C s i | ]}t j| |�qS rZ )rV r` )rs rW rZ rZ r[ rt � s �)]ZALREADY_ENABLEDZ NOT_ENABLEDZCOMMAND_FAILEDZ NO_IPV6_NATZ PANIC_MODEZZONE_ALREADY_SETZUNKNOWN_INTERFACEZ ZONE_CONFLICTZ BUILTIN_CHAINZEBTABLES_NO_REJECTZNOT_OVERLOADABLEZ NO_DEFAULTSZ BUILTIN_ZONEZBUILTIN_SERVICEZBUILTIN_ICMPTYPEZ NAME_CONFLICTZ NAME_MISMATCHZ PARSE_ERRORZ ACCESS_DENIEDZUNKNOWN_SOURCEZRT_TO_PERM_FAILEDZIPSET_WITH_TIMEOUTZ BUILTIN_IPSETZ ALREADY_SETZMISSING_IMPORTZ DBUS_ERRORZBUILTIN_HELPERZ NOT_APPLIEDZINVALID_ACTIONZINVALID_SERVICEZ INVALID_PORTZINVALID_PROTOCOLZINVALID_INTERFACEZ INVALID_ADDRZINVALID_FORWARDZINVALID_ICMPTYPEZ INVALID_TABLEZ INVALID_CHAINZINVALID_TARGETZ INVALID_IPVZ INVALID_ZONEZINVALID_PROPERTYZ INVALID_VALUEZINVALID_OBJECTZ INVALID_NAMEZINVALID_FILENAMEZINVALID_DIRECTORYZ INVALID_TYPEZINVALID_SETTINGZINVALID_DESTINATIONZ INVALID_RULEZ INVALID_LIMITZINVALID_FAMILYZINVALID_LOG_LEVELZINVALID_AUDIT_TYPEZ INVALID_MARKZINVALID_CONTEXTZINVALID_COMMANDZ INVALID_USERZ INVALID_UIDZINVALID_MODULEZINVALID_PASSTHROUGHZ INVALID_MACZ INVALID_IPSETZ INVALID_ENTRYZINVALID_OPTIONZINVALID_HELPERZINVALID_PRIORITYZINVALID_POLICYZINVALID_LOG_PREFIXZINVALID_NFLOG_GROUPZINVALID_NFLOG_QUEUEZ MISSING_TABLEZ MISSING_CHAINZ MISSING_PORTZMISSING_PROTOCOLZ MISSING_ADDRZ MISSING_NAMEZMISSING_SETTINGZMISSING_FAMILYZRUNNING_BUT_FAILEDZ NOT_RUNNINGZNOT_AUTHORIZEDrf �sys� ExceptionrV �modulesrj rq �dirr` rd rZ rZ rZ r[ �<module> s� �� __pycache__/dbus_utils.cpython-39.opt-1.pyc 0000644 00000014323 15025011705 0014520 0 ustar 00 a ���g�$ � @ s� g d �Z ddlZddlZddlmZ ddlmZ dd� Zdd� Zd d � Z d d � Z d d� Z dd� Z dd� Z d dd�Zdd� Zd dd�Zdd� Zdd � ZdS ) ) �command_of_pid� pid_of_sender� uid_of_sender� user_of_uid�context_of_sender�command_of_sender�user_of_sender�dbus_to_python�dbus_signature�%dbus_introspection_prepare_properties�!dbus_introspection_add_properties� N)�minidom)�logc C sd zJt d| d��(}|�� d �dd��� }W d � n1 s>0 Y W n ty^ Y dS 0 |S )z Get command for pid from /proc z/proc/%d/cmdline�rr � � N)�open� readlines�replace�strip� Exception)�pid�f�cmd� r �7/usr/lib/python3.9/site-packages/firewall/dbus_utils.pyr " s : r c C sD | � dd�}t�|d�}zt|�|��}W n ty> Y dS 0 |S )zV Get pid from sender string using org.freedesktop.DBus.GetConnectionUnixProcessID �org.freedesktop.DBus�/org/freedesktop/DBusN)� get_object�dbus� Interface�intZGetConnectionUnixProcessID� ValueError)�bus�sender�dbus_obj� dbus_ifacer r r r r + s r c C sD | � dd�}t�|d�}zt|�|��}W n ty> Y dS 0 |S )zU Get user id from sender string using org.freedesktop.DBus.GetConnectionUnixUser r r N)r r r r! ZGetConnectionUnixUserr" )r# r$ r% r& �uidr r r r 8 s r c C s, zt �| �}W n ty" Y dS 0 |d S )z Get user for uid from pwd Nr )�pwd�getpwuidr )r' Zpwsr r r r E s r c C sP | � dd�}t�|d�}z|�|�}W n ty: Y dS 0 d�ttt|���S )zk Get SELinux context from sender string using org.freedesktop.DBus.GetConnectionSELinuxSecurityContext r r N� ) r r r Z#GetConnectionSELinuxSecurityContextr �join�map�chrr )r# r$ r% r& �contextr r r r N s r c C s t t| |��S )z Return command of D-Bus sender )r r �r# r$ r r r r \ s r c C s t t| |��S )N)r r r/ r r r r a s r c C s` | d u r| }�n�t | tj�r(t| �}�nzt | tj�r@t| �}�nbt | tj�rXt| �}�nJt | tj�s�t | tj�s�t | tj �s�t | tj �s�t | tj �s�t | tj �s�t | tj �r�t| �}n�t | tj�r�t| �}n�t | tj�r�dd� | D �}n�t | tj��r tdd� | D ��}n�t | tj��r,dd� | �� D �}nvt | t��s�t | t��s�t | t��s�t | t��s�t | t��s�t | t��s�t | t��s�t | t��r�| }ntdt| � ��|d u�r\|tk�r�t |t��rF|tk�r�t |t��rF|tk�r�t |t��rF|tk�rt |t��rF|tk�rt |t��rF|tk�r0t |t��rF|tk�r\t |t��s\td|t|�|f ��|S )Nc S s g | ] }t |��qS r �r ��.0�xr r r � <listcomp>x � z"dbus_to_python.<locals>.<listcomp>c S s g | ] }t |��qS r r0 r1 r r r r4 z r5 c S s i | ]\}}t |�t |��qS r r0 )r2 �k�vr r r � <dictcomp>| r5 z"dbus_to_python.<locals>.<dictcomp>� Unhandled %sz%s is %s, expected %s) � isinstancer �Boolean�bool�String�str� ObjectPath�Byte�Int16�Int32�Int64�UInt16�UInt32�UInt64r! �Double�float�Array�Struct�tuple� Dictionary�items�bytes�list�dict� TypeError�repr�type)�objZ expected_typeZ python_objr r r r d s� � � � � � � ������� ������������r c C s$ t | tj�rdS t | tj�r dS t | tj�r0dS t | tj�r@dS t | tj�rPdS t | tj�r`dS t | tj�rpdS t | tj �r�dS t | tj �r�d S t | tj �r�d S t | tj �r�d S t | tj �r�t| j�d kr�d | j S d| j S n@t | tj�� r�d| j S t | tj��rd| j S tdt| � ��d S )N�b�s�o�y�n�ir3 �q�u�t�d� za(%s)za%sz(%s)za{%s}r9 )r: r r; r= r? r@ rA rB rC rD rE rF rG rI �lenZ signaturerJ rL rQ rR )rT r r r r � s> r c C s� |d u r i }t | d�s"t| di � t| d�}i ||< z| �|�}W n tyX i }Y n0 |�� D ]J\}}dt|�i|| |< ||v r�|| || | d< qbd|| | d< qbd S )N�_fw_dbus_propertiesrS �access�read)�hasattr�setattr�getattrZGetAllr rM r )rT � interfacerb �dip�_dict�key�valuer r r r � s r c C s� t �|�}t| d�r�|�d�D ]�}|�d�r |�d�|kr i }t| d�rRt| d�}||v r || �� D ]H\}}|�d�}|� d|� |� d|d � |� d|d � |� |� qfq t � |� � � |� � } |�� | S )Nra rg �name�propertyrS rb )r � parseStringrd �getElementsByTagName� hasAttribute� getAttributerf rM � createElement� setAttribute� appendChildr �debug10�toxml�unlink) rT �datarg �doc�noderh rj rk ZpropZnew_datar r r r � s( � r c C s> t �|�}||v r�|�d�D ]t}|�d�r |�d�|kr |�d�D ]L}|�d�rB|�d�|| v rB|�d�}|�dd� |�dd� |�|� qBq ||v �r |�d�D ]t}|�d�r�|�d�|kr�|�d�D ]L} | �d�r�| �d�|| v r�|�d�}|�dd� |�dd� | �|� q�q�t� |� � � |� � }|� � |S ) Nrg rl �method� annotationz org.freedesktop.DBus.Deprecatedrk �true�signal) r rn ro rp rq rr rs rt r ru rv rw ) rT rx rg Zdeprecated_methodsZdeprecated_signalsry rz Z method_noder| Z signal_noder r r �!dbus_introspection_add_deprecated� s> � � � � r )N)N)�__all__r r( Zxml.domr Zfirewall.core.loggerr r r r r r r r r r r r r r r r r �<module> s .# __pycache__/__init__.cpython-39.opt-1.pyc 0000644 00000000220 15025011705 0014071 0 ustar 00 a ���g � @ s d S )N� r r r �5/usr/lib/python3.9/site-packages/firewall/__init__.py�<module> � __pycache__/client.cpython-39.opt-1.pyc 0000644 00000407725 15025011705 0013635 0 ustar 00 a ���g� � @ s� d dl mZ d dlZd dlZd dlmZ d dlmZm Z m Z d dl m Z d dl mZ d dlmZmZmZ d dlmZ d d lmZ d dlZd dlZdad ad d � ZG d d� de�ZG dd� de�Z G dd� de�Z G dd� de�Z G dd� de�Z G dd� de�Z G dd� de�Z!G dd � d e�Z"G d d � d e�Z#G d d � d e�Z$G d!d"� d"e�Z%G d#d$� d$e�Z&G d%d&� d&e�Z'G d'd(� d(e�Z(G d)d*� d*e�Z)G d+d,� d,e�Z*G d-d.� d.e�Z+G d/d0� d0e�Z,dS )1� )�GLibN)�config)�DEFAULT_ZONE_TARGET�DEFAULT_POLICY_TARGET�DEFAULT_POLICY_PRIORITY��dbus_to_python)� Rich_Rule)�normalize_ipset_entry� check_entry_overlaps_existing� check_for_overlapping_entries)�errors)� FirewallErrorFc s t �� �� fdd��}|S )z#Decorator to handle exceptions c s d}|�s z� | i |��W S t jjy� } zd|�� }|�� }tsD� d|v rVtd� n0d|v rht|� n d}|rzt|� n tt|�� W Y d }~ndd }~0 ty� } z ts�� n tt|�� W Y d }~n.d }~0 ty� ts� n tt � � � Y n0 t s�q qd S )NFZNotAuthorizedExceptionzorg.freedesktop.DBus.ErrorT) �dbus� exceptions� DBusException�get_dbus_messageZ get_dbus_name�exception_handler�strr � Exception� traceback� format_exc�not_authorized_loop)�args�kwargsZ authorized�eZ dbus_messageZ dbus_name��func� �3/usr/lib/python3.9/site-packages/firewall/client.py�_impl- s6 z handle_exceptions.<locals>._impl)� functools�wraps)r r r r r �handle_exceptions* s !r# c @ s� e Zd Zed�dd��Zedd� �Zedd� �Zedd � �Zed d � �Zed d � �Z edd� �Z edd� �Z edd� �Z edd� �Z edd� �Zedd� �Zedd� �Zed d � �Zed d � �Zed d!� �Zed"d#� �Zed$d%� �Zed&d'� �Zed(d)� �Zed*d+� �Zed,d-� �Zed.d/� �Zed0d1� �Zed2d3� �Z ed4d5� �Z ed6d7� �Z ed8d9� �Z ed:d;� �Z ed<d=� �Z!ed>d?� �Z"ed@dA� �Z#edBdC� �Z$edDdE� �Z%edFdG� �Z&edHdI� �Z'edJdK� �Z(edLdM� �Z)edNdO� �Z*edPdQ� �Z+edRdS� �Z,edTdU� �Z-edVdW� �Z.edXdY� �Z/edZd[� �Z0ed\d]� �Z1ed^d_� �Z2ed`da� �Z3edbdc� �Z4eddde� �Z5edfdg� �Z6edhdi� �Z7edjdk� �Z8edldm� �Z9edndo� �Z:edpdq� �Z;edrds� �Z<edtdu� �Z=edvdw� �Z>edxdy� �Z?edzd{� �Z@ed|d}� �ZAed~d� �ZBed�d�� �ZCed�d�� �ZDed�d�� �ZEed�d�� �ZFed�d�� �ZGed�d�� �ZHed�d�� �ZIed�d�� �ZJed�d�� �ZKed�d�� �ZLed�d�� �ZMed�d�� �ZNdS )��FirewallClientZoneSettingsNc C s� ddddt g g g dg g g g g g ddg| _g d�| _g d�| _|r~t|t�rjt|�D ]\}}|| | j|< qRt|t�r~| �|� d S )N� F)�version�short� description�UNUSED�target�services�ports� icmp_blocks� masquerade� forward_ports� interfaces�sourcesZ rules_str� protocols� source_portsZicmp_block_inversion�forward)�sr5 r5 �br5 r5 �(ss)r5 r6 �(ssss)r5 r5 r5 r5 r7 r6 r6 ) r �settings� settings_name�settings_dbus_type� isinstance�list� enumerate�dict�setSettingsDict��selfr9 �i�vr r r �__init__T s � z#FirewallClientZoneSettings.__init__c C s d| j | jf S �Nz%s(%r)�� __class__r9 �rB r r r �__repr__k s z#FirewallClientZoneSettings.__repr__c C s2 i }t | j| j�D ]\}}|dkr$q|||< q|S )Nr) ��zipr: r9 �rB r9 �key�valuer r r �getSettingsDicto s z*FirewallClientZoneSettings.getSettingsDictc C s$ |D ]}|| | j | j�|�< qd S �N�r9 r: �index�rB r9 rN r r r r@ w s z*FirewallClientZoneSettings.setSettingsDictc C sx i }t | j| j| j�D ]\\}}}|dkr*qt|�tu rJtj||d�||< qt|�tu rjtj ||d�||< q|||< q|S )Nr) �Z signature� rL r: r9 r; �typer= r �Arrayr? � Dictionary�rB r9 rN rO �sigr r r �getSettingsDbusDict{ s z.FirewallClientZoneSettings.getSettingsDbusDictc C s$ | � � }|d= |d= |d= |d= |S �Nr& r' r( r* )rP �rB r9 r r r �getRuntimeSettingsDict� s z1FirewallClientZoneSettings.getRuntimeSettingsDictc C s$ | � � }|d= |d= |d= |d= |S r] �r\ r^ r r r �getRuntimeSettingsDbusDict� s z5FirewallClientZoneSettings.getRuntimeSettingsDbusDictc C s | j d S �Nr �r9 rI r r r � getVersion� s z%FirewallClientZoneSettings.getVersionc C s || j d< d S rb rc �rB r& r r r � setVersion� s z%FirewallClientZoneSettings.setVersionc C s | j d S �N� rc rI r r r �getShort� s z#FirewallClientZoneSettings.getShortc C s || j d< d S rg rc �rB r' r r r �setShort� s z#FirewallClientZoneSettings.setShortc C s | j d S �N� rc rI r r r �getDescription� s z)FirewallClientZoneSettings.getDescriptionc C s || j d< d S rl rc �rB r( r r r �setDescription� s z)FirewallClientZoneSettings.setDescriptionc C s | j d tkr| j d S dS )N� �default)r9 r rI r r r � getTarget� s z$FirewallClientZoneSettings.getTargetc C s |dkr |nt | jd< d S )Nrr rq )r r9 �rB r* r r r � setTarget� s z$FirewallClientZoneSettings.setTargetc C s | j d S �N� rc rI r r r � getServices� s z&FirewallClientZoneSettings.getServicesc C s || j d< d S rv rc �rB r+ r r r � setServices� s z&FirewallClientZoneSettings.setServicesc C s0 || j d vr | j d �|� n ttj|��d S rv �r9 �appendr r �ALREADY_ENABLED�rB �servicer r r � addService� s z%FirewallClientZoneSettings.addServicec C s0 || j d v r | j d �|� n ttj|��d S rv �r9 �remover r � NOT_ENABLEDr~ r r r � removeService� s z(FirewallClientZoneSettings.removeServicec C s || j d v S rv rc r~ r r r � queryService� s z'FirewallClientZoneSettings.queryServicec C s | j d S �N� rc rI r r r �getPorts� s z#FirewallClientZoneSettings.getPortsc C s || j d< d S r� rc �rB r, r r r �setPorts� s z#FirewallClientZoneSettings.setPortsc C s@ ||f| j d vr(| j d �||f� nttjd||f ��d S �Nr� �'%s:%s'r{ �rB �port�protocolr r r �addPort� s �z"FirewallClientZoneSettings.addPortc C s@ ||f| j d v r(| j d �||f� nttjd||f ��d S r� r� r� r r r � removePort� s �z%FirewallClientZoneSettings.removePortc C s ||f| j d v S r� rc r� r r r � queryPort� s z$FirewallClientZoneSettings.queryPortc C s | j d S �N� rc rI r r r � getProtocols� s z'FirewallClientZoneSettings.getProtocolsc C s || j d< d S r� rc �rB r2 r r r � setProtocols� s z'FirewallClientZoneSettings.setProtocolsc C s0 || j d vr | j d �|� n ttj|��d S r� r{ �rB r� r r r � addProtocol� s z&FirewallClientZoneSettings.addProtocolc C s0 || j d v r | j d �|� n ttj|��d S r� r� r� r r r �removeProtocol� s z)FirewallClientZoneSettings.removeProtocolc C s || j d v S r� rc r� r r r � queryProtocol� s z(FirewallClientZoneSettings.queryProtocolc C s | j d S �N� rc rI r r r �getSourcePorts� s z)FirewallClientZoneSettings.getSourcePortsc C s || j d< d S r� rc r� r r r �setSourcePorts s z)FirewallClientZoneSettings.setSourcePortsc C s@ ||f| j d vr(| j d �||f� nttjd||f ��d S �Nr� r� r{ r� r r r � addSourcePort s �z(FirewallClientZoneSettings.addSourcePortc C s@ ||f| j d v r(| j d �||f� nttjd||f ��d S r� r� r� r r r �removeSourcePort s �z+FirewallClientZoneSettings.removeSourcePortc C s ||f| j d v S r� rc r� r r r �querySourcePort s z*FirewallClientZoneSettings.querySourcePortc C s | j d S �N� rc rI r r r � getIcmpBlocks s z(FirewallClientZoneSettings.getIcmpBlocksc C s || j d< d S r� rc �rB Z icmpblocksr r r � setIcmpBlocks s z(FirewallClientZoneSettings.setIcmpBlocksc C s0 || j d vr | j d �|� n ttj|��d S r� r{ �rB Zicmptyper r r � addIcmpBlock s z'FirewallClientZoneSettings.addIcmpBlockc C s0 || j d v r | j d �|� n ttj|��d S r� r� r� r r r �removeIcmpBlock" s z*FirewallClientZoneSettings.removeIcmpBlockc C s || j d v S r� rc r� r r r �queryIcmpBlock( s z)FirewallClientZoneSettings.queryIcmpBlockc C s | j d S �N� rc rI r r r �getIcmpBlockInversion, s z0FirewallClientZoneSettings.getIcmpBlockInversionc C s || j d< d S r� rc )rB �flagr r r �setIcmpBlockInversion/ s z0FirewallClientZoneSettings.setIcmpBlockInversionc C s& | j d sd| j d< n ttjd��d S )Nr� T�icmp-block-inversion�r9 r r r} rI r r r �addIcmpBlockInversion2 s z0FirewallClientZoneSettings.addIcmpBlockInversionc C s& | j d rd| j d< n ttjd��d S )Nr� Fr� �r9 r r r� rI r r r �removeIcmpBlockInversion8 s z3FirewallClientZoneSettings.removeIcmpBlockInversionc C s | j d S r� rc rI r r r �queryIcmpBlockInversion> s z2FirewallClientZoneSettings.queryIcmpBlockInversionc C s | j d S �N� rc rI r r r � getForwardB s z%FirewallClientZoneSettings.getForwardc C s || j d< d S r� rc �rB r4 r r r � setForwardE s z%FirewallClientZoneSettings.setForwardc C s& | j d sd| j d< n ttjd��d S )Nr� Tr4 r� rI r r r � addForwardH s z%FirewallClientZoneSettings.addForwardc C s& | j d rd| j d< n ttjd��d S )Nr� Fr4 r� rI r r r � removeForwardN s z(FirewallClientZoneSettings.removeForwardc C s | j d S r� rc rI r r r � queryForwardT s z'FirewallClientZoneSettings.queryForwardc C s | j d S �N� rc rI r r r � getMasqueradeX s z(FirewallClientZoneSettings.getMasqueradec C s || j d< d S r� rc �rB r. r r r � setMasquerade[ s z(FirewallClientZoneSettings.setMasqueradec C s& | j d sd| j d< n ttjd��d S )Nr� Tr. r� rI r r r � addMasquerade^ s z(FirewallClientZoneSettings.addMasqueradec C s& | j d rd| j d< n ttjd��d S )Nr� Fr. r� rI r r r �removeMasqueraded s z+FirewallClientZoneSettings.removeMasqueradec C s | j d S r� rc rI r r r �queryMasqueradej s z*FirewallClientZoneSettings.queryMasqueradec C s | j d S �N� rc rI r r r �getForwardPortsn s z*FirewallClientZoneSettings.getForwardPortsc C s || j d< d S r� rc r� r r r �setForwardPortsq s z*FirewallClientZoneSettings.setForwardPortsc C sd |d u r d}|d u rd}||||f| j d vrH| j d �||||f� nttjd||||f ��d S �Nr% r� � '%s:%s:%s:%s'r{ �rB r� r� Zto_portZto_addrr r r �addForwardPortt s �z)FirewallClientZoneSettings.addForwardPortc C sd |d u r d}|d u rd}||||f| j d v rH| j d �||||f� nttjd||||f ��d S r� r� r� r r r �removeForwardPort s �z,FirewallClientZoneSettings.removeForwardPortc C s. |d u r d}|d u rd}||||f| j d v S )Nr% r� rc r� r r r �queryForwardPort� s z+FirewallClientZoneSettings.queryForwardPortc C s | j d S �N� rc rI r r r � getInterfaces� s z(FirewallClientZoneSettings.getInterfacesc C s || j d< d S r� rc �rB r0 r r r � setInterfaces� s z(FirewallClientZoneSettings.setInterfacesc C s0 || j d vr | j d �|� n ttj|��d S r� r{ �rB � interfacer r r � addInterface� s z'FirewallClientZoneSettings.addInterfacec C s0 || j d v r | j d �|� n ttj|��d S r� r� r� r r r �removeInterface� s z*FirewallClientZoneSettings.removeInterfacec C s || j d v S r� rc r� r r r �queryInterface� s z)FirewallClientZoneSettings.queryInterfacec C s | j d S �N� rc rI r r r � getSources� s z%FirewallClientZoneSettings.getSourcesc C s || j d< d S r� rc �rB r1 r r r � setSources� s z%FirewallClientZoneSettings.setSourcesc C s0 || j d vr | j d �|� n ttj|��d S r� r{ �rB �sourcer r r � addSource� s z$FirewallClientZoneSettings.addSourcec C s0 || j d v r | j d �|� n ttj|��d S r� r� r� r r r � removeSource� s z'FirewallClientZoneSettings.removeSourcec C s || j d v S r� rc r� r r r � querySource� s z&FirewallClientZoneSettings.querySourcec C s | j d S )N� rc rI r r r � getRichRules� s z'FirewallClientZoneSettings.getRichRulesc C s dd� |D �}|| j d< d S )Nc S s g | ]}t t|d ���qS ��Zrule_str�r r ��.0�rr r r � <listcomp>� � z;FirewallClientZoneSettings.setRichRules.<locals>.<listcomp>r� rc �rB Zrulesr r r � setRichRules� s z'FirewallClientZoneSettings.setRichRulesc C s> t t|d��}|| jd vr.| jd �|� n ttj|��d S �Nr� r� �r r r9 r| r r r} �rB �ruler r r � addRichRule� s z&FirewallClientZoneSettings.addRichRulec C s> t t|d��}|| jd v r.| jd �|� n ttj|��d S r� �r r r9 r� r r r� r� r r r �removeRichRule� s z)FirewallClientZoneSettings.removeRichRulec C s t t|d��}|| jd v S r� �r r r9 r� r r r � queryRichRule� s z(FirewallClientZoneSettings.queryRichRule)N)O�__name__� __module__� __qualname__r# rE rJ rP r@ r\ r_ ra rd rf ri rk rn rp rs ru rx rz r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r r r r r$ S s, r$ c @ s� e Zd Zdd� Zedd� �Zedd� �Zedd� �Zed d � �Zed d � �Z ed d� �Z edd� �Z edd� �Z edd� �Z edd� �Zedd� �Zedd� �Zedd � �Zed d � �Zed d � �Zed!d"� �Zed#d$� �Zed%d&� �Zed'd(� �Zed)d*� �Zed+d,� �Zed-d.� �Zed/d0� �Zed1d2� �Z ed3d4� �Z ed5d6� �Z ed7d8� �Z ed9d:� �Z ed;d<� �Z!ed=d>� �Z"ed?d@� �Z#edAdB� �Z$edCdD� �Z%edEdF� �Z&edGdH� �Z'edIdJ� �Z(edKdL� �Z)edMdN� �Z*edOdP� �Z+edQdR� �Z,edSdT� �Z-edUdV� �Z.edWdX� �Z/edYdZ� �Z0ed[d\� �Z1ed]d^� �Z2ed_d`� �Z3edadb� �Z4edcdd� �Z5ededf� �Z6edgdh� �Z7edidj� �Z8edkdl� �Z9edmdn� �Z:edodp� �Z;edqdr� �Z<edsdt� �Z=edudv� �Z>edwdx� �Z?edydz� �Z@ed{d|� �ZAed}d~� �ZBedd�� �ZCed�d�� �ZDed�d�� �ZEed�d�� �ZFed�d�� �ZGed�d�� �ZHed�d�� �ZIed�d�� �ZJed�d�� �ZKed�d�� �ZLed�d�� �ZMed�d�� �ZNed�d�� �ZOed�d�� �ZPd�S )��FirewallClientConfigZonec C sL || _ || _| j �tjj|�| _tj| jtjjd�| _ tj| jdd�| _ d S �N��dbus_interface� org.freedesktop.DBus.Properties) �bus�path� get_objectr r �DBUS_INTERFACE�dbus_obj� Interface�DBUS_INTERFACE_CONFIG_ZONE�fw_zone� fw_properties�rB r r r r r rE � s ��z!FirewallClientConfigZone.__init__c C s t | j�tjj|��S rQ )r r �Getr r r �rB �propr r r � get_property� s �z%FirewallClientConfigZone.get_propertyc C s t | j�tjj��S rQ )r r �GetAllr r r rI r r r �get_properties� s �z'FirewallClientConfigZone.get_propertiesc C s | j �tjj||� d S rQ )r �Setr r r �rB r rO r r r � set_property� s �z%FirewallClientConfigZone.set_propertyc C s t t| j�� ��S rQ )r$ r r � getSettings2rI r r r � getSettings� s z$FirewallClientConfigZone.getSettingsc C s | j �|�� � d S rQ )r �update2r\ r^ r r r �update� s z FirewallClientConfigZone.updatec C s | j �� d S rQ )r � loadDefaultsrI r r r r � s z%FirewallClientConfigZone.loadDefaultsc C s | j �� d S rQ )r r� rI r r r r� s z FirewallClientConfigZone.removec C s | j �|� d S rQ )r �rename�rB �namer r r r s z FirewallClientConfigZone.renamec C s | j �� S rQ )r rd rI r r r rd s z#FirewallClientConfigZone.getVersionc C s | j �|� d S rQ )r rf re r r r rf s z#FirewallClientConfigZone.setVersionc C s | j �� S rQ )r ri rI r r r ri s z!FirewallClientConfigZone.getShortc C s | j �|� d S rQ )r rk rj r r r rk s z!FirewallClientConfigZone.setShortc C s | j �� S rQ )r rn rI r r r rn ! s z'FirewallClientConfigZone.getDescriptionc C s | j �|� d S rQ )r rp ro r r r rp % s z'FirewallClientConfigZone.setDescriptionc C s | j �� S rQ )r rs rI r r r rs + s z"FirewallClientConfigZone.getTargetc C s | j �|� d S rQ )r ru rt r r r ru / s z"FirewallClientConfigZone.setTargetc C s | j �� S rQ )r rx rI r r r rx 5 s z$FirewallClientConfigZone.getServicesc C s | j �|� d S rQ )r rz ry r r r rz 9 s z$FirewallClientConfigZone.setServicesc C s | j �|� d S rQ )r r� r~ r r r r� = s z#FirewallClientConfigZone.addServicec C s | j �|� d S rQ )r r� r~ r r r r� A s z&FirewallClientConfigZone.removeServicec C s | j �|�S rQ )r r� r~ r r r r� E s z%FirewallClientConfigZone.queryServicec C s | j �� S rQ )r r� rI r r r r� K s z!FirewallClientConfigZone.getPortsc C s | j �|� d S rQ )r r� r� r r r r� O s z!FirewallClientConfigZone.setPortsc C s | j �||� d S rQ )r r� r� r r r r� S s z FirewallClientConfigZone.addPortc C s | j �||� d S rQ )r r� r� r r r r� W s z#FirewallClientConfigZone.removePortc C s | j �||�S rQ )r r� r� r r r r� [ s z"FirewallClientConfigZone.queryPortc C s | j �� S rQ )r r� rI r r r r� a s z%FirewallClientConfigZone.getProtocolsc C s | j �|� d S rQ )r r� r� r r r r� e s z%FirewallClientConfigZone.setProtocolsc C s | j �|� d S rQ )r r� r� r r r r� i s z$FirewallClientConfigZone.addProtocolc C s | j �|� d S rQ )r r� r� r r r r� m s z'FirewallClientConfigZone.removeProtocolc C s | j �|�S rQ )r r� r� r r r r� q s z&FirewallClientConfigZone.queryProtocolc C s | j �� S rQ )r r� rI r r r r� w s z'FirewallClientConfigZone.getSourcePortsc C s | j �|� d S rQ )r r� r� r r r r� { s z'FirewallClientConfigZone.setSourcePortsc C s | j �||� d S rQ )r r� r� r r r r� s z&FirewallClientConfigZone.addSourcePortc C s | j �||� d S rQ )r r� r� r r r r� � s z)FirewallClientConfigZone.removeSourcePortc C s | j �||�S rQ )r r� r� r r r r� � s z(FirewallClientConfigZone.querySourcePortc C s | j �� S rQ )r r� rI r r r r� � s z&FirewallClientConfigZone.getIcmpBlocksc C s | j �|� d S rQ )r r� )rB Z icmptypesr r r r� � s z&FirewallClientConfigZone.setIcmpBlocksc C s | j �|� d S rQ )r r� r� r r r r� � s z%FirewallClientConfigZone.addIcmpBlockc C s | j �|� d S rQ )r r� r� r r r r� � s z(FirewallClientConfigZone.removeIcmpBlockc C s | j �|�S rQ )r r� r� r r r r� � s z'FirewallClientConfigZone.queryIcmpBlockc C s | j �� S rQ )r r� rI r r r r� � s z.FirewallClientConfigZone.getIcmpBlockInversionc C s | j �|� d S rQ )r r� )rB Z inversionr r r r� � s z.FirewallClientConfigZone.setIcmpBlockInversionc C s | j �� d S rQ )r r� rI r r r r� � s z.FirewallClientConfigZone.addIcmpBlockInversionc C s | j �� d S rQ )r r� rI r r r r� � s z1FirewallClientConfigZone.removeIcmpBlockInversionc C s | j �� S rQ )r r� rI r r r r� � s z0FirewallClientConfigZone.queryIcmpBlockInversionc C s | j �� d S �Nr4 �r r rI r r r r� � s z#FirewallClientConfigZone.getForwardc C s | j �d|i� d S r �r r r� r r r r� � s z#FirewallClientConfigZone.setForwardc C s | j �ddi� d S �Nr4 Tr rI r r r r� � s z#FirewallClientConfigZone.addForwardc C s | j �ddi� d S �Nr4 Fr rI r r r r� � s z&FirewallClientConfigZone.removeForwardc C s | j �� d S r r rI r r r r� � s z%FirewallClientConfigZone.queryForwardc C s | j �� S rQ )r r� rI r r r r� � s z&FirewallClientConfigZone.getMasqueradec C s | j �|� d S rQ )r r� r� r r r r� � s z&FirewallClientConfigZone.setMasqueradec C s | j �� d S rQ )r r� rI r r r r� � s z&FirewallClientConfigZone.addMasqueradec C s | j �� d S rQ )r r� rI r r r r� � s z)FirewallClientConfigZone.removeMasqueradec C s | j �� S rQ )r r� rI r r r r� � s z(FirewallClientConfigZone.queryMasqueradec C s | j �� S rQ )r r� rI r r r r� � s z(FirewallClientConfigZone.getForwardPortsc C s | j �|� d S rQ )r r� r� r r r r� � s z(FirewallClientConfigZone.setForwardPortsc C s. |d u r d}|d u rd}| j �||||� d S �Nr% )r r� �rB r� r� �toport�toaddrr r r r� � s z'FirewallClientConfigZone.addForwardPortc C s. |d u r d}|d u rd}| j �||||� d S r# )r r� r$ r r r r� � s z*FirewallClientConfigZone.removeForwardPortc C s* |d u r d}|d u rd}| j �||||�S r# )r r� r$ r r r r� � s z)FirewallClientConfigZone.queryForwardPortc C s | j �� S rQ )r r� rI r r r r� s z&FirewallClientConfigZone.getInterfacesc C s | j �|� d S rQ )r r� r� r r r r� s z&FirewallClientConfigZone.setInterfacesc C s | j �|� d S rQ )r r� r� r r r r� s z%FirewallClientConfigZone.addInterfacec C s | j �|� d S rQ )r r� r� r r r r� s z(FirewallClientConfigZone.removeInterfacec C s | j �|�S rQ )r r� r� r r r r� s z'FirewallClientConfigZone.queryInterfacec C s | j �� S rQ )r r� rI r r r r� s z#FirewallClientConfigZone.getSourcesc C s | j �|� d S rQ )r r� r� r r r r� ! s z#FirewallClientConfigZone.setSourcesc C s | j �|� d S rQ )r r� r� r r r r� % s z"FirewallClientConfigZone.addSourcec C s | j �|� d S rQ )r r� r� r r r r� ) s z%FirewallClientConfigZone.removeSourcec C s | j �|�S rQ )r r� r� r r r r� - s z$FirewallClientConfigZone.querySourcec C s | j �� S rQ )r r� rI r r r r� 3 s z%FirewallClientConfigZone.getRichRulesc C s | j �|� d S rQ )r r� r� r r r r� 7 s z%FirewallClientConfigZone.setRichRulesc C s | j �|� d S rQ )r r� r� r r r r� ; s z$FirewallClientConfigZone.addRichRulec C s | j �|� d S rQ )r r� r� r r r r� ? s z'FirewallClientConfigZone.removeRichRulec C s | j �|�S rQ )r r� r� r r r r� C s z&FirewallClientConfigZone.queryRichRuleN)Qr� r� r� rE r# r r r r r r r� r rd rf ri rk rn rp rs ru rx rz r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r r r r r� � s2 r� c @ s" e Zd Zed�dd��Zedd� �Zedd� �Zedd � �Zed d � �Zd d � Z edd� �Z edd� �Z edd� �Z edd� �Z edd� �Zedd� �Zedd� �Zed d � �Zed d � �Zed d!� �Zed"d#� �Zed$d%� �Zed&d'� �Zed(d)� �Zed*d+� �Zed,d-� �Zed.d/� �Zed0d1� �Zed2d3� �Z ed4d5� �Z ed6d7� �Z ed8d9� �Z ed:d;� �Z ed<d=� �Z!ed>d?� �Z"ed@dA� �Z#edBdC� �Z$edDdE� �Z%edFdG� �Z&edHdI� �Z'edJdK� �Z(edLdM� �Z)edNdO� �Z*edPdQ� �Z+edRdS� �Z,edTdU� �Z-edVdW� �Z.edXdY� �Z/edZd[� �Z0ed\d]� �Z1ed^d_� �Z2ed`da� �Z3edbdc� �Z4eddde� �Z5edfdg� �Z6edhdi� �Z7edjdk� �Z8edldm� �Z9edndo� �Z:edpdq� �Z;edrds� �Z<edtdu� �Z=edvdw� �Z>edxdy� �Z?edzd{� �Z@ed|d}� �ZAed~d� �ZBed�d�� �ZCed�d�� �ZDed�d�� �ZEdS )�� FirewallClientPolicySettingsNc C sB dg g g g dg t g g g dg tdd�| _g d�| _|r>| �|� d S )Nr% F)r( � egress_zonesr/ r- � ingress_zonesr. r, �priorityr2 � rich_rulesr+ r' r3 r* r& )r5 r5 r8 r5 r5 r6 r7 rC r5 r5 r5 r5 r7 r5 r5 )r r r9 r; r@ r^ r r r rE H s& � z%FirewallClientPolicySettings.__init__c C s d| j | jf S rF rG rI r r r rJ b s z%FirewallClientPolicySettings.__repr__c C s | j S rQ rc rI r r r rP f s z,FirewallClientPolicySettings.getSettingsDictc C s |D ]}|| | j |< qd S rQ rc rT r r r r@ i s z,FirewallClientPolicySettings.setSettingsDictc C sr i }t | j| j�D ]Z\}}| j| }t|�tu rDtj||d�||< qt|�tu rdtj||d�||< q|||< q|S �NrU ) rL r9 r; rW r= r rX r? rY )rB r9 rN r[ rO r r r r\ m s z0FirewallClientPolicySettings.getSettingsDbusDictc C s | � � }dD ] }||= q |S )N)r& r' r( r* r` rT r r r ra y s z7FirewallClientPolicySettings.getRuntimeSettingsDbusDictc C s | j d S �Nr& rc rI r r r rd s z'FirewallClientPolicySettings.getVersionc C s || j d< d S r- rc re r r r rf � s z'FirewallClientPolicySettings.setVersionc C s | j d S �Nr' rc rI r r r ri � s z%FirewallClientPolicySettings.getShortc C s || j d< d S r. rc rj r r r rk � s z%FirewallClientPolicySettings.setShortc C s | j d S �Nr( rc rI r r r rn � s z+FirewallClientPolicySettings.getDescriptionc C s || j d< d S r/ rc ro r r r rp � s z+FirewallClientPolicySettings.setDescriptionc C s | j d S �Nr* rc rI r r r rs � s z&FirewallClientPolicySettings.getTargetc C s || j d< d S r0 rc rt r r r ru � s z&FirewallClientPolicySettings.setTargetc C s | j d S �Nr+ rc rI r r r rx � s z(FirewallClientPolicySettings.getServicesc C s || j d< d S r1 rc ry r r r rz � s z(FirewallClientPolicySettings.setServicesc C s0 || j d vr | j d �|� n ttj|��d S r1 r{ r~ r r r r� � s z'FirewallClientPolicySettings.addServicec C s0 || j d v r | j d �|� n ttj|��d S r1 r� r~ r r r r� � s z*FirewallClientPolicySettings.removeServicec C s || j d v S r1 rc r~ r r r r� � s z)FirewallClientPolicySettings.queryServicec C s | j d S �Nr, rc rI r r r r� � s z%FirewallClientPolicySettings.getPortsc C s || j d< d S r2 rc r� r r r r� � s z%FirewallClientPolicySettings.setPortsc C s@ ||f| j d vr(| j d �||f� nttjd||f ��d S �Nr, r� r{ r� r r r r� � s �z$FirewallClientPolicySettings.addPortc C s@ ||f| j d v r(| j d �||f� nttjd||f ��d S r3 r� r� r r r r� � s �z'FirewallClientPolicySettings.removePortc C s ||f| j d v S r2 rc r� r r r r� � s z&FirewallClientPolicySettings.queryPortc C s | j d S �Nr2 rc rI r r r r� � s z)FirewallClientPolicySettings.getProtocolsc C s || j d< d S r4 rc r� r r r r� � s z)FirewallClientPolicySettings.setProtocolsc C s0 || j d vr | j d �|� n ttj|��d S r4 r{ r� r r r r� � s z(FirewallClientPolicySettings.addProtocolc C s0 || j d v r | j d �|� n ttj|��d S r4 r� r� r r r r� � s z+FirewallClientPolicySettings.removeProtocolc C s || j d v S r4 rc r� r r r r� � s z*FirewallClientPolicySettings.queryProtocolc C s | j d S �Nr3 rc rI r r r r� � s z+FirewallClientPolicySettings.getSourcePortsc C s || j d< d S r5 rc r� r r r r� � s z+FirewallClientPolicySettings.setSourcePortsc C s@ ||f| j d vr(| j d �||f� nttjd||f ��d S �Nr3 r� r{ r� r r r r� � s �z*FirewallClientPolicySettings.addSourcePortc C s@ ||f| j d v r(| j d �||f� nttjd||f ��d S r6 r� r� r r r r� � s �z-FirewallClientPolicySettings.removeSourcePortc C s ||f| j d v S r5 rc r� r r r r� � s z,FirewallClientPolicySettings.querySourcePortc C s | j d S �Nr- rc rI r r r r� � s z*FirewallClientPolicySettings.getIcmpBlocksc C s || j d< d S r7 rc r� r r r r� � s z*FirewallClientPolicySettings.setIcmpBlocksc C s0 || j d vr | j d �|� n ttj|��d S r7 r{ r� r r r r� � s z)FirewallClientPolicySettings.addIcmpBlockc C s0 || j d v r | j d �|� n ttj|��d S r7 r� r� r r r r� s z,FirewallClientPolicySettings.removeIcmpBlockc C s || j d v S r7 rc r� r r r r� s z+FirewallClientPolicySettings.queryIcmpBlockc C s | j d S �Nr. rc rI r r r r� s z*FirewallClientPolicySettings.getMasqueradec C s || j d< d S r8 rc r� r r r r� s z*FirewallClientPolicySettings.setMasqueradec C s& | j d sd| j d< n ttjd��d S )Nr. Tr� rI r r r r� s z*FirewallClientPolicySettings.addMasqueradec C s& | j d rd| j d< n ttjd��d S )Nr. Fr� rI r r r r� s z-FirewallClientPolicySettings.removeMasqueradec C s | j d S r8 rc rI r r r r� s z,FirewallClientPolicySettings.queryMasqueradec C s | j d S �Nr/ rc rI r r r r� # s z,FirewallClientPolicySettings.getForwardPortsc C s || j d< d S r9 rc r� r r r r� & s z,FirewallClientPolicySettings.setForwardPortsc C sd |d u r d}|d u rd}||||f| j d vrH| j d �||||f� nttjd||||f ��d S �Nr% r/ r� r{ r� r r r r� ) s �z+FirewallClientPolicySettings.addForwardPortc C sd |d u r d}|d u rd}||||f| j d v rH| j d �||||f� nttjd||||f ��d S r: r� r� r r r r� 4 s �z.FirewallClientPolicySettings.removeForwardPortc C s. |d u r d}|d u rd}||||f| j d v S )Nr% r/ rc r� r r r r� ? s z-FirewallClientPolicySettings.queryForwardPortc C s | j d S )Nr+ rc rI r r r r� G s z)FirewallClientPolicySettings.getRichRulesc C s dd� |D �}|| j d< d S )Nc S s g | ]}t t|d ���qS r� r� r� r r r r� L r� z=FirewallClientPolicySettings.setRichRules.<locals>.<listcomp>r+ rc r� r r r r� J s z)FirewallClientPolicySettings.setRichRulesc C s> t t|d��}|| jd vr.| jd �|� n ttj|��d S �Nr� r+ r� r� r r r r� N s z(FirewallClientPolicySettings.addRichRulec C s> t t|d��}|| jd v r.| jd �|� n ttj|��d S r; r� r� r r r r� U s z+FirewallClientPolicySettings.removeRichRulec C s t t|d��}|| jd v S r; r� r� r r r r� \ s z*FirewallClientPolicySettings.queryRichRulec C s | j d S �Nr) rc rI r r r �getIngressZonesa s z,FirewallClientPolicySettings.getIngressZonesc C s || j d< d S r< rc )rB r) r r r �setIngressZonesd s z,FirewallClientPolicySettings.setIngressZonesc C s0 || j d vr | j d �|� n ttj|��d S r< r{ �rB Z ingress_zoner r r �addIngressZoneg s z+FirewallClientPolicySettings.addIngressZonec C s0 || j d v r | j d �|� n ttj|��d S r< r� r? r r r �removeIngressZonem s z.FirewallClientPolicySettings.removeIngressZonec C s || j d v S r< rc r? r r r �queryIngressZones s z-FirewallClientPolicySettings.queryIngressZonec C s | j d S �Nr( rc rI r r r �getEgressZonesw s z+FirewallClientPolicySettings.getEgressZonesc C s || j d< d S rC rc )rB r( r r r �setEgressZonesz s z+FirewallClientPolicySettings.setEgressZonesc C s0 || j d vr | j d �|� n ttj|��d S rC r{ �rB Z egress_zoner r r � addEgressZone} s z*FirewallClientPolicySettings.addEgressZonec C s0 || j d v r | j d �|� n ttj|��d S rC r� rF r r r �removeEgressZone� s z-FirewallClientPolicySettings.removeEgressZonec C s || j d v S rC rc rF r r r �queryEgressZone� s z,FirewallClientPolicySettings.queryEgressZonec C s | j d S �Nr* rc rI r r r � getPriority� s z(FirewallClientPolicySettings.getPriorityc C s t |�| jd< d S rJ )�intr9 )rB r* r r r � setPriority� s z(FirewallClientPolicySettings.setPriority)N)Fr� r� r� r# rE rJ rP r@ r\ ra rd rf ri rk rn rp rs ru rx rz r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r= r> r@ rA rB rD rE rG rH rI rK rM r r r r r' G s r' c @ st e Zd Zdd� Zedd� �Zedd� �Zedd� �Zed d � �Zed d � �Z ed d� �Z edd� �Z edd� �Z dS )�FirewallClientConfigPolicyc C sL || _ || _| j �tjj|�| _tj| jtjjd�| _ tj| jdd�| _ d S r� ) r r r r r r r r � DBUS_INTERFACE_CONFIG_POLICY� fw_policyr r r r r rE � s ��z#FirewallClientConfigPolicy.__init__c C s t | j�tjj|��S rQ )r r r r r rO r r r r r � s �z'FirewallClientConfigPolicy.get_propertyc C s t | j�tjj��S rQ )r r r r r rO rI r r r r � s �z)FirewallClientConfigPolicy.get_propertiesc C s | j �tjj||� d S rQ )r r r r rO r r r r r � s �z'FirewallClientConfigPolicy.set_propertyc C s t t| j�� ��S rQ )r' r rP r rI r r r r � s z&FirewallClientConfigPolicy.getSettingsc C s | j �|�� � d S rQ )rP r r\ r^ r r r r � s z!FirewallClientConfigPolicy.updatec C s | j �� d S rQ )rP r rI r r r r � s z'FirewallClientConfigPolicy.loadDefaultsc C s | j �� d S rQ )rP r� rI r r r r� � s z!FirewallClientConfigPolicy.removec C s | j �|� d S rQ )rP r r r r r r � s z!FirewallClientConfigPolicy.renameN) r� r� r� rE r# r r r r r r r� r r r r r rN � s" rN c @ s8 e Zd Zed^dd��Zedd� �Zedd� �Zedd � �Zed d � �Zed d � �Z edd� �Z edd� �Z edd� �Z edd� �Z edd� �Zedd� �Zedd� �Zed d � �Zed d � �Zed d!� �Zed"d#� �Zed$d%� �Zed&d'� �Zed(d)� �Zed*d+� �Zed,d-� �Zed.d/� �Zed0d1� �Zed2d3� �Z ed4d5� �Z ed6d7� �Z ed8d9� �Z ed:d;� �Z ed<d=� �Z!ed>d?� �Z"ed@dA� �Z#edBdC� �Z$edDdE� �Z%ed_dFdG��Z&edHdI� �Z'edJdK� �Z(edLdM� �Z)edNdO� �Z*edPdQ� �Z+edRdS� �Z,edTdU� �Z-edVdW� �Z.edXdY� �Z/edZd[� �Z0ed\d]� �Z1dS )`� FirewallClientServiceSettingsNc C sz dddg g i g g g g g | _ g d�| _g d�| _|rvt|�tu r`t|�D ]\}}|| | j |< qFnt|�tu rv| �|� d S )Nr% ) r& r' r( r, �modules� destinationr2 r3 �includes�helpers) r5 r5 r5 r7 r5 �ssr5 r7 r5 r5 )r9 r: r; rW r= r> r? r@ rA r r r rE � s z&FirewallClientServiceSettings.__init__c C s d| j | jf S rF rG rI r r r rJ � s z&FirewallClientServiceSettings.__repr__c C s( i }t | j| j�D ]\}}|||< q|S rQ rK rM r r r rP � s z-FirewallClientServiceSettings.getSettingsDictc C s$ |D ]}|| | j | j�|�< qd S rQ rR rT r r r r@ � s z-FirewallClientServiceSettings.setSettingsDictc C sn i }t | j| j| j�D ]R\}}}t|�tu r@tj||d�||< qt|�tu r`tj ||d�||< q|||< q|S r, rV rZ r r r r\ � s z1FirewallClientServiceSettings.getSettingsDbusDictc C s | j d S rb rc rI r r r rd � s z(FirewallClientServiceSettings.getVersionc C s || j d< d S rb rc re r r r rf � s z(FirewallClientServiceSettings.setVersionc C s | j d S rg rc rI r r r ri � s z&FirewallClientServiceSettings.getShortc C s || j d< d S rg rc rj r r r rk � s z&FirewallClientServiceSettings.setShortc C s | j d S rl rc rI r r r rn � s z,FirewallClientServiceSettings.getDescriptionc C s || j d< d S rl rc ro r r r rp s z,FirewallClientServiceSettings.setDescriptionc C s | j d S �N� rc rI r r r r� s z&FirewallClientServiceSettings.getPortsc C s || j d< d S rW rc r� r r r r� s z&FirewallClientServiceSettings.setPortsc C s@ ||f| j d vr(| j d �||f� nttjd||f ��d S �NrX r� r{ r� r r r r� s �z%FirewallClientServiceSettings.addPortc C s@ ||f| j d v r(| j d �||f� nttjd||f ��d S rY r� r� r r r r� s �z(FirewallClientServiceSettings.removePortc C s ||f| j d v S rW rc r� r r r r� s z'FirewallClientServiceSettings.queryPortc C s | j d S r� rc rI r r r r� s z*FirewallClientServiceSettings.getProtocolsc C s || j d< d S r� rc r� r r r r� s z*FirewallClientServiceSettings.setProtocolsc C s0 || j d vr | j d �|� n ttj|��d S r� r{ r� r r r r� " s z)FirewallClientServiceSettings.addProtocolc C s0 || j d v r | j d �|� n ttj|��d S r� r� r� r r r r� ( s z,FirewallClientServiceSettings.removeProtocolc C s || j d v S r� rc r� r r r r� . s z+FirewallClientServiceSettings.queryProtocolc C s | j d S r� rc rI r r r r� 2 s z,FirewallClientServiceSettings.getSourcePortsc C s || j d< d S r� rc r� r r r r� 5 s z,FirewallClientServiceSettings.setSourcePortsc C s@ ||f| j d vr(| j d �||f� nttjd||f ��d S �Nr� r� r{ r� r r r r� 8 s �z+FirewallClientServiceSettings.addSourcePortc C s@ ||f| j d v r(| j d �||f� nttjd||f ��d S rZ r� r� r r r r� ? s �z.FirewallClientServiceSettings.removeSourcePortc C s ||f| j d v S r� rc r� r r r r� F s z-FirewallClientServiceSettings.querySourcePortc C s | j d S �Nrq rc rI r r r � getModulesJ s z(FirewallClientServiceSettings.getModulesc C s || j d< d S r[ rc �rB rR r r r � setModulesM s z(FirewallClientServiceSettings.setModulesc C s0 || j d vr | j d �|� n ttj|��d S r[ r{ �rB �moduler r r � addModuleP s z'FirewallClientServiceSettings.addModulec C s0 || j d v r | j d �|� n ttj|��d S r[ r� r_ r r r � removeModuleV s z*FirewallClientServiceSettings.removeModulec C s || j d v S r[ rc r_ r r r � queryModule\ s z)FirewallClientServiceSettings.queryModulec C s | j d S rv rc rI r r r �getDestinations` s z-FirewallClientServiceSettings.getDestinationsc C s || j d< d S rv rc �rB Z destinationsr r r �setDestinationsc s z-FirewallClientServiceSettings.setDestinationsc C sH || j d vs | j d | |kr0|| j d |< nttjd||f ��d S �Nrw r� r� �rB Z dest_type�addressr r r �setDestinationf s ��z,FirewallClientServiceSettings.setDestinationc C s^ || j d v rJ|d ur<| j d | |kr<ttjd||f ��| j d |= nttjd| ��d S )Nrw r� z'%s'r� rh r r r �removeDestinationn s �z/FirewallClientServiceSettings.removeDestinationc C s || j d v o || j d | kS rv rc rh r r r �queryDestinationw s �z.FirewallClientServiceSettings.queryDestinationc C s | j d S r� rc rI r r r � getIncludes| s z)FirewallClientServiceSettings.getIncludesc C s || j d< d S r� rc �rB rT r r r � setIncludes s z)FirewallClientServiceSettings.setIncludesc C s0 || j d vr | j d �|� n ttj|��d S r� r{ �rB Zincluder r r � addInclude� s z(FirewallClientServiceSettings.addIncludec C s0 || j d v r | j d �|� n ttj|��d S r� r� rp r r r � removeInclude� s z+FirewallClientServiceSettings.removeIncludec C s || j d v S r� rc rp r r r � queryInclude� s z*FirewallClientServiceSettings.queryIncludec C s | j d S r� rc rI r r r � getHelpers� s z(FirewallClientServiceSettings.getHelpersc C s || j d< d S r� rc )rB rU r r r � setHelpers� s z(FirewallClientServiceSettings.setHelpersc C s0 || j d vr | j d �|� n ttj|��d S r� r{ �rB �helperr r r � addHelper� s z'FirewallClientServiceSettings.addHelperc C s0 || j d v r | j d �|� n ttj|��d S r� r� rv r r r � removeHelper� s z*FirewallClientServiceSettings.removeHelperc C s || j d v S r� rc rv r r r � queryHelper� s z)FirewallClientServiceSettings.queryHelper)N)N)2r� r� r� r# rE rJ rP r@ r\ rd rf ri rk rn rp r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r\ r^ ra rb rc rd rf rj rk rl rm ro rq rr rs rt ru rx ry rz r r r r rQ � s� rQ c @ s� e Zd Zed*dd��Zedd� �Zedd� �Zedd � �Zed d � �Zed d � �Z edd� �Z edd� �Z edd� �Z edd� �Z edd� �Zedd� �Zedd� �Zed d � �Zed d � �Zed d!� �Zed"d#� �Zed$d%� �Zed&d'� �Zed(d)� �ZdS )+�FirewallClientIPSetSettingsNc C s" |r || _ nddddi g g| _ d S r# rc r^ r r r rE � s z$FirewallClientIPSetSettings.__init__c C s d| j | jf S rF rG rI r r r rJ � s z$FirewallClientIPSetSettings.__repr__c C s | j d S rb rc rI r r r rd � s z&FirewallClientIPSetSettings.getVersionc C s || j d< d S rb rc re r r r rf � s z&FirewallClientIPSetSettings.setVersionc C s | j d S rg rc rI r r r ri � s z$FirewallClientIPSetSettings.getShortc C s || j d< d S rg rc rj r r r rk � s z$FirewallClientIPSetSettings.setShortc C s | j d S rl rc rI r r r rn � s z*FirewallClientIPSetSettings.getDescriptionc C s || j d< d S rl rc ro r r r rp � s z*FirewallClientIPSetSettings.setDescriptionc C s | j d S rW rc rI r r r �getType� s z#FirewallClientIPSetSettings.getTypec C s || j d< d S rW rc )rB Z ipset_typer r r �setType� s z#FirewallClientIPSetSettings.setTypec C s | j d S r[ rc rI r r r � getOptions� s z&FirewallClientIPSetSettings.getOptionsc C s || j d< d S r[ rc )rB �optionsr r r � setOptions� s z&FirewallClientIPSetSettings.setOptionsc C sP || j d vs | j d | |kr0|| j d |< n ttj|rFd||f n|��d S )Nrq z'%s=%s'r� �rB rN rO r r r � addOption� s ��z%FirewallClientIPSetSettings.addOptionc C s, || j d v r | j d |= n ttj|��d S r[ r� )rB rN r r r � removeOption� s z(FirewallClientIPSetSettings.removeOptionc C s || j d v o | j d | |kS r[ rc r� r r r � queryOption� s z'FirewallClientIPSetSettings.queryOptionc C s | j d S rv rc rI r r r � getEntries� s z&FirewallClientIPSetSettings.getEntriesc C s@ d| j d v r*| j d d dkr*ttj��t|� || j d< d S �N�timeoutrq �0rw )r9 r r �IPSET_WITH_TIMEOUTr �rB �entriesr r r � setEntries� s � z&FirewallClientIPSetSettings.setEntriesc C sr d| j d v r*| j d d dkr*ttj��t|�}|| j d vrbt|| j d � | j d �|� n ttj|��d S r� )r9 r r r� r r r| r} �rB �entryr r r �addEntry� s � z$FirewallClientIPSetSettings.addEntryc C sb d| j d v r*| j d d dkr*ttj��t|�}|| j d v rR| j d �|� n ttj|��d S r� )r9 r r r� r r� r� r� r r r � removeEntry� s � z'FirewallClientIPSetSettings.removeEntryc C s@ d| j d v r*| j d d dkr*ttj��t|�}|| j d v S r� )r9 r r r� r r� r r r � queryEntry s � z&FirewallClientIPSetSettings.queryEntry)N)r� r� r� r# rE rJ rd rf ri rk rn rp r| r} r~ r� r� r� r� r� r� r� r� r� r r r r r{ � sP r{ c @ s� e Zd Zedd� �Zedd� �Zedd� �Zedd� �Zed d � �Zed d � �Z ed d� �Z edd� �Z edd� �Z edd� �Z edd� �Zedd� �Zedd� �Zedd � �Zed d � �Zed d � �Zed!d"� �Zed#d$� �Zed%d&� �Zed'd(� �Zd)S )*�FirewallClientConfigIPSetc C sL || _ || _| j �tjj|�| _tj| jtjjd�| _ tj| jdd�| _ d S r� ) r r r r r r r r �DBUS_INTERFACE_CONFIG_IPSET�fw_ipsetr r r r r rE s ��z"FirewallClientConfigIPSet.__init__c C s t | j�tjj|��S rQ )r r r r r r� r r r r r s �z&FirewallClientConfigIPSet.get_propertyc C s t | j�tjj��S rQ )r r r r r r� rI r r r r # s �z(FirewallClientConfigIPSet.get_propertiesc C s | j �tjj||� d S rQ )r r r r r� r r r r r ( s �z&FirewallClientConfigIPSet.set_propertyc C s t tt| j�� ���S rQ )r{ r= r r� r rI r r r r - s �z%FirewallClientConfigIPSet.getSettingsc C s | j �t|j�� d S rQ )r� r �tupler9 r^ r r r r 2 s z FirewallClientConfigIPSet.updatec C s | j �� d S rQ )r� r rI r r r r 6 s z&FirewallClientConfigIPSet.loadDefaultsc C s | j �� d S rQ )r� r� rI r r r r� : s z FirewallClientConfigIPSet.removec C s | j �|� d S rQ )r� r r r r r r > s z FirewallClientConfigIPSet.renamec C s | j �� S rQ )r� rd rI r r r rd D s z$FirewallClientConfigIPSet.getVersionc C s | j �|� d S rQ )r� rf re r r r rf H s z$FirewallClientConfigIPSet.setVersionc C s | j �� S rQ )r� ri rI r r r ri N s z"FirewallClientConfigIPSet.getShortc C s | j �|� d S rQ )r� rk rj r r r rk R s z"FirewallClientConfigIPSet.setShortc C s | j �� S rQ )r� rn rI r r r rn X s z(FirewallClientConfigIPSet.getDescriptionc C s | j �|� d S rQ )r� rp ro r r r rp \ s z(FirewallClientConfigIPSet.setDescriptionc C s | j �� S rQ �r� r� rI r r r r� b s z$FirewallClientConfigIPSet.getEntriesc C s | j �|� d S rQ �r� r� r� r r r r� f s z$FirewallClientConfigIPSet.setEntriesc C s | j �|� d S rQ �r� r� r� r r r r� j s z"FirewallClientConfigIPSet.addEntryc C s | j �|� d S rQ �r� r� r� r r r r� n s z%FirewallClientConfigIPSet.removeEntryc C s | j �|�S rQ )r� r� r� r r r r� r s z$FirewallClientConfigIPSet.queryEntryN)r� r� r� r# rE r r r r r r r� r rd rf ri rk rn rp r� r� r� r� r� r r r r r� sP r� c @ s� e Zd Zed$dd��Zedd� �Zedd� �Zedd � �Zed d � �Zed d � �Z edd� �Z edd� �Z edd� �Z edd� �Z edd� �Zedd� �Zedd� �Zed d � �Zed d � �Zed d!� �Zed"d#� �ZdS )%� FirewallClientHelperSettingsNc C s" |r || _ ndddddg g| _ d S r# rc r^ r r r rE y s z%FirewallClientHelperSettings.__init__c C s d| j | jf S rF rG rI r r r rJ � s z%FirewallClientHelperSettings.__repr__c C s | j d S rb rc rI r r r rd � s z'FirewallClientHelperSettings.getVersionc C s || j d< d S rb rc re r r r rf � s z'FirewallClientHelperSettings.setVersionc C s | j d S rg rc rI r r r ri � s z%FirewallClientHelperSettings.getShortc C s || j d< d S rg rc rj r r r rk � s z%FirewallClientHelperSettings.setShortc C s | j d S rl rc rI r r r rn � s z+FirewallClientHelperSettings.getDescriptionc C s || j d< d S rl rc ro r r r rp � s z+FirewallClientHelperSettings.setDescriptionc C s | j d S rW rc rI r r r � getFamily� s z&FirewallClientHelperSettings.getFamilyc C s |d u rd| j d< || j d< d S )Nr% rX rc �rB �ipvr r r � setFamily� s z&FirewallClientHelperSettings.setFamilyc C s | j d S r[ rc rI r r r � getModule� s z&FirewallClientHelperSettings.getModulec C s || j d< d S r[ rc r_ r r r � setModule� s z&FirewallClientHelperSettings.setModulec C s | j d S rv rc rI r r r r� � s z%FirewallClientHelperSettings.getPortsc C s || j d< d S rv rc r� r r r r� � s z%FirewallClientHelperSettings.setPortsc C s@ ||f| j d vr(| j d �||f� nttjd||f ��d S rg r{ r� r r r r� � s �z$FirewallClientHelperSettings.addPortc C s@ ||f| j d v r(| j d �||f� nttjd||f ��d S rg r� r� r r r r� � s �z'FirewallClientHelperSettings.removePortc C s ||f| j d v S rv rc r� r r r r� � s z&FirewallClientHelperSettings.queryPort)N)r� r� r� r# rE rJ rd rf ri rk rn rp r� r� r� r� r� r� r� r� r� r r r r r� x sD r� c @ s, e Zd Zedd� �Zedd� �Zedd� �Zedd� �Zed d � �Zed d � �Z ed d� �Z edd� �Z edd� �Z edd� �Z edd� �Zedd� �Zedd� �Zedd � �Zed d � �Zed d � �Zed!d"� �Zed#d$� �Zed%d&� �Zed'd(� �Zed)d*� �Zed+d,� �Zed-d.� �Zed/d0� �Zd1S )2�FirewallClientConfigHelperc C sL || _ || _| j �tjj|�| _tj| jtjjd�| _ tj| jdd�| _ d S r� ) r r r r r r r r � DBUS_INTERFACE_CONFIG_HELPER� fw_helperr r r r r rE � s ��z#FirewallClientConfigHelper.__init__c C s t | j�tjj|��S rQ )r r r r r r� r r r r r � s �z'FirewallClientConfigHelper.get_propertyc C s t | j�tjj��S rQ )r r r r r r� rI r r r r � s �z)FirewallClientConfigHelper.get_propertiesc C s | j �tjj||� d S rQ )r r r r r� r r r r r � s �z'FirewallClientConfigHelper.set_propertyc C s t tt| j�� ���S rQ )r� r= r r� r rI r r r r � s �z&FirewallClientConfigHelper.getSettingsc C s | j �t|j�� d S rQ )r� r r� r9 r^ r r r r � s z!FirewallClientConfigHelper.updatec C s | j �� d S rQ )r� r rI r r r r � s z'FirewallClientConfigHelper.loadDefaultsc C s | j �� d S rQ )r� r� rI r r r r� � s z!FirewallClientConfigHelper.removec C s | j �|� d S rQ )r� r r r r r r � s z!FirewallClientConfigHelper.renamec C s | j �� S rQ )r� rd rI r r r rd � s z%FirewallClientConfigHelper.getVersionc C s | j �|� d S rQ )r� rf re r r r rf � s z%FirewallClientConfigHelper.setVersionc C s | j �� S rQ )r� ri rI r r r ri � s z#FirewallClientConfigHelper.getShortc C s | j �|� d S rQ )r� rk rj r r r rk s z#FirewallClientConfigHelper.setShortc C s | j �� S rQ )r� rn rI r r r rn s z)FirewallClientConfigHelper.getDescriptionc C s | j �|� d S rQ )r� rp ro r r r rp s z)FirewallClientConfigHelper.setDescriptionc C s | j �� S rQ )r� r� rI r r r r� s z#FirewallClientConfigHelper.getPortsc C s | j �|� d S rQ )r� r� r� r r r r� s z#FirewallClientConfigHelper.setPortsc C s | j �||� d S rQ )r� r� r� r r r r� s z"FirewallClientConfigHelper.addPortc C s | j �||� d S rQ )r� r� r� r r r r� s z%FirewallClientConfigHelper.removePortc C s | j �||�S rQ )r� r� r� r r r r� # s z$FirewallClientConfigHelper.queryPortc C s | j �� S rQ )r� r� rI r r r r� ) s z$FirewallClientConfigHelper.getFamilyc C s$ |d u r| j �d� | j �|� d S r# )r� r� r� r r r r� - s z$FirewallClientConfigHelper.setFamilyc C s | j �� S rQ )r� r� rI r r r r� 5 s z$FirewallClientConfigHelper.getModulec C s | j �|� d S rQ )r� r� r_ r r r r� 9 s z$FirewallClientConfigHelper.setModuleN) r� r� r� r# rE r r r r r r r� r rd rf ri rk rn rp r� r� r� r� r� r� r� r� r� r r r r r� � s` r� c @ s6 e Zd Zedd� �Zedd� �Zedd� �Zedd� �Zed d � �Zed d � �Z ed d� �Z edd� �Z edd� �Z edd� �Z edd� �Zedd� �Zedd� �Zedd � �Zed d � �Zed d � �Zed!d"� �Zed#d$� �Zed%d&� �Zed'd(� �Zed)d*� �Zed+d,� �Zed-d.� �Zed/d0� �Zed1d2� �Z ed3d4� �Z ed5d6� �Z ed7d8� �Z ed9d:� �Z ed;d<� �Z!ed=d>� �Z"ed?d@� �Z#edAdB� �Z$edCdD� �Z%edEdF� �Z&edGdH� �Z'edIdJ� �Z(edKdL� �Z)edMdN� �Z*ed^dPdQ��Z+edRdS� �Z,edTdU� �Z-edVdW� �Z.edXdY� �Z/edZd[� �Z0ed\d]� �Z1dOS )_�FirewallClientConfigServicec C sL || _ || _| j �tjj|�| _tj| jtjjd�| _ tj| jdd�| _ d S r� ) r r r r r r r r � DBUS_INTERFACE_CONFIG_SERVICE� fw_servicer r r r r rE @ s ��z$FirewallClientConfigService.__init__c C s t | j�tjj|��S rQ )r r r r r r� r r r r r K s �z(FirewallClientConfigService.get_propertyc C s t | j�tjj��S rQ )r r r r r r� rI r r r r P s �z*FirewallClientConfigService.get_propertiesc C s | j �tjj||� d S rQ )r r r r r� r r r r r U s �z(FirewallClientConfigService.set_propertyc C s t t| j�� ��S rQ )rQ r r� r rI r r r r Z s �z'FirewallClientConfigService.getSettingsc C s | j �|�� � d S rQ )r� r r\ r^ r r r r _ s z"FirewallClientConfigService.updatec C s | j �� d S rQ )r� r rI r r r r c s z(FirewallClientConfigService.loadDefaultsc C s | j �� d S rQ )r� r� rI r r r r� g s z"FirewallClientConfigService.removec C s | j �|� d S rQ )r� r r r r r r k s z"FirewallClientConfigService.renamec C s | j �� S rQ )r� rd rI r r r rd q s z&FirewallClientConfigService.getVersionc C s | j �|� d S rQ )r� rf re r r r rf u s z&FirewallClientConfigService.setVersionc C s | j �� S rQ )r� ri rI r r r ri { s z$FirewallClientConfigService.getShortc C s | j �|� d S rQ )r� rk rj r r r rk s z$FirewallClientConfigService.setShortc C s | j �� S rQ )r� rn rI r r r rn � s z*FirewallClientConfigService.getDescriptionc C s | j �|� d S rQ )r� rp ro r r r rp � s z*FirewallClientConfigService.setDescriptionc C s | j �� S rQ )r� r� rI r r r r� � s z$FirewallClientConfigService.getPortsc C s | j �|� d S rQ )r� r� r� r r r r� � s z$FirewallClientConfigService.setPortsc C s | j �||� d S rQ )r� r� r� r r r r� � s z#FirewallClientConfigService.addPortc C s | j �||� d S rQ )r� r� r� r r r r� � s z&FirewallClientConfigService.removePortc C s | j �||�S rQ )r� r� r� r r r r� � s z%FirewallClientConfigService.queryPortc C s | j �� S rQ )r� r� rI r r r r� � s z(FirewallClientConfigService.getProtocolsc C s | j �|� d S rQ )r� r� r� r r r r� � s z(FirewallClientConfigService.setProtocolsc C s | j �|� d S rQ )r� r� r� r r r r� � s z'FirewallClientConfigService.addProtocolc C s | j �|� d S rQ )r� r� r� r r r r� � s z*FirewallClientConfigService.removeProtocolc C s | j �|�S rQ )r� r� r� r r r r� � s z)FirewallClientConfigService.queryProtocolc C s | j �� S rQ )r� r� rI r r r r� � s z*FirewallClientConfigService.getSourcePortsc C s | j �|� d S rQ )r� r� r� r r r r� � s z*FirewallClientConfigService.setSourcePortsc C s | j �||� d S rQ )r� r� r� r r r r� � s z)FirewallClientConfigService.addSourcePortc C s | j �||� d S rQ )r� r� r� r r r r� � s z,FirewallClientConfigService.removeSourcePortc C s | j �||�S rQ )r� r� r� r r r r� � s z+FirewallClientConfigService.querySourcePortc C s | j �� S rQ )r� r\ rI r r r r\ � s z&FirewallClientConfigService.getModulesc C s | j �|� d S rQ )r� r^ r] r r r r^ � s z&FirewallClientConfigService.setModulesc C s | j �|� d S rQ )r� ra r_ r r r ra � s z%FirewallClientConfigService.addModulec C s | j �|� d S rQ )r� rb r_ r r r rb � s z(FirewallClientConfigService.removeModulec C s | j �|�S rQ )r� rc r_ r r r rc � s z'FirewallClientConfigService.queryModulec C s | j �� S rQ )r� rd rI r r r rd � s z+FirewallClientConfigService.getDestinationsc C s | j �|� d S rQ )r� rf re r r r rf � s z+FirewallClientConfigService.setDestinationsc C s | j �|�S rQ )r� �getDestination�rB rS r r r r� � s z*FirewallClientConfigService.getDestinationc C s | j �||� d S rQ )r� rj �rB rS ri r r r rj � s z*FirewallClientConfigService.setDestinationNc C s: |d ur*| � |�|kr*ttjd||f ��| j�|� d S )Nr� )r� r r r� r� rk r� r r r rk � s �z-FirewallClientConfigService.removeDestinationc C s | j �||�S rQ )r� rl r� r r r rl � s z,FirewallClientConfigService.queryDestinationc C s | j �� S rQ )r� rm rI r r r rm s z'FirewallClientConfigService.getIncludesc C s | j �|� d S rQ )r� ro rn r r r ro s z'FirewallClientConfigService.setIncludesc C s | j �|� d S rQ )r� rq rp r r r rq s z&FirewallClientConfigService.addIncludec C s | j �|� d S rQ )r� rr rp r r r rr s z)FirewallClientConfigService.removeIncludec C s | j �|�S rQ )r� rs rp r r r rs s z(FirewallClientConfigService.queryInclude)N)2r� r� r� r# rE r r r r r r r� r rd rf ri rk rn rp r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r\ r^ ra rb rc rd rf r� rj rk rl rm ro rq rr rs r r r r r� ? s� r� c @ s� e Zd Zed dd��Zedd� �Zedd� �Zedd � �Zed d � �Zed d � �Z edd� �Z edd� �Z edd� �Z edd� �Z edd� �Zedd� �Zedd� �ZdS ) � FirewallClientIcmpTypeSettingsNc C s |r || _ ndddg g| _ d S r# rc r^ r r r rE s z'FirewallClientIcmpTypeSettings.__init__c C s d| j | jf S rF rG rI r r r rJ # s z'FirewallClientIcmpTypeSettings.__repr__c C s | j d S rb rc rI r r r rd ' s z)FirewallClientIcmpTypeSettings.getVersionc C s || j d< d S rb rc re r r r rf * s z)FirewallClientIcmpTypeSettings.setVersionc C s | j d S rg rc rI r r r ri . s z'FirewallClientIcmpTypeSettings.getShortc C s || j d< d S rg rc rj r r r rk 1 s z'FirewallClientIcmpTypeSettings.setShortc C s | j d S rl rc rI r r r rn 5 s z-FirewallClientIcmpTypeSettings.getDescriptionc C s || j d< d S rl rc ro r r r rp 8 s z-FirewallClientIcmpTypeSettings.setDescriptionc C s | j d S rW rc rI r r r rd < s z.FirewallClientIcmpTypeSettings.getDestinationsc C s || j d< d S rW rc re r r r rf ? s z.FirewallClientIcmpTypeSettings.setDestinationsc C sH | j d sttj|��n,|| j d vr8| j d �|� n ttj|��d S rW )r9 r r r} r| r� r r r �addDestinationB s z-FirewallClientIcmpTypeSettings.addDestinationc C s\ || j d v r | j d �|� n8| j d sL| �ttddg�t|g� �� n ttj|��d S )NrX Zipv4Zipv6)r9 r� rf r= �setr r r� r� r r r rk K s � z0FirewallClientIcmpTypeSettings.removeDestinationc C s | j d p|| j d v S rW rc r� r r r rl V s �z/FirewallClientIcmpTypeSettings.queryDestination)N)r� r� r� r# rE rJ rd rf ri rk rn rp rd rf r� rk rl r r r r r� s4 r� c @ s� e Zd Zedd� �Zedd� �Zedd� �Zedd� �Zed d � �Zed d � �Z ed d� �Z edd� �Z edd� �Z edd� �Z edd� �Zedd� �Zedd� �Zedd � �Zed d � �Zed d � �Zed!d"� �Zed#d$� �Zed%d&� �Zed'd(� �Zd)S )*� FirewallClientConfigIcmpTypec C sL || _ || _| j �tjj|�| _tj| jtjjd�| _ tj| jdd�| _ d S r� ) r r r r r r r r � DBUS_INTERFACE_CONFIG_ICMPTYPE� fw_icmptyper r r r r rE _ s ��z%FirewallClientConfigIcmpType.__init__c C s t | j�tjj|��S rQ )r r r r r r� r r r r r j s �z)FirewallClientConfigIcmpType.get_propertyc C s t | j�tjj��S rQ )r r r r r r� rI r r r r o s �z+FirewallClientConfigIcmpType.get_propertiesc C s | j �tjj||� d S rQ )r r r r r� r r r r r t s �z)FirewallClientConfigIcmpType.set_propertyc C s t tt| j�� ���S rQ )r� r= r r� r rI r r r r y s �z(FirewallClientConfigIcmpType.getSettingsc C s | j �t|j�� d S rQ )r� r r� r9 r^ r r r r ~ s z#FirewallClientConfigIcmpType.updatec C s | j �� d S rQ )r� r rI r r r r � s z)FirewallClientConfigIcmpType.loadDefaultsc C s | j �� d S rQ )r� r� rI r r r r� � s z#FirewallClientConfigIcmpType.removec C s | j �|� d S rQ )r� r r r r r r � s z#FirewallClientConfigIcmpType.renamec C s | j �� S rQ )r� rd rI r r r rd � s z'FirewallClientConfigIcmpType.getVersionc C s | j �|� d S rQ )r� rf re r r r rf � s z'FirewallClientConfigIcmpType.setVersionc C s | j �� S rQ )r� ri rI r r r ri � s z%FirewallClientConfigIcmpType.getShortc C s | j �|� d S rQ )r� rk rj r r r rk � s z%FirewallClientConfigIcmpType.setShortc C s | j �� S rQ )r� rn rI r r r rn � s z+FirewallClientConfigIcmpType.getDescriptionc C s | j �|� d S rQ )r� rp ro r r r rp � s z+FirewallClientConfigIcmpType.setDescriptionc C s | j �� S rQ )r� rd rI r r r rd � s z,FirewallClientConfigIcmpType.getDestinationsc C s | j �|� d S rQ )r� rf re r r r rf � s z,FirewallClientConfigIcmpType.setDestinationsc C s | j �|� d S rQ )r� r� r� r r r r� � s z+FirewallClientConfigIcmpType.addDestinationc C s | j �|� d S rQ )r� rk r� r r r rk � s z.FirewallClientConfigIcmpType.removeDestinationc C s | j �|�S rQ )r� rl r� r r r rl � s z-FirewallClientConfigIcmpType.queryDestinationN)r� r� r� r# rE r r r r r r r� r rd rf ri rk rn rp rd rf r� rk rl r r r r r� ^ sP r� c @ s e Zd Zed.dd��Zedd� �Zedd� �Zedd � �Zed d � �Zed d � �Z edd� �Z edd� �Z edd� �Z edd� �Z edd� �Zedd� �Zedd� �Zed d � �Zed d � �Zed d!� �Zed"d#� �Zed$d%� �Zed&d'� �Zed(d)� �Zed*d+� �Zed,d-� �ZdS )/�'FirewallClientPoliciesLockdownWhitelistNc C s |r || _ ng g g g g| _ d S rQ rc r^ r r r rE � s z0FirewallClientPoliciesLockdownWhitelist.__init__c C s d| j | jf S rF rG rI r r r rJ � s z0FirewallClientPoliciesLockdownWhitelist.__repr__c C s | j d S rb rc rI r r r � getCommands� s z3FirewallClientPoliciesLockdownWhitelist.getCommandsc C s || j d< d S rb rc )rB Zcommandsr r r � setCommands� s z3FirewallClientPoliciesLockdownWhitelist.setCommandsc C s" || j d vr | j d �|� d S rb �r9 r| �rB Zcommandr r r � addCommand� s z2FirewallClientPoliciesLockdownWhitelist.addCommandc C s" || j d v r | j d �|� d S rb �r9 r� r� r r r � removeCommand� s z5FirewallClientPoliciesLockdownWhitelist.removeCommandc C s || j d v S rb rc r� r r r � queryCommand� s z4FirewallClientPoliciesLockdownWhitelist.queryCommandc C s | j d S rg rc rI r r r � getContexts� s z3FirewallClientPoliciesLockdownWhitelist.getContextsc C s || j d< d S rg rc )rB Zcontextsr r r � setContexts� s z3FirewallClientPoliciesLockdownWhitelist.setContextsc C s" || j d vr | j d �|� d S rg r� �rB �contextr r r � addContext� s z2FirewallClientPoliciesLockdownWhitelist.addContextc C s" || j d v r | j d �|� d S rg r� r� r r r � removeContext� s z5FirewallClientPoliciesLockdownWhitelist.removeContextc C s || j d v S rg rc r� r r r � queryContext� s z4FirewallClientPoliciesLockdownWhitelist.queryContextc C s | j d S rl rc rI r r r �getUsers� s z0FirewallClientPoliciesLockdownWhitelist.getUsersc C s || j d< d S rl rc )rB Zusersr r r �setUsers� s z0FirewallClientPoliciesLockdownWhitelist.setUsersc C s" || j d vr | j d �|� d S rl r� �rB �userr r r �addUser� s z/FirewallClientPoliciesLockdownWhitelist.addUserc C s" || j d v r | j d �|� d S rl r� r� r r r � removeUser� s z2FirewallClientPoliciesLockdownWhitelist.removeUserc C s || j d v S rl rc r� r r r � queryUser s z1FirewallClientPoliciesLockdownWhitelist.queryUserc C s | j d S rW rc rI r r r �getUids s z/FirewallClientPoliciesLockdownWhitelist.getUidsc C s || j d< d S rW rc �rB Zuidsr r r �setUids s z/FirewallClientPoliciesLockdownWhitelist.setUidsc C s" || j d vr | j d �|� d S rW r� �rB �uidr r r �addUid s z.FirewallClientPoliciesLockdownWhitelist.addUidc C s" || j d v r | j d �|� d S rW r� r� r r r � removeUid s z1FirewallClientPoliciesLockdownWhitelist.removeUidc C s || j d v S rW rc r� r r r �queryUid s z0FirewallClientPoliciesLockdownWhitelist.queryUid)N)r� r� r� r# rE rJ r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r r r r r� � sX r� c @ s� e Zd Zedd� �Zedd� �Zedd� �Zedd� �Zed d � �Zed d � �Z ed d� �Z edd� �Z edd� �Z edd� �Z edd� �Zedd� �Zedd� �Zedd � �Zed d � �Zed d � �Zed!d"� �Zed#d$� �Zed%d&� �Zed'd(� �Zd)S )*� FirewallClientConfigPoliciesc C s8 || _ | j �tjjtjj�| _tj| jtjjd�| _ d S �Nr ) r r r r r �DBUS_PATH_CONFIGr r � DBUS_INTERFACE_CONFIG_POLICIES� fw_policies�rB r r r r rE s ��z%FirewallClientConfigPolicies.__init__c C s t tt| j�� ���S rQ )r� r= r r� �getLockdownWhitelistrI r r r r� % s �z1FirewallClientConfigPolicies.getLockdownWhitelistc C s | j �t|j�� d S rQ )r� �setLockdownWhitelistr� r9 r^ r r r r� * s z1FirewallClientConfigPolicies.setLockdownWhitelistc C s | j �|� d S rQ �r� �addLockdownWhitelistCommandr� r r r r� 0 s z8FirewallClientConfigPolicies.addLockdownWhitelistCommandc C s | j �|� d S rQ �r� � removeLockdownWhitelistCommandr� r r r r� 4 s z;FirewallClientConfigPolicies.removeLockdownWhitelistCommandc C s t | j�|��S rQ �r r� � queryLockdownWhitelistCommandr� r r r r� 8 s z:FirewallClientConfigPolicies.queryLockdownWhitelistCommandc C s t | j�� �S rQ �r r� � getLockdownWhitelistCommandsrI r r r r� < s z9FirewallClientConfigPolicies.getLockdownWhitelistCommandsc C s | j �|� d S rQ �r� �addLockdownWhitelistContextr� r r r r� B s z8FirewallClientConfigPolicies.addLockdownWhitelistContextc C s | j �|� d S rQ �r� � removeLockdownWhitelistContextr� r r r r� F s z;FirewallClientConfigPolicies.removeLockdownWhitelistContextc C s t | j�|��S rQ �r r� � queryLockdownWhitelistContextr� r r r r� J s z:FirewallClientConfigPolicies.queryLockdownWhitelistContextc C s t | j�� �S rQ �r r� � getLockdownWhitelistContextsrI r r r r� N s z9FirewallClientConfigPolicies.getLockdownWhitelistContextsc C s | j �|� d S rQ �r� �addLockdownWhitelistUserr� r r r r� T s z5FirewallClientConfigPolicies.addLockdownWhitelistUserc C s | j �|� d S rQ �r� �removeLockdownWhitelistUserr� r r r r� X s z8FirewallClientConfigPolicies.removeLockdownWhitelistUserc C s t | j�|��S rQ �r r� �queryLockdownWhitelistUserr� r r r r� \ s z7FirewallClientConfigPolicies.queryLockdownWhitelistUserc C s t | j�� �S rQ �r r� �getLockdownWhitelistUsersrI r r r r� ` s z6FirewallClientConfigPolicies.getLockdownWhitelistUsersc C s t | j�� �S rQ �r r� �getLockdownWhitelistUidsrI r r r r� f s z5FirewallClientConfigPolicies.getLockdownWhitelistUidsc C s | j �|� d S rQ )r� �setLockdownWhitelistUidsr� r r r r� j s z5FirewallClientConfigPolicies.setLockdownWhitelistUidsc C s | j �|� d S rQ �r� �addLockdownWhitelistUidr� r r r r� n s z4FirewallClientConfigPolicies.addLockdownWhitelistUidc C s | j �|� d S rQ �r� �removeLockdownWhitelistUidr� r r r r� r s z7FirewallClientConfigPolicies.removeLockdownWhitelistUidc C s t | j�|��S rQ �r r� �queryLockdownWhitelistUidr� r r r r� v s z6FirewallClientConfigPolicies.queryLockdownWhitelistUidN)r� r� r� r# rE r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r r r r r� sP r� c @ s e Zd Zed.dd��Zedd� �Zedd� �Zedd � �Zed d � �Zed d � �Z edd� �Z edd� �Z edd� �Z edd� �Z edd� �Zedd� �Zedd� �Zed d � �Zed d � �Zed d!� �Zed"d#� �Zed$d%� �Zed&d'� �Zed(d)� �Zed*d+� �Zed,d-� �ZdS )/�FirewallClientDirectNc C s |r || _ n g g g g| _ d S rQ rc r^ r r r rE } s z FirewallClientDirect.__init__c C s d| j | jf S rF rG rI r r r rJ � s z FirewallClientDirect.__repr__c C s | j d S rb rc rI r r r � getAllChains� s z!FirewallClientDirect.getAllChainsc s � �fdd�| j d D �S )Nc s, g | ]$}|d � kr|d �kr|d �qS )r rh rm r �r� r� �r� �tabler r r� � s �z2FirewallClientDirect.getChains.<locals>.<listcomp>r rc �rB r� r� r r� r � getChains� s z FirewallClientDirect.getChainsc C s || j d< d S rb rc )rB Zchainsr r r � setAllChains� s z!FirewallClientDirect.setAllChainsc C s, |||f}|| j d vr(| j d �|� d S rb r� �rB r� r� �chain�idxr r r �addChain� s z FirewallClientDirect.addChainc C s, |||f}|| j d v r(| j d �|� d S rb r� r r r r � removeChain� s z FirewallClientDirect.removeChainc C s |||f}|| j d v S rb rc r r r r � queryChain� s z FirewallClientDirect.queryChainc C s | j d S rg rc rI r r r � getAllRules� s z FirewallClientDirect.getAllRulesc s � ��fdd�| j d D �S )Nc s< g | ]4}|d �kr|d �kr|d � kr|dd� �qS )r rh rm rX Nr r� �r r� r� r r r� � s �z1FirewallClientDirect.getRules.<locals>.<listcomp>rh rc �rB r� r� r r r r �getRules� s z FirewallClientDirect.getRulesc C s || j d< d S rg rc r� r r r � setAllRules� s z FirewallClientDirect.setAllRulesc C s0 |||||f}|| j d vr,| j d �|� d S rg r� �rB r� r� r r* r r r r r �addRule� s z FirewallClientDirect.addRulec C s0 |||||f}|| j d v r,| j d �|� d S rg r� r r r r � removeRule� s z FirewallClientDirect.removeRulec C sL t | jd �D ]8}|d |kr|d |kr|d |kr| jd �|� qd S )Nrh r rm )r= r9 r� r r r r � removeRules� s $z FirewallClientDirect.removeRulesc C s |||||f}|| j d v S rg rc r r r r � queryRule� s z FirewallClientDirect.queryRulec C s | j d S rl rc rI r r r �getAllPassthroughs� s z'FirewallClientDirect.getAllPassthroughsc C s || j d< d S rl rc )rB Z passthroughsr r r �setAllPassthroughs� s z'FirewallClientDirect.setAllPassthroughsc C s g | j d< d S rl rc rI r r r �removeAllPassthroughs� s z*FirewallClientDirect.removeAllPassthroughsc s � fdd�| j d D �S )Nc s g | ]}|d � kr|d �qS )r rh r r� �r� r r r� � s �z8FirewallClientDirect.getPassthroughs.<locals>.<listcomp>rm rc r� r r r �getPassthroughs� s z$FirewallClientDirect.getPassthroughsc C s* ||f}|| j d vr&| j d �|� d S rl r� �rB r� r r r r r �addPassthrough� s z#FirewallClientDirect.addPassthroughc C s* ||f}|| j d v r&| j d �|� d S rl r� r r r r �removePassthrough� s z&FirewallClientDirect.removePassthroughc C s ||f}|| j d v S rl rc r r r r �queryPassthrough� s z%FirewallClientDirect.queryPassthrough)N)r� r� r� r# rE rJ r� r� r� r r r r r r r r r r r r r r r r r r r r r r� | sX r� c @ s� e Zd Zedd� �Zedd� �Zedd� �Zedd� �Zed d � �Zed d � �Z ed d� �Z edd� �Z edd� �Z edd� �Z edd� �Zedd� �Zedd� �Zedd � �Zed d � �Zed d � �Zed!d"� �Zed#d$� �Zed%d&� �Zd'S )(�FirewallClientConfigDirectc C s8 || _ | j �tjjtjj�| _tj| jtjjd�| _ d S r� ) r r r r r r� r r � DBUS_INTERFACE_CONFIG_DIRECT� fw_directr� r r r rE � s ��z#FirewallClientConfigDirect.__init__c C s t tt| j�� ���S rQ )r� r= r r r rI r r r r � s �z&FirewallClientConfigDirect.getSettingsc C s | j �t|j�� d S rQ )r r r� r9 r^ r r r r � s z!FirewallClientConfigDirect.updatec C s | j �|||� d S rQ �r r r r r r r � s z#FirewallClientConfigDirect.addChainc C s | j �|||� d S rQ �r r r r r r r � s z&FirewallClientConfigDirect.removeChainc C s t | j�|||��S rQ �r r r r r r r r � s z%FirewallClientConfigDirect.queryChainc C s t | j�||��S rQ �r r r� r� r r r r� � s z$FirewallClientConfigDirect.getChainsc C s t | j�� �S rQ �r r r� rI r r r r� s z'FirewallClientConfigDirect.getAllChainsc C s | j �|||||� d S rQ �r r �rB r� r� r r* r r r r r s z"FirewallClientConfigDirect.addRulec C s | j �|||||� d S rQ �r r r" r r r r s z%FirewallClientConfigDirect.removeRulec C s | j �|||� d S rQ �r r r r r r r s z&FirewallClientConfigDirect.removeRulesc C s t | j�|||||��S rQ �r r r r" r r r r s z$FirewallClientConfigDirect.queryRulec C s t | j�|||��S rQ �r r r r r r r r s z#FirewallClientConfigDirect.getRulesc C s t | j�� �S rQ �r r r rI r r r r s z&FirewallClientConfigDirect.getAllRulesc C s | j �||� d S rQ �r r �rB r� r r r r r # s z)FirewallClientConfigDirect.addPassthroughc C s | j �||� d S rQ �r r r) r r r r ' s z,FirewallClientConfigDirect.removePassthroughc C s t | j�||��S rQ �r r r r) r r r r + s z+FirewallClientConfigDirect.queryPassthroughc C s t | j�|��S rQ �r r r r� r r r r / s z*FirewallClientConfigDirect.getPassthroughsc C s t | j�� �S rQ �r r r rI r r r r 3 s z-FirewallClientConfigDirect.getAllPassthroughsN)r� r� r� r# rE r r r r r r� r� r r r r r r r r r r r r r r r r � sL r c @ s� e Zd Zedd� �Zedd� �Zedd� �Zedd� �Zed d � �Zed d � �Z ed d� �Z edd� �Z edd� �Z edd� �Z edd� �Zedd� �Zedd� �Zedd � �Zed d � �Zed d � �Zed!d"� �Zed#d$� �Zed%d&� �Zed'd(� �Zed)d*� �Zed+d,� �Zed-d.� �Zed/d0� �Zed1d2� �Z ed3d4� �Z ed5d6� �Z ed7d8� �Z ed9d:� �Z ed;d<� �Z!ed=d>� �Z"ed?d@� �Z#edAdB� �Z$edCdD� �Z%edEdF� �Z&edGdH� �Z'edIdJ� �Z(edKdL� �Z)dMS )N�FirewallClientConfigc C sb || _ | j �tjjtjj�| _tj| jtjjd�| _ tj| jdd�| _ t | j �| _ t | j �| _d S r� )r r r r r r� r r �DBUS_INTERFACE_CONFIG� fw_configr r� � _policiesr �_directr� r r r rE : s ��� z FirewallClientConfig.__init__c C s t | j�tjj|��S rQ )r r r r r r/ r r r r r I s �z!FirewallClientConfig.get_propertyc C s t | j�tjj��S rQ )r r r r r r/ rI r r r r N s �z#FirewallClientConfig.get_propertiesc C s | j �tjj||� d S rQ )r r r r r/ r r r r r S s z!FirewallClientConfig.set_propertyc C s t | j�� �S rQ )r r0 � getIPSetNamesrI r r r r3 Y s z"FirewallClientConfig.getIPSetNamesc C s t | j�� �S rQ )r r0 � listIPSetsrI r r r r4 ] s z FirewallClientConfig.listIPSetsc C s t | j|�S rQ )r� r �rB r r r r �getIPSeta s z FirewallClientConfig.getIPSetc C s t | j�|��}t| j|�S rQ )r r0 �getIPSetByNamer� r �rB r r r r r r7 e s z#FirewallClientConfig.getIPSetByNamec C s> t |t�r | j�|t|j��}n| j�|t|��}t| j|�S rQ )r< r{ r0 �addIPSetr� r9 r� r �rB r r9 r r r r r9 j s z FirewallClientConfig.addIPSetc C s t | j�� �S rQ )r r0 � getZoneNamesrI r r r r; t s z!FirewallClientConfig.getZoneNamesc C s t | j�� �S rQ )r r0 � listZonesrI r r r r< x s z FirewallClientConfig.listZonesc C s t | j|�S rQ )r� r r5 r r r �getZone| s z FirewallClientConfig.getZonec C s t | j�|��}t| j|�S rQ )r r0 � getZoneByNamer� r r8 r r r r> � s z"FirewallClientConfig.getZoneByNamec C s t | j�|��S rQ )r r0 �getZoneOfInterface)rB Zifacer r r r? � s z'FirewallClientConfig.getZoneOfInterfacec C s t | j�|��S rQ )r r0 �getZoneOfSourcer� r r r r@ � s z$FirewallClientConfig.getZoneOfSourcec C s^ t |t�r | j�||�� �}n4t |t�r8| j�||�}n| j�|t|d d� ��}t| j |�S r� ) r< r$ r0 ZaddZone2r\ r? �addZoner� r� r r: r r r rA � s z FirewallClientConfig.addZonec C s t | j�� �S rQ )r r0 �getPolicyNamesrI r r r rB � s z#FirewallClientConfig.getPolicyNamesc C s t | j�� �S rQ )r r0 � listPoliciesrI r r r rC � s z!FirewallClientConfig.listPoliciesc C s t | j|�S rQ )rN r r5 r r r � getPolicy� s z FirewallClientConfig.getPolicyc C s t | j�|��}t| j|�S rQ )r r0 �getPolicyByNamerN r r8 r r r rE � s z$FirewallClientConfig.getPolicyByNamec C s8 t |t�r | j�||�� �}n| j�||�}t| j|�S rQ )r< r' r0 � addPolicyr\ rN r r: r r r rF � s z FirewallClientConfig.addPolicyc C s t | j�� �S rQ )r r0 �getServiceNamesrI r r r rG � s z$FirewallClientConfig.getServiceNamesc C s t | j�� �S rQ )r r0 � listServicesrI r r r rH � s z!FirewallClientConfig.listServicesc C s t | j|�S rQ )r� r r5 r r r � getService� s z FirewallClientConfig.getServicec C s t | j�|��}t| j|�S rQ )r r0 �getServiceByNamer� r r8 r r r rJ � s z%FirewallClientConfig.getServiceByNamec C s` t |t�r | j�||�� �}n6t|�tu r:| j�||�}n| j�|t|d d� ��}t | j |�S r� ) r< rQ r0 Z addService2r\ rW r? r� r� r� r r: r r r r� � s z FirewallClientConfig.addServicec C s t | j�� �S rQ )r r0 �getIcmpTypeNamesrI r r r rK � s z%FirewallClientConfig.getIcmpTypeNamesc C s t | j�� �S rQ )r r0 � listIcmpTypesrI r r r rL � s z"FirewallClientConfig.listIcmpTypesc C s t | j|�S rQ )r� r r5 r r r � getIcmpType� s z FirewallClientConfig.getIcmpTypec C s t | j�|��}t| j|�S rQ )r r0 �getIcmpTypeByNamer� r r8 r r r rN � s z&FirewallClientConfig.getIcmpTypeByNamec C s> t |t�r | j�|t|j��}n| j�|t|��}t| j|�S rQ )r< r� r0 � addIcmpTyper� r9 r� r r: r r r rO � s z FirewallClientConfig.addIcmpTypec C s | j S rQ )r1 rI r r r �policies� s z FirewallClientConfig.policiesc C s | j S rQ )r2 rI r r r �direct� s zFirewallClientConfig.directc C s t | j�� �S rQ )r r0 �getHelperNamesrI r r r rR � s z#FirewallClientConfig.getHelperNamesc C s t | j�� �S rQ )r r0 � listHelpersrI r r r rS � s z FirewallClientConfig.listHelpersc C s t | j|�S rQ )r� r r5 r r r � getHelper s z FirewallClientConfig.getHelperc C s t | j�|��}t| j|�S rQ )r r0 �getHelperByNamer� r r8 r r r rU s z$FirewallClientConfig.getHelperByNamec C s> t |t�r | j�|t|j��}n| j�|t|��}t| j|�S rQ )r< r� r0 rx r� r9 r� r r: r r r rx s z FirewallClientConfig.addHelperN)*r� r� r� r# rE r r r r3 r4 r6 r7 r9 r; r< r= r> r? r@ rA rB rC rD rE rF rG rH rI rJ r� rK rL rM rN rO rP rQ rR rS rT rU rx r r r r r. 9 s� r. c @ s� e Zd Ze�d dd��Zedd� �Zedd � �Zed d � �Zed d � �Zedd� �Z edd� �Z edd� �Z edd� �Z edd� �Z edd� �Zedd� �Zed d � �Zed d � �Zed d!� �Zed"d#� �Zed$d%� �Zed&d'� �Zed(d)� �Zed*d+� �Zed,d-� �Zed.d/� �Zed0d1� �Zed2d3� �Zed4d5� �Z ed6d7� �Z ed8d9� �Z ed:d;� �Z ed<d=� �Z ed>d?� �Z!ed@dA� �Z"edBdC� �Z#edDdE� �Z$edFdG� �Z%edHdI� �Z&edJdK� �Z'edLdM� �Z(edNdO� �Z)edPdQ� �Z*edRdS� �Z+edTdU� �Z,edVdW� �Z-edXdY� �Z.edZd[� �Z/ed\d]� �Z0ed^d_� �Z1ed`da� �Z2edbdc� �Z3eddde� �Z4edfdg� �Z5edhdi� �Z6edjdk� �Z7edldm� �Z8edndo� �Z9edpdq� �Z:edrds� �Z;edtdu� �Z<edvdw� �Z=edxdy� �Z>edzd{� �Z?ed|d}� �Z@ed~d� �ZAed�d�� �ZBed�d�� �ZCed�d�� �ZDe�d d�d���ZEed�d�� �ZFed�d�� �ZGed�d�� �ZHe�d d�d���ZIed�d�� �ZJed�d�� �ZKed�d�� �ZLe�d d�d���ZMed�d�� �ZNed�d�� �ZOed�d�� �ZPe�d d�d���ZQed�d�� �ZRed�d�� �ZSed�d�� �ZTed�d�� �ZUed�d�� �ZVed�d�� �ZWe�d!d�d���ZXed�d�� �ZYed�d�� �ZZe�d"d�d���Z[ed�d�� �Z\ed�d�� �Z]ed�d�� �Z^e�d#d�d���Z_ed�d�� �Z`ed�d�� �Zaed�d�� �Zbe�d$d�dÄ�Zced�dń �Zded�dDŽ �Zeed�dɄ �Zfed�d˄ �Zged�d̈́ �Zhed�dτ �Zied�dф �Zjed�dӄ �Zked�dՄ �Zled�dׄ �Zmed�dل �Zned�dۄ �Zoed�d݄ �Zped�d߄ �Zqed�d� �Zred�d� �Zsed�d� �Zted�d� �Zued�d� �Zved�d� �Zwed�d� �Zxed�d� �Zyed�d� �Zzed�d� �Z{ed�d�� �Z|ed�d�� �Z}ed�d�� �Z~ed�d�� �Zed�d�� �Z�ed�d�� �Z�e�d �d� �Z�e�d�d� �Z�e�d�d� �Z�e�d�d� �Z�e�d�d � �Z�e�d �d � �Z�e�d �d � �Z�e�d�d� �Z�e�d�d� �Z�e�d�d� �Z�e�d�d� �Z�e�d�d� �Z�e�d�d� �Z�e�d�d� �Z�dS (% �FirewallClientNr Tc P C s� |s^t jjjdd� zt �� | _W qd t jjyZ } z tt j |� � ��W Y d }~qdd }~0 0 n|| _| jj | j ddtj jd� tj jtj jtj jtj jtj jtj jtj jtj jtj jtj jtj jtj jtj jtj j tj j fD ] }| jj | j |dddd � q�i | _ d d d d ddddddddddddddd d d d d d!d"d#d$d%d&d&d'd(d)d*d+d,d-d.d/d0d1d2d3d4d5d6d7d8d9d:d;d<d=d>d?d@dAdBdCdDdEdFdGdHdIdJdKdLdMdNdOdPdQdRdSdTdUdVdWdX�O| _ | �!� || _"|dYk�r�t#�$|| j%� n| �%� d S )ZNT)Zset_as_defaultZNameOwnerChangedzorg.freedesktop.DBus)Zhandler_functionZ signal_namer Zarg0r� �memberr )r Zinterface_keywordZmember_keywordZ path_keyword�connection-changed�connection-established�connection-lostZLogDeniedChangedZDefaultZoneChangedZPanicModeEnabledZPanicModeDisabledZReloadedZ ServiceAddedZServiceRemovedZ PortAddedZ PortRemovedZSourcePortAddedZSourcePortRemovedZ ProtocolAddedZProtocolRemovedZMasqueradeAddedZMasqueradeRemovedZForwardPortAddedZForwardPortRemovedZIcmpBlockAddedZIcmpBlockRemovedZIcmpBlockInversionAddedZIcmpBlockInversionRemovedZ RichRuleAddedZRichRuleRemovedZInterfaceAddedZInterfaceRemovedZZoneOfInterfaceChangedZ SourceAddedZ SourceRemovedZZoneOfSourceChangedZ ZoneUpdatedZ PolicyUpdatedZ EntryAddedZ EntryRemovedZ ChainAddedZ ChainRemovedZ RuleAddedZ RuleRemovedZPassthroughAddedZPassthroughRemovedzconfig:direct:UpdatedZLockdownEnabledZLockdownDisabledZ LockdownWhitelistCommandAddedZ LockdownWhitelistCommandRemovedZ LockdownWhitelistContextAddedZ LockdownWhitelistContextRemovedZLockdownWhitelistUidAddedZLockdownWhitelistUidRemovedZLockdownWhitelistUserAddedZ LockdownWhitelistUserRemovedz(config:policies:LockdownWhitelistUpdatedzconfig:IPSetAddedzconfig:IPSetUpdatedzconfig:IPSetRemovedzconfig:IPSetRenamedzconfig:ZoneAddedzconfig:ZoneUpdatedzconfig:ZoneRemovedzconfig:ZoneRenamedzconfig:PolicyAddedzconfig:PolicyUpdatedzconfig:PolicyRemovedzconfig:PolicyRenamedzconfig:ServiceAddedzconfig:ServiceUpdatedzconfig:ServiceRemovedzconfig:ServiceRenamedzconfig:IcmpTypeAddedzconfig:IcmpTypeUpdatedzconfig:IcmpTypeRemovedzconfig:IcmpTypeRenamedzconfig:HelperAddedzconfig:HelperUpdatedzconfig:HelperRemovedzconfig:HelperRenamed)OrX rY rZ zlog-denied-changedzdefault-zone-changedzpanic-mode-enabledzpanic-mode-disabledZreloadedz service-addedzservice-removedz port-addedz port-removedzsource-port-addedzsource-port-removedzprotocol-addedzprotocol-removedzmasquerade-addedzmasquerade-removedzforward-port-addedzforward-port-removedzicmp-block-addedzicmp-block-removedzicmp-block-inversion-addedz icmp-block-inversion-removedzrichrule-addedzrichrule-removedzinterface-addedzinterface-removedz zone-changedzzone-of-interface-changedz source-addedzsource-removedzzone-of-source-changedz zone-updatedzpolicy-updatedzipset-entry-addedzipset-entry-removedzdirect:chain-addedzdirect:chain-removedzdirect:rule-addedzdirect:rule-removedzdirect:passthrough-addedzdirect:passthrough-removedzconfig:direct:updatedzlockdown-enabledzlockdown-disabledz lockdown-whitelist-command-addedz"lockdown-whitelist-command-removedz lockdown-whitelist-context-addedz"lockdown-whitelist-context-removedz lockdown-whitelist-uid-addedz lockdown-whitelist-uid-removedz lockdown-whitelist-user-addedz lockdown-whitelist-user-removedz*config:policies:lockdown-whitelist-updatedzconfig:ipset-addedzconfig:ipset-updatedzconfig:ipset-removedzconfig:ipset-renamedzconfig:zone-addedzconfig:zone-updatedzconfig:zone-removedzconfig:zone-renamedzconfig:policy-addedzconfig:policy-updatedzconfig:policy-removedzconfig:policy-renamedzconfig:service-addedzconfig:service-updatedzconfig:service-removedzconfig:service-renamedzconfig:icmptype-addedzconfig:icmptype-updatedzconfig:icmptype-removedzconfig:icmptype-renamedzconfig:helper-addedzconfig:helper-updatedzconfig:helper-removedzconfig:helper-renamedr )&r ZmainloopZglibZ DBusGMainLoopZ SystemBusr r r r r Z DBUS_ERRORr Zadd_signal_receiver�_dbus_connection_changedr r �DBUS_INTERFACE_IPSET�DBUS_INTERFACE_ZONE�DBUS_INTERFACE_POLICY�DBUS_INTERFACE_DIRECT�DBUS_INTERFACE_POLICIESr/ r� r rO r� r� r r� r� �_signal_receiver� _callback� _callbacks� _init_vars�quietr Ztimeout_add_seconds�_connection_established)rB r �waitre r r� r r r rE s� � �� ��Y zFirewallClient.__init__c C s: d | _ d | _d | _d | _d | _d | _d | _d | _d| _d S )NF) �fwr� r rP r� r r �_config� connectedrI r r r rd � s zFirewallClient._init_varsc C s t S rQ �r rI r r r �getExceptionHandler� s z"FirewallClient.getExceptionHandlerc C s |a d S rQ rk )rB Zhandlerr r r �setExceptionHandler� s z"FirewallClient.setExceptionHandlerc C s t S rQ �r rI r r r �getNotAuthorizedLoop� s z#FirewallClient.getNotAuthorizedLoopc C s |a d S rQ rn )rB �enabler r r �setNotAuthorizedLoop� s z#FirewallClient.setNotAuthorizedLoopc G s0 || j v r ||f| j| j | < n td| ��d S )NzUnknown callback name '%s')rc rb � ValueError)rB r �callbackr r r r �connect� s zFirewallClient.connectc C s* |t jjkrd S |r | �� n| �� d S rQ )r r r rf �_connection_lost)rB r Z old_ownerZ new_ownerr r r r[ � s z'FirewallClient._dbus_connection_changedc C sd z�| j �tjjtjj�| _tj| jtjjd�| _tj| jtjj d�| _ tj| jtjj d�| _ tj| jtjj d�| _tj| jtjjd�| _tj| jtjjd�| _tj| jdd�| _W nv tjjy� } z"| js�td|�� � W Y d }~d S d }~0 t�y( } z | j�std|� W Y d }~d S d }~0 0 t| j �| _d| _ | j dtjjd� | j dtjjd� d S ) Nr r r r TrY �rW r� rX ) r r r r r Z DBUS_PATHr r rh r\ r� r] r r^ rP r_ r r` r� r r r re �printr r r. ri rj ra )rB r r r r rf � sX �� ��� ��� ��z&FirewallClient._connection_establishedc C s0 | � � | jdtjjd� | jdtjjd� d S )NrZ rv rX )rd ra r r r rI r r r ru � s ��z FirewallClient._connection_lostc O s� d|vsd|vrd S |d }|d }|� tjj�r:d| }|� tjj�rRd| }n�|� tjj�rjd| }n�|� tjj�r�d| }np|� tjj�r�d| }nX|� tjj�r�d| }n@|tjj kr�d | }n*|tjj kr�d | }n|tjj kr�d | }d }| j D ]2}| j | |kr�| j | | j v r�| j | j | }q�|d u �r>d S d d � |D �}z(|d �rf|�|d � |d |� W n. t�y� } zt|� W Y d }~n d }~0 0 d S )NrW r� z config:Zonez config:Policyz config:IPSetzconfig:Servicezconfig:IcmpTypez config:Helperzconfig:zconfig:policies:zconfig:direct:c S s g | ] }t |��qS r r )r� �argr r r r� % r� z3FirewallClient._signal_receiver.<locals>.<listcomp>rh r )� startswithr r r rO r� r� r� r� r/ r� r rc rb �extendr rw ) rB r r �signalr� �cbrs Zcb_args�msgr r r ra � sJ � z FirewallClient._signal_receiverc C s | j S rQ )ri rI r r r r / s zFirewallClient.configc C s | j �� d S rQ )rh �reloadrI r r r r~ 3 s zFirewallClient.reloadc C s | j �� d S rQ )rh �resetToDefaultsrI r r r r 7 s z FirewallClient.resetToDefaultsc C s | j �� d S rQ )rh ZcompleteReloadrI r r r �complete_reload; s z FirewallClient.complete_reloadc C s | j �� d S rQ )rh �runtimeToPermanentrI r r r r� ? s z!FirewallClient.runtimeToPermanentc C s | j �� d S rQ )rh �checkPermanentConfigrI r r r r� C s z#FirewallClient.checkPermanentConfigc C s t | j�tjj|��S rQ )r r r r r r r r r r r G s �zFirewallClient.get_propertyc C s t | j�tjj��S rQ )r r r r r r rI r r r r L s �z FirewallClient.get_propertiesc C s | j �tjj||� d S rQ )r r r r r r r r r r Q s zFirewallClient.set_propertyc C s | j �� d S rQ )rh �enablePanicModerI r r r r� W s z FirewallClient.enablePanicModec C s | j �� d S rQ )rh �disablePanicModerI r r r r� [ s z FirewallClient.disablePanicModec C s t | j�� �S rQ )r rh �queryPanicModerI r r r r� _ s z FirewallClient.queryPanicModec C s t t| j�|���S rQ )r$ r r �getZoneSettings2�rB �zoner r r �getZoneSettingse s z FirewallClient.getZoneSettingsc C s t | j�� �S rQ )r r� � getIPSetsrI r r r r� i s zFirewallClient.getIPSetsc C s t tt| j�|����S rQ )r{ r= r r� �getIPSetSettings�rB �ipsetr r r r� m s �z FirewallClient.getIPSetSettingsc C s | j �||� d S rQ r� �rB r� r� r r r r� r s zFirewallClient.addEntryc C s | j �|�S rQ r� r� r r r r� v s zFirewallClient.getEntriesc C s | j �||�S rQ r� )rB r� r� r r r r� z s zFirewallClient.setEntriesc C s | j �||� d S rQ r� r� r r r r� ~ s zFirewallClient.removeEntryc C s t | j�||��S rQ )r r� r� r� r r r r� � s zFirewallClient.queryEntryc C s t | j�� �S rQ )r rh rH rI r r r rH � s zFirewallClient.listServicesc C s t t| j�|���S rQ )rQ r rh ZgetServiceSettings2r~ r r r �getServiceSettings� s �z!FirewallClient.getServiceSettingsc C s t | j�� �S rQ )r rh rL rI r r r rL � s z FirewallClient.listIcmpTypesc C s t tt| j�|����S rQ )r� r= r rh �getIcmpTypeSettingsr� r r r r� � s �z"FirewallClient.getIcmpTypeSettingsc C s t | j�� �S rQ )r rh rt rI r r r rt � s zFirewallClient.getHelpersc C s t tt| j�|����S rQ )r� r= r rh �getHelperSettingsrv r r r r� � s �z FirewallClient.getHelperSettingsc C s t | j�� �S rQ )r rh �getAutomaticHelpersrI r r r r� � s z"FirewallClient.getAutomaticHelpersc C s | j �|� d S rQ )rh �setAutomaticHelpers�rB rO r r r r� � s z"FirewallClient.setAutomaticHelpersc C s t | j�� �S rQ )r rh � getLogDeniedrI r r r r� � s zFirewallClient.getLogDeniedc C s | j �|� d S rQ )rh � setLogDeniedr� r r r r� � s zFirewallClient.setLogDeniedc C s t | j�� �S rQ )r rh �getDefaultZonerI r r r r� � s z FirewallClient.getDefaultZonec C s | j �|� d S rQ )rh �setDefaultZoner� r r r r� � s z FirewallClient.setDefaultZonec C s | j �||�� � d S rQ )r �setZoneSettings2ra )rB r� r9 r r r �setZoneSettings� s z FirewallClient.setZoneSettingsc C s t | j�� �S rQ )r r �getZonesrI r r r r� � s zFirewallClient.getZonesc C s t | j�� �S rQ )r r �getActiveZonesrI r r r r� � s z FirewallClient.getActiveZonesc C s t | j�|��S rQ )r r r? r� r r r r? � s z!FirewallClient.getZoneOfInterfacec C s t | j�|��S rQ )r r r@ r� r r r r@ � s z FirewallClient.getZoneOfSourcec C s t | j�|��S rQ )r r � isImmutabler� r r r r� � s zFirewallClient.isImmutablec C s t t| j�|���S rQ )r' r rP �getPolicySettings�rB �policyr r r r� � s z FirewallClient.getPolicySettingsc C s | j �||�� � d S rQ )rP �setPolicySettingsra )rB r� r9 r r r r� � s z FirewallClient.setPolicySettingsc C s t | j�� �S rQ )r rP � getPoliciesrI r r r r� � s zFirewallClient.getPoliciesc C s t | j�� �S rQ )r rP �getActivePoliciesrI r r r r� � s z FirewallClient.getActivePoliciesc C s t | j�|��S rQ )r rP r� r� r r r �isPolicyImmutable� s z FirewallClient.isPolicyImmutablec C s t | j�||��S rQ )r r r� �rB r� r� r r r r� � s zFirewallClient.addInterfacec C s t | j�||��S rQ )r r � changeZoner� r r r r� � s zFirewallClient.changeZonec C s t | j�||��S rQ )r r �changeZoneOfInterfacer� r r r r� � s �z$FirewallClient.changeZoneOfInterfacec C s t | j�|��S rQ )r r r� r� r r r r� � s z FirewallClient.getInterfacesc C s t | j�||��S rQ )r r r� r� r r r r� s z FirewallClient.queryInterfacec C s t | j�||��S rQ )r r r� r� r r r r� s z FirewallClient.removeInterfacec C s t | j�||��S rQ )r r r� �rB r� r� r r r r� s zFirewallClient.addSourcec C s t | j�||��S rQ )r r �changeZoneOfSourcer� r r r r� s z!FirewallClient.changeZoneOfSourcec C s t | j�|��S rQ )r r r� r� r r r r� s zFirewallClient.getSourcesc C s t | j�||��S rQ )r r r� r� r r r r� s zFirewallClient.querySourcec C s t | j�||��S rQ )r r r� r� r r r r� s zFirewallClient.removeSourcec C s t | j�|||��S rQ )r r r� )rB r� r� r� r r r r� " s zFirewallClient.addRichRulec C s t | j�|��S rQ )r r r� r� r r r r� & s zFirewallClient.getRichRulesc C s t | j�||��S rQ )r r r� �rB r� r� r r r r� * s z FirewallClient.queryRichRulec C s t | j�||��S rQ )r r r� r� r r r r� . s z FirewallClient.removeRichRulec C s t | j�|||��S rQ )r r r� )rB r� r r� r r r r� 4 s zFirewallClient.addServicec C s t | j�|��S rQ )r r rx r� r r r rx 8 s zFirewallClient.getServicesc C s t | j�||��S rQ )r r r� �rB r� r r r r r� < s zFirewallClient.queryServicec C s t | j�||��S rQ )r r r� r� r r r r� @ s z FirewallClient.removeServicec C s t | j�||||��S rQ )r r r� �rB r� r� r� r� r r r r� F s zFirewallClient.addPortc C s t | j�|��S rQ )r r r� r� r r r r� J s zFirewallClient.getPortsc C s t | j�|||��S rQ )r r r� �rB r� r� r� r r r r� N s zFirewallClient.queryPortc C s t | j�|||��S rQ )r r r� r� r r r r� R s zFirewallClient.removePortc C s t | j�|||��S rQ )r r r� )rB r� r� r� r r r r� X s zFirewallClient.addProtocolc C s t | j�|��S rQ )r r r� r� r r r r� \ s zFirewallClient.getProtocolsc C s t | j�||��S rQ )r r r� �rB r� r� r r r r� ` s z FirewallClient.queryProtocolc C s t | j�||��S rQ )r r r� r� r r r r� d s z FirewallClient.removeProtocolc C s | j �|ddi� d S r! �r r� r� r r r r� j s zFirewallClient.addForwardc C s t | j�|��d S r )r r r� r� r r r r� n s zFirewallClient.queryForwardc C s | j �|ddi� d S r" r� r� r r r r� r s z FirewallClient.removeForwardc C s t | j�||��S rQ )r r r� )rB r� r� r r r r� x s z FirewallClient.addMasqueradec C s t | j�|��S rQ )r r r� r� r r r r� | s z FirewallClient.queryMasqueradec C s t | j�|��S rQ )r r r� r� r r r r� � s z FirewallClient.removeMasqueradec C s2 |d u r d}|d u rd}t | j�||||||��S r# )r r r� )rB r� r� r� r% r& r� r r r r� � s �z FirewallClient.addForwardPortc C s t | j�|��S rQ )r r r� r� r r r r� � s z FirewallClient.getForwardPortsc C s0 |d u r d}|d u rd}t | j�|||||��S r# )r r r� �rB r� r� r� r% r& r r r r� � s �z FirewallClient.queryForwardPortc C s0 |d u r d}|d u rd}t | j�|||||��S r# )r r r� r� r r r r� � s �z FirewallClient.removeForwardPortc C s t | j�||||��S rQ )r r r� r� r r r r� � s �z FirewallClient.addSourcePortc C s t | j�|��S rQ )r r r� r� r r r r� � s z FirewallClient.getSourcePortsc C s t | j�|||��S rQ )r r r� r� r r r r� � s z FirewallClient.querySourcePortc C s t | j�|||��S rQ )r r r� r� r r r r� � s �z FirewallClient.removeSourcePortc C s t | j�|||��S rQ )r r r� )rB r� �icmpr� r r r r� � s zFirewallClient.addIcmpBlockc C s t | j�|��S rQ )r r r� r� r r r r� � s z FirewallClient.getIcmpBlocksc C s t | j�||��S rQ )r r r� �rB r� r� r r r r� � s z FirewallClient.queryIcmpBlockc C s t | j�||��S rQ )r r r� r� r r r r� � s z FirewallClient.removeIcmpBlockc C s t | j�|��S rQ )r r r� r� r r r r� � s z$FirewallClient.addIcmpBlockInversionc C s t | j�|��S rQ )r r r� r� r r r r� � s z&FirewallClient.queryIcmpBlockInversionc C s t | j�|��S rQ )r r r� r� r r r r� � s z'FirewallClient.removeIcmpBlockInversionc C s | j �|||� d S rQ r r r r r r � s zFirewallClient.addChainc C s | j �|||� d S rQ r r r r r r � s zFirewallClient.removeChainc C s t | j�|||��S rQ r r r r r r � s zFirewallClient.queryChainc C s t | j�||��S rQ r r� r r r r� � s zFirewallClient.getChainsc C s t | j�� �S rQ r rI r r r r� � s zFirewallClient.getAllChainsc C s | j �|||||� d S rQ r! r" r r r r � s zFirewallClient.addRulec C s | j �|||||� d S rQ r# r" r r r r � s zFirewallClient.removeRulec C s | j �|||� d S rQ r$ r r r r r � s zFirewallClient.removeRulesc C s t | j�|||||��S rQ r% r" r r r r s zFirewallClient.queryRulec C s t | j�|||��S rQ r& r r r r r s zFirewallClient.getRulesc C s t | j�� �S rQ r' rI r r r r s zFirewallClient.getAllRulesc C s t | j�||��S rQ )r r � passthroughr) r r r r� s zFirewallClient.passthroughc C s t | j�� �S rQ r- rI r r r r s z!FirewallClient.getAllPassthroughsc C s | j �� d S rQ )r r rI r r r r s z$FirewallClient.removeAllPassthroughsc C s t | j�|��S rQ r, r� r r r r s z FirewallClient.getPassthroughsc C s | j �||� d S rQ r( r) r r r r ! s z FirewallClient.addPassthroughc C s | j �||� d S rQ r* r) r r r r % s z FirewallClient.removePassthroughc C s t | j�||��S rQ r+ r) r r r r ) s z FirewallClient.queryPassthroughc C s | j �� d S rQ )r� �enableLockdownrI r r r r� / s z FirewallClient.enableLockdownc C s | j �� d S rQ )r� �disableLockdownrI r r r r� 3 s z FirewallClient.disableLockdownc C s t | j�� �S rQ )r r� � queryLockdownrI r r r r� 7 s z FirewallClient.queryLockdownc C s | j �|� d S rQ r� r� r r r r� ? s z*FirewallClient.addLockdownWhitelistCommandc C s t | j�� �S rQ r� rI r r r r� C s z+FirewallClient.getLockdownWhitelistCommandsc C s t | j�|��S rQ r� r� r r r r� G s z,FirewallClient.queryLockdownWhitelistCommandc C s | j �|� d S rQ r� r� r r r r� K s z-FirewallClient.removeLockdownWhitelistCommandc C s | j �|� d S rQ r� r� r r r r� Q s z*FirewallClient.addLockdownWhitelistContextc C s t | j�� �S rQ r� rI r r r r� U s z+FirewallClient.getLockdownWhitelistContextsc C s t | j�|��S rQ r� r� r r r r� Y s z,FirewallClient.queryLockdownWhitelistContextc C s | j �|� d S rQ r� r� r r r r� ] s z-FirewallClient.removeLockdownWhitelistContextc C s | j �|� d S rQ r� r� r r r r� c s z&FirewallClient.addLockdownWhitelistUidc C s t | j�� �S rQ r� rI r r r r� g s z'FirewallClient.getLockdownWhitelistUidsc C s t | j�|��S rQ r� r� r r r r� k s z(FirewallClient.queryLockdownWhitelistUidc C s | j �|� d S rQ r� r� r r r r� o s z)FirewallClient.removeLockdownWhitelistUidc C s | j �|� d S rQ r� r� r r r r� u s z'FirewallClient.addLockdownWhitelistUserc C s t | j�� �S rQ r� rI r r r r� y s z(FirewallClient.getLockdownWhitelistUsersc C s t | j�|��S rQ r� r� r r r r� } s z)FirewallClient.queryLockdownWhitelistUserc C s | j �|� d S rQ r� r� r r r r� � s z*FirewallClient.removeLockdownWhitelistUserc C s | j �� dS )z( Authorize once for all polkit actions. N)rh � authorizeAllrI r r r r� � s zFirewallClient.authorizeAll)Nr T)r )r )r )r )r )r )r )r )�r� r� r� r# rE rd rl rm ro rq rt r[ rf ru ra r r~ r r� r� r� r r r r� r� r� r� r� r� r� r� r� r� r� rH r� rL r� rt r� r� r� r� r� r� r� r� r� r� r? r@ r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� rx r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r r r r� r� r r r r r r r� r r r r r r r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r r r r rV s4 % / � rV )-Z gi.repositoryr Zdbus.mainloop.glibr r! Zfirewallr Zfirewall.core.baser r r Zfirewall.dbus_utilsr Zfirewall.core.richr Zfirewall.core.ipsetr r r r Zfirewall.errorsr r r r r# �objectr$ r� r' rN rQ r{ r� r� r� r� r� r� r� r� r� r r. rV r r r r �<module> sT ) n O0 ghfK| ]CgVab[ [ command.py 0000644 00000057301 15025011705 0006536 0 ustar 00 # -*- coding: utf-8 -*- # # Copyright (C) 2011-2016 Red Hat, Inc. # # Authors: # Thomas Woerner <twoerner@redhat.com> # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see <http://www.gnu.org/licenses/>. # """FirewallCommand class for command line client simplification""" __all__ = [ "FirewallCommand" ] import sys from firewall import errors from firewall.errors import FirewallError from dbus.exceptions import DBusException from firewall.functions import checkIPnMask, checkIP6nMask, check_mac, \ check_port, check_single_address class FirewallCommand(object): def __init__(self, quiet=False, verbose=False): self.quiet = quiet self.verbose = verbose self.__use_exception_handler = True self.fw = None def set_fw(self, fw): self.fw = fw def set_quiet(self, flag): self.quiet = flag def get_quiet(self): return self.quiet def set_verbose(self, flag): self.verbose = flag def get_verbose(self): return self.verbose def print_msg(self, msg=None): if msg is not None and not self.quiet: sys.stdout.write(msg + "\n") def print_error_msg(self, msg=None): if msg is not None and not self.quiet: sys.stderr.write(msg + "\n") def print_warning(self, msg=None): FAIL = '\033[91m' END = '\033[00m' if sys.stderr.isatty(): msg = FAIL + msg + END self.print_error_msg(msg) def print_and_exit(self, msg=None, exit_code=0): #OK = '\033[92m' #END = '\033[00m' if exit_code > 1: self.print_warning(msg) else: #if sys.stdout.isatty(): # msg = OK + msg + END self.print_msg(msg) sys.exit(exit_code) def fail(self, msg=None): self.print_and_exit(msg, 2) def print_if_verbose(self, msg=None): if msg is not None and self.verbose: sys.stdout.write(msg + "\n") def __cmd_sequence(self, cmd_type, option, action_method, query_method, # pylint: disable=W0613, R0913, R0914 parse_method, message, start_args=None, end_args=None, # pylint: disable=W0613 no_exit=False): if self.fw is not None: self.fw.authorizeAll() items = [ ] _errors = 0 _error_codes = [ ] for item in option: if parse_method is not None: try: item = parse_method(item) except Exception as msg: code = FirewallError.get_code(str(msg)) if len(option) > 1: self.print_warning("Warning: %s" % msg) else: self.print_and_exit("Error: %s" % msg, code) if code not in _error_codes: _error_codes.append(code) _errors += 1 continue items.append(item) for item in items: call_item = [ ] if start_args is not None: call_item += start_args if not isinstance(item, list) and not isinstance(item, tuple): call_item.append(item) else: call_item += item if end_args is not None: call_item += end_args self.deactivate_exception_handler() try: action_method(*call_item) except (DBusException, Exception) as msg: if isinstance(msg, DBusException): self.fail_if_not_authorized(msg.get_dbus_name()) msg = msg.get_dbus_message() else: msg = str(msg) code = FirewallError.get_code(msg) if code in [ errors.ALREADY_ENABLED, errors.NOT_ENABLED, errors.ZONE_ALREADY_SET, errors.ALREADY_SET ]: code = 0 if len(option) > 1: self.print_warning("Warning: %s" % msg) elif code == 0: self.print_warning("Warning: %s" % msg) return else: self.print_and_exit("Error: %s" % msg, code) if code not in _error_codes: _error_codes.append(code) _errors += 1 self.activate_exception_handler() if not no_exit: if len(option) > _errors or 0 in _error_codes: # There have been more options than errors or there # was at least one error code 0, return. return elif len(_error_codes) == 1: # Exactly one error code, use it. sys.exit(_error_codes[0]) elif len(_error_codes) > 1: # There is more than error, exit using # UNKNOWN_ERROR. This could happen within sequences # where parsing failed with different errors like # INVALID_PORT and INVALID_PROTOCOL. sys.exit(errors.UNKNOWN_ERROR) def add_sequence(self, option, action_method, query_method, parse_method, # pylint: disable=R0913 message, no_exit=False): self.__cmd_sequence("add", option, action_method, query_method, parse_method, message, no_exit=no_exit) def x_add_sequence(self, x, option, action_method, query_method, # pylint: disable=R0913 parse_method, message, no_exit=False): self.__cmd_sequence("add", option, action_method, query_method, parse_method, message, start_args=[x], no_exit=no_exit) def zone_add_timeout_sequence(self, zone, option, action_method, # pylint: disable=R0913 query_method, parse_method, message, timeout, no_exit=False): self.__cmd_sequence("add", option, action_method, query_method, parse_method, message, start_args=[zone], end_args=[timeout], no_exit=no_exit) def remove_sequence(self, option, action_method, query_method, # pylint: disable=R0913 parse_method, message, no_exit=False): self.__cmd_sequence("remove", option, action_method, query_method, parse_method, message, no_exit=no_exit) def x_remove_sequence(self, x, option, action_method, query_method, # pylint: disable=R0913 parse_method, message, no_exit=False): self.__cmd_sequence("remove", option, action_method, query_method, parse_method, message, start_args=[x], no_exit=no_exit) def __query_sequence(self, option, query_method, parse_method, message, # pylint: disable=R0913 start_args=None, no_exit=False): items = [ ] for item in option: if parse_method is not None: try: item = parse_method(item) except Exception as msg: if len(option) > 1: self.print_warning("Warning: %s" % msg) continue else: code = FirewallError.get_code(str(msg)) self.print_and_exit("Error: %s" % msg, code) items.append(item) for item in items: call_item = [ ] if start_args is not None: call_item += start_args if not isinstance(item, list) and not isinstance(item, tuple): call_item.append(item) else: call_item += item self.deactivate_exception_handler() try: res = query_method(*call_item) except DBusException as msg: self.fail_if_not_authorized(msg.get_dbus_name()) code = FirewallError.get_code(msg.get_dbus_message()) if len(option) > 1: self.print_warning("Warning: %s" % msg.get_dbus_message()) continue else: self.print_and_exit("Error: %s" % msg.get_dbus_message(), code) except Exception as msg: code = FirewallError.get_code(str(msg)) if len(option) > 1: self.print_warning("Warning: %s" % msg) else: self.print_and_exit("Error: %s" % msg, code) self.activate_exception_handler() if len(option) > 1: self.print_msg("%s: %s" % (message % item, ("no", "yes")[res])) else: self.print_query_result(res) if not no_exit: sys.exit(0) def query_sequence(self, option, query_method, parse_method, message, # pylint: disable=R0913 no_exit=False): self.__query_sequence(option, query_method, parse_method, message, no_exit=no_exit) def x_query_sequence(self, x, option, query_method, parse_method, # pylint: disable=R0913 message, no_exit=False): self.__query_sequence(option, query_method, parse_method, message, start_args=[x], no_exit=no_exit) def parse_source(self, value): if not checkIPnMask(value) and not checkIP6nMask(value) \ and not check_mac(value) and not \ (value.startswith("ipset:") and len(value) > 6): raise FirewallError(errors.INVALID_ADDR, "'%s' is no valid IPv4, IPv6 or MAC address, nor an ipset" % value) return value def parse_port(self, value, separator="/"): try: (port, proto) = value.split(separator) except ValueError: raise FirewallError(errors.INVALID_PORT, "bad port (most likely " "missing protocol), correct syntax is " "portid[-portid]%sprotocol" % separator) if not check_port(port): raise FirewallError(errors.INVALID_PORT, port) if proto not in [ "tcp", "udp", "sctp", "dccp" ]: raise FirewallError(errors.INVALID_PROTOCOL, "'%s' not in {'tcp'|'udp'|'sctp'|'dccp'}" % \ proto) return (port, proto) def parse_forward_port(self, value, compat=False): port = None protocol = None toport = None toaddr = None i = 0 while ("=" in value[i:]): opt = value[i:].split("=", 1)[0] i += len(opt) + 1 if "=" in value[i:]: val = value[i:].split(":", 1)[0] else: val = value[i:] i += len(val) + 1 if opt == "port": port = val elif opt == "proto": protocol = val elif opt == "toport": toport = val elif opt == "toaddr": toaddr = val elif opt == "if" and compat: # ignore if option in compat mode pass else: raise FirewallError(errors.INVALID_FORWARD, "invalid forward port arg '%s'" % (opt)) if not port: raise FirewallError(errors.INVALID_FORWARD, "missing port") if not protocol: raise FirewallError(errors.INVALID_FORWARD, "missing protocol") if not (toport or toaddr): raise FirewallError(errors.INVALID_FORWARD, "missing destination") if not check_port(port): raise FirewallError(errors.INVALID_PORT, port) if protocol not in [ "tcp", "udp", "sctp", "dccp" ]: raise FirewallError(errors.INVALID_PROTOCOL, "'%s' not in {'tcp'|'udp'|'sctp'|'dccp'}" % \ protocol) if toport and not check_port(toport): raise FirewallError(errors.INVALID_PORT, toport) if toaddr and not check_single_address("ipv4", toaddr): if compat or not check_single_address("ipv6", toaddr): raise FirewallError(errors.INVALID_ADDR, toaddr) return (port, protocol, toport, toaddr) def parse_ipset_option(self, value): args = value.split("=") if len(args) == 1: return (args[0], "") elif len(args) == 2: return args else: raise FirewallError(errors.INVALID_OPTION, "invalid ipset option '%s'" % (value)) def check_destination_ipv(self, value): ipvs = [ "ipv4", "ipv6", ] if value not in ipvs: raise FirewallError(errors.INVALID_IPV, "invalid argument: %s (choose from '%s')" % \ (value, "', '".join(ipvs))) return value def parse_service_destination(self, value): try: (ipv, destination) = value.split(":", 1) except ValueError: raise FirewallError(errors.INVALID_DESTINATION, "destination syntax is ipv:address[/mask]") return (self.check_destination_ipv(ipv), destination) def check_ipv(self, value): ipvs = [ "ipv4", "ipv6", "eb" ] if value not in ipvs: raise FirewallError(errors.INVALID_IPV, "invalid argument: %s (choose from '%s')" % \ (value, "', '".join(ipvs))) return value def check_helper_family(self, value): ipvs = [ "", "ipv4", "ipv6" ] if value not in ipvs: raise FirewallError(errors.INVALID_IPV, "invalid argument: %s (choose from '%s')" % \ (value, "', '".join(ipvs))) return value def check_module(self, value): if not value.startswith("nf_conntrack_"): raise FirewallError( errors.INVALID_MODULE, "'%s' does not start with 'nf_conntrack_'" % value) if len(value.replace("nf_conntrack_", "")) < 1: raise FirewallError(errors.INVALID_MODULE, "Module name '%s' too short" % value) return value def print_zone_policy_info(self, zone, settings, default_zone=None, extra_interfaces=[], isPolicy=True): # pylint: disable=R0914 target = settings.getTarget() services = settings.getServices() ports = settings.getPorts() protocols = settings.getProtocols() masquerade = settings.getMasquerade() forward_ports = settings.getForwardPorts() source_ports = settings.getSourcePorts() icmp_blocks = settings.getIcmpBlocks() rules = settings.getRichRules() description = settings.getDescription() short_description = settings.getShort() if isPolicy: ingress_zones = settings.getIngressZones() egress_zones = settings.getEgressZones() priority = settings.getPriority() else: icmp_block_inversion = settings.getIcmpBlockInversion() interfaces = sorted(set(settings.getInterfaces() + extra_interfaces)) sources = settings.getSources() forward = settings.getForward() def rich_rule_sorted_key(rule): priority = 0 search_str = "priority=" try: i = rule.index(search_str) except ValueError: pass else: i += len(search_str) priority = int(rule[i:i+(rule[i:].index(" "))].replace("\"", "")) return priority attributes = [] if default_zone is not None: if zone == default_zone: attributes.append("default") if (not isPolicy and (interfaces or sources)) or \ ( isPolicy and ingress_zones and egress_zones): attributes.append("active") if attributes: zone = zone + " (%s)" % ", ".join(attributes) self.print_msg(zone) if self.verbose: self.print_msg(" summary: " + short_description) self.print_msg(" description: " + description) if isPolicy: self.print_msg(" priority: " + str(priority)) self.print_msg(" target: " + target) if not isPolicy: self.print_msg(" icmp-block-inversion: %s" % \ ("yes" if icmp_block_inversion else "no")) if isPolicy: self.print_msg(" ingress-zones: " + " ".join(ingress_zones)) self.print_msg(" egress-zones: " + " ".join(egress_zones)) else: self.print_msg(" interfaces: " + " ".join(interfaces)) self.print_msg(" sources: " + " ".join(sources)) self.print_msg(" services: " + " ".join(sorted(services))) self.print_msg(" ports: " + " ".join(["%s/%s" % (port[0], port[1]) for port in ports])) self.print_msg(" protocols: " + " ".join(sorted(protocols))) if not isPolicy: self.print_msg(" forward: %s" % ("yes" if forward else "no")) self.print_msg(" masquerade: %s" % ("yes" if masquerade else "no")) self.print_msg(" forward-ports: " + ("\n\t" if forward_ports else "") + "\n\t".join(["port=%s:proto=%s:toport=%s:toaddr=%s" % \ (port, proto, toport, toaddr) for (port, proto, toport, toaddr) in \ forward_ports])) self.print_msg(" source-ports: " + " ".join(["%s/%s" % (port[0], port[1]) for port in source_ports])) self.print_msg(" icmp-blocks: " + " ".join(icmp_blocks)) self.print_msg(" rich rules: " + ("\n\t" if rules else "") + "\n\t".join(sorted(rules, key=rich_rule_sorted_key))) def print_zone_info(self, zone, settings, default_zone=None, extra_interfaces=[]): self.print_zone_policy_info(zone, settings, default_zone=default_zone, extra_interfaces=extra_interfaces, isPolicy=False) def print_policy_info(self, policy, settings, default_zone=None, extra_interfaces=[]): self.print_zone_policy_info(policy, settings, default_zone=default_zone, extra_interfaces=extra_interfaces, isPolicy=True) def print_service_info(self, service, settings): ports = settings.getPorts() protocols = settings.getProtocols() source_ports = settings.getSourcePorts() modules = settings.getModules() description = settings.getDescription() destinations = settings.getDestinations() short_description = settings.getShort() includes = settings.getIncludes() helpers = settings.getHelpers() self.print_msg(service) if self.verbose: self.print_msg(" summary: " + short_description) self.print_msg(" description: " + description) self.print_msg(" ports: " + " ".join(["%s/%s" % (port[0], port[1]) for port in ports])) self.print_msg(" protocols: " + " ".join(protocols)) self.print_msg(" source-ports: " + " ".join(["%s/%s" % (port[0], port[1]) for port in source_ports])) self.print_msg(" modules: " + " ".join(modules)) self.print_msg(" destination: " + " ".join(["%s:%s" % (k, v) for k, v in destinations.items()])) self.print_msg(" includes: " + " ".join(sorted(includes))) self.print_msg(" helpers: " + " ".join(sorted(helpers))) def print_icmptype_info(self, icmptype, settings): destinations = settings.getDestinations() description = settings.getDescription() short_description = settings.getShort() if len(destinations) == 0: destinations = [ "ipv4", "ipv6" ] self.print_msg(icmptype) if self.verbose: self.print_msg(" summary: " + short_description) self.print_msg(" description: " + description) self.print_msg(" destination: " + " ".join(destinations)) def print_ipset_info(self, ipset, settings): ipset_type = settings.getType() options = settings.getOptions() entries = settings.getEntries() description = settings.getDescription() short_description = settings.getShort() self.print_msg(ipset) if self.verbose: self.print_msg(" summary: " + short_description) self.print_msg(" description: " + description) self.print_msg(" type: " + ipset_type) self.print_msg(" options: " + " ".join(["%s=%s" % (k, v) if v else k for k, v in options.items()])) self.print_msg(" entries: " + " ".join(entries)) def print_helper_info(self, helper, settings): ports = settings.getPorts() module = settings.getModule() family = settings.getFamily() description = settings.getDescription() short_description = settings.getShort() self.print_msg(helper) if self.verbose: self.print_msg(" summary: " + short_description) self.print_msg(" description: " + description) self.print_msg(" family: " + family) self.print_msg(" module: " + module) self.print_msg(" ports: " + " ".join(["%s/%s" % (port[0], port[1]) for port in ports])) def print_query_result(self, value): if value: self.print_and_exit("yes") else: self.print_and_exit("no", 1) def exception_handler(self, exception_message): if not self.__use_exception_handler: raise self.fail_if_not_authorized(exception_message) code = FirewallError.get_code(str(exception_message)) if code in [ errors.ALREADY_ENABLED, errors.NOT_ENABLED, errors.ZONE_ALREADY_SET, errors.ALREADY_SET ]: self.print_warning("Warning: %s" % exception_message) else: self.print_and_exit("Error: %s" % exception_message, code) def fail_if_not_authorized(self, exception_message): if "NotAuthorizedException" in exception_message: msg = """Authorization failed. Make sure polkit agent is running or run the application as superuser.""" self.print_and_exit(msg, errors.NOT_AUTHORIZED) def deactivate_exception_handler(self): self.__use_exception_handler = False def activate_exception_handler(self): self.__use_exception_handler = True def get_ipset_entries_from_file(self, filename): entries = [ ] entries_set = set() f = open(filename) for line in f: if not line: break line = line.strip() if len(line) < 1 or line[0] in ['#', ';']: continue if line not in entries_set: entries.append(line) entries_set.add(line) f.close() return entries functions.py 0000644 00000045053 15025011705 0007131 0 ustar 00 # -*- coding: utf-8 -*- # # Copyright (C) 2007,2008,2011,2012 Red Hat, Inc. # # Authors: # Thomas Woerner <twoerner@redhat.com> # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see <http://www.gnu.org/licenses/>. # __all__ = [ "getPortID", "getPortRange", "portStr", "getServiceName", "checkIP", "checkIP6", "checkIPnMask", "checkIP6nMask", "checkProtocol", "checkInterface", "checkUINT16", "checkUINT32", "firewalld_is_active", "tempFile", "readfile", "writefile", "enable_ip_forwarding", "check_port", "check_address", "check_single_address", "check_mac", "uniqify", "ppid_of_pid", "max_zone_name_len", "checkUser", "checkUid", "checkCommand", "checkContext", "joinArgs", "splitArgs", "max_policy_name_len", "checkTcpMssClamp", "stripNonPrintableCharacters"] import socket import os import os.path import shlex import pipes import string import tempfile from firewall.core.logger import log from firewall.config import FIREWALLD_TEMPDIR, FIREWALLD_PIDFILE NOPRINT_TRANS_TABLE = { # Limit to C0 and C1 code points. Building entries for all unicode code # points requires too much memory. # C0 = [0, 31] # C1 = [127, 159] # i: None for i in range(0, 160) if not (i > 31 and i < 127) } def getPortID(port): """ Check and Get port id from port string or port id using socket.getservbyname @param port port string or port id @return Port id if valid, -1 if port can not be found and -2 if port is too big """ if isinstance(port, int): _id = port else: if port: port = port.strip() try: _id = int(port) except ValueError: try: _id = socket.getservbyname(port) except socket.error: return -1 if _id > 65535: return -2 return _id def getPortRange(ports): """ Get port range for port range string or single port id @param ports an integer or port string or port range string @return Array containing start and end port id for a valid range or -1 if port can not be found and -2 if port is too big for integer input or -1 for invalid ranges or None if the range is ambiguous. """ # (port, port) or [port, port] case if isinstance(ports, tuple) or isinstance(ports, list): return ports # "<port-id>" case if isinstance(ports, int) or ports.isdigit(): id1 = getPortID(ports) if id1 >= 0: return (id1,) return id1 splits = ports.split("-") # "<port-id>-<port-id>" case if len(splits) == 2 and splits[0].isdigit() and splits[1].isdigit(): id1 = getPortID(splits[0]) id2 = getPortID(splits[1]) if id1 >= 0 and id2 >= 0: if id1 < id2: return (id1, id2) elif id1 > id2: return (id2, id1) else: # ids are the same return (id1,) # everything else "<port-str>[-<port-str>]" matched = [ ] for i in range(len(splits), 0, -1): id1 = getPortID("-".join(splits[:i])) port2 = "-".join(splits[i:]) if len(port2) > 0: id2 = getPortID(port2) if id1 >= 0 and id2 >= 0: if id1 < id2: matched.append((id1, id2)) elif id1 > id2: matched.append((id2, id1)) else: matched.append((id1, )) else: if id1 >= 0: matched.append((id1,)) if i == len(splits): # full match, stop here break if len(matched) < 1: return -1 elif len(matched) > 1: return None return matched[0] def portStr(port, delimiter=":"): """ Create port and port range string @param port port or port range int or [int, int] @param delimiter of the output string for port ranges, default ':' @return Port or port range string, empty string if port isn't specified, None if port or port range is not valid """ if port == "": return "" _range = getPortRange(port) if isinstance(_range, int) and _range < 0: return None elif len(_range) == 1: return "%s" % _range else: return "%s%s%s" % (_range[0], delimiter, _range[1]) def portInPortRange(port, range): _port = getPortRange(port) _range = getPortRange(range) if len(_port) == 1: if len(_range) == 1: return getPortID(_port[0]) == getPortID(_range[0]) if len(_range) == 2 and \ getPortID(_port[0]) >= getPortID(_range[0]) and getPortID(_port[0]) <= getPortID(_range[1]): return True elif len(_port) == 2: if len(_range) == 2 and \ getPortID(_port[0]) >= getPortID(_range[0]) and getPortID(_port[0]) <= getPortID(_range[1]) and \ getPortID(_port[1]) >= getPortID(_range[0]) and getPortID(_port[1]) <= getPortID(_range[1]): return True return False def coalescePortRange(new_range, ranges): """ Coalesce a port range with existing list of port ranges @param new_range tuple/list/string @param ranges list of tuple/list/string @return tuple of (list of ranges added after coalescing, list of removed original ranges) """ coalesced_range = getPortRange(new_range) # normalize singleton ranges, e.g. (x,) --> (x,x) if len(coalesced_range) == 1: coalesced_range = (coalesced_range[0], coalesced_range[0]) _ranges = map(getPortRange, ranges) _ranges = sorted(map(lambda x: (x[0],x[0]) if len(x) == 1 else x, _ranges), key=lambda x: x[0]) removed_ranges = [] for range in _ranges: if coalesced_range[0] <= range[0] and coalesced_range[1] >= range[1]: # new range covers this removed_ranges.append(range) elif coalesced_range[0] <= range[0] and coalesced_range[1] < range[1] and \ coalesced_range[1] >= range[0]: # expand beginning of range removed_ranges.append(range) coalesced_range = (coalesced_range[0], range[1]) elif coalesced_range[0] > range[0] and coalesced_range[1] >= range[1] and \ coalesced_range[0] <= range[1]: # expand end of range removed_ranges.append(range) coalesced_range = (range[0], coalesced_range[1]) # normalize singleton ranges, e.g. (x,x) --> (x,) removed_ranges = list(map(lambda x: (x[0],) if x[0] == x[1] else x, removed_ranges)) if coalesced_range[0] == coalesced_range[1]: coalesced_range = (coalesced_range[0],) return ([coalesced_range], removed_ranges) def breakPortRange(remove_range, ranges): """ break a port range from existing list of port ranges @param remove_range tuple/list/string @param ranges list of tuple/list/string @return tuple of (list of ranges added after breaking up, list of removed original ranges) """ remove_range = getPortRange(remove_range) # normalize singleton ranges, e.g. (x,) --> (x,x) if len(remove_range) == 1: remove_range = (remove_range[0], remove_range[0]) _ranges = map(getPortRange, ranges) _ranges = sorted(map(lambda x: (x[0],x[0]) if len(x) == 1 else x, _ranges), key=lambda x: x[0]) removed_ranges = [] added_ranges = [] for range in _ranges: if remove_range[0] <= range[0] and remove_range[1] >= range[1]: # remove entire range removed_ranges.append(range) elif remove_range[0] <= range[0] and remove_range[1] < range[1] and \ remove_range[1] >= range[0]: # remove from beginning of range removed_ranges.append(range) added_ranges.append((remove_range[1] + 1, range[1])) elif remove_range[0] > range[0] and remove_range[1] >= range[1] and \ remove_range[0] <= range[1]: # remove from end of range removed_ranges.append(range) added_ranges.append((range[0], remove_range[0] - 1)) elif remove_range[0] > range[0] and remove_range[1] < range[1]: # remove inside range removed_ranges.append(range) added_ranges.append((range[0], remove_range[0] - 1)) added_ranges.append((remove_range[1] + 1, range[1])) # normalize singleton ranges, e.g. (x,x) --> (x,) removed_ranges = list(map(lambda x: (x[0],) if x[0] == x[1] else x, removed_ranges)) added_ranges = list(map(lambda x: (x[0],) if x[0] == x[1] else x, added_ranges)) return (added_ranges, removed_ranges) def getServiceName(port, proto): """ Check and Get service name from port and proto string combination using socket.getservbyport @param port string or id @param protocol string @return Service name if port and protocol are valid, else None """ try: name = socket.getservbyport(int(port), proto) except socket.error: return None return name def checkIP(ip): """ Check IPv4 address. @param ip address string @return True if address is valid, else False """ try: socket.inet_pton(socket.AF_INET, ip) except socket.error: return False return True def normalizeIP6(ip): """ Normalize the IPv6 address This is mostly about converting URL-like IPv6 address to normal ones. e.g. [1234::4321] --> 1234:4321 """ return ip.strip("[]") def checkIP6(ip): """ Check IPv6 address. @param ip address string @return True if address is valid, else False """ try: socket.inet_pton(socket.AF_INET6, normalizeIP6(ip)) except socket.error: return False return True def checkIPnMask(ip): index = ip.find("/") if index != -1: addr = ip[:index] mask = ip[index + 1:] if not addr or not mask: return False else: addr = ip mask = None if not checkIP(addr): return False if mask: if "." in mask: return checkIP(mask) else: try: i = int(mask) except ValueError: return False if i < 0 or i > 32: return False return True def stripNonPrintableCharacters(rule_str): return rule_str.translate(NOPRINT_TRANS_TABLE) def checkIP6nMask(ip): index = ip.find("/") if index != -1: addr = ip[:index] mask = ip[index + 1:] if not addr or not mask: return False else: addr = ip mask = None if not checkIP6(addr): return False if mask: try: i = int(mask) except ValueError: return False if i < 0 or i > 128: return False return True def checkProtocol(protocol): try: i = int(protocol) except ValueError: # string try: socket.getprotobyname(protocol) except socket.error: return False else: if i < 0 or i > 255: return False return True def checkTcpMssClamp(tcp_mss_clamp_value): if tcp_mss_clamp_value: if tcp_mss_clamp_value.isdigit(): if int(tcp_mss_clamp_value) < 536: return False elif tcp_mss_clamp_value == "None": return True elif tcp_mss_clamp_value != "pmtu": return False return True def checkInterface(iface): """ Check interface string @param interface string @return True if interface is valid (maximum 16 chars and does not contain ' ', '/', '!', ':', '*'), else False """ if not iface or len(iface) > 16: return False for ch in [ ' ', '/', '!', '*' ]: # !:* are limits for iptables <= 1.4.5 if ch in iface: return False # disabled old iptables check #if iface == "+": # # limit for iptables <= 1.4.5 # return False return True def checkUINT16(val): try: x = int(val, 0) except ValueError: return False else: if x >= 0 and x <= 65535: return True return False def checkUINT32(val): try: x = int(val, 0) except ValueError: return False else: if x >= 0 and x <= 4294967295: return True return False def firewalld_is_active(): """ Check if firewalld is active @return True if there is a firewalld pid file and the pid is used by firewalld """ if not os.path.exists(FIREWALLD_PIDFILE): return False try: with open(FIREWALLD_PIDFILE, "r") as fd: pid = fd.readline() except Exception: return False if not os.path.exists("/proc/%s" % pid): return False try: with open("/proc/%s/cmdline" % pid, "r") as fd: cmdline = fd.readline() except Exception: return False if "firewalld" in cmdline: return True return False def tempFile(): try: if not os.path.exists(FIREWALLD_TEMPDIR): os.mkdir(FIREWALLD_TEMPDIR, 0o750) return tempfile.NamedTemporaryFile(mode='wt', prefix="temp.", dir=FIREWALLD_TEMPDIR, delete=False) except Exception as msg: log.error("Failed to create temporary file: %s" % msg) raise def readfile(filename): try: with open(filename, "r") as f: return f.readlines() except Exception as e: log.error('Failed to read file "%s": %s' % (filename, e)) return None def writefile(filename, line): try: with open(filename, "w") as f: f.write(line) except Exception as e: log.error('Failed to write to file "%s": %s' % (filename, e)) return False return True def enable_ip_forwarding(ipv): if ipv == "ipv4": return writefile("/proc/sys/net/ipv4/ip_forward", "1\n") elif ipv == "ipv6": return writefile("/proc/sys/net/ipv6/conf/all/forwarding", "1\n") return False def get_nf_conntrack_short_name(module): return module.replace("_","-").replace("nf-conntrack-", "") def check_port(port): _range = getPortRange(port) if _range == -2 or _range == -1 or _range is None or \ (len(_range) == 2 and _range[0] >= _range[1]): if _range == -2: log.debug2("'%s': port > 65535" % port) elif _range == -1: log.debug2("'%s': port is invalid" % port) elif _range is None: log.debug2("'%s': port is ambiguous" % port) elif len(_range) == 2 and _range[0] >= _range[1]: log.debug2("'%s': range start >= end" % port) return False return True def check_address(ipv, source): if ipv == "ipv4": return checkIPnMask(source) elif ipv == "ipv6": return checkIP6nMask(source) else: return False def check_single_address(ipv, source): if ipv == "ipv4": return checkIP(source) elif ipv == "ipv6": return checkIP6(source) else: return False def check_mac(mac): if len(mac) == 12+5: # 0 1 : 3 4 : 6 7 : 9 10 : 12 13 : 15 16 for i in (2, 5, 8, 11, 14): if mac[i] != ":": return False for i in (0, 1, 3, 4, 6, 7, 9, 10, 12, 13, 15, 16): if mac[i] not in string.hexdigits: return False return True return False def uniqify(_list): # removes duplicates from list, whilst preserving order output = [] for x in _list: if x not in output: output.append(x) return output def ppid_of_pid(pid): """ Get parent for pid """ try: f = os.popen("ps -o ppid -h -p %d 2>/dev/null" % pid) pid = int(f.readlines()[0].strip()) f.close() except Exception: return None return pid def max_policy_name_len(): """ iptables limits length of chain to (currently) 28 chars. The longest chain we create is POST_<policy>_allow, which leaves 28 - 11 = 17 chars for <policy>. """ from firewall.core.ipXtables import POLICY_CHAIN_PREFIX from firewall.core.base import SHORTCUTS longest_shortcut = max(map(len, SHORTCUTS.values())) return 28 - (longest_shortcut + len(POLICY_CHAIN_PREFIX) + len("_allow")) def max_zone_name_len(): """ Netfilter limits length of chain to (currently) 28 chars. The longest chain we create is POST_<zone>_allow, which leaves 28 - 11 = 17 chars for <zone>. """ from firewall.core.base import SHORTCUTS longest_shortcut = max(map(len, SHORTCUTS.values())) return 28 - (longest_shortcut + len("__allow")) def checkUser(user): if len(user) < 1 or len(user) > os.sysconf('SC_LOGIN_NAME_MAX'): return False for c in user: if c not in string.ascii_letters and \ c not in string.digits and \ c not in [ ".", "-", "_", "$" ]: return False return True def checkUid(uid): if isinstance(uid, str): try: uid = int(uid) except ValueError: return False if uid >= 0 and uid <= 2**31-1: return True return False def checkCommand(command): if len(command) < 1 or len(command) > 1024: return False for ch in [ "|", "\n", "\0" ]: if ch in command: return False if command[0] != "/": return False return True def checkContext(context): splits = context.split(":") if len(splits) not in [4, 5]: return False # user ends with _u if not root if splits[0] != "root" and splits[0][-2:] != "_u": return False # role ends with _r if splits[1][-2:] != "_r": return False # type ends with _t if splits[2][-2:] != "_t": return False # level might also contain : if len(splits[3]) < 1: return False return True def joinArgs(args): if "quote" in dir(shlex): return " ".join(shlex.quote(a) for a in args) else: return " ".join(pipes.quote(a) for a in args) def splitArgs(_string): return shlex.split(_string) errors.py 0000644 00000010054 15025011705 0006426 0 ustar 00 # -*- coding: utf-8 -*- # # Copyright (C) 2010-2012 Red Hat, Inc. # # Authors: # Thomas Woerner <twoerner@redhat.com> # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see <http://www.gnu.org/licenses/>. # ALREADY_ENABLED = 11 NOT_ENABLED = 12 COMMAND_FAILED = 13 NO_IPV6_NAT = 14 PANIC_MODE = 15 ZONE_ALREADY_SET = 16 UNKNOWN_INTERFACE = 17 ZONE_CONFLICT = 18 BUILTIN_CHAIN = 19 EBTABLES_NO_REJECT = 20 NOT_OVERLOADABLE = 21 NO_DEFAULTS = 22 BUILTIN_ZONE = 23 BUILTIN_SERVICE = 24 BUILTIN_ICMPTYPE = 25 NAME_CONFLICT = 26 NAME_MISMATCH = 27 PARSE_ERROR = 28 ACCESS_DENIED = 29 UNKNOWN_SOURCE = 30 RT_TO_PERM_FAILED = 31 IPSET_WITH_TIMEOUT = 32 BUILTIN_IPSET = 33 ALREADY_SET = 34 MISSING_IMPORT = 35 DBUS_ERROR = 36 BUILTIN_HELPER = 37 NOT_APPLIED = 38 INVALID_ACTION = 100 INVALID_SERVICE = 101 INVALID_PORT = 102 INVALID_PROTOCOL = 103 INVALID_INTERFACE = 104 INVALID_ADDR = 105 INVALID_FORWARD = 106 INVALID_ICMPTYPE = 107 INVALID_TABLE = 108 INVALID_CHAIN = 109 INVALID_TARGET = 110 INVALID_IPV = 111 INVALID_ZONE = 112 INVALID_PROPERTY = 113 INVALID_VALUE = 114 INVALID_OBJECT = 115 INVALID_NAME = 116 INVALID_FILENAME = 117 INVALID_DIRECTORY = 118 INVALID_TYPE = 119 INVALID_SETTING = 120 INVALID_DESTINATION = 121 INVALID_RULE = 122 INVALID_LIMIT = 123 INVALID_FAMILY = 124 INVALID_LOG_LEVEL = 125 INVALID_AUDIT_TYPE = 126 INVALID_MARK = 127 INVALID_CONTEXT = 128 INVALID_COMMAND = 129 INVALID_USER = 130 INVALID_UID = 131 INVALID_MODULE = 132 INVALID_PASSTHROUGH = 133 INVALID_MAC = 134 INVALID_IPSET = 135 INVALID_ENTRY = 136 INVALID_OPTION = 137 INVALID_HELPER = 138 INVALID_PRIORITY = 139 INVALID_POLICY = 140 INVALID_LOG_PREFIX = 141 INVALID_NFLOG_GROUP = 142 INVALID_NFLOG_QUEUE = 143 MISSING_TABLE = 200 MISSING_CHAIN = 201 MISSING_PORT = 202 MISSING_PROTOCOL = 203 MISSING_ADDR = 204 MISSING_NAME = 205 MISSING_SETTING = 206 MISSING_FAMILY = 207 RUNNING_BUT_FAILED = 251 NOT_RUNNING = 252 NOT_AUTHORIZED = 253 UNKNOWN_ERROR = 254 import sys class FirewallError(Exception): def __init__(self, code, msg=None): self.code = code self.msg = msg def __repr__(self): return '%s(%r, %r)' % (self.__class__, self.code, self.msg) def __str__(self): if self.msg: return "%s: %s" % (self.errors[self.code], self.msg) return self.errors[self.code] def get_code(msg): if msg is not None and ":" in msg: idx = msg.index(":") ecode = msg[:idx] else: ecode = msg try: code = FirewallError.codes[ecode] except KeyError: code = UNKNOWN_ERROR return code get_code = staticmethod(get_code) mod = sys.modules[FirewallError.__module__] FirewallError.errors = { getattr(mod,varname) : varname for varname in dir(mod) if not varname.startswith("_") and \ type(getattr(mod,varname)) == int } FirewallError.codes = { FirewallError.errors[code] : code for code in FirewallError.errors } fw_types.py 0000644 00000004220 15025011705 0006750 0 ustar 00 # -*- coding: utf-8 -*- # # Copyright (C) 2013-2016 Red Hat, Inc. # # Authors: # Thomas Woerner <twoerner@redhat.com> # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see <http://www.gnu.org/licenses/>. # __all__ = [ "LastUpdatedOrderedDict" ] class LastUpdatedOrderedDict(object): def __init__(self, x=None): self._dict = { } self._list = [ ] if x: self.update(x) def clear(self): del self._list[:] self._dict.clear() def update(self, x): for key,value in x.items(): self[key] = value def items(self): return [(key, self[key]) for key in self._list] def __delitem__(self, key): if key in self._dict: self._list.remove(key) del self._dict[key] def __repr__(self): return '%s([%s])' % (self.__class__.__name__, ', '.join( ['(%r, %r)' % (key, self[key]) for key in self._list])) def __setitem__(self, key, value): if key not in self._dict: self._list.append(key) self._dict[key] = value def __getitem__(self, key): if type(key) == int: return self._list[key] else: return self._dict[key] def __len__(self): return len(self._list) def copy(self): return LastUpdatedOrderedDict(self) def keys(self): return self._list[:] def values(self): return [ self[key] for key in self._list ] def setdefault(self, key, value=None): if key in self: return self[key] else: self[key] = value return value config/__pycache__/dbus.cpython-39.opt-1.pyc 0000644 00000003005 15025011705 0014540 0 ustar 00 a ���g � @ s d Z dZde Zed Zed Zed Zed Zed Zed Zed Z ed Z ed Z ed Z ed Z ed Zed Zed Zd e Zed Zed Zed Zed Zed Zed Zed Zde Zed Zed Zed Z e d Z ed Z e d Z ed Z ed Z!dS )� � z org.fedoraproject.FirewallD%dz.zonez.policyz.directz .policiesz.ipsetz.configz.servicez .icmptypez.helperz /org/fedoraproject/FirewallD%dz/configz/config/icmptypez/config/servicez /config/zonez/config/policyz /config/ipsetz/config/helperz.infoz.allN)"ZDBUS_INTERFACE_VERSIONZDBUS_INTERFACE_REVISIONZDBUS_INTERFACEZDBUS_INTERFACE_ZONEZDBUS_INTERFACE_POLICYZDBUS_INTERFACE_DIRECTZDBUS_INTERFACE_POLICIESZDBUS_INTERFACE_IPSETZDBUS_INTERFACE_CONFIGZDBUS_INTERFACE_CONFIG_ZONEZ DBUS_INTERFACE_CONFIG_POLICYZ DBUS_INTERFACE_CONFIG_SERVICEZ DBUS_INTERFACE_CONFIG_ICMPTYPEZ DBUS_INTERFACE_CONFIG_POLICIESZ DBUS_INTERFACE_CONFIG_DIRECTZDBUS_INTERFACE_CONFIG_IPSETZ DBUS_INTERFACE_CONFIG_HELPERZ DBUS_PATHZDBUS_PATH_CONFIGZDBUS_PATH_CONFIG_ICMPTYPEZDBUS_PATH_CONFIG_SERVICEZDBUS_PATH_CONFIG_ZONEZDBUS_PATH_CONFIG_POLICYZDBUS_PATH_CONFIG_IPSETZDBUS_PATH_CONFIG_HELPERZ _PK_ACTIONZPK_ACTION_POLICIESZPK_ACTION_POLICIES_INFOZPK_ACTION_CONFIGZPK_ACTION_CONFIG_INFOZPK_ACTION_DIRECTZPK_ACTION_DIRECT_INFOZPK_ACTION_INFOZ PK_ACTION_ALL� r r �8/usr/lib/python3.9/site-packages/firewall/config/dbus.py�<module> sB config/__pycache__/dbus.cpython-39.pyc 0000644 00000003005 15025011705 0013601 0 ustar 00 a ���g � @ s d Z dZde Zed Zed Zed Zed Zed Zed Zed Z ed Z ed Z ed Z ed Z ed Zed Zed Zd e Zed Zed Zed Zed Zed Zed Zed Zde Zed Zed Zed Z e d Z ed Z e d Z ed Z ed Z!dS )� � z org.fedoraproject.FirewallD%dz.zonez.policyz.directz .policiesz.ipsetz.configz.servicez .icmptypez.helperz /org/fedoraproject/FirewallD%dz/configz/config/icmptypez/config/servicez /config/zonez/config/policyz /config/ipsetz/config/helperz.infoz.allN)"ZDBUS_INTERFACE_VERSIONZDBUS_INTERFACE_REVISIONZDBUS_INTERFACEZDBUS_INTERFACE_ZONEZDBUS_INTERFACE_POLICYZDBUS_INTERFACE_DIRECTZDBUS_INTERFACE_POLICIESZDBUS_INTERFACE_IPSETZDBUS_INTERFACE_CONFIGZDBUS_INTERFACE_CONFIG_ZONEZ DBUS_INTERFACE_CONFIG_POLICYZ DBUS_INTERFACE_CONFIG_SERVICEZ DBUS_INTERFACE_CONFIG_ICMPTYPEZ DBUS_INTERFACE_CONFIG_POLICIESZ DBUS_INTERFACE_CONFIG_DIRECTZDBUS_INTERFACE_CONFIG_IPSETZ DBUS_INTERFACE_CONFIG_HELPERZ DBUS_PATHZDBUS_PATH_CONFIGZDBUS_PATH_CONFIG_ICMPTYPEZDBUS_PATH_CONFIG_SERVICEZDBUS_PATH_CONFIG_ZONEZDBUS_PATH_CONFIG_POLICYZDBUS_PATH_CONFIG_IPSETZDBUS_PATH_CONFIG_HELPERZ _PK_ACTIONZPK_ACTION_POLICIESZPK_ACTION_POLICIES_INFOZPK_ACTION_CONFIGZPK_ACTION_CONFIG_INFOZPK_ACTION_DIRECTZPK_ACTION_DIRECT_INFOZPK_ACTION_INFOZ PK_ACTION_ALL� r r �8/usr/lib/python3.9/site-packages/firewall/config/dbus.py�<module> sB config/__pycache__/__init__.cpython-39.pyc 0000644 00000007362 15025011705 0014415 0 ustar 00 a ���g� � @ sb d dl Z ze �e jd� W n4 e jyN d dlZdejd< e �e jd� Y n0 dZd dlZejed� ddl m Z dZ d Z d Z d e Ze d Zd ZdZg d�Ze�d�ZdZdd� Zed� dd� Zed� dZdZdZdZd Zd Z d Z d d d!d"d#d$d%d&d'd(� Z g d)�Z g d*�Z d+d,gZ!g d-�Z"d.Z#d/Z$d0Z%d1Z&d1Z'd2Z(d1Z)d3Z*d4Z+d+Z,d0Z-d5Z.d0Z/d1Z0d0Z1dS )6� N� �C�LC_ALLZ firewalld)�domain� )�dbuszfirewall-configzfirewall-appletz /usr/share/z.gladez(C) 2010-2017 Red Hat, Inc.z1.3.4)z$Thomas Woerner <twoerner@redhat.com>z"Jiri Popelka <jpopelka@redhat.com>zEric Garver <e@erig.me>ac This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this program. If not, see <http://www.gnu.org/licenses/>.zhttp://www.firewalld.orgc C sP | a | d a| d a| d a| d a| d a| d a| d a| d a| d a d S ) Nz/firewalld.conf�/zones� /services� /icmptypes�/ipsets�/helpers� /policiesz /direct.xmlz/lockdown-whitelist.xml) Z ETC_FIREWALLDZFIREWALLD_CONFZETC_FIREWALLD_ZONESZETC_FIREWALLD_SERVICESZETC_FIREWALLD_ICMPTYPESZETC_FIREWALLD_IPSETSZETC_FIREWALLD_HELPERSZETC_FIREWALLD_POLICIESZFIREWALLD_DIRECTZLOCKDOWN_WHITELIST��path� r �</usr/lib/python3.9/site-packages/firewall/config/__init__.py�set_system_config_paths@ s r z/etc/firewalldc C s8 | a | d a| d a| d a| d a| d a| d ad S )Nr r r r r r )ZUSR_LIB_FIREWALLDZFIREWALLD_ZONESZFIREWALLD_SERVICESZFIREWALLD_ICMPTYPESZFIREWALLD_IPSETSZFIREWALLD_HELPERSZFIREWALLD_POLICIESr r r r �set_default_config_pathsQ s r z/usr/lib/firewalldz/var/log/firewalldZmixedz/var/run/firewalld.pidz/run/firewalldz/etc/sysconfigz /etc/sysconfig/network-scriptsz/etc/sysctl.confz/usr/sbin/iptablesz/usr/sbin/iptables-restorez/usr/sbin/ip6tablesz/usr/sbin/ip6tables-restorez/usr/sbin/ebtablesz/usr/sbin/ebtables-restorez/usr/sbin/ipsetz/sbin/modprobez /sbin/rmmod) Zipv4z ipv4-restoreZipv6z ipv6-restoreZebz eb-restoreZipsetZmodprobeZrmmod)�allZunicast� broadcastZ multicast�off)�yes�no�systemZnftablesZiptables)r �truer Zfalse�strictZloosez loose-forwardzstrict-forwardZpublic�d TFr r r z#INPUT:DROP,FORWARD:DROP,OUTPUT:DROP)2�locale� setlocaler �Error�os�environZDOMAIN�gettext�installr r Z DAEMON_NAMEZ CONFIG_NAMEZ APPLET_NAMEZDATADIRZCONFIG_GLADE_NAMEZ COPYRIGHTZVERSIONZAUTHORS�LICENSEZWEBSITEr r ZFIREWALLD_LOGFILEZFIREWALLD_LOGTARGETZFIREWALLD_PIDFILEZFIREWALLD_TEMPDIRZ SYSCONFIGDIRZIFCFGDIRZ SYSCTL_CONFIGZCOMMANDSZLOG_DENIED_VALUESZAUTOMATIC_HELPERS_VALUESZFIREWALL_BACKEND_VALUESZIPV6_RPFILTER_VALUESZ FALLBACK_ZONEZFALLBACK_MINIMAL_MARKZFALLBACK_CLEANUP_ON_EXITZ FALLBACK_CLEANUP_MODULES_ON_EXITZFALLBACK_LOCKDOWNZFALLBACK_IPV6_RPFILTERZFALLBACK_INDIVIDUAL_CALLSZFALLBACK_LOG_DENIEDZFALLBACK_AUTOMATIC_HELPERSZFALLBACK_FIREWALL_BACKENDZ FALLBACK_FLUSH_ALL_ON_RELOADZFALLBACK_RELOAD_POLICYZFALLBACK_RFC3964_IPV4Z FALLBACK_ALLOW_ZONE_DRIFTINGZ FALLBACK_NFTABLES_TABLE_OWNERr r r r �<module> s| � � config/__pycache__/__init__.cpython-39.opt-1.pyc 0000644 00000007362 15025011705 0015354 0 ustar 00 a ���g� � @ sb d dl Z ze �e jd� W n4 e jyN d dlZdejd< e �e jd� Y n0 dZd dlZejed� ddl m Z dZ d Z d Z d e Ze d Zd ZdZg d�Ze�d�ZdZdd� Zed� dd� Zed� dZdZdZdZd Zd Z d Z d d d!d"d#d$d%d&d'd(� Z g d)�Z g d*�Z d+d,gZ!g d-�Z"d.Z#d/Z$d0Z%d1Z&d1Z'd2Z(d1Z)d3Z*d4Z+d+Z,d0Z-d5Z.d0Z/d1Z0d0Z1dS )6� N� �C�LC_ALLZ firewalld)�domain� )�dbuszfirewall-configzfirewall-appletz /usr/share/z.gladez(C) 2010-2017 Red Hat, Inc.z1.3.4)z$Thomas Woerner <twoerner@redhat.com>z"Jiri Popelka <jpopelka@redhat.com>zEric Garver <e@erig.me>ac This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this program. If not, see <http://www.gnu.org/licenses/>.zhttp://www.firewalld.orgc C sP | a | d a| d a| d a| d a| d a| d a| d a| d a| d a d S ) Nz/firewalld.conf�/zones� /services� /icmptypes�/ipsets�/helpers� /policiesz /direct.xmlz/lockdown-whitelist.xml) Z ETC_FIREWALLDZFIREWALLD_CONFZETC_FIREWALLD_ZONESZETC_FIREWALLD_SERVICESZETC_FIREWALLD_ICMPTYPESZETC_FIREWALLD_IPSETSZETC_FIREWALLD_HELPERSZETC_FIREWALLD_POLICIESZFIREWALLD_DIRECTZLOCKDOWN_WHITELIST��path� r �</usr/lib/python3.9/site-packages/firewall/config/__init__.py�set_system_config_paths@ s r z/etc/firewalldc C s8 | a | d a| d a| d a| d a| d a| d ad S )Nr r r r r r )ZUSR_LIB_FIREWALLDZFIREWALLD_ZONESZFIREWALLD_SERVICESZFIREWALLD_ICMPTYPESZFIREWALLD_IPSETSZFIREWALLD_HELPERSZFIREWALLD_POLICIESr r r r �set_default_config_pathsQ s r z/usr/lib/firewalldz/var/log/firewalldZmixedz/var/run/firewalld.pidz/run/firewalldz/etc/sysconfigz /etc/sysconfig/network-scriptsz/etc/sysctl.confz/usr/sbin/iptablesz/usr/sbin/iptables-restorez/usr/sbin/ip6tablesz/usr/sbin/ip6tables-restorez/usr/sbin/ebtablesz/usr/sbin/ebtables-restorez/usr/sbin/ipsetz/sbin/modprobez /sbin/rmmod) Zipv4z ipv4-restoreZipv6z ipv6-restoreZebz eb-restoreZipsetZmodprobeZrmmod)�allZunicast� broadcastZ multicast�off)�yes�no�systemZnftablesZiptables)r �truer Zfalse�strictZloosez loose-forwardzstrict-forwardZpublic�d TFr r r z#INPUT:DROP,FORWARD:DROP,OUTPUT:DROP)2�locale� setlocaler �Error�os�environZDOMAIN�gettext�installr r Z DAEMON_NAMEZ CONFIG_NAMEZ APPLET_NAMEZDATADIRZCONFIG_GLADE_NAMEZ COPYRIGHTZVERSIONZAUTHORS�LICENSEZWEBSITEr r ZFIREWALLD_LOGFILEZFIREWALLD_LOGTARGETZFIREWALLD_PIDFILEZFIREWALLD_TEMPDIRZ SYSCONFIGDIRZIFCFGDIRZ SYSCTL_CONFIGZCOMMANDSZLOG_DENIED_VALUESZAUTOMATIC_HELPERS_VALUESZFIREWALL_BACKEND_VALUESZIPV6_RPFILTER_VALUESZ FALLBACK_ZONEZFALLBACK_MINIMAL_MARKZFALLBACK_CLEANUP_ON_EXITZ FALLBACK_CLEANUP_MODULES_ON_EXITZFALLBACK_LOCKDOWNZFALLBACK_IPV6_RPFILTERZFALLBACK_INDIVIDUAL_CALLSZFALLBACK_LOG_DENIEDZFALLBACK_AUTOMATIC_HELPERSZFALLBACK_FIREWALL_BACKENDZ FALLBACK_FLUSH_ALL_ON_RELOADZFALLBACK_RELOAD_POLICYZFALLBACK_RFC3964_IPV4Z FALLBACK_ALLOW_ZONE_DRIFTINGZ FALLBACK_NFTABLES_TABLE_OWNERr r r r �<module> s| � � config/dbus.py 0000644 00000005021 15025011705 0007312 0 ustar 00 # -*- coding: utf-8 -*- # # Copyright (C) 2011,2016 Red Hat, Inc. # # Authors: # Thomas Woerner <twoerner@redhat.com> # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see <http://www.gnu.org/licenses/>. # DBUS_INTERFACE_VERSION = 1 DBUS_INTERFACE_REVISION = 15 DBUS_INTERFACE = "org.fedoraproject.FirewallD%d" % DBUS_INTERFACE_VERSION DBUS_INTERFACE_ZONE = DBUS_INTERFACE+".zone" DBUS_INTERFACE_POLICY = DBUS_INTERFACE+".policy" DBUS_INTERFACE_DIRECT = DBUS_INTERFACE+".direct" DBUS_INTERFACE_POLICIES = DBUS_INTERFACE+".policies" DBUS_INTERFACE_IPSET = DBUS_INTERFACE+".ipset" DBUS_INTERFACE_CONFIG = DBUS_INTERFACE+".config" DBUS_INTERFACE_CONFIG_ZONE = DBUS_INTERFACE_CONFIG+".zone" DBUS_INTERFACE_CONFIG_POLICY = DBUS_INTERFACE_CONFIG+".policy" DBUS_INTERFACE_CONFIG_SERVICE = DBUS_INTERFACE_CONFIG+".service" DBUS_INTERFACE_CONFIG_ICMPTYPE = DBUS_INTERFACE_CONFIG+".icmptype" DBUS_INTERFACE_CONFIG_POLICIES = DBUS_INTERFACE_CONFIG+".policies" DBUS_INTERFACE_CONFIG_DIRECT = DBUS_INTERFACE_CONFIG+".direct" DBUS_INTERFACE_CONFIG_IPSET = DBUS_INTERFACE_CONFIG+".ipset" DBUS_INTERFACE_CONFIG_HELPER = DBUS_INTERFACE_CONFIG+".helper" DBUS_PATH = "/org/fedoraproject/FirewallD%d" % DBUS_INTERFACE_VERSION DBUS_PATH_CONFIG = DBUS_PATH+"/config" DBUS_PATH_CONFIG_ICMPTYPE = DBUS_PATH+"/config/icmptype" DBUS_PATH_CONFIG_SERVICE = DBUS_PATH+"/config/service" DBUS_PATH_CONFIG_ZONE = DBUS_PATH+"/config/zone" DBUS_PATH_CONFIG_POLICY = DBUS_PATH+"/config/policy" DBUS_PATH_CONFIG_IPSET = DBUS_PATH+"/config/ipset" DBUS_PATH_CONFIG_HELPER = DBUS_PATH+"/config/helper" # Polkit actions _PK_ACTION = "org.fedoraproject.FirewallD%d" % DBUS_INTERFACE_VERSION PK_ACTION_POLICIES = _PK_ACTION+".policies" PK_ACTION_POLICIES_INFO = PK_ACTION_POLICIES+".info" PK_ACTION_CONFIG = _PK_ACTION+".config" PK_ACTION_CONFIG_INFO = PK_ACTION_CONFIG+".info" PK_ACTION_DIRECT = _PK_ACTION+".direct" PK_ACTION_DIRECT_INFO = PK_ACTION_DIRECT+".info" PK_ACTION_INFO = _PK_ACTION+".info" PK_ACTION_ALL = _PK_ACTION+".all" # implies all other actions config/__init__.py 0000644 00000011744 15025011705 0010125 0 ustar 00 # -*- coding: utf-8 -*- # # Copyright (C) 2007-2016 Red Hat, Inc. # Authors: # Thomas Woerner <twoerner@redhat.com> # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see <http://www.gnu.org/licenses/>. # # translation import locale try: locale.setlocale(locale.LC_ALL, "") except locale.Error: import os os.environ['LC_ALL'] = 'C' locale.setlocale(locale.LC_ALL, "") DOMAIN = 'firewalld' import gettext gettext.install(domain=DOMAIN) from . import dbus # noqa: F401 # configuration DAEMON_NAME = 'firewalld' CONFIG_NAME = 'firewall-config' APPLET_NAME = 'firewall-applet' DATADIR = '/usr/share/' + DAEMON_NAME CONFIG_GLADE_NAME = CONFIG_NAME + '.glade' COPYRIGHT = '(C) 2010-2017 Red Hat, Inc.' VERSION = '1.3.4' AUTHORS = [ "Thomas Woerner <twoerner@redhat.com>", "Jiri Popelka <jpopelka@redhat.com>", "Eric Garver <e@erig.me>", ] LICENSE = gettext.gettext( "This program is free software; you can redistribute it and/or modify " "it under the terms of the GNU General Public License as published by " "the Free Software Foundation; either version 2 of the License, or " "(at your option) any later version.\n" "\n" "This program is distributed in the hope that it will be useful, " "but WITHOUT ANY WARRANTY; without even the implied warranty of " "MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the " "GNU General Public License for more details.\n" "\n" "You should have received a copy of the GNU General Public License " "along with this program. If not, see <http://www.gnu.org/licenses/>.") WEBSITE = 'http://www.firewalld.org' def set_system_config_paths(path): global ETC_FIREWALLD, FIREWALLD_CONF, ETC_FIREWALLD_ZONES, \ ETC_FIREWALLD_SERVICES, ETC_FIREWALLD_ICMPTYPES, \ ETC_FIREWALLD_IPSETS, ETC_FIREWALLD_HELPERS, \ FIREWALLD_DIRECT, LOCKDOWN_WHITELIST, ETC_FIREWALLD_POLICIES ETC_FIREWALLD = path FIREWALLD_CONF = path + '/firewalld.conf' ETC_FIREWALLD_ZONES = path + '/zones' ETC_FIREWALLD_SERVICES = path + '/services' ETC_FIREWALLD_ICMPTYPES = path + '/icmptypes' ETC_FIREWALLD_IPSETS = path + '/ipsets' ETC_FIREWALLD_HELPERS = path + '/helpers' ETC_FIREWALLD_POLICIES = path + '/policies' FIREWALLD_DIRECT = path + '/direct.xml' LOCKDOWN_WHITELIST = path + '/lockdown-whitelist.xml' set_system_config_paths('/etc/firewalld') def set_default_config_paths(path): global USR_LIB_FIREWALLD, FIREWALLD_ZONES, FIREWALLD_SERVICES, \ FIREWALLD_ICMPTYPES, FIREWALLD_IPSETS, FIREWALLD_HELPERS, \ FIREWALLD_POLICIES USR_LIB_FIREWALLD = path FIREWALLD_ZONES = path + '/zones' FIREWALLD_SERVICES = path + '/services' FIREWALLD_ICMPTYPES = path + '/icmptypes' FIREWALLD_IPSETS = path + '/ipsets' FIREWALLD_HELPERS = path + '/helpers' FIREWALLD_POLICIES = path + '/policies' set_default_config_paths('/usr/lib/firewalld') FIREWALLD_LOGFILE = '/var/log/firewalld' FIREWALLD_LOGTARGET = 'mixed' FIREWALLD_PIDFILE = "/var/run/firewalld.pid" FIREWALLD_TEMPDIR = '/run/firewalld' SYSCONFIGDIR = '/etc/sysconfig' IFCFGDIR = "/etc/sysconfig/network-scripts" SYSCTL_CONFIG = '/etc/sysctl.conf' # commands used by backends COMMANDS = { "ipv4": "/usr/sbin/iptables", "ipv4-restore": "/usr/sbin/iptables-restore", "ipv6": "/usr/sbin/ip6tables", "ipv6-restore": "/usr/sbin/ip6tables-restore", "eb": "/usr/sbin/ebtables", "eb-restore": "/usr/sbin/ebtables-restore", "ipset": "/usr/sbin/ipset", "modprobe": "/sbin/modprobe", "rmmod": "/sbin/rmmod", } LOG_DENIED_VALUES = [ "all", "unicast", "broadcast", "multicast", "off" ] AUTOMATIC_HELPERS_VALUES = [ "yes", "no", "system" ] FIREWALL_BACKEND_VALUES = [ "nftables", "iptables" ] IPV6_RPFILTER_VALUES = ["yes", "true", "no", "false", "strict", "loose", "loose-forward", "strict-forward"] # fallbacks: will be overloaded by firewalld.conf FALLBACK_ZONE = "public" FALLBACK_MINIMAL_MARK = 100 FALLBACK_CLEANUP_ON_EXIT = True FALLBACK_CLEANUP_MODULES_ON_EXIT = False FALLBACK_LOCKDOWN = False FALLBACK_IPV6_RPFILTER = "strict" FALLBACK_INDIVIDUAL_CALLS = False FALLBACK_LOG_DENIED = "off" FALLBACK_AUTOMATIC_HELPERS = "no" FALLBACK_FIREWALL_BACKEND = "nftables" FALLBACK_FLUSH_ALL_ON_RELOAD = True FALLBACK_RELOAD_POLICY = "INPUT:DROP,FORWARD:DROP,OUTPUT:DROP" FALLBACK_RFC3964_IPV4 = True FALLBACK_ALLOW_ZONE_DRIFTING = False FALLBACK_NFTABLES_TABLE_OWNER = True server/__pycache__/config_service.cpython-39.opt-1.pyc 0000644 00000047616 15025011705 0016651 0 ustar 00 a ���g_u � @ s� d dl Z d dlZ d dlmZ d dlmZmZmZ d dlm Z d dl m Z d dl m Z mZmZmZ d dlmZ d dlmZ G d d � d e �ZdS ) � N)�config)�dbus_to_python�%dbus_introspection_prepare_properties�!dbus_introspection_add_properties)�log)�DbusServiceObject)�handle_exceptions�dbus_handle_exceptions�dbus_service_method�dbus_polkit_require_auth)�errors)� FirewallErrorc s� e Zd ZdZdZejjZe � fdd��Z e dd� �Z e dd� �Z e d d � �Zeejd d d �e d�dd���Zeejddd �e d�dd���Zeejj�eejdd�e d�dd����Zejjejdd�dd � �Zeejj�eejdd �e d�� fd d � ���Zeejjd d �e d�d!d"���Z eejjdd �e d�d#d$���Z eejjd d�e d�d%d&���Z eejjdd�e d�d'd(���Z eejj�e d�d)d*���Z ejjejjdd�e d+d,� ��Z!eejj�e d�d-d.���Z"ejjejjdd�e d/d0� ��Z#eejjdd�e d�d1d2���Z$ejjejjdd�e d3d4� ��Z%eejjdd �e d�d5d6���Z&eejjdd�e d�d7d8���Z'eejjdd �e d�d9d:���Z(eejjdd�e d�d;d<���Z)eejjdd �e d�d=d>���Z*eejjdd�e d�d?d@���Z+eejjdAd �e d�dBdC���Z,eejjdAd�e d�dDdE���Z-eejjd d�e d�dFdG���Z.eejjd d�e d�dHdI���Z/eejjd dJd �e d�dKdL���Z0eejjdMd �e d�dNdO���Z1eejjdMd�e d�dPdQ���Z2eejjdd�e d�dRdS���Z3eejjdd�e d�dTdU���Z4eejjddJd �e d�dVdW���Z5eejjdAd �e d�dXdY���Z6eejjdAd�e d�dZd[���Z7eejjd d�e d�d\d]���Z8eejjd d�e d�d^d_���Z9eejjd dJd �e d�d`da���Z:eejjdMd �e d�dbdc���Z;eejjdMd�e d�ddde���Z<eejjdd�e d�dfdg���Z=eejjdd�e d�dhdi���Z>eejjddJd �e d�djdk���Z?eejjdld �e d�dmdn���Z@eejjdld�e d�dodp���ZAeejjddd �e d�dqdr���ZBeejjd d�e d�dsdt���ZCeejjdd�e d�dudv���ZDeejjd dJd �e d�dwdx���ZEeejjdMd �e d�dydz���ZFeejjdMd�e d�d{d|���ZGeejjdd�e d�d}d~���ZHeejjdd�e d�dd����ZIeejjddJd �e d�d�d����ZJ� ZKS )��FirewallDConfigServicezFirewallD main classTc s` t t| �j|i |�� || _|| _|| _|| _|d | _|d | _d| j | _ t | tj j � d S )Nr � zconfig.service.%d) �superr �__init__�parentr �obj�item_id�busname�path� _log_prefixr �dbus� DBUS_INTERFACE_CONFIG_SERVICE)�selfr Zconf�servicer �args�kwargs�� __class__� �B/usr/lib/python3.9/site-packages/firewall/server/config_service.pyr 2 s �z FirewallDConfigService.__init__c C s d S �Nr �r r r r! �__del__? s z FirewallDConfigService.__del__c C s | � � d S r" )Zremove_from_connectionr# r r r! � unregisterC s z!FirewallDConfigService.unregisterc C s� |dkrt �| jj�S |dkr,t �| jj�S |dkrBt �| jj�S |dkrXt �| jj�S |dkrnt �| jj�S t j � d| ��d S )N�name�filenamer �default�builtinzDorg.freedesktop.DBus.Error.InvalidArgs: Property '%s' does not exist) r �Stringr r& r' r ZBooleanr( r) � exceptions� DBusException)r � property_namer r r! � _get_propertyK s ��z$FirewallDConfigService._get_property�ss�v)� in_signature� out_signatureNc C sL t |t�}t |t�}t�d| j||� |tjjkrBtj� d| ��| � |�S )Nz%s.Get('%s', '%s')�Jorg.freedesktop.DBus.Error.UnknownInterface: Interface '%s' does not exist) r �strr �debug1r r r r r+ r, r. )r �interface_namer- �senderr r r! �Get\ s � ��zFirewallDConfigService.Get�sza{sv}c C s` t |t�}t�d| j|� |tjjkr6tj� d| ��i }dD ]}| � |�||< q>tj |dd�S )Nz%s.GetAll('%s')r3 )r& r' r r( r) �sv�Z signature) r r4 r r5 r r r r r+ r, r. Z Dictionary)r r6 r7 �ret�xr r r! �GetAllm s ��z FirewallDConfigService.GetAllZssv)r1 c C sl t |t�}t |t�}t |�}t�d| j|||� | j�|� |tjj krXtj � d| ��tj � d| ��d S )Nz%s.Set('%s', '%s', '%s')r3 zGorg.freedesktop.DBus.Error.PropertyReadOnly: Property '%s' is read-only) r r4 r r5 r r � accessCheckr r r r+ r, )r r6 r- Z new_valuer7 r r r! �Set~ s$ � ����zFirewallDConfigService.Setzsa{sv}asr; c C s2 t |t�}t |�}t |�}t�d| j|||� d S )Nz&%s.PropertiesChanged('%s', '%s', '%s'))r r4 r r5 r )r r6 Zchanged_propertiesZinvalidated_propertiesr r r! �PropertiesChanged� s �z(FirewallDConfigService.PropertiesChanged)r2 c s8 t �d| j� tt| ��| j| j�� �}t | |t j j �S )Nz%s.Introspect()) r Zdebug2r r r � Introspectr r Zget_busr r r r )r r7 �datar r r! rB � s � �z!FirewallDConfigService.Introspectz(sssa(ss)asa{ss}asa(ss))c C s t �d| j� | j�| j�S )�!get settings for service z%s.getSettings())r r5 r r Zget_service_configr �r r7 r r r! � getSettings� s z"FirewallDConfigService.getSettingsc C s t �d| j� | j�| j�S )rD z%s.getSettings2())r r5 r r �get_service_config_dictr rE r r r! � getSettings2� s z#FirewallDConfigService.getSettings2c C sF t |�}t�d| j� | j�|� | j�| j|�| _| � | jj � dS )z$update settings for service z%s.update('...')N) r r r5 r r r? r Zset_service_configr �Updatedr& �r �settingsr7 r r r! �update� s z FirewallDConfigService.updatec C sF t |�}t�d| j� | j�|� | j�| j|�| _| � | jj � d S )Nz%s.update2('...')) r r r5 r r r? r �set_service_config_dictr rI r& rJ r r r! �update2� s z FirewallDConfigService.update2c C s< t �d| j� | j�|� | j�| j�| _| �| jj � dS )z2load default settings for builtin service z%s.loadDefaults()N) r r5 r r r? r Zload_service_defaultsr rI r& rE r r r! � loadDefaults� s z#FirewallDConfigService.loadDefaultsc C s t �d| j|f � d S )Nz%s.Updated('%s')�r r5 r �r r& r r r! rI � s z FirewallDConfigService.Updatedc C s: t �d| j� | j�|� | j�| j� | j�| j� dS )zremove service z%s.removeService()N) r r5 r r r? r Zremove_servicer Z removeServicerE r r r! �remove� s z FirewallDConfigService.removec C s t �d| j|f � d S )Nz%s.Removed('%s')rP rQ r r r! �Removed� s z FirewallDConfigService.Removedc C sF t |t�}t�d| j|� | j�|� | j�| j |�| _ | � |� dS )zrename service z%s.rename('%s')N) r r4 r r5 r r r? r Zrename_servicer �Renamed)r r& r7 r r r! �rename� s z FirewallDConfigService.renamec C s t �d| j|f � d S )Nz%s.Renamed('%s')rP rQ r r r! rT s z FirewallDConfigService.Renamedc C s t �d| j� | �� d S )Nz%s.getVersion()r �r r5 r rF rE r r r! � getVersion s z!FirewallDConfigService.getVersionc C sH t |t�}t�d| j|� | j�|� t| �� �}||d< | � |� d S )Nz%s.setVersion('%s')r � r r4 r r5 r r r? �listrF rL )r �versionr7 rK r r r! � setVersion s z!FirewallDConfigService.setVersionc C s t �d| j� | �� d S )Nz %s.getShort()r rV rE r r r! �getShort s z FirewallDConfigService.getShortc C sH t |t�}t�d| j|� | j�|� t| �� �}||d< | � |� d S )Nz%s.setShort('%s')r rX )r Zshortr7 rK r r r! �setShort$ s z FirewallDConfigService.setShortc C s t �d| j� | �� d S )Nz%s.getDescription()� rV rE r r r! �getDescription1 s z%FirewallDConfigService.getDescriptionc C sH t |t�}t�d| j|� | j�|� t| �� �}||d< | � |� d S )Nz%s.setDescription('%s')r^ rX )r � descriptionr7 rK r r r! �setDescription8 s � z%FirewallDConfigService.setDescriptionza(ss)c C s t �d| j� | �� d S )Nz %s.getPorts()� rV rE r r r! �getPortsF s z FirewallDConfigService.getPortsc C s� g }t |t�D ](}t|t�r,|�t|�� q|�|� q|}t�d| jd�dd� |D ��� | j � |� t| � � �}||d< | � |� d S )Nz%s.setPorts('[%s]')�,c s s" | ]}d |d |d f V qdS �z ('%s, '%s')r r Nr ��.0�portr r r! � <genexpr>Z � z2FirewallDConfigService.setPorts.<locals>.<genexpr>rb � r rY � isinstance�append�tupler r5 r �joinr r? rF rL �r Zportsr7 Z_portsrh rK r r r! �setPortsM s � z FirewallDConfigService.setPortsc C s� t |t�}t |t�}t�d| j||� | j�|� t| �� �}||f|d v rbt t j d||f ��|d � ||f� | � |� d S )Nz%s.addPort('%s', '%s')rb �%s:%s�r r4 r r5 r r r? rY rF r r �ALREADY_ENABLEDrm rL �r rh �protocolr7 rK r r r! �addPort` s � �z FirewallDConfigService.addPortc C s� t |t�}t |t�}t�d| j||� | j�|� t| �� �}||f|d vrbt t j d||f ��|d � ||f� | � |� d S )Nz%s.removePort('%s', '%s')rb rr �r r4 r r5 r r r? rY rF r r � NOT_ENABLEDrR rL ru r r r! � removePortp s � z!FirewallDConfigService.removePort�bc C s: t |t�}t |t�}t�d| j||� ||f| �� d v S )Nz%s.queryPort('%s', '%s')rb �r r4 r r5 r rF �r rh rv r7 r r r! � queryPort s �z FirewallDConfigService.queryPort�asc C s t �d| j� | �� d S )Nz%s.getProtocols()� rV rE r r r! � getProtocols� s z#FirewallDConfigService.getProtocolsc C sN t |t�}t�d| jd�|�� | j�|� t| �� �}||d< | � |� d S )Nz%s.setProtocols('[%s]')rd r� ) r rY r r5 r ro r r? rF rL )r Z protocolsr7 rK r r r! � setProtocols� s � z#FirewallDConfigService.setProtocolsc C sf t |t�}t�d| j|� | j�|� t| �� �}||d v rJt t j |��|d � |� | � |� d S )Nz%s.addProtocol('%s')r� rs �r rv r7 rK r r r! � addProtocol� s z"FirewallDConfigService.addProtocolc C sf t |t�}t�d| j|� | j�|� t| �� �}||d vrJt t j |��|d � |� | � |� d S )Nz%s.removeProtocol('%s')r� rx r� r r r! �removeProtocol� s z%FirewallDConfigService.removeProtocolc C s* t |t�}t�d| j|� || �� d v S )Nz%s.queryProtocol(%s')r� r| )r rv r7 r r r! � queryProtocol� s z$FirewallDConfigService.queryProtocolc C s t �d| j� | �� d S )Nz%s.getSourcePorts()� rV rE r r r! �getSourcePorts� s z%FirewallDConfigService.getSourcePortsc C s� g }t |t�D ](}t|t�r,|�t|�� q|�|� q|}t�d| jd�dd� |D ��� | j � |� t| � � �}||d< | � |� d S )Nz%s.setSourcePorts('[%s]')rd c s s" | ]}d |d |d f V qdS re r rf r r r! ri � rj z8FirewallDConfigService.setSourcePorts.<locals>.<genexpr>r� rk rp r r r! �setSourcePorts� s � z%FirewallDConfigService.setSourcePortsc C s� t |t�}t |t�}t�d| j||� | j�|� t| �� �}||f|d v rbt t j d||f ��|d � ||f� | � |� d S )Nz %s.addSourcePort('%s', '%s')r� rr rs ru r r r! � addSourcePort� s � �z$FirewallDConfigService.addSourcePortc C s� t |t�}t |t�}t�d| j||� | j�|� t| �� �}||f|d vrbt t j d||f ��|d � ||f� | � |� d S )Nz %s.removeSourcePort('%s', '%s')r� rr rx ru r r r! �removeSourcePort� s � z'FirewallDConfigService.removeSourcePortc C s: t |t�}t |t�}t�d| j||� ||f| �� d v S )Nz %s.querySourcePort('%s', '%s')r� r| r} r r r! �querySourcePort� s �z&FirewallDConfigService.querySourcePortc C s t �d| j� | �� d S )Nz%s.getModules()� rV rE r r r! � getModules s z!FirewallDConfigService.getModulesc C s� t |t�}g }|D ]8}|�d�r@|�dd�}d|v r@|�dd�}|�|� q|}t�d| jd�|�� | j � |� t| � � �}||d< | � |� d S )N� nf_conntrack_� �_�-z%s.setModules('[%s]')rd r� ) r rY � startswith�replacerm r r5 r ro r r? rF rL )r �modulesr7 Z_modules�modulerK r r r! � setModules s � z!FirewallDConfigService.setModulesc C s� t |t�}|�d�r4|�dd�}d|v r4|�dd�}t�d| j|� | j�|� t | � � �}||d v rtt t j |��|d �|� | �|� d S )Nr� r� r� r� z%s.addModule('%s')r� )r r4 r� r� r r5 r r r? rY rF r r rt rm rL �r r� r7 rK r r r! � addModule" s z FirewallDConfigService.addModulec C s� t |t�}|�d�r4|�dd�}d|v r4|�dd�}t�d| j|� | j�|� t | � � �}||d vrtt t j |��|d �|� | �|� d S )Nr� r� r� r� z%s.removeModule('%s')r� )r r4 r� r� r r5 r r r? rY rF r r ry rR rL r� r r r! � removeModule3 s z#FirewallDConfigService.removeModulec C sT t |t�}|�d�r4|�dd�}d|v r4|�dd�}t�d| j|� || �� d v S )Nr� r� r� r� z%s.queryModule('%s')r� )r r4 r� r� r r5 r rF )r r� r7 r r r! � queryModuleD s z"FirewallDConfigService.queryModuleza{ss}c C s t �d| j� | �� d S )Nz%s.getDestinations()� rV rE r r r! �getDestinationsR s z&FirewallDConfigService.getDestinationsc C sV t |t�}t�d| j|�d�|�d�� | j�|� t| � � �}||d< | � |� d S )Nz*%s.setDestinations({ipv4:'%s', ipv6:'%s'})Zipv4Zipv6r� ) r �dictr r5 r �getr r? rY rF rL )r Z destinationsr7 rK r r r! �setDestinationsY s � z&FirewallDConfigService.setDestinationsc C sV t |t�}t�d| j|� | j�|� t| �� �}||d vrJt t j |��|d | S )Nz%s.getDestination('%s')r� ) r r4 r r5 r r r? rY rF r r ry �r �familyr7 rK r r r! �getDestinationf s � z%FirewallDConfigService.getDestinationc C s� t |t�}t |t�}t�d| j||� | j�|� t| �� �}||d v rn|d | |krnt t j d||f ��||d |< | � |� d S )Nz %s.setDestination('%s', '%s')r� z '%s': '%s') r r4 r r5 r r r? rY rF r r rt rL �r r� �addressr7 rK r r r! �setDestinations s � � z%FirewallDConfigService.setDestinationc C sb t |t�}t�d| j|� | j�|� t| �� �}||d vrJt t j |��|d |= | � |� d S )Nz%s.removeDestination('%s')r� ) r r4 r r5 r r r? rY rF r r ry rL r� r r r! �removeDestination� s � z(FirewallDConfigService.removeDestinationc C sJ t |t�}t |t�}t�d| j||� | �� }||d v oH||d | kS )Nz %s.queryDestination('%s', '%s')r� r| r� r r r! �queryDestination� s � �z'FirewallDConfigService.queryDestinationc C s< t �d| j� | j�|� | j�| j�}d|v r8|d S g S )Nz%s.getIncludes()�includes)r r5 r r r? r rG r )r r7 rK r r r! � getIncludes� s z"FirewallDConfigService.getIncludesc C sZ t |t�}t�d| j|� | j�|� d|d d � i}| j�| j |�| _ | � | j j � d S )Nz%s.setIncludes('%s')r� ) r rY r r5 r r r? r rM r rI r& )r r� r7 rK r r r! � setIncludes� s z"FirewallDConfigService.setIncludesc C sj t |t�}t�d| j|� | j�|� | j�| j �}|� dg �� |� | j� | j |�| _ | � | j j� d S )Nz%s.addInclude('%s')r� )r r4 r r5 r r r? r rG r � setdefaultrm rM rI r& �r Zincluder7 rK r r r! � addInclude� s z!FirewallDConfigService.addIncludec C sf t |t�}t�d| j|� | j�|� | j�| j �}|d � |� | j� | j |�| _ | � | j j � d S )Nz%s.removeInclude('%s')r� )r r4 r r5 r r r? r rG r rR rM rI r& r� r r r! � removeInclude� s z$FirewallDConfigService.removeIncludec C s@ t |t�}t�d| j|� | j�| j�}d|v r<||d v S dS )Nz%s.queryInclude('%s')r� F)r r4 r r5 r r rG r r� r r r! � queryInclude� s z#FirewallDConfigService.queryInclude)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)L�__name__� __module__� __qualname__�__doc__Z persistentr r ZPK_ACTION_CONFIGZ default_polkit_auth_requiredr r r r$ r% r. r ZPROPERTIES_IFACEr8 r> r r@ r �signalrA ZPK_ACTION_INFOZINTROSPECTABLE_IFACErB r rF rH rL rN rO rI rR rS rU rT rW r[ r\ r] r_ ra rc rq rw rz r~ r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� � __classcell__r r r r! r * s �� ��� � � � � � �� �� �� ��� � � �� � � ���� � � ����� �� � � � � ��� � �r )r Z dbus.serviceZfirewallr Zfirewall.dbus_utilsr r r Zfirewall.core.loggerr Zfirewall.server.dbusr Zfirewall.server.decoratorsr r r r r Zfirewall.errorsr r r r r r! �<module> s server/__pycache__/decorators.cpython-39.pyc 0000644 00000012755 15025011705 0015066 0 ustar 00 a ���g� � @ s� d Z g d�ZddlZddlZddlZddlZddlZddlmZ ddl m Z ddl m Z ddl mZ ddlmZmZ dd lmZ d d � Zd d � Zdd� ZG dd� d�ZG dd� de�ZG dd� d�ZdS )z>This module contains decorators for use with and without D-Bus)�handle_exceptions�dbus_handle_exceptions�dbus_service_method� N)� DBusException)� FirewallError)�errors)�log)�FirewallDBusException�NotAuthorizedException)� uid_of_senderc s t �� �� fdd��}|S )zTDecorator to handle exceptions and log them. Used if not conneced to D-Bus. c sj z� | i |��W S t yL } z$t�t�� � t�|� W Y d }~n"d }~0 tyd t�� Y n0 d S �N)r r �debug1� traceback� format_exc�error� Exception� exception)�args�kwargsr ��func� �>/usr/lib/python3.9/site-packages/firewall/server/decorators.py�_impl0 s z handle_exceptions.<locals>._impl)� functools�wraps�r r r r r r , s r c s& t �� �� fdd��}t�� �|_|S )z�Decorator to handle exceptions, log and report them into D-Bus :Raises DBusException: on a firewall error code problems. c s� z� | i |��W S t y� } zjt �t|��}|tjtjtjtjfv rVt� t|�� n t� t � � � t� t|�� tt|���W Y d }~nfd }~0 ty� } z|�W Y d }~n@d }~0 ty� } z t�� tt|���W Y d }~n d }~0 0 d S r )r �get_code�strr ZALREADY_ENABLEDZ NOT_ENABLEDZZONE_ALREADY_SETZ ALREADY_SETr Zwarningr r r r r r r r )r r r �code�exr r r r @ s � z%dbus_handle_exceptions.<locals>._impl)r r �inspectZ signatureZ __signature__r r r r r ; s r c O s |� dd� tjj| i |��S )z Add sender argument for D-BusZsender_keyword�sender)� setdefault�dbusZservice�method�r r r r r r ` s r c @ s& e Zd ZdZi Zddd�Zdd� ZdS )� dbus_service_method_deprecatedzRDecorator that maintains a list of deprecated methods in dbus interfaces. Nc C s* || _ | j r&| j | jvr&t� | j| j < d S r )� interface� deprecated�set)�selfr( r r r �__init__k s z'dbus_service_method_deprecated.__init__c s4 | j r| j| j �� j� t�� �� fdd��}|S )Nc s � | i |��S r r r& r r r r u s z6dbus_service_method_deprecated.__call__.<locals>._impl)r( r) �add�__name__r r �r+ r r r r r �__call__q s z'dbus_service_method_deprecated.__call__)N)r. � __module__� __qualname__�__doc__r) r, r0 r r r r r' e s r' c @ s e Zd ZdZdS )� dbus_service_signal_deprecatedzRDecorator that maintains a list of deprecated signals in dbus interfaces. N)r. r1 r2 r3 r r r r r4 z s r4 c @ sD e Zd ZdZdZdZdZdZdZdZ dd� Z e dd � �Z d d � Z dS ) �dbus_polkit_require_authz�Decorator factory that checks if the interface/method can be used by the sender/user. Assumes wrapped function is a method inside a class derived from DbusServiceObject. zorg.freedesktop.PolicyKit1z%/org/freedesktop/PolicyKit1/Authorityz$org.freedesktop.PolicyKit1.AuthorityNc C s || _ d S r )�_polkit_auth_required)r+ Zpolkit_auth_requiredr r r r, � s z!dbus_polkit_require_auth.__init__c C s | j �| j� d | _d | _d S r )�_busZremove_signal_receiver�_bus_signal_receiver�_interface_polkit)�cls�nameZ old_ownerZ new_ownerr r r �_polkit_name_owner_changed� s z3dbus_polkit_require_auth._polkit_name_owner_changedc s$ t �� �� �fdd��}�j|_|S )Nc s8 t ��jst�� t ��_t ��jsHt ��jjt ��jdd�jd�t ��_t ��js�z6t� t ��j� t ��jt ��j �t ��j �t ��_W n tj y� Y n0 �j}|s�t� d��|�d�}|�r*t ��j�rt ��j�dd|if|i dd �\}}}|�s*t|d ��n$tt ��j|�}|d k�r*t|d ��� | i |��S ) NZNameOwnerChangedzorg.freedesktop.DBus)Zhandler_functionZ signal_nameZdbus_interfaceZarg0z'Not Authorized: No action_id specified.r" zsystem-bus-namer; � � Zpolkitr �uid)�typer7 r$ Z SystemBusr8 Zadd_signal_receiverr< � _polkit_namer9 Z InterfaceZ get_object� _polkit_path�_polkit_interfacer r6 �getZCheckAuthorizationr r )r r Z action_idr" �result�_r? �r r+ r r r � sF � �� � z0dbus_polkit_require_auth.__call__.<locals>._impl)r r r6 r/ r rG r r0 � s +z!dbus_polkit_require_auth.__call__)r. r1 r2 r3 rA rB rC r7 r8 r9 r, � classmethodr< r0 r r r r r5 � s r5 )r3 �__all__r$ Z dbus.servicer r r! Zdbus.exceptionsr Zfirewall.errorsr Zfirewallr Zfirewall.core.loggerr Zfirewall.server.dbusr r Zfirewall.dbus_utilsr r r r r' r4 r5 r r r r �<module> s$ % server/__pycache__/config_helper.cpython-39.opt-1.pyc 0000644 00000027732 15025011705 0016465 0 ustar 00 a ���g*D � @ s� d dl Z d dlZ d dlmZ d dlmZmZmZ d dlm Z d dl m Z d dl m Z d dlmZmZmZmZ d dlmZ d d lmZ G d d � d e �ZdS ) � N)�config)�dbus_to_python�%dbus_introspection_prepare_properties�!dbus_introspection_add_properties)�Helper)�log)�DbusServiceObject)�handle_exceptions�dbus_handle_exceptions�dbus_service_method�dbus_polkit_require_auth)�errors)� FirewallErrorc s� e Zd ZdZdZejjZe � fdd��Z e dd� �Z e dd� �Z e d d � �Zeejd d d �e dTdd���Zeejddd �e dUdd���Zeejj�eejdd�e dVdd����Zejjejdd�dd � �Zeejj�eejdd �e dW� fd d � ���Zeejje j d �e dXd d!���Z eejje j d�e dYd"d#���Z eejj�e dZd$d%���Z ejjejjdd�e d&d'� ��Z!eejj�e d[d(d)���Z"ejjejjdd�e d*d+� ��Z#eejjdd�e d\d,d-���Z$ejjejjdd�e d.d/� ��Z%eejjdd �e d]d0d1���Z&eejjdd�e d^d2d3���Z'eejjdd �e d_d4d5���Z(eejjdd�e d`d6d7���Z)eejjdd �e dad8d9���Z*eejjdd�e dbd:d;���Z+eejjdd �e dcd<d=���Z,eejjdd�e ddd>d?���Z-eejjdd@d �e dedAdB���Z.eejjdd �e dfdCdD���Z/eejjdd�e dgdEdF���Z0eejjdd@d �e dhdGdH���Z1eejjdId �e didJdK���Z2eejjdId�e djdLdM���Z3eejjd d�e dkdNdO���Z4eejjd d�e dldPdQ���Z5eejjd d@d �e dmdRdS���Z6� Z7S )n�FirewallDConfigHelperzFirewallD main classTc s` t t| �j|i |�� || _|| _|| _|| _|d | _|d | _d| j | _ t | tj j � d S )Nr � zconfig.helper.%d) �superr �__init__�parentr �obj�item_id�busname�path� _log_prefixr �dbus� DBUS_INTERFACE_CONFIG_HELPER)�selfr Zconf�helperr �args�kwargs�� __class__� �A/usr/lib/python3.9/site-packages/firewall/server/config_helper.pyr 3 s �z FirewallDConfigHelper.__init__c C s d S �Nr! �r r! r! r" �__del__@ s z FirewallDConfigHelper.__del__c C s | � � d S r# )Zremove_from_connectionr$ r! r! r" � unregisterD s z FirewallDConfigHelper.unregisterc C s� |dkrt �| jj�S |dkr,t �| jj�S |dkrBt �| jj�S |dkrXt �| jj�S |dkrnt �| jj�S t j � d| ��d S )N�name�filenamer �default�builtinzDorg.freedesktop.DBus.Error.InvalidArgs: Property '%s' does not exist) r �Stringr r' r( r ZBooleanr) r* � exceptions� DBusException)r � property_namer! r! r" � _get_propertyL s ��z#FirewallDConfigHelper._get_property�ss�v)� in_signature� out_signatureNc C sL t |t�}t |t�}t�d| j||� |tjjkrBtj� d| ��| � |�S )Nz%s.Get('%s', '%s')�Jorg.freedesktop.DBus.Error.UnknownInterface: Interface '%s' does not exist) r �strr �debug1r r r r r, r- r/ )r �interface_namer. �senderr! r! r" �Get] s � ��zFirewallDConfigHelper.Get�sza{sv}c C s` t |t�}t�d| j|� |tjjkr6tj� d| ��i }dD ]}| � |�||< q>tj |dd�S )Nz%s.GetAll('%s')r4 )r' r( r r) r* �sv�Z signature) r r5 r r6 r r r r r, r- r/ Z Dictionary)r r7 r8 �ret�xr! r! r" �GetAlln s ��z FirewallDConfigHelper.GetAllZssv)r2 c C sl t |t�}t |t�}t |�}t�d| j|||� | j�|� |tjj krXtj � d| ��tj � d| ��d S )Nz%s.Set('%s', '%s', '%s')r4 zGorg.freedesktop.DBus.Error.PropertyReadOnly: Property '%s' is read-only) r r5 r r6 r r � accessCheckr r r r, r- )r r7 r. Z new_valuer8 r! r! r" �Set s$ � ����zFirewallDConfigHelper.Setzsa{sv}asr< c C s2 t |t�}t |�}t |�}t�d| j|||� d S )Nz&%s.PropertiesChanged('%s', '%s', '%s'))r r5 r r6 r )r r7 Zchanged_propertiesZinvalidated_propertiesr! r! r" �PropertiesChanged� s �z'FirewallDConfigHelper.PropertiesChanged)r3 c s8 t �d| j� tt| ��| j| j�� �}t | |t j j �S )Nz%s.Introspect()) r Zdebug2r r r � Introspectr r Zget_busr r r r )r r8 �datar r! r" rC � s � �z FirewallDConfigHelper.Introspectc C s t �d| j� | j�| j�S )z get settings for helper z%s.getSettings())r r6 r r Zget_helper_configr �r r8 r! r! r" � getSettings� s z!FirewallDConfigHelper.getSettingsc C sF t |�}t�d| j� | j�|� | j�| j|�| _| � | jj � dS )z#update settings for helper z%s.update('...')N) r r r6 r r r@ r Zset_helper_configr �Updatedr' )r �settingsr8 r! r! r" �update� s z FirewallDConfigHelper.updatec C s< t �d| j� | j�|� | j�| j�| _| �| jj � dS )z1load default settings for builtin helper z%s.loadDefaults()N) r r6 r r r@ r Zload_helper_defaultsr rG r' rE r! r! r" � loadDefaults� s z"FirewallDConfigHelper.loadDefaultsc C s t �d| j|f � d S )Nz%s.Updated('%s')�r r6 r �r r' r! r! r" rG � s z FirewallDConfigHelper.Updatedc C s: t �d| j� | j�|� | j�| j� | j�| j� dS )zremove helper z%s.removeHelper()N) r r6 r r r@ r Z remove_helperr Z removeHelperrE r! r! r" �remove� s z FirewallDConfigHelper.removec C s t �d| j|f � d S )Nz%s.Removed('%s')rK rL r! r! r" �Removed� s z FirewallDConfigHelper.Removedc C sF t |t�}t�d| j|� | j�|� | j�| j |�| _ | � |� dS )zrename helper z%s.rename('%s')N) r r5 r r6 r r r@ r Z rename_helperr �Renamed)r r' r8 r! r! r" �rename� s z FirewallDConfigHelper.renamec C s t �d| j|f � d S )Nz%s.Renamed('%s')rK rL r! r! r" rO � s z FirewallDConfigHelper.Renamedc C s t �d| j� | �� d S )Nz%s.getVersion()r �r r6 r rF rE r! r! r" � getVersion� s z FirewallDConfigHelper.getVersionc C sH t |t�}t�d| j|� | j�|� t| �� �}||d< | � |� d S )Nz%s.setVersion('%s')r � r r5 r r6 r r r@ �listrF rI )r �versionr8 rH r! r! r" � setVersion� s z FirewallDConfigHelper.setVersionc C s t �d| j� | �� d S )Nz %s.getShort()r rQ rE r! r! r" �getShort s z FirewallDConfigHelper.getShortc C sH t |t�}t�d| j|� | j�|� t| �� �}||d< | � |� d S )Nz%s.setShort('%s')r rS )r Zshortr8 rH r! r! r" �setShort s z FirewallDConfigHelper.setShortc C s t �d| j� | �� d S )Nz%s.getDescription()� rQ rE r! r! r" �getDescription s z$FirewallDConfigHelper.getDescriptionc C sH t |t�}t�d| j|� | j�|� t| �� �}||d< | � |� d S )Nz%s.setDescription('%s')rY rS )r � descriptionr8 rH r! r! r" �setDescription& s � z$FirewallDConfigHelper.setDescriptionc C s. t �d| j� | j�|� t| �� �}|d S )Nz%s.getFamily()� �r r6 r r r@ rT rF �r r8 rH r! r! r" � getFamily4 s z FirewallDConfigHelper.getFamilyc C sd t |t�}t�d| j|� | j�|� t| �� �}|d |krNt t j d| ��||d< | � |� d S )Nz%s.setFamily('%s')r] �'%s'� r r5 r r6 r r r@ rT rF r r �ALREADY_ENABLEDrI �r Zipvr8 rH r! r! r" � setFamily= s z FirewallDConfigHelper.setFamily�bc C s. t |t�}t�d| j|� | �� }|d |kS )Nz%s.queryFamily('%s')r] �r r5 r r6 r rF rd r! r! r" � queryFamilyJ s z!FirewallDConfigHelper.queryFamilyc C s. t �d| j� | j�|� t| �� �}|d S )Nz%s.getModule()� r^ r_ r! r! r" � getModuleU s z FirewallDConfigHelper.getModulec C sd t |t�}t�d| j|� | j�|� t| �� �}|d |krNt t j d| ��||d< | � |� d S )Nz%s.setModule('%s')ri ra rb �r �moduler8 rH r! r! r" � setModule^ s z FirewallDConfigHelper.setModulec C s. t |t�}t�d| j|� | �� }|d |kS )Nz%s.queryModule('%s')ri rg rk r! r! r" � queryModulek s z!FirewallDConfigHelper.queryModuleza(ss)c C s t �d| j� | �� d S )Nz %s.getPorts()� rQ rE r! r! r" �getPortsv s z FirewallDConfigHelper.getPortsc C s� g }t |t�D ](}t|t�r,|�t|�� q|�|� q|}t�d| jd�dd� |D ��� | j � |� t| � � �}||d< | � |� d S )Nz%s.setPorts('[%s]')�,c s s" | ]}d |d |d f V qdS )z ('%s, '%s')r r Nr! )�.0�portr! r! r" � <genexpr>� � z1FirewallDConfigHelper.setPorts.<locals>.<genexpr>ro ) r rT � isinstance�append�tupler r6 r �joinr r@ rF rI )r Zportsr8 Z_portsrs rH r! r! r" �setPorts} s � z FirewallDConfigHelper.setPortsc C s� t |t�}t |t�}t�d| j||� | j�|� t| �� �}||f|d v rbt t j d||f ��|d � ||f� | � |� d S )Nz%s.addPort('%s', '%s')ro �%s:%s)r r5 r r6 r r r@ rT rF r r rc rw rI �r rs �protocolr8 rH r! r! r" �addPort� s � �z FirewallDConfigHelper.addPortc C s� t |t�}t |t�}t�d| j||� | j�|� t| �� �}||f|d vrbt t j d||f ��|d � ||f� | � |� d S )Nz%s.removePort('%s', '%s')ro r{ )r r5 r r6 r r r@ rT rF r r Z NOT_ENABLEDrM rI r| r! r! r" � removePort� s � z FirewallDConfigHelper.removePortc C s: t |t�}t |t�}t�d| j||� ||f| �� d v S )Nz%s.queryPort('%s', '%s')ro rg )r rs r} r8 r! r! r" � queryPort� s �z FirewallDConfigHelper.queryPort)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)8�__name__� __module__� __qualname__�__doc__Z persistentr r ZPK_ACTION_CONFIGZ default_polkit_auth_requiredr r r r% r& r/ r ZPROPERTIES_IFACEr9 r? r rA Zservice�signalrB ZPK_ACTION_INFOZINTROSPECTABLE_IFACErC r r ZDBUS_SIGNATURErF rI rJ rG rM rN rP rO rR rV rW rX rZ r\ r` re rh rj rm rn rp rz r~ r r� � __classcell__r! r! r r" r + s0 �� �� � � � � �� �� �� �� ��� ���� � �r )r Z dbus.serviceZfirewallr Zfirewall.dbus_utilsr r r Zfirewall.core.io.helperr Zfirewall.core.loggerr Zfirewall.server.dbusr Zfirewall.server.decoratorsr r r r r Zfirewall.errorsr r r! r! r! r" �<module> s server/__pycache__/dbus.cpython-39.opt-1.pyc 0000644 00000003041 15025011705 0014601 0 ustar 00 a ���g� � @ sP d dl Z d dlmZ G dd� de j�ZG dd� de j�ZG dd� de jj�ZdS ) � N)�configc @ s e Zd Zd Zdejj ZdS )�FirewallDBusExceptionz %s.ExceptionN)�__name__� __module__� __qualname__�__doc__r �dbus�DBUS_INTERFACE�_dbus_error_name� r r �8/usr/lib/python3.9/site-packages/firewall/server/dbus.pyr s r c s e Zd Z� fdd�Z� ZS )�NotAuthorizedExceptionc s& t jjd | _t� �d�||�� d S )Nz.NotAuthorizedExceptionzNot Authorized({}): {})r r r r �super�__init__�format)�selfZ action_id�method�args�kwargs�� __class__r r r s z NotAuthorizedException.__init__)r r r r � __classcell__r r r r r s r c s e Zd Z� fdd�Z� ZS )�DbusServiceObjectc s^ ddl m} t| �D ]<}t| |�}t|d�rt|d�s|| j�}t| |||�� qt� �| �S )Nr )�dbus_polkit_require_authZ_dbus_is_methodZ_polkit_auth_required) Zfirewall.server.decoratorsr �dir�getattr�hasattrZ default_polkit_auth_required�setattrr �__new__)�clsr r r Z attr_namer Z _decoratorr r r r s � zDbusServiceObject.__new__)r r r r r r r r r r s r ) r Zfirewallr Z DBusExceptionr r ZserviceZObjectr r r r r �<module> s server/__pycache__/config_icmptype.cpython-39.pyc 0000644 00000024270 15025011705 0016073 0 ustar 00 a ���g�9 � @ s� d dl Z d dlZ d dlmZ d dlmZmZmZ d dlm Z d dl m Z d dl m Z d dlmZmZmZmZ d dlmZ d d lmZ G d d � d e �ZdS ) � N)�config)�dbus_to_python�%dbus_introspection_prepare_properties�!dbus_introspection_add_properties)�IcmpType)�log)�DbusServiceObject)�handle_exceptions�dbus_handle_exceptions�dbus_service_method�dbus_polkit_require_auth)�errors)� FirewallErrorc s< e Zd ZdZdZejjZe � fdd��Z e dd� �Z e dd� �Z e d d � �Zeejd d d �e dHdd���Zeejddd �e dIdd���Zeejj�eejdd�e dJdd����Zejjejdd�dd � �Zeejj�eejdd �e dK� fd d � ���Zeejje j d �e dLd d!���Z eejje j d�e dMd"d#���Z eejj�e dNd$d%���Z ejjejjdd�e d&d'� ��Z!eejj�e dOd(d)���Z"ejjejjdd�e d*d+� ��Z#eejjdd�e dPd,d-���Z$ejjejjdd�e d.d/� ��Z%eejjdd �e dQd0d1���Z&eejjdd�e dRd2d3���Z'eejjdd �e dSd4d5���Z(eejjdd�e dTd6d7���Z)eejjdd �e dUd8d9���Z*eejjdd�e dVd:d;���Z+eejjd<d �e dWd=d>���Z,eejjd<d�e dXd?d@���Z-eejjdd�e dYdAdB���Z.eejjdd�e dZdCdD���Z/eejjddEd �e d[dFdG���Z0� Z1S )\�FirewallDConfigIcmpTypezFirewallD main classTc s` t t| �j|i |�� || _|| _|| _|| _|d | _|d | _d| j | _ t | tj j � d S )Nr � zconfig.icmptype.%d) �superr �__init__�parentr �obj�item_id�busname�path� _log_prefixr �dbus� DBUS_INTERFACE_CONFIG_ICMPTYPE)�selfr ZconfZicmptyper �args�kwargs�� __class__� �C/usr/lib/python3.9/site-packages/firewall/server/config_icmptype.pyr 3 s �z FirewallDConfigIcmpType.__init__c C s d S �Nr �r r r r! �__del__@ s z FirewallDConfigIcmpType.__del__c C s | � � d S r" )Zremove_from_connectionr# r r r! � unregisterD s z"FirewallDConfigIcmpType.unregisterc C s� |dkrt �| jj�S |dkr,t �| jj�S |dkrBt �| jj�S |dkrXt �| jj�S |dkrnt �| jj�S t j � d| ��d S )N�name�filenamer �default�builtinzDorg.freedesktop.DBus.Error.InvalidArgs: Property '%s' does not exist) r �Stringr r& r' r ZBooleanr( r) � exceptions� DBusException)r � property_namer r r! � _get_propertyL s ��z%FirewallDConfigIcmpType._get_property�ss�v)� in_signature� out_signatureNc C sL t |t�}t |t�}t�d| j||� |tjjkrBtj� d| ��| � |�S )Nz%s.Get('%s', '%s')�Jorg.freedesktop.DBus.Error.UnknownInterface: Interface '%s' does not exist) r �strr �debug1r r r r r+ r, r. )r �interface_namer- �senderr r r! �Get] s � ��zFirewallDConfigIcmpType.Get�sza{sv}c C s` t |t�}t�d| j|� |tjjkr6tj� d| ��i }dD ]}| � |�||< q>tj |dd�S )Nz%s.GetAll('%s')r3 )r& r' r r( r) �sv�Z signature) r r4 r r5 r r r r r+ r, r. Z Dictionary)r r6 r7 �ret�xr r r! �GetAlln s ��z FirewallDConfigIcmpType.GetAllZssv)r1 c C sl t |t�}t |t�}t |�}t�d| j|||� | j�|� |tjj krXtj � d| ��tj � d| ��d S )Nz%s.Set('%s', '%s', '%s')r3 zGorg.freedesktop.DBus.Error.PropertyReadOnly: Property '%s' is read-only) r r4 r r5 r r � accessCheckr r r r+ r, )r r6 r- Z new_valuer7 r r r! �Set s$ � ����zFirewallDConfigIcmpType.Setzsa{sv}asr; c C s2 t |t�}t |�}t |�}t�d| j|||� d S )Nz&%s.PropertiesChanged('%s', '%s', '%s'))r r4 r r5 r )r r6 Zchanged_propertiesZinvalidated_propertiesr r r! �PropertiesChanged� s �z)FirewallDConfigIcmpType.PropertiesChanged)r2 c s8 t �d| j� tt| ��| j| j�� �}t | |t j j �S )Nz%s.Introspect()) r Zdebug2r r r � Introspectr r Zget_busr r r r )r r7 �datar r r! rB � s � �z"FirewallDConfigIcmpType.Introspectc C s t �d| j� | j�| j�S )z"get settings for icmptype z%s.getSettings())r r5 r r Zget_icmptype_configr �r r7 r r r! � getSettings� s z#FirewallDConfigIcmpType.getSettingsc C sF t |�}t�d| j� | j�|� | j�| j|�| _| � | jj � dS )z%update settings for icmptype z%s.update('...')N) r r r5 r r r? r Zset_icmptype_configr �Updatedr& )r �settingsr7 r r r! �update� s z FirewallDConfigIcmpType.updatec C s< t �d| j� | j�|� | j�| j�| _| �| jj � dS )z3load default settings for builtin icmptype z%s.loadDefaults()N) r r5 r r r? r Zload_icmptype_defaultsr rF r& rD r r r! � loadDefaults� s z$FirewallDConfigIcmpType.loadDefaultsc C s t �d| j|f � d S )Nz%s.Updated('%s')�r r5 r �r r& r r r! rF � s z FirewallDConfigIcmpType.Updatedc C s: t �d| j� | j�|� | j�| j� | j�| j� dS )zremove icmptype z%s.removeIcmpType()N) r r5 r r r? r Zremove_icmptyper ZremoveIcmpTyperD r r r! �remove� s z FirewallDConfigIcmpType.removec C s t �d| j|f � d S )Nz%s.Removed('%s')rJ rK r r r! �Removed� s z FirewallDConfigIcmpType.Removedc C sF t |t�}t�d| j|� | j�|� | j�| j |�| _ | � |� dS )zrename icmptype z%s.rename('%s')N) r r4 r r5 r r r? r Zrename_icmptyper �Renamed)r r& r7 r r r! �rename� s z FirewallDConfigIcmpType.renamec C s t �d| j|f � d S )Nz%s.Renamed('%s')rJ rK r r r! rN � s z FirewallDConfigIcmpType.Renamedc C s t �d| j� | �� d S )Nz%s.getVersion()r �r r5 r rE rD r r r! � getVersion� s z"FirewallDConfigIcmpType.getVersionc C sH t |t�}t�d| j|� | j�|� t| �� �}||d< | � |� d S )Nz%s.setVersion('%s')r � r r4 r r5 r r r? �listrE rH )r �versionr7 rG r r r! � setVersion� s z"FirewallDConfigIcmpType.setVersionc C s t �d| j� | �� d S )Nz %s.getShort()r rP rD r r r! �getShort s z FirewallDConfigIcmpType.getShortc C sH t |t�}t�d| j|� | j�|� t| �� �}||d< | � |� d S )Nz%s.setShort('%s')r rR )r Zshortr7 rG r r r! �setShort s z FirewallDConfigIcmpType.setShortc C s t �d| j� | �� d S )Nz%s.getDescription()� rP rD r r r! �getDescription s z&FirewallDConfigIcmpType.getDescriptionc C sH t |t�}t�d| j|� | j�|� t| �� �}||d< | � |� d S )Nz%s.setDescription('%s')rX rR )r � descriptionr7 rG r r r! �setDescription& s � z&FirewallDConfigIcmpType.setDescription�asc C s t �d| j� t| �� d �S )Nz%s.getDestinations()� )r r5 r �sortedrE rD r r r! �getDestinations4 s z'FirewallDConfigIcmpType.getDestinationsc C sN t |t�}t�d| jd�|�� | j�|� t| �� �}||d< | � |� d S )Nz%s.setDestinations('[%s]')�,r] ) r rS r r5 r �joinr r? rE rH )r Z destinationsr7 rG r r r! �setDestinations; s � z'FirewallDConfigIcmpType.setDestinationsc C sf t |t�}t�d| j|� | j�|� t| �� �}||d v rJt t j |��|d � |� | � |� d S )Nz%s.addDestination('%s')r] )r r4 r r5 r r r? rS rE r r ZALREADY_ENABLED�appendrH �r Z destinationr7 rG r r r! �addDestinationG s � z&FirewallDConfigIcmpType.addDestinationc C s� t |t�}t�d| j|� | j�|� t| �� �}|d rd||d vrTt t j |��q�|d � |� n tt ddg�t |g� �|d< | �|� d S )Nz%s.removeDestination('%s')r] Zipv4Zipv6)r r4 r r5 r r r? rS rE r r Z NOT_ENABLEDrL �setrH rd r r r! �removeDestinationU s � � z)FirewallDConfigIcmpType.removeDestination�bc C s8 t |t�}t�d| j|� | �� }|d p6||d v S )Nz%s.queryDestination('%s')r] )r r4 r r5 r rE rd r r r! �queryDestinationh s � �z(FirewallDConfigIcmpType.queryDestination)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)2�__name__� __module__� __qualname__�__doc__Z persistentr r ZPK_ACTION_CONFIGZ default_polkit_auth_requiredr r r r$ r% r. r ZPROPERTIES_IFACEr8 r> r r@ Zservice�signalrA ZPK_ACTION_INFOZINTROSPECTABLE_IFACErB r r ZDBUS_SIGNATURErE rH rI rF rL rM rO rN rQ rU rV rW rY r[ r_ rb re rg ri � __classcell__r r r r! r + s� �� �� � � � � �� �� �� �� � ��r )r Z dbus.serviceZfirewallr Zfirewall.dbus_utilsr r r Zfirewall.core.io.icmptyper Zfirewall.core.loggerr Zfirewall.server.dbusr Zfirewall.server.decoratorsr r r r r Zfirewall.errorsr r r r r r! �<module> s server/__pycache__/config_icmptype.cpython-39.opt-1.pyc 0000644 00000024270 15025011705 0017032 0 ustar 00 a ���g�9 � @ s� d dl Z d dlZ d dlmZ d dlmZmZmZ d dlm Z d dl m Z d dl m Z d dlmZmZmZmZ d dlmZ d d lmZ G d d � d e �ZdS ) � N)�config)�dbus_to_python�%dbus_introspection_prepare_properties�!dbus_introspection_add_properties)�IcmpType)�log)�DbusServiceObject)�handle_exceptions�dbus_handle_exceptions�dbus_service_method�dbus_polkit_require_auth)�errors)� FirewallErrorc s< e Zd ZdZdZejjZe � fdd��Z e dd� �Z e dd� �Z e d d � �Zeejd d d �e dHdd���Zeejddd �e dIdd���Zeejj�eejdd�e dJdd����Zejjejdd�dd � �Zeejj�eejdd �e dK� fd d � ���Zeejje j d �e dLd d!���Z eejje j d�e dMd"d#���Z eejj�e dNd$d%���Z ejjejjdd�e d&d'� ��Z!eejj�e dOd(d)���Z"ejjejjdd�e d*d+� ��Z#eejjdd�e dPd,d-���Z$ejjejjdd�e d.d/� ��Z%eejjdd �e dQd0d1���Z&eejjdd�e dRd2d3���Z'eejjdd �e dSd4d5���Z(eejjdd�e dTd6d7���Z)eejjdd �e dUd8d9���Z*eejjdd�e dVd:d;���Z+eejjd<d �e dWd=d>���Z,eejjd<d�e dXd?d@���Z-eejjdd�e dYdAdB���Z.eejjdd�e dZdCdD���Z/eejjddEd �e d[dFdG���Z0� Z1S )\�FirewallDConfigIcmpTypezFirewallD main classTc s` t t| �j|i |�� || _|| _|| _|| _|d | _|d | _d| j | _ t | tj j � d S )Nr � zconfig.icmptype.%d) �superr �__init__�parentr �obj�item_id�busname�path� _log_prefixr �dbus� DBUS_INTERFACE_CONFIG_ICMPTYPE)�selfr ZconfZicmptyper �args�kwargs�� __class__� �C/usr/lib/python3.9/site-packages/firewall/server/config_icmptype.pyr 3 s �z FirewallDConfigIcmpType.__init__c C s d S �Nr �r r r r! �__del__@ s z FirewallDConfigIcmpType.__del__c C s | � � d S r" )Zremove_from_connectionr# r r r! � unregisterD s z"FirewallDConfigIcmpType.unregisterc C s� |dkrt �| jj�S |dkr,t �| jj�S |dkrBt �| jj�S |dkrXt �| jj�S |dkrnt �| jj�S t j � d| ��d S )N�name�filenamer �default�builtinzDorg.freedesktop.DBus.Error.InvalidArgs: Property '%s' does not exist) r �Stringr r& r' r ZBooleanr( r) � exceptions� DBusException)r � property_namer r r! � _get_propertyL s ��z%FirewallDConfigIcmpType._get_property�ss�v)� in_signature� out_signatureNc C sL t |t�}t |t�}t�d| j||� |tjjkrBtj� d| ��| � |�S )Nz%s.Get('%s', '%s')�Jorg.freedesktop.DBus.Error.UnknownInterface: Interface '%s' does not exist) r �strr �debug1r r r r r+ r, r. )r �interface_namer- �senderr r r! �Get] s � ��zFirewallDConfigIcmpType.Get�sza{sv}c C s` t |t�}t�d| j|� |tjjkr6tj� d| ��i }dD ]}| � |�||< q>tj |dd�S )Nz%s.GetAll('%s')r3 )r& r' r r( r) �sv�Z signature) r r4 r r5 r r r r r+ r, r. Z Dictionary)r r6 r7 �ret�xr r r! �GetAlln s ��z FirewallDConfigIcmpType.GetAllZssv)r1 c C sl t |t�}t |t�}t |�}t�d| j|||� | j�|� |tjj krXtj � d| ��tj � d| ��d S )Nz%s.Set('%s', '%s', '%s')r3 zGorg.freedesktop.DBus.Error.PropertyReadOnly: Property '%s' is read-only) r r4 r r5 r r � accessCheckr r r r+ r, )r r6 r- Z new_valuer7 r r r! �Set s$ � ����zFirewallDConfigIcmpType.Setzsa{sv}asr; c C s2 t |t�}t |�}t |�}t�d| j|||� d S )Nz&%s.PropertiesChanged('%s', '%s', '%s'))r r4 r r5 r )r r6 Zchanged_propertiesZinvalidated_propertiesr r r! �PropertiesChanged� s �z)FirewallDConfigIcmpType.PropertiesChanged)r2 c s8 t �d| j� tt| ��| j| j�� �}t | |t j j �S )Nz%s.Introspect()) r Zdebug2r r r � Introspectr r Zget_busr r r r )r r7 �datar r r! rB � s � �z"FirewallDConfigIcmpType.Introspectc C s t �d| j� | j�| j�S )z"get settings for icmptype z%s.getSettings())r r5 r r Zget_icmptype_configr �r r7 r r r! � getSettings� s z#FirewallDConfigIcmpType.getSettingsc C sF t |�}t�d| j� | j�|� | j�| j|�| _| � | jj � dS )z%update settings for icmptype z%s.update('...')N) r r r5 r r r? r Zset_icmptype_configr �Updatedr& )r �settingsr7 r r r! �update� s z FirewallDConfigIcmpType.updatec C s< t �d| j� | j�|� | j�| j�| _| �| jj � dS )z3load default settings for builtin icmptype z%s.loadDefaults()N) r r5 r r r? r Zload_icmptype_defaultsr rF r& rD r r r! � loadDefaults� s z$FirewallDConfigIcmpType.loadDefaultsc C s t �d| j|f � d S )Nz%s.Updated('%s')�r r5 r �r r& r r r! rF � s z FirewallDConfigIcmpType.Updatedc C s: t �d| j� | j�|� | j�| j� | j�| j� dS )zremove icmptype z%s.removeIcmpType()N) r r5 r r r? r Zremove_icmptyper ZremoveIcmpTyperD r r r! �remove� s z FirewallDConfigIcmpType.removec C s t �d| j|f � d S )Nz%s.Removed('%s')rJ rK r r r! �Removed� s z FirewallDConfigIcmpType.Removedc C sF t |t�}t�d| j|� | j�|� | j�| j |�| _ | � |� dS )zrename icmptype z%s.rename('%s')N) r r4 r r5 r r r? r Zrename_icmptyper �Renamed)r r& r7 r r r! �rename� s z FirewallDConfigIcmpType.renamec C s t �d| j|f � d S )Nz%s.Renamed('%s')rJ rK r r r! rN � s z FirewallDConfigIcmpType.Renamedc C s t �d| j� | �� d S )Nz%s.getVersion()r �r r5 r rE rD r r r! � getVersion� s z"FirewallDConfigIcmpType.getVersionc C sH t |t�}t�d| j|� | j�|� t| �� �}||d< | � |� d S )Nz%s.setVersion('%s')r � r r4 r r5 r r r? �listrE rH )r �versionr7 rG r r r! � setVersion� s z"FirewallDConfigIcmpType.setVersionc C s t �d| j� | �� d S )Nz %s.getShort()r rP rD r r r! �getShort s z FirewallDConfigIcmpType.getShortc C sH t |t�}t�d| j|� | j�|� t| �� �}||d< | � |� d S )Nz%s.setShort('%s')r rR )r Zshortr7 rG r r r! �setShort s z FirewallDConfigIcmpType.setShortc C s t �d| j� | �� d S )Nz%s.getDescription()� rP rD r r r! �getDescription s z&FirewallDConfigIcmpType.getDescriptionc C sH t |t�}t�d| j|� | j�|� t| �� �}||d< | � |� d S )Nz%s.setDescription('%s')rX rR )r � descriptionr7 rG r r r! �setDescription& s � z&FirewallDConfigIcmpType.setDescription�asc C s t �d| j� t| �� d �S )Nz%s.getDestinations()� )r r5 r �sortedrE rD r r r! �getDestinations4 s z'FirewallDConfigIcmpType.getDestinationsc C sN t |t�}t�d| jd�|�� | j�|� t| �� �}||d< | � |� d S )Nz%s.setDestinations('[%s]')�,r] ) r rS r r5 r �joinr r? rE rH )r Z destinationsr7 rG r r r! �setDestinations; s � z'FirewallDConfigIcmpType.setDestinationsc C sf t |t�}t�d| j|� | j�|� t| �� �}||d v rJt t j |��|d � |� | � |� d S )Nz%s.addDestination('%s')r] )r r4 r r5 r r r? rS rE r r ZALREADY_ENABLED�appendrH �r Z destinationr7 rG r r r! �addDestinationG s � z&FirewallDConfigIcmpType.addDestinationc C s� t |t�}t�d| j|� | j�|� t| �� �}|d rd||d vrTt t j |��q�|d � |� n tt ddg�t |g� �|d< | �|� d S )Nz%s.removeDestination('%s')r] Zipv4Zipv6)r r4 r r5 r r r? rS rE r r Z NOT_ENABLEDrL �setrH rd r r r! �removeDestinationU s � � z)FirewallDConfigIcmpType.removeDestination�bc C s8 t |t�}t�d| j|� | �� }|d p6||d v S )Nz%s.queryDestination('%s')r] )r r4 r r5 r rE rd r r r! �queryDestinationh s � �z(FirewallDConfigIcmpType.queryDestination)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)2�__name__� __module__� __qualname__�__doc__Z persistentr r ZPK_ACTION_CONFIGZ default_polkit_auth_requiredr r r r$ r% r. r ZPROPERTIES_IFACEr8 r> r r@ Zservice�signalrA ZPK_ACTION_INFOZINTROSPECTABLE_IFACErB r r ZDBUS_SIGNATURErE rH rI rF rL rM rO rN rQ rU rV rW rY r[ r_ rb re rg ri � __classcell__r r r r! r + s� �� �� � � � � �� �� �� �� � ��r )r Z dbus.serviceZfirewallr Zfirewall.dbus_utilsr r r Zfirewall.core.io.icmptyper Zfirewall.core.loggerr Zfirewall.server.dbusr Zfirewall.server.decoratorsr r r r r Zfirewall.errorsr r r r r r! �<module> s server/__pycache__/decorators.cpython-39.opt-1.pyc 0000644 00000012755 15025011705 0016025 0 ustar 00 a ���g� � @ s� d Z g d�ZddlZddlZddlZddlZddlZddlmZ ddl m Z ddl m Z ddl mZ ddlmZmZ dd lmZ d d � Zd d � Zdd� ZG dd� d�ZG dd� de�ZG dd� d�ZdS )z>This module contains decorators for use with and without D-Bus)�handle_exceptions�dbus_handle_exceptions�dbus_service_method� N)� DBusException)� FirewallError)�errors)�log)�FirewallDBusException�NotAuthorizedException)� uid_of_senderc s t �� �� fdd��}|S )zTDecorator to handle exceptions and log them. Used if not conneced to D-Bus. c sj z� | i |��W S t yL } z$t�t�� � t�|� W Y d }~n"d }~0 tyd t�� Y n0 d S �N)r r �debug1� traceback� format_exc�error� Exception� exception)�args�kwargsr ��func� �>/usr/lib/python3.9/site-packages/firewall/server/decorators.py�_impl0 s z handle_exceptions.<locals>._impl)� functools�wraps�r r r r r r , s r c s& t �� �� fdd��}t�� �|_|S )z�Decorator to handle exceptions, log and report them into D-Bus :Raises DBusException: on a firewall error code problems. c s� z� | i |��W S t y� } zjt �t|��}|tjtjtjtjfv rVt� t|�� n t� t � � � t� t|�� tt|���W Y d }~nfd }~0 ty� } z|�W Y d }~n@d }~0 ty� } z t�� tt|���W Y d }~n d }~0 0 d S r )r �get_code�strr ZALREADY_ENABLEDZ NOT_ENABLEDZZONE_ALREADY_SETZ ALREADY_SETr Zwarningr r r r r r r r )r r r �code�exr r r r @ s � z%dbus_handle_exceptions.<locals>._impl)r r �inspectZ signatureZ __signature__r r r r r ; s r c O s |� dd� tjj| i |��S )z Add sender argument for D-BusZsender_keyword�sender)� setdefault�dbusZservice�method�r r r r r r ` s r c @ s& e Zd ZdZi Zddd�Zdd� ZdS )� dbus_service_method_deprecatedzRDecorator that maintains a list of deprecated methods in dbus interfaces. Nc C s* || _ | j r&| j | jvr&t� | j| j < d S r )� interface� deprecated�set)�selfr( r r r �__init__k s z'dbus_service_method_deprecated.__init__c s4 | j r| j| j �� j� t�� �� fdd��}|S )Nc s � | i |��S r r r& r r r r u s z6dbus_service_method_deprecated.__call__.<locals>._impl)r( r) �add�__name__r r �r+ r r r r r �__call__q s z'dbus_service_method_deprecated.__call__)N)r. � __module__� __qualname__�__doc__r) r, r0 r r r r r' e s r' c @ s e Zd ZdZdS )� dbus_service_signal_deprecatedzRDecorator that maintains a list of deprecated signals in dbus interfaces. N)r. r1 r2 r3 r r r r r4 z s r4 c @ sD e Zd ZdZdZdZdZdZdZdZ dd� Z e dd � �Z d d � Z dS ) �dbus_polkit_require_authz�Decorator factory that checks if the interface/method can be used by the sender/user. Assumes wrapped function is a method inside a class derived from DbusServiceObject. zorg.freedesktop.PolicyKit1z%/org/freedesktop/PolicyKit1/Authorityz$org.freedesktop.PolicyKit1.AuthorityNc C s || _ d S r )�_polkit_auth_required)r+ Zpolkit_auth_requiredr r r r, � s z!dbus_polkit_require_auth.__init__c C s | j �| j� d | _d | _d S r )�_busZremove_signal_receiver�_bus_signal_receiver�_interface_polkit)�cls�nameZ old_ownerZ new_ownerr r r �_polkit_name_owner_changed� s z3dbus_polkit_require_auth._polkit_name_owner_changedc s$ t �� �� �fdd��}�j|_|S )Nc s8 t ��jst�� t ��_t ��jsHt ��jjt ��jdd�jd�t ��_t ��js�z6t� t ��j� t ��jt ��j �t ��j �t ��_W n tj y� Y n0 �j}|s�t� d��|�d�}|�r*t ��j�rt ��j�dd|if|i dd �\}}}|�s*t|d ��n$tt ��j|�}|d k�r*t|d ��� | i |��S ) NZNameOwnerChangedzorg.freedesktop.DBus)Zhandler_functionZ signal_nameZdbus_interfaceZarg0z'Not Authorized: No action_id specified.r" zsystem-bus-namer; � � Zpolkitr �uid)�typer7 r$ Z SystemBusr8 Zadd_signal_receiverr< � _polkit_namer9 Z InterfaceZ get_object� _polkit_path�_polkit_interfacer r6 �getZCheckAuthorizationr r )r r Z action_idr" �result�_r? �r r+ r r r � sF � �� � z0dbus_polkit_require_auth.__call__.<locals>._impl)r r r6 r/ r rG r r0 � s +z!dbus_polkit_require_auth.__call__)r. r1 r2 r3 rA rB rC r7 r8 r9 r, � classmethodr< r0 r r r r r5 � s r5 )r3 �__all__r$ Z dbus.servicer r r! Zdbus.exceptionsr Zfirewall.errorsr Zfirewallr Zfirewall.core.loggerr Zfirewall.server.dbusr r Zfirewall.dbus_utilsr r r r r' r4 r5 r r r r �<module> s$ % server/__pycache__/config_helper.cpython-39.pyc 0000644 00000027732 15025011705 0015526 0 ustar 00 a ���g*D � @ s� d dl Z d dlZ d dlmZ d dlmZmZmZ d dlm Z d dl m Z d dl m Z d dlmZmZmZmZ d dlmZ d d lmZ G d d � d e �ZdS ) � N)�config)�dbus_to_python�%dbus_introspection_prepare_properties�!dbus_introspection_add_properties)�Helper)�log)�DbusServiceObject)�handle_exceptions�dbus_handle_exceptions�dbus_service_method�dbus_polkit_require_auth)�errors)� FirewallErrorc s� e Zd ZdZdZejjZe � fdd��Z e dd� �Z e dd� �Z e d d � �Zeejd d d �e dTdd���Zeejddd �e dUdd���Zeejj�eejdd�e dVdd����Zejjejdd�dd � �Zeejj�eejdd �e dW� fd d � ���Zeejje j d �e dXd d!���Z eejje j d�e dYd"d#���Z eejj�e dZd$d%���Z ejjejjdd�e d&d'� ��Z!eejj�e d[d(d)���Z"ejjejjdd�e d*d+� ��Z#eejjdd�e d\d,d-���Z$ejjejjdd�e d.d/� ��Z%eejjdd �e d]d0d1���Z&eejjdd�e d^d2d3���Z'eejjdd �e d_d4d5���Z(eejjdd�e d`d6d7���Z)eejjdd �e dad8d9���Z*eejjdd�e dbd:d;���Z+eejjdd �e dcd<d=���Z,eejjdd�e ddd>d?���Z-eejjdd@d �e dedAdB���Z.eejjdd �e dfdCdD���Z/eejjdd�e dgdEdF���Z0eejjdd@d �e dhdGdH���Z1eejjdId �e didJdK���Z2eejjdId�e djdLdM���Z3eejjd d�e dkdNdO���Z4eejjd d�e dldPdQ���Z5eejjd d@d �e dmdRdS���Z6� Z7S )n�FirewallDConfigHelperzFirewallD main classTc s` t t| �j|i |�� || _|| _|| _|| _|d | _|d | _d| j | _ t | tj j � d S )Nr � zconfig.helper.%d) �superr �__init__�parentr �obj�item_id�busname�path� _log_prefixr �dbus� DBUS_INTERFACE_CONFIG_HELPER)�selfr Zconf�helperr �args�kwargs�� __class__� �A/usr/lib/python3.9/site-packages/firewall/server/config_helper.pyr 3 s �z FirewallDConfigHelper.__init__c C s d S �Nr! �r r! r! r" �__del__@ s z FirewallDConfigHelper.__del__c C s | � � d S r# )Zremove_from_connectionr$ r! r! r" � unregisterD s z FirewallDConfigHelper.unregisterc C s� |dkrt �| jj�S |dkr,t �| jj�S |dkrBt �| jj�S |dkrXt �| jj�S |dkrnt �| jj�S t j � d| ��d S )N�name�filenamer �default�builtinzDorg.freedesktop.DBus.Error.InvalidArgs: Property '%s' does not exist) r �Stringr r' r( r ZBooleanr) r* � exceptions� DBusException)r � property_namer! r! r" � _get_propertyL s ��z#FirewallDConfigHelper._get_property�ss�v)� in_signature� out_signatureNc C sL t |t�}t |t�}t�d| j||� |tjjkrBtj� d| ��| � |�S )Nz%s.Get('%s', '%s')�Jorg.freedesktop.DBus.Error.UnknownInterface: Interface '%s' does not exist) r �strr �debug1r r r r r, r- r/ )r �interface_namer. �senderr! r! r" �Get] s � ��zFirewallDConfigHelper.Get�sza{sv}c C s` t |t�}t�d| j|� |tjjkr6tj� d| ��i }dD ]}| � |�||< q>tj |dd�S )Nz%s.GetAll('%s')r4 )r' r( r r) r* �sv�Z signature) r r5 r r6 r r r r r, r- r/ Z Dictionary)r r7 r8 �ret�xr! r! r" �GetAlln s ��z FirewallDConfigHelper.GetAllZssv)r2 c C sl t |t�}t |t�}t |�}t�d| j|||� | j�|� |tjj krXtj � d| ��tj � d| ��d S )Nz%s.Set('%s', '%s', '%s')r4 zGorg.freedesktop.DBus.Error.PropertyReadOnly: Property '%s' is read-only) r r5 r r6 r r � accessCheckr r r r, r- )r r7 r. Z new_valuer8 r! r! r" �Set s$ � ����zFirewallDConfigHelper.Setzsa{sv}asr< c C s2 t |t�}t |�}t |�}t�d| j|||� d S )Nz&%s.PropertiesChanged('%s', '%s', '%s'))r r5 r r6 r )r r7 Zchanged_propertiesZinvalidated_propertiesr! r! r" �PropertiesChanged� s �z'FirewallDConfigHelper.PropertiesChanged)r3 c s8 t �d| j� tt| ��| j| j�� �}t | |t j j �S )Nz%s.Introspect()) r Zdebug2r r r � Introspectr r Zget_busr r r r )r r8 �datar r! r" rC � s � �z FirewallDConfigHelper.Introspectc C s t �d| j� | j�| j�S )z get settings for helper z%s.getSettings())r r6 r r Zget_helper_configr �r r8 r! r! r" � getSettings� s z!FirewallDConfigHelper.getSettingsc C sF t |�}t�d| j� | j�|� | j�| j|�| _| � | jj � dS )z#update settings for helper z%s.update('...')N) r r r6 r r r@ r Zset_helper_configr �Updatedr' )r �settingsr8 r! r! r" �update� s z FirewallDConfigHelper.updatec C s< t �d| j� | j�|� | j�| j�| _| �| jj � dS )z1load default settings for builtin helper z%s.loadDefaults()N) r r6 r r r@ r Zload_helper_defaultsr rG r' rE r! r! r" � loadDefaults� s z"FirewallDConfigHelper.loadDefaultsc C s t �d| j|f � d S )Nz%s.Updated('%s')�r r6 r �r r' r! r! r" rG � s z FirewallDConfigHelper.Updatedc C s: t �d| j� | j�|� | j�| j� | j�| j� dS )zremove helper z%s.removeHelper()N) r r6 r r r@ r Z remove_helperr Z removeHelperrE r! r! r" �remove� s z FirewallDConfigHelper.removec C s t �d| j|f � d S )Nz%s.Removed('%s')rK rL r! r! r" �Removed� s z FirewallDConfigHelper.Removedc C sF t |t�}t�d| j|� | j�|� | j�| j |�| _ | � |� dS )zrename helper z%s.rename('%s')N) r r5 r r6 r r r@ r Z rename_helperr �Renamed)r r' r8 r! r! r" �rename� s z FirewallDConfigHelper.renamec C s t �d| j|f � d S )Nz%s.Renamed('%s')rK rL r! r! r" rO � s z FirewallDConfigHelper.Renamedc C s t �d| j� | �� d S )Nz%s.getVersion()r �r r6 r rF rE r! r! r" � getVersion� s z FirewallDConfigHelper.getVersionc C sH t |t�}t�d| j|� | j�|� t| �� �}||d< | � |� d S )Nz%s.setVersion('%s')r � r r5 r r6 r r r@ �listrF rI )r �versionr8 rH r! r! r" � setVersion� s z FirewallDConfigHelper.setVersionc C s t �d| j� | �� d S )Nz %s.getShort()r rQ rE r! r! r" �getShort s z FirewallDConfigHelper.getShortc C sH t |t�}t�d| j|� | j�|� t| �� �}||d< | � |� d S )Nz%s.setShort('%s')r rS )r Zshortr8 rH r! r! r" �setShort s z FirewallDConfigHelper.setShortc C s t �d| j� | �� d S )Nz%s.getDescription()� rQ rE r! r! r" �getDescription s z$FirewallDConfigHelper.getDescriptionc C sH t |t�}t�d| j|� | j�|� t| �� �}||d< | � |� d S )Nz%s.setDescription('%s')rY rS )r � descriptionr8 rH r! r! r" �setDescription& s � z$FirewallDConfigHelper.setDescriptionc C s. t �d| j� | j�|� t| �� �}|d S )Nz%s.getFamily()� �r r6 r r r@ rT rF �r r8 rH r! r! r" � getFamily4 s z FirewallDConfigHelper.getFamilyc C sd t |t�}t�d| j|� | j�|� t| �� �}|d |krNt t j d| ��||d< | � |� d S )Nz%s.setFamily('%s')r] �'%s'� r r5 r r6 r r r@ rT rF r r �ALREADY_ENABLEDrI �r Zipvr8 rH r! r! r" � setFamily= s z FirewallDConfigHelper.setFamily�bc C s. t |t�}t�d| j|� | �� }|d |kS )Nz%s.queryFamily('%s')r] �r r5 r r6 r rF rd r! r! r" � queryFamilyJ s z!FirewallDConfigHelper.queryFamilyc C s. t �d| j� | j�|� t| �� �}|d S )Nz%s.getModule()� r^ r_ r! r! r" � getModuleU s z FirewallDConfigHelper.getModulec C sd t |t�}t�d| j|� | j�|� t| �� �}|d |krNt t j d| ��||d< | � |� d S )Nz%s.setModule('%s')ri ra rb �r �moduler8 rH r! r! r" � setModule^ s z FirewallDConfigHelper.setModulec C s. t |t�}t�d| j|� | �� }|d |kS )Nz%s.queryModule('%s')ri rg rk r! r! r" � queryModulek s z!FirewallDConfigHelper.queryModuleza(ss)c C s t �d| j� | �� d S )Nz %s.getPorts()� rQ rE r! r! r" �getPortsv s z FirewallDConfigHelper.getPortsc C s� g }t |t�D ](}t|t�r,|�t|�� q|�|� q|}t�d| jd�dd� |D ��� | j � |� t| � � �}||d< | � |� d S )Nz%s.setPorts('[%s]')�,c s s" | ]}d |d |d f V qdS )z ('%s, '%s')r r Nr! )�.0�portr! r! r" � <genexpr>� � z1FirewallDConfigHelper.setPorts.<locals>.<genexpr>ro ) r rT � isinstance�append�tupler r6 r �joinr r@ rF rI )r Zportsr8 Z_portsrs rH r! r! r" �setPorts} s � z FirewallDConfigHelper.setPortsc C s� t |t�}t |t�}t�d| j||� | j�|� t| �� �}||f|d v rbt t j d||f ��|d � ||f� | � |� d S )Nz%s.addPort('%s', '%s')ro �%s:%s)r r5 r r6 r r r@ rT rF r r rc rw rI �r rs �protocolr8 rH r! r! r" �addPort� s � �z FirewallDConfigHelper.addPortc C s� t |t�}t |t�}t�d| j||� | j�|� t| �� �}||f|d vrbt t j d||f ��|d � ||f� | � |� d S )Nz%s.removePort('%s', '%s')ro r{ )r r5 r r6 r r r@ rT rF r r Z NOT_ENABLEDrM rI r| r! r! r" � removePort� s � z FirewallDConfigHelper.removePortc C s: t |t�}t |t�}t�d| j||� ||f| �� d v S )Nz%s.queryPort('%s', '%s')ro rg )r rs r} r8 r! r! r" � queryPort� s �z FirewallDConfigHelper.queryPort)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)8�__name__� __module__� __qualname__�__doc__Z persistentr r ZPK_ACTION_CONFIGZ default_polkit_auth_requiredr r r r% r& r/ r ZPROPERTIES_IFACEr9 r? r rA Zservice�signalrB ZPK_ACTION_INFOZINTROSPECTABLE_IFACErC r r ZDBUS_SIGNATURErF rI rJ rG rM rN rP rO rR rV rW rX rZ r\ r` re rh rj rm rn rp rz r~ r r� � __classcell__r! r! r r" r + s0 �� �� � � � � �� �� �� �� ��� ���� � �r )r Z dbus.serviceZfirewallr Zfirewall.dbus_utilsr r r Zfirewall.core.io.helperr Zfirewall.core.loggerr Zfirewall.server.dbusr Zfirewall.server.decoratorsr r r r r Zfirewall.errorsr r r! r! r! r" �<module> s server/__pycache__/config_service.cpython-39.pyc 0000644 00000047616 15025011705 0015712 0 ustar 00 a ���g_u � @ s� d dl Z d dlZ d dlmZ d dlmZmZmZ d dlm Z d dl m Z d dl m Z mZmZmZ d dlmZ d dlmZ G d d � d e �ZdS ) � N)�config)�dbus_to_python�%dbus_introspection_prepare_properties�!dbus_introspection_add_properties)�log)�DbusServiceObject)�handle_exceptions�dbus_handle_exceptions�dbus_service_method�dbus_polkit_require_auth)�errors)� FirewallErrorc s� e Zd ZdZdZejjZe � fdd��Z e dd� �Z e dd� �Z e d d � �Zeejd d d �e d�dd���Zeejddd �e d�dd���Zeejj�eejdd�e d�dd����Zejjejdd�dd � �Zeejj�eejdd �e d�� fd d � ���Zeejjd d �e d�d!d"���Z eejjdd �e d�d#d$���Z eejjd d�e d�d%d&���Z eejjdd�e d�d'd(���Z eejj�e d�d)d*���Z ejjejjdd�e d+d,� ��Z!eejj�e d�d-d.���Z"ejjejjdd�e d/d0� ��Z#eejjdd�e d�d1d2���Z$ejjejjdd�e d3d4� ��Z%eejjdd �e d�d5d6���Z&eejjdd�e d�d7d8���Z'eejjdd �e d�d9d:���Z(eejjdd�e d�d;d<���Z)eejjdd �e d�d=d>���Z*eejjdd�e d�d?d@���Z+eejjdAd �e d�dBdC���Z,eejjdAd�e d�dDdE���Z-eejjd d�e d�dFdG���Z.eejjd d�e d�dHdI���Z/eejjd dJd �e d�dKdL���Z0eejjdMd �e d�dNdO���Z1eejjdMd�e d�dPdQ���Z2eejjdd�e d�dRdS���Z3eejjdd�e d�dTdU���Z4eejjddJd �e d�dVdW���Z5eejjdAd �e d�dXdY���Z6eejjdAd�e d�dZd[���Z7eejjd d�e d�d\d]���Z8eejjd d�e d�d^d_���Z9eejjd dJd �e d�d`da���Z:eejjdMd �e d�dbdc���Z;eejjdMd�e d�ddde���Z<eejjdd�e d�dfdg���Z=eejjdd�e d�dhdi���Z>eejjddJd �e d�djdk���Z?eejjdld �e d�dmdn���Z@eejjdld�e d�dodp���ZAeejjddd �e d�dqdr���ZBeejjd d�e d�dsdt���ZCeejjdd�e d�dudv���ZDeejjd dJd �e d�dwdx���ZEeejjdMd �e d�dydz���ZFeejjdMd�e d�d{d|���ZGeejjdd�e d�d}d~���ZHeejjdd�e d�dd����ZIeejjddJd �e d�d�d����ZJ� ZKS )��FirewallDConfigServicezFirewallD main classTc s` t t| �j|i |�� || _|| _|| _|| _|d | _|d | _d| j | _ t | tj j � d S )Nr � zconfig.service.%d) �superr �__init__�parentr �obj�item_id�busname�path� _log_prefixr �dbus� DBUS_INTERFACE_CONFIG_SERVICE)�selfr Zconf�servicer �args�kwargs�� __class__� �B/usr/lib/python3.9/site-packages/firewall/server/config_service.pyr 2 s �z FirewallDConfigService.__init__c C s d S �Nr �r r r r! �__del__? s z FirewallDConfigService.__del__c C s | � � d S r" )Zremove_from_connectionr# r r r! � unregisterC s z!FirewallDConfigService.unregisterc C s� |dkrt �| jj�S |dkr,t �| jj�S |dkrBt �| jj�S |dkrXt �| jj�S |dkrnt �| jj�S t j � d| ��d S )N�name�filenamer �default�builtinzDorg.freedesktop.DBus.Error.InvalidArgs: Property '%s' does not exist) r �Stringr r& r' r ZBooleanr( r) � exceptions� DBusException)r � property_namer r r! � _get_propertyK s ��z$FirewallDConfigService._get_property�ss�v)� in_signature� out_signatureNc C sL t |t�}t |t�}t�d| j||� |tjjkrBtj� d| ��| � |�S )Nz%s.Get('%s', '%s')�Jorg.freedesktop.DBus.Error.UnknownInterface: Interface '%s' does not exist) r �strr �debug1r r r r r+ r, r. )r �interface_namer- �senderr r r! �Get\ s � ��zFirewallDConfigService.Get�sza{sv}c C s` t |t�}t�d| j|� |tjjkr6tj� d| ��i }dD ]}| � |�||< q>tj |dd�S )Nz%s.GetAll('%s')r3 )r& r' r r( r) �sv�Z signature) r r4 r r5 r r r r r+ r, r. Z Dictionary)r r6 r7 �ret�xr r r! �GetAllm s ��z FirewallDConfigService.GetAllZssv)r1 c C sl t |t�}t |t�}t |�}t�d| j|||� | j�|� |tjj krXtj � d| ��tj � d| ��d S )Nz%s.Set('%s', '%s', '%s')r3 zGorg.freedesktop.DBus.Error.PropertyReadOnly: Property '%s' is read-only) r r4 r r5 r r � accessCheckr r r r+ r, )r r6 r- Z new_valuer7 r r r! �Set~ s$ � ����zFirewallDConfigService.Setzsa{sv}asr; c C s2 t |t�}t |�}t |�}t�d| j|||� d S )Nz&%s.PropertiesChanged('%s', '%s', '%s'))r r4 r r5 r )r r6 Zchanged_propertiesZinvalidated_propertiesr r r! �PropertiesChanged� s �z(FirewallDConfigService.PropertiesChanged)r2 c s8 t �d| j� tt| ��| j| j�� �}t | |t j j �S )Nz%s.Introspect()) r Zdebug2r r r � Introspectr r Zget_busr r r r )r r7 �datar r r! rB � s � �z!FirewallDConfigService.Introspectz(sssa(ss)asa{ss}asa(ss))c C s t �d| j� | j�| j�S )�!get settings for service z%s.getSettings())r r5 r r Zget_service_configr �r r7 r r r! � getSettings� s z"FirewallDConfigService.getSettingsc C s t �d| j� | j�| j�S )rD z%s.getSettings2())r r5 r r �get_service_config_dictr rE r r r! � getSettings2� s z#FirewallDConfigService.getSettings2c C sF t |�}t�d| j� | j�|� | j�| j|�| _| � | jj � dS )z$update settings for service z%s.update('...')N) r r r5 r r r? r Zset_service_configr �Updatedr& �r �settingsr7 r r r! �update� s z FirewallDConfigService.updatec C sF t |�}t�d| j� | j�|� | j�| j|�| _| � | jj � d S )Nz%s.update2('...')) r r r5 r r r? r �set_service_config_dictr rI r& rJ r r r! �update2� s z FirewallDConfigService.update2c C s< t �d| j� | j�|� | j�| j�| _| �| jj � dS )z2load default settings for builtin service z%s.loadDefaults()N) r r5 r r r? r Zload_service_defaultsr rI r& rE r r r! � loadDefaults� s z#FirewallDConfigService.loadDefaultsc C s t �d| j|f � d S )Nz%s.Updated('%s')�r r5 r �r r& r r r! rI � s z FirewallDConfigService.Updatedc C s: t �d| j� | j�|� | j�| j� | j�| j� dS )zremove service z%s.removeService()N) r r5 r r r? r Zremove_servicer Z removeServicerE r r r! �remove� s z FirewallDConfigService.removec C s t �d| j|f � d S )Nz%s.Removed('%s')rP rQ r r r! �Removed� s z FirewallDConfigService.Removedc C sF t |t�}t�d| j|� | j�|� | j�| j |�| _ | � |� dS )zrename service z%s.rename('%s')N) r r4 r r5 r r r? r Zrename_servicer �Renamed)r r& r7 r r r! �rename� s z FirewallDConfigService.renamec C s t �d| j|f � d S )Nz%s.Renamed('%s')rP rQ r r r! rT s z FirewallDConfigService.Renamedc C s t �d| j� | �� d S )Nz%s.getVersion()r �r r5 r rF rE r r r! � getVersion s z!FirewallDConfigService.getVersionc C sH t |t�}t�d| j|� | j�|� t| �� �}||d< | � |� d S )Nz%s.setVersion('%s')r � r r4 r r5 r r r? �listrF rL )r �versionr7 rK r r r! � setVersion s z!FirewallDConfigService.setVersionc C s t �d| j� | �� d S )Nz %s.getShort()r rV rE r r r! �getShort s z FirewallDConfigService.getShortc C sH t |t�}t�d| j|� | j�|� t| �� �}||d< | � |� d S )Nz%s.setShort('%s')r rX )r Zshortr7 rK r r r! �setShort$ s z FirewallDConfigService.setShortc C s t �d| j� | �� d S )Nz%s.getDescription()� rV rE r r r! �getDescription1 s z%FirewallDConfigService.getDescriptionc C sH t |t�}t�d| j|� | j�|� t| �� �}||d< | � |� d S )Nz%s.setDescription('%s')r^ rX )r � descriptionr7 rK r r r! �setDescription8 s � z%FirewallDConfigService.setDescriptionza(ss)c C s t �d| j� | �� d S )Nz %s.getPorts()� rV rE r r r! �getPortsF s z FirewallDConfigService.getPortsc C s� g }t |t�D ](}t|t�r,|�t|�� q|�|� q|}t�d| jd�dd� |D ��� | j � |� t| � � �}||d< | � |� d S )Nz%s.setPorts('[%s]')�,c s s" | ]}d |d |d f V qdS �z ('%s, '%s')r r Nr ��.0�portr r r! � <genexpr>Z � z2FirewallDConfigService.setPorts.<locals>.<genexpr>rb � r rY � isinstance�append�tupler r5 r �joinr r? rF rL �r Zportsr7 Z_portsrh rK r r r! �setPortsM s � z FirewallDConfigService.setPortsc C s� t |t�}t |t�}t�d| j||� | j�|� t| �� �}||f|d v rbt t j d||f ��|d � ||f� | � |� d S )Nz%s.addPort('%s', '%s')rb �%s:%s�r r4 r r5 r r r? rY rF r r �ALREADY_ENABLEDrm rL �r rh �protocolr7 rK r r r! �addPort` s � �z FirewallDConfigService.addPortc C s� t |t�}t |t�}t�d| j||� | j�|� t| �� �}||f|d vrbt t j d||f ��|d � ||f� | � |� d S )Nz%s.removePort('%s', '%s')rb rr �r r4 r r5 r r r? rY rF r r � NOT_ENABLEDrR rL ru r r r! � removePortp s � z!FirewallDConfigService.removePort�bc C s: t |t�}t |t�}t�d| j||� ||f| �� d v S )Nz%s.queryPort('%s', '%s')rb �r r4 r r5 r rF �r rh rv r7 r r r! � queryPort s �z FirewallDConfigService.queryPort�asc C s t �d| j� | �� d S )Nz%s.getProtocols()� rV rE r r r! � getProtocols� s z#FirewallDConfigService.getProtocolsc C sN t |t�}t�d| jd�|�� | j�|� t| �� �}||d< | � |� d S )Nz%s.setProtocols('[%s]')rd r� ) r rY r r5 r ro r r? rF rL )r Z protocolsr7 rK r r r! � setProtocols� s � z#FirewallDConfigService.setProtocolsc C sf t |t�}t�d| j|� | j�|� t| �� �}||d v rJt t j |��|d � |� | � |� d S )Nz%s.addProtocol('%s')r� rs �r rv r7 rK r r r! � addProtocol� s z"FirewallDConfigService.addProtocolc C sf t |t�}t�d| j|� | j�|� t| �� �}||d vrJt t j |��|d � |� | � |� d S )Nz%s.removeProtocol('%s')r� rx r� r r r! �removeProtocol� s z%FirewallDConfigService.removeProtocolc C s* t |t�}t�d| j|� || �� d v S )Nz%s.queryProtocol(%s')r� r| )r rv r7 r r r! � queryProtocol� s z$FirewallDConfigService.queryProtocolc C s t �d| j� | �� d S )Nz%s.getSourcePorts()� rV rE r r r! �getSourcePorts� s z%FirewallDConfigService.getSourcePortsc C s� g }t |t�D ](}t|t�r,|�t|�� q|�|� q|}t�d| jd�dd� |D ��� | j � |� t| � � �}||d< | � |� d S )Nz%s.setSourcePorts('[%s]')rd c s s" | ]}d |d |d f V qdS re r rf r r r! ri � rj z8FirewallDConfigService.setSourcePorts.<locals>.<genexpr>r� rk rp r r r! �setSourcePorts� s � z%FirewallDConfigService.setSourcePortsc C s� t |t�}t |t�}t�d| j||� | j�|� t| �� �}||f|d v rbt t j d||f ��|d � ||f� | � |� d S )Nz %s.addSourcePort('%s', '%s')r� rr rs ru r r r! � addSourcePort� s � �z$FirewallDConfigService.addSourcePortc C s� t |t�}t |t�}t�d| j||� | j�|� t| �� �}||f|d vrbt t j d||f ��|d � ||f� | � |� d S )Nz %s.removeSourcePort('%s', '%s')r� rr rx ru r r r! �removeSourcePort� s � z'FirewallDConfigService.removeSourcePortc C s: t |t�}t |t�}t�d| j||� ||f| �� d v S )Nz %s.querySourcePort('%s', '%s')r� r| r} r r r! �querySourcePort� s �z&FirewallDConfigService.querySourcePortc C s t �d| j� | �� d S )Nz%s.getModules()� rV rE r r r! � getModules s z!FirewallDConfigService.getModulesc C s� t |t�}g }|D ]8}|�d�r@|�dd�}d|v r@|�dd�}|�|� q|}t�d| jd�|�� | j � |� t| � � �}||d< | � |� d S )N� nf_conntrack_� �_�-z%s.setModules('[%s]')rd r� ) r rY � startswith�replacerm r r5 r ro r r? rF rL )r �modulesr7 Z_modules�modulerK r r r! � setModules s � z!FirewallDConfigService.setModulesc C s� t |t�}|�d�r4|�dd�}d|v r4|�dd�}t�d| j|� | j�|� t | � � �}||d v rtt t j |��|d �|� | �|� d S )Nr� r� r� r� z%s.addModule('%s')r� )r r4 r� r� r r5 r r r? rY rF r r rt rm rL �r r� r7 rK r r r! � addModule" s z FirewallDConfigService.addModulec C s� t |t�}|�d�r4|�dd�}d|v r4|�dd�}t�d| j|� | j�|� t | � � �}||d vrtt t j |��|d �|� | �|� d S )Nr� r� r� r� z%s.removeModule('%s')r� )r r4 r� r� r r5 r r r? rY rF r r ry rR rL r� r r r! � removeModule3 s z#FirewallDConfigService.removeModulec C sT t |t�}|�d�r4|�dd�}d|v r4|�dd�}t�d| j|� || �� d v S )Nr� r� r� r� z%s.queryModule('%s')r� )r r4 r� r� r r5 r rF )r r� r7 r r r! � queryModuleD s z"FirewallDConfigService.queryModuleza{ss}c C s t �d| j� | �� d S )Nz%s.getDestinations()� rV rE r r r! �getDestinationsR s z&FirewallDConfigService.getDestinationsc C sV t |t�}t�d| j|�d�|�d�� | j�|� t| � � �}||d< | � |� d S )Nz*%s.setDestinations({ipv4:'%s', ipv6:'%s'})Zipv4Zipv6r� ) r �dictr r5 r �getr r? rY rF rL )r Z destinationsr7 rK r r r! �setDestinationsY s � z&FirewallDConfigService.setDestinationsc C sV t |t�}t�d| j|� | j�|� t| �� �}||d vrJt t j |��|d | S )Nz%s.getDestination('%s')r� ) r r4 r r5 r r r? rY rF r r ry �r �familyr7 rK r r r! �getDestinationf s � z%FirewallDConfigService.getDestinationc C s� t |t�}t |t�}t�d| j||� | j�|� t| �� �}||d v rn|d | |krnt t j d||f ��||d |< | � |� d S )Nz %s.setDestination('%s', '%s')r� z '%s': '%s') r r4 r r5 r r r? rY rF r r rt rL �r r� �addressr7 rK r r r! �setDestinations s � � z%FirewallDConfigService.setDestinationc C sb t |t�}t�d| j|� | j�|� t| �� �}||d vrJt t j |��|d |= | � |� d S )Nz%s.removeDestination('%s')r� ) r r4 r r5 r r r? rY rF r r ry rL r� r r r! �removeDestination� s � z(FirewallDConfigService.removeDestinationc C sJ t |t�}t |t�}t�d| j||� | �� }||d v oH||d | kS )Nz %s.queryDestination('%s', '%s')r� r| r� r r r! �queryDestination� s � �z'FirewallDConfigService.queryDestinationc C s< t �d| j� | j�|� | j�| j�}d|v r8|d S g S )Nz%s.getIncludes()�includes)r r5 r r r? r rG r )r r7 rK r r r! � getIncludes� s z"FirewallDConfigService.getIncludesc C sZ t |t�}t�d| j|� | j�|� d|d d � i}| j�| j |�| _ | � | j j � d S )Nz%s.setIncludes('%s')r� ) r rY r r5 r r r? r rM r rI r& )r r� r7 rK r r r! � setIncludes� s z"FirewallDConfigService.setIncludesc C sj t |t�}t�d| j|� | j�|� | j�| j �}|� dg �� |� | j� | j |�| _ | � | j j� d S )Nz%s.addInclude('%s')r� )r r4 r r5 r r r? r rG r � setdefaultrm rM rI r& �r Zincluder7 rK r r r! � addInclude� s z!FirewallDConfigService.addIncludec C sf t |t�}t�d| j|� | j�|� | j�| j �}|d � |� | j� | j |�| _ | � | j j � d S )Nz%s.removeInclude('%s')r� )r r4 r r5 r r r? r rG r rR rM rI r& r� r r r! � removeInclude� s z$FirewallDConfigService.removeIncludec C s@ t |t�}t�d| j|� | j�| j�}d|v r<||d v S dS )Nz%s.queryInclude('%s')r� F)r r4 r r5 r r rG r r� r r r! � queryInclude� s z#FirewallDConfigService.queryInclude)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)L�__name__� __module__� __qualname__�__doc__Z persistentr r ZPK_ACTION_CONFIGZ default_polkit_auth_requiredr r r r$ r% r. r ZPROPERTIES_IFACEr8 r> r r@ r �signalrA ZPK_ACTION_INFOZINTROSPECTABLE_IFACErB r rF rH rL rN rO rI rR rS rU rT rW r[ r\ r] r_ ra rc rq rw rz r~ r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� � __classcell__r r r r! r * s �� ��� � � � � � �� �� �� ��� � � �� � � ���� � � ����� �� � � � � ��� � �r )r Z dbus.serviceZfirewallr Zfirewall.dbus_utilsr r r Zfirewall.core.loggerr Zfirewall.server.dbusr Zfirewall.server.decoratorsr r r r r Zfirewall.errorsr r r r r r! �<module> s server/__pycache__/config_ipset.cpython-39.pyc 0000644 00000031152 15025011705 0015362 0 ustar 00 a ���gI � @ s� d dl Z d dlZ d dlmZ d dlmZmZmZ d dlm Z d dl m Z m Z m Z mZ d dlmZ d dlmZ d dlmZmZmZmZ d d lmZ d d lmZ G d d � d e�ZdS ) � N)�config)�dbus_to_python�%dbus_introspection_prepare_properties�!dbus_introspection_add_properties)�IPSet)� IPSET_TYPES�normalize_ipset_entry� check_entry_overlaps_existing� check_for_overlapping_entries)�log)�DbusServiceObject)�handle_exceptions�dbus_handle_exceptions�dbus_service_method�dbus_polkit_require_auth)�errors)� FirewallErrorc s e Zd ZdZdZejjZe � fdd��Z e dd� �Z e dd� �Z e d d � �Zeejd d d �e dWdd���Zeejddd �e dXdd���Zeejj�eejdd�e dYdd����Zejjejdd�dd � �Zeejj�eejdd �e dZ� fd d � ���Zeejje j d �e d[d d!���Z eejje j d�e d\d"d#���Z eejj�e d]d$d%���Z ejjejjdd�e d&d'� ��Z!eejj�e d^d(d)���Z"ejjejjdd�e d*d+� ��Z#eejjdd�e d_d,d-���Z$ejjejjdd�e d.d/� ��Z%eejjdd �e d`d0d1���Z&eejjdd�e dad2d3���Z'eejjdd �e dbd4d5���Z(eejjdd�e dcd6d7���Z)eejjdd �e ddd8d9���Z*eejjdd�e ded:d;���Z+eejjdd �e dfd<d=���Z,eejjdd�e dgd>d?���Z-eejjd@d �e dhdAdB���Z.eejjd@d�e didCdD���Z/eejjd d�e djdEdF���Z0eejjdd�e dkdGdH���Z1eejjd dId �e dldJdK���Z2eejjdLd �e dmdMdN���Z3eejjdLd�e dndOdP���Z4eejjdd�e dodQdR���Z5eejjdd�e dpdSdT���Z6eejjddId �e dqdUdV���Z7� Z8S )r�FirewallDConfigIPSetzFirewallD main classTc s` t t| �j|i |�� || _|| _|| _|| _|d | _|d | _d| j | _ t | tj j � d S )Nr � zconfig.ipset.%d) �superr �__init__�parentr �obj�item_id�busname�path� _log_prefixr �dbus�DBUS_INTERFACE_CONFIG_IPSET)�selfr ZconfZipsetr �args�kwargs�� __class__� �@/usr/lib/python3.9/site-packages/firewall/server/config_ipset.pyr 6 s �z FirewallDConfigIPSet.__init__c C s d S �Nr$ �r r$ r$ r% �__del__C s z FirewallDConfigIPSet.__del__c C s | � � d S r& )Zremove_from_connectionr' r$ r$ r% � unregisterG s z FirewallDConfigIPSet.unregisterc C s� |dkrt �| jj�S |dkr,t �| jj�S |dkrBt �| jj�S |dkrXt �| jj�S |dkrnt �| jj�S t j � d| ��d S )N�name�filenamer �default�builtinzDorg.freedesktop.DBus.Error.InvalidArgs: Property '%s' does not exist) r �Stringr r* r+ r ZBooleanr, r- � exceptions� DBusException)r � property_namer$ r$ r% � _get_propertyO s ��z"FirewallDConfigIPSet._get_property�ss�v)� in_signature� out_signatureNc C sL t |t�}t |t�}t�d| j||� |tjjkrBtj� d| ��| � |�S )Nz%s.Get('%s', '%s')�Jorg.freedesktop.DBus.Error.UnknownInterface: Interface '%s' does not exist) r �strr �debug1r r r r r/ r0 r2 )r �interface_namer1 �senderr$ r$ r% �Get` s � ��zFirewallDConfigIPSet.Get�sza{sv}c C s` t |t�}t�d| j|� |tjjkr6tj� d| ��i }dD ]}| � |�||< q>tj |dd�S )Nz%s.GetAll('%s')r7 )r* r+ r r, r- �sv�Z signature) r r8 r r9 r r r r r/ r0 r2 Z Dictionary)r r: r; �ret�xr$ r$ r% �GetAllq s ��zFirewallDConfigIPSet.GetAllZssv)r5 c C sl t |t�}t |t�}t |�}t�d| j|||� | j�|� |tjj krXtj � d| ��tj � d| ��d S )Nz%s.Set('%s', '%s', '%s')r7 zGorg.freedesktop.DBus.Error.PropertyReadOnly: Property '%s' is read-only) r r8 r r9 r r � accessCheckr r r r/ r0 )r r: r1 Z new_valuer; r$ r$ r% �Set� s$ � ����zFirewallDConfigIPSet.Setzsa{sv}asr? c C s2 t |t�}t |�}t |�}t�d| j|||� d S )Nz&%s.PropertiesChanged('%s', '%s', '%s'))r r8 r r9 r )r r: Zchanged_propertiesZinvalidated_propertiesr$ r$ r% �PropertiesChanged� s �z&FirewallDConfigIPSet.PropertiesChanged)r6 c s8 t �d| j� tt| ��| j| j�� �}t | |t j j �S )Nz%s.Introspect()) r Zdebug2r r r � Introspectr r Zget_busr r r r )r r; �datar" r$ r% rF � s � �z FirewallDConfigIPSet.Introspectc C s t �d| j� | j�| j�S )z get settings for ipset z%s.getSettings())r r9 r r Zget_ipset_configr �r r; r$ r$ r% � getSettings� s z FirewallDConfigIPSet.getSettingsc C sF t |�}t�d| j� | j�|� | j�| j|�| _| � | jj � dS )z"update settings for ipset z%s.update('...')N) r r r9 r r rC r Zset_ipset_configr �Updatedr* )r �settingsr; r$ r$ r% �update� s zFirewallDConfigIPSet.updatec C s< t �d| j� | j�|� | j�| j�| _| �| jj � dS )z0load default settings for builtin ipset z%s.loadDefaults()N) r r9 r r rC r Zload_ipset_defaultsr rJ r* rH r$ r$ r% � loadDefaults� s z!FirewallDConfigIPSet.loadDefaultsc C s t �d| j|f � d S )Nz%s.Updated('%s')�r r9 r �r r* r$ r$ r% rJ � s z FirewallDConfigIPSet.Updatedc C s: t �d| j� | j�|� | j�| j� | j�| j� dS )zremove ipset z %s.remove()N) r r9 r r rC r Z remove_ipsetr Z removeIPSetrH r$ r$ r% �remove� s zFirewallDConfigIPSet.removec C s t �d| j|f � d S )Nz%s.Removed('%s')rN rO r$ r$ r% �Removed� s z FirewallDConfigIPSet.Removedc C sF t |t�}t�d| j|� | j�|� | j�| j |�| _ | � |� dS )zrename ipset z%s.rename('%s')N) r r8 r r9 r r rC r Z rename_ipsetr �Renamed)r r* r; r$ r$ r% �rename� s zFirewallDConfigIPSet.renamec C s t �d| j|f � d S )Nz%s.Renamed('%s')rN rO r$ r$ r% rR � s z FirewallDConfigIPSet.Renamedc C s t �d| j� | �� d S )Nz%s.getVersion()r �r r9 r rI rH r$ r$ r% � getVersion� s z FirewallDConfigIPSet.getVersionc C sH t |t�}t�d| j|� | j�|� t| �� �}||d< | � |� d S )Nz%s.setVersion('%s')r � r r8 r r9 r r rC �listrI rL )r �versionr; rK r$ r$ r% � setVersion s z FirewallDConfigIPSet.setVersionc C s t �d| j� | �� d S )Nz %s.getShort()r rT rH r$ r$ r% �getShort s z FirewallDConfigIPSet.getShortc C sH t |t�}t�d| j|� | j�|� t| �� �}||d< | � |� d S )Nz%s.setShort('%s')r rV )r Zshortr; rK r$ r$ r% �setShort s z FirewallDConfigIPSet.setShortc C s t �d| j� | �� d S )Nz%s.getDescription()� rT rH r$ r$ r% �getDescription# s z#FirewallDConfigIPSet.getDescriptionc C sH t |t�}t�d| j|� | j�|� t| �� �}||d< | � |� d S )Nz%s.setDescription('%s')r\ rV )r � descriptionr; rK r$ r$ r% �setDescription* s � z#FirewallDConfigIPSet.setDescriptionc C s t �d| j� | �� d S )Nz %s.getType()� rT rH r$ r$ r% �getType8 s z FirewallDConfigIPSet.getTypec C s\ t |t�}t�d| j|� | j�|� |tvr:tt j |��t | � � �}||d< | � |� d S )Nz%s.setType('%s')r` )r r8 r r9 r r rC r r r Z INVALID_TYPErW rI rL )r Z ipset_typer; rK r$ r$ r% �setType? s z FirewallDConfigIPSet.setTypeza{ss}c C s t �d| j� | �� d S )Nz%s.getOptions()� rT rH r$ r$ r% � getOptionsN s z FirewallDConfigIPSet.getOptionsc C sL t |t�}t�d| jt|�� | j�|� t| � � �}||d< | � |� d S )Nz%s.setOptions('[%s]')rc ) r �dictr r9 r �reprr rC rW rI rL )r �optionsr; rK r$ r$ r% � setOptionsU s � z FirewallDConfigIPSet.setOptionsc C s� t |t�}t |t�}t�d| j||� | j�|� t| �� �}||d v rn|d | |krnt t j d||f ��||d |< | � |� d S )Nz%s.addOption('%s', '%s')rc z '%s': '%s') r r8 r r9 r r rC rW rI r r �ALREADY_ENABLEDrL �r �key�valuer; rK r$ r$ r% � addOptiona s � z FirewallDConfigIPSet.addOptionc C sb t |t�}t�d| j|� | j�|� t| �� �}||d vrJt t j |��|d |= | � |� d S )Nz%s.removeOption('%s')rc ) r r8 r r9 r r rC rW rI r r � NOT_ENABLEDrL )r rk r; rK r$ r$ r% � removeOptionp s z!FirewallDConfigIPSet.removeOption�bc C sN t |t�}t |t�}t�d| j||� t| �� �}||d v oL|d | |kS )Nz%s.queryOption('%s', '%s')rc )r r8 r r9 r rW rI rj r$ r$ r% � queryOption} s � z FirewallDConfigIPSet.queryOption�asc C s t �d| j� | �� d S )Nz%s.getEntries()� rT rH r$ r$ r% � getEntries� s z FirewallDConfigIPSet.getEntriesc C s| t |t�}t|� t�d| jd�|�� | j�|� t| � � �}d|d v rf|d d dkrft t j ��||d< | � |� d S )Nz%s.setEntries('[%s]')�,�timeoutrc �0rs )r rW r r r9 r �joinr rC rI r r �IPSET_WITH_TIMEOUTrL )r �entriesr; rK r$ r$ r% � setEntries� s � z FirewallDConfigIPSet.setEntriesc C s� t |t�}t|�}t�d| j|� | j�|� t| � � �}d|d v r`|d d dkr`t t j ��||d v rxt t j |��t||d � |d �|� | �|� d S )Nz%s.addEntry('%s')rv rc rw rs )r r8 r r r9 r r rC rW rI r r ry ri r �appendrL �r �entryr; rK r$ r$ r% �addEntry� s z FirewallDConfigIPSet.addEntryc C s� t |t�}t|�}t�d| j|� | j�|� t| � � �}d|d v r`|d d dkr`t t j ��||d vrxt t j |��|d �|� | �|� d S )Nz%s.removeEntry('%s')rv rc rw rs )r r8 r r r9 r r rC rW rI r r ry rn rP rL r} r$ r$ r% � removeEntry� s z FirewallDConfigIPSet.removeEntryc C s` t |t�}t|�}t�d| j|� t| �� �}d|d v rT|d d dkrTtt j ��||d v S )Nz%s.queryEntry('%s')rv rc rw rs ) r r8 r r r9 r rW rI r r ry r} r$ r$ r% � queryEntry� s z FirewallDConfigIPSet.queryEntry)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)9�__name__� __module__� __qualname__�__doc__Z persistentr r ZPK_ACTION_CONFIGZ default_polkit_auth_requiredr r r r( r) r2 r ZPROPERTIES_IFACEr< rB r rD Zservice�signalrE ZPK_ACTION_INFOZINTROSPECTABLE_IFACErF r r ZDBUS_SIGNATURErI rL rM rJ rP rQ rS rR rU rY rZ r[ r] r_ ra rb rd rh rm ro rq rt r{ r r� r� � __classcell__r$ r$ r" r% r . s0 �� �� � �� �� �� �� �� � � � �� �� �r ) r Z dbus.serviceZfirewallr Zfirewall.dbus_utilsr r r Zfirewall.core.io.ipsetr Zfirewall.core.ipsetr r r r Zfirewall.core.loggerr Zfirewall.server.dbusr Zfirewall.server.decoratorsr r r r r Zfirewall.errorsr r r$ r$ r$ r% �<module> s server/__pycache__/config_policy.cpython-39.pyc 0000644 00000015124 15025011705 0015536 0 ustar 00 a ���g� � @ st d dl Z d dlZ d dlmZ d dlmZmZmZ d dlm Z d dl m Z d dl m Z mZmZmZ G dd� de �ZdS ) � N)�config)�dbus_to_python�%dbus_introspection_prepare_properties�!dbus_introspection_add_properties)�log)�DbusServiceObject)�handle_exceptions�dbus_handle_exceptions�dbus_service_method�dbus_polkit_require_authc s� e Zd ZdZejjZe� fdd��Z e dd� �Z e dd� �Z e dd � �Z eejd d d �e d/dd���Zeejddd �e d0dd���Zeejj�eejdd�e d1dd����Zejjejdd�dd� �Zeejj�eejdd �e d2� fd d � ���Zeejjdd �e d3d d ���Zeejjdd�e d4d!d"���Z eejj�e d5d#d$���Z ejjejjdd�e d%d&� ��Z eejj�e d6d'd(���Z ejjejjdd�e d)d*� ��Z eejjdd�e d7d+d,���Z!ejjejjdd�e d-d.� ��Z"� Z#S )8�FirewallDConfigPolicyTc s` t t| �j|i |�� || _|| _|| _|| _|d | _|d | _d| j | _ t | tj j � d S )Nr � zconfig.policy.%d) �superr �__init__�parentr �obj�item_id�busname�path� _log_prefixr �dbus� DBUS_INTERFACE_CONFIG_POLICY)�selfr ZconfZpolicyr �args�kwargs�� __class__� �A/usr/lib/python3.9/site-packages/firewall/server/config_policy.pyr s �z FirewallDConfigPolicy.__init__c C s d S �Nr �r r r r �__del__# s z FirewallDConfigPolicy.__del__c C s | � � d S r )Zremove_from_connectionr r r r � unregister' s z FirewallDConfigPolicy.unregisterc C s� |dkrt �| jj�S |dkr,t �| jj�S |dkrBt �| jj�S |dkrXt �| jj�S |dkrnt �| jj�S t j � d| ��d S )N�name�filenamer �default�builtinzDorg.freedesktop.DBus.Error.InvalidArgs: Property '%s' does not exist) r �Stringr r# r$ r ZBooleanr% r& � exceptions� DBusException)r � property_namer r r � _get_property/ s ��z#FirewallDConfigPolicy._get_property�ss�v)� in_signature� out_signatureNc C sL t |t�}t |t�}t�d| j||� |tjjkrBtj� d| ��| � |�S )Nz%s.Get('%s', '%s')�Jorg.freedesktop.DBus.Error.UnknownInterface: Interface '%s' does not exist) r �strr �debug1r r r r r( r) r+ )r �interface_namer* �senderr r r �Get@ s � ��zFirewallDConfigPolicy.Get�sza{sv}c C s` t |t�}t�d| j|� |tjjkr6tj� d| ��i }dD ]}| � |�||< q>tj |dd�S )Nz%s.GetAll('%s')r0 )r# r$ r r% r& �sv�Z signature) r r1 r r2 r r r r r( r) r+ Z Dictionary)r r3 r4 �ret�xr r r �GetAllQ s ��z FirewallDConfigPolicy.GetAllZssv)r. c C sl t |t�}t |t�}t |�}t�d| j|||� | j�|� |tjj krXtj � d| ��tj � d| ��d S )Nz%s.Set('%s', '%s', '%s')r0 zGorg.freedesktop.DBus.Error.PropertyReadOnly: Property '%s' is read-only) r r1 r r2 r r � accessCheckr r r r( r) )r r3 r* Z new_valuer4 r r r �Setb s$ � ����zFirewallDConfigPolicy.Setzsa{sv}asr8 c C s2 t |t�}t |�}t |�}t�d| j|||� d S )Nz&%s.PropertiesChanged('%s', '%s', '%s'))r r1 r r2 r )r r3 Zchanged_propertiesZinvalidated_propertiesr r r �PropertiesChangedv s �z'FirewallDConfigPolicy.PropertiesChanged)r/ c s8 t �d| j� tt| ��| j| j�� �}t | |t j j �S )Nz%s.Introspect()) r Zdebug2r r r � Introspectr r Zget_busr r r r )r r4 �datar r r r? s � �z FirewallDConfigPolicy.Introspectc C s t �d| j� | j�| j�}|S )z get settings for policy z%s.getSettings())r r2 r r Z get_policy_object_config_dictr )r r4 �settingsr r r � getSettings� s z!FirewallDConfigPolicy.getSettingsc C sF t |�}t�d| j� | j�|� | j�| j|�| _| � | jj � dS )z#update settings for policy z%s.update('...')N) r r r2 r r r< r Z set_policy_object_config_dictr �Updatedr# )r rA r4 r r r �update� s z FirewallDConfigPolicy.updatec C s< t �d| j� | j�|� | j�| j�| _| �| jj � dS )z1load default settings for builtin policy z%s.loadDefaults()N) r r2 r r r< r Zload_policy_object_defaultsr rC r# �r r4 r r r � loadDefaults� s z"FirewallDConfigPolicy.loadDefaultsc C s t �d| j|f � d S )Nz%s.Updated('%s')�r r2 r �r r# r r r rC � s z FirewallDConfigPolicy.Updatedc C s: t �d| j� | j�|� | j�| j� | j�| j� dS )zremove policy z%s.removePolicy()N) r r2 r r r< r Zremove_policy_objectr Z removePolicyrE r r r �remove� s z FirewallDConfigPolicy.removec C s t �d| j|f � d S )Nz%s.Removed('%s')rG rH r r r �Removed� s z FirewallDConfigPolicy.Removedc C sF t |t�}t�d| j|� | j�|� | j�| j |�| _ | � |� dS )zrename policy z%s.rename('%s')N) r r1 r r2 r r r< r Zrename_policy_objectr �Renamed)r r# r4 r r r �rename� s z FirewallDConfigPolicy.renamec C s t �d| j|f � d S )Nz%s.Renamed('%s')rG rH r r r rK � s z FirewallDConfigPolicy.Renamed)N)N)N)N)N)N)N)N)N)$�__name__� __module__� __qualname__Z persistentr r ZPK_ACTION_CONFIGZ default_polkit_auth_requiredr r r r! r" r+ r ZPROPERTIES_IFACEr5 r; r r= Zservice�signalr> ZPK_ACTION_INFOZINTROSPECTABLE_IFACEr? r rB rD rF rC rI rJ rL rK � __classcell__r r r r r sx �� �� � r )r Z dbus.serviceZfirewallr Zfirewall.dbus_utilsr r r Zfirewall.core.loggerr Zfirewall.server.dbusr Zfirewall.server.decoratorsr r r r r r r r r �<module> s server/__pycache__/server.cpython-39.pyc 0000644 00000004413 15025011705 0014217 0 ustar 00 a ���gY � @ st d gZ ddlZddlmZ ddlZddlZddlZddlmZ ddl m Z ddl m Z dd� Z d d � Zd d d �ZdS )� run_server� N)�GLib)�config)�log)� FirewallDc C s | � � dS )NT)�reload)�service� r �:/usr/lib/python3.9/site-packages/firewall/server/server.py�sighup0 s r c C s | � � d S )N)�quit)�mainloopr r r �sigterm4 s r Fc sf d}| rFddl m� ddl� � �� � �� j� d�� ���fdd��z�tjjj dd� t� � }tj j t jj|d �}t|t jj�}t�� }| r�t���� ttd �r�tj}ntj}|tjtjt|� |tjtjt |� |� � W nr t y� t � d � Y nX t!�y t �"d � Y n< t#�yR } z"t �"d |j$j%t&|�� W Y d}~n d}~0 0 |�rb|�'� dS )zI Main function for firewall server. Handles D-Bus and GLib mainloop. Nr )�pformat� c sn � � � t� j�dkr^td� tdt� j� � � jD ] } tt| �d� t�| �� q6td� t���� d S )Nr zP >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> zGARBAGE OBJECTS (%d): z zP <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<< )Zcollect�lenZgarbage�print�typer �timeout_add_seconds)�x��gc� gc_collectZ gc_timeoutr r r r H s z run_server.<locals>.gc_collectT)Zset_as_default)�bus�unix_signal_addz Stopping..z Raising SystemExit in run_serverzException %s: %s)(Zpprintr r �enableZ set_debugZ DEBUG_LEAK�dbusr ZglibZ DBusGMainLoopZ SystemBusr ZBusNamer ZDBUS_INTERFACEr Z DBUS_PATHr ZMainLoopr �hasattrr Zunix_signal_add_fullZ PRIORITY_HIGH�signal�SIGHUPr �SIGTERMr �run�KeyboardInterruptr Zdebug1� SystemExit�error� Exception� __class__�__name__�str�stop)Zdebug_gcr r �namer r �er r r r = sD � � ,)F)�__all__r Z gi.repositoryr r Z dbus.serviceZdbus.mainloop.glibZfirewallr Zfirewall.core.loggerr Zfirewall.server.firewalldr r r r r r r r �<module> s server/__pycache__/dbus.cpython-39.pyc 0000644 00000003041 15025011705 0013642 0 ustar 00 a ���g� � @ sP d dl Z d dlmZ G dd� de j�ZG dd� de j�ZG dd� de jj�ZdS ) � N)�configc @ s e Zd Zd Zdejj ZdS )�FirewallDBusExceptionz %s.ExceptionN)�__name__� __module__� __qualname__�__doc__r �dbus�DBUS_INTERFACE�_dbus_error_name� r r �8/usr/lib/python3.9/site-packages/firewall/server/dbus.pyr s r c s e Zd Z� fdd�Z� ZS )�NotAuthorizedExceptionc s& t jjd | _t� �d�||�� d S )Nz.NotAuthorizedExceptionzNot Authorized({}): {})r r r r �super�__init__�format)�selfZ action_id�method�args�kwargs�� __class__r r r s z NotAuthorizedException.__init__)r r r r � __classcell__r r r r r s r c s e Zd Z� fdd�Z� ZS )�DbusServiceObjectc s^ ddl m} t| �D ]<}t| |�}t|d�rt|d�s|| j�}t| |||�� qt� �| �S )Nr )�dbus_polkit_require_authZ_dbus_is_methodZ_polkit_auth_required) Zfirewall.server.decoratorsr �dir�getattr�hasattrZ default_polkit_auth_required�setattrr �__new__)�clsr r r Z attr_namer Z _decoratorr r r r s � zDbusServiceObject.__new__)r r r r r r r r r r s r ) r Zfirewallr Z DBusExceptionr r ZserviceZObjectr r r r r �<module> s server/__pycache__/firewalld.cpython-39.opt-1.pyc 0000644 00000216355 15025011705 0015633 0 ustar 00 a ���gG� � @ sB d gZ ddlmZ ddlZddlZddlZddlmZ ddlm Z ddl m Z ddl m Z ddlmZ dd lmZmZ dd lmZmZmZmZmZmZ dd lmZ dd l m Z m Z m Z m Z m!Z!m"Z"m#Z#m$Z$ dd l%m&Z& ddl'm(Z( ddl)m*Z* ddl+m,Z, ddl-m.Z.m/Z/ ddl0m1Z1 ddlm2Z2 ddl3m4Z4 G dd � d e�Z5dS )� FirewallD� )�GLibN)�config)�Firewall)� Rich_Rule)�log)�FirewallClientZoneSettings)�FirewallDBusException�DbusServiceObject)�dbus_handle_exceptions�dbus_service_method�handle_exceptions� dbus_service_method_deprecated� dbus_service_signal_deprecated�dbus_polkit_require_auth)�FirewallDConfig)�dbus_to_python�command_of_sender�context_of_sender� uid_of_sender� user_of_uid�%dbus_introspection_prepare_properties�!dbus_introspection_add_properties�!dbus_introspection_add_deprecated)�check_on_disk_config)�IPSet)�IcmpType)�Helper)� nm_get_connection_of_interface�nm_set_zone_of_connection)�ifcfg_set_zone_of_interface)�errors)� FirewallErrorc s ! e Zd ZdZdZejjZe � fdd��Z dd� Z e dd� �Z e d d � �Z ed d � �Zed d� �Zedd� �Zedd� �Zedd� �Zeejddd�e�d�dd���Zeejdd d�e�d�d d ���Zeejj�eejd d �e�d�d!d"����Zejjejd#d$�d%d&� �Z eejj �eej dd'�e�d�� fd(d)� ���Z eejj�eejj d*d*d�e�d�d+d,����Z!eejj�eejj d*d*d�e�d�d-d.����Z"ej�ejj �ed/d0� ��Z#eejj�eejj d*d*d��d�d1d2���Z$eejj�eejj d*d*d�e�d�d3d4����Z%eejj�eejj d*d*d�e�d�d5d6����Z&eejj'�eejj(d*d*d�e�d�d7d8����Z)eejj'�eejj(d*d*d�e�d�d9d:����Z*eejj+�eejj(d*d;d�e�d�d<d=����Z,ejjejj(d*d$�ed>d?� ��Z-ejjejj(d*d$�ed@dA� ��Z.eejj'�eejj(dd*d�e�d�dBdC����Z/eejj'�eejj(dd*d�e�d�dDdE����Z0eejj+�eejj(dd;d�e�d�dFdG����Z1eejj+�eejj(d*dHd�e�d�dIdJ����Z2ejjejj(dd$�edKdL� ��Z3ejjejj(dd$�edMdN� ��Z4eejj'�eejj(dOd*d�e�d�dPdQ����Z5eejj'�eejj(dOd*d�e�d�dRdS����Z6eejj+�eejj(dOd;d�e�d�dTdU����Z7eejj+�eejj(d*dVd�e�d�dWdX����Z8ejjejj(dOd$�edYdZ� ��Z9ejjejj(dOd$�ed[d\� ��Z:eejj'�eejj(dd*d�e�d�d]d^����Z;eejj'�eejj(dd*d�e�d�d_d`����Z<eejj+�eejj(dd;d�e�d�dadb����Z=eejj+�eejj(d*dHd�e�d�dcdd����Z>ejjejj(dd$�ededf� ��Z?ejjejj(dd$�edgdh� ��Z@eejj'�eejj(dd*d�e�d�didj����ZAeejj'�eejj(dd*d�e�d�dkdl����ZBeejj+�eejj(dd;d�e�d�dmdn����ZCeejj+�eejj(d*dHd�e�d�dodp����ZDejjejj(dd$�edqdr� ��ZEejjejj(dd$�edsdt� ��ZFeejj�eejj d*d*d�e�d�dudv����ZGeejj�eejj d*d*d�e�d�dwdx����ZHeejj �eejj d*d;d�e�d�dydz����ZIejjejj d*d$�ed{d|� ��ZJejjejj d*d$�ed}d~� ��ZKeejjL�eejj ddd�e�d�d�d�����ZMeejjL�eejjNdd d�e�d�d�d�����ZOeejjL�eejjNd�d �e�d�d�d�����ZPejjejjNd�d$�ed�d�� ��ZQeejjL�eejjRdd d�e�d�d�d�����ZSeejjL�eejjRd�d �e�d�d�d�����ZTejjejjRd�d$�ed�d�� ��ZUeejj �eejj d*dHd�e�d�d�d�����ZVeejjL�eejj dd�d�e�d�d�d�����ZWeejjL�eejj dd d�e�d�d�d�����ZXeejj �eejj d*dHd�e�d�d�d�����ZYeejjL�eejj deZj[d�e�d�d�d�����Z\eejjL�eejj d*dd�e�d�d�d�����Z]eejj�eejj dd*d�e�d�d�d�����Z^ejjejj dd$�ed�d�� ��Z_eejjL�eejj d*dd�e�d�d�d�����Z`eejj�eejj dd*d�e�d�d�d�����Zaejjejj dd$�ed�d�� ��Zbeejj �eejj d*dd�e�d�d�d�����Zceejj�eejj dd*d�e�d�d�d�����Zdejjejj dd$�ed�d�� ��Zeeejj �eejjRd*dHd�e�d�d�d�����Zfeejj �eejjRd*d�d�e�d�d�d�����Zgeejj �eejjNd*dHd�e�d�d�d�����Zheejj �eejjNd*d�d�e�d�d�d�����Zieejj �eejjNddd�e�d�d�d�����Zjeejj �eejjNddd�e�d�d�d�����ZkeejjL�eejjNdd;d�e�d�d�d�����Zleejj�eejjNddd�e�d�d�d�����Zmeejj�eejjNddd�e�d�d�d�����Zneejj�eejjNddd�e�d�d�d�����Zoeejj�eejjNddd�e�d�d�d���ZpeejjL�eejjNdd;d�e�d�d�dĄ���ZqeejjL�eejjNddHd�e�d�d�dƄ���ZrejjejjNdd$�ed�dȄ ��ZsejjejjNdd$�ed�dʄ ��ZtejjejjNdd$�ed�d̄ ��ZuejjejjNdd$�ed�d΄ ��Zveejj�eejjNddd�e�d�d�dЄ���Zweejj�eejjNddd�e�d�d�d҄���Zxeejj�eejjNddd�e�d�d�dԄ���ZyeejjL�eejjNdd;d�e�d�d�dք���ZzeejjL�eejjNddHd�e�d�d�d���Z{ejjejjNdd$�ed�dڄ ��Z|ejjejjNdd$�ed�d܄ ��Z}ejjejjNdd$�ed�dބ ��Z~ed�d� �Zeejj�eejjNd�dd�e�d�d�d����Z�eejj�eejjNddd�e�d�d�d����Z�eejjL�eejjNdd;d�e�d�d�d����Z�eejjL�eejjNddHd�e�d�d�d����Z�ejjejjNd�d$�ed�d� ��Z�ejjejjNdd$�ed�d� ��Z�ed�d� �Z�eejj�eejjNd�dd�e�d�d�d����Z�eejj�eejjNddd�e�d�d�d����Z�eejjL�eejjNdd;d�e�d�d�d�����Z�eejjL�eejjNddHd�e�d�d�d�����Z�ejjejjNd�d$�ed�d�� ��Z�ejjejjNdd$�ed�d�� ��Z�ed�d�� �Z�eejj�eejjNd�dd�e�d�d��d ����Z�eejj�eejjN�ddd�e�d��d�d����Z�eejjL�eejjN�dd;d�e�d��d�d����Z�eejjL�eejjNd�dd�e�d��d�d����Z�ejjejjNd�d$�e�d��d �d ���Z�ejjejjN�dd$�e�d �d � ��Z�e�d�d� �Z�eejj�eejjNd�dd�e�d��d�d����Z�eejj�eejjNddd�e�d��d�d����Z�eejjL�eejjNdd;d�e�d��d�d����Z�eejjL�eejjNddHd�e�d �d�d����Z�ejjejjNd�d$�e�d�d�d���Z�ejjejjNdd$�e�d�d� ��Z�e�d �d � �Z�eejj�eejjNd�dd�e�d�d �d ����Z�eejj�eejjN�ddd�e�d�d �d!����Z�eejjL�eejjN�dd;d�e�d�d"�d#����Z�eejjL�eejjNd�dd�e�d�d$�d%����Z�ejjejjNd�d$�e�d�d&�d'���Z�ejjejjN�dd$�e�d(�d)� ��Z�e�d*�d+� �Z�eejj�eejjN�d,dd�e�d�d-�d.����Z�eejj�eejjNddd�e�d�d/�d0����Z�eejjL�eejjNdd;d�e�d �d1�d2����Z�ejjejjN�d,d$�e�d �d3�d4���Z�ejjejjNdd$�e�d5�d6� ��Z�e�d7�d8� �Z�eejj�eejjN�d9dd�e�d �d:�d;����Z�eejj�eejjN�d<dd�e�d �d=�d>����Z�eejjL�eejjN�d<d;d�e�d �d?�d@����Z�eejjL�eejjNd�dd�e�d�dA�dB����Z�ejjejjN�d9d$�e�d�dC�dD���Z�ejjejjN�d<d$�e�dE�dF� ��Z�e�dG�dH� �Z�eejj�eejjNd�dd�e�d�dI�dJ����Z�eejj�eejjNddd�e�d�dK�dL����Z�eejjL�eejjNdd;d�e�d�dM�dN����Z�eejjL�eejjNddHd�e�d�dO�dP����Z�ejjejjNd�d$�e�d�dQ�dR���Z�ejjejjNdd$�e�dS�dT� ��Z�eejj�eejjNddd�e�d�dU�dV����Z�eejj�eejjNddd�e�d�dW�dX����Z�eejjL�eejjNdd;d�e�d�dY�dZ����Z�ejjejjNdd$�e�d[�d\� ��Z�ejjejjNdd$�e�d]�d^� ��Z�eejj��e�ejj��eejj��dd*d�e�d�d_�d`�����Z�eejj��e�ejj��eejj��dd*d�e�d�da�db�����Z�eejj��e�ejj��eejj��dd;d�e�d�dc�dd�����Z�eejj��e�ejj��eejj�ddHd�e�d�de�df�����Z�eejj��e�ejj��eejj�d*�dgd�e�d �dh�di�����Z�e�ejj��ejjejj��dd$�e�dj�dk� ���Z�e�ejj��ejjejj��dd$�e�dl�dm� ���Z�eejj��e�ejj��eejj��dnd*d�e�d �do�dp�����Z�eejj��e�ejj��eejj��dnd*d�e�d �dq�dr�����Z�eejj��e�ejj��eejj��dd*d�e�d �ds�dt�����Z�eejj��e�ejj��eejj��dnd;d�e�d �du�dv�����Z�eejj��e�ejj��eejj��d�dwd�e�d!�dx�dy�����Z�eejj��e�ejj��eejj�d*�dzd�e�d"�d{�d|�����Z�e�ejj��ejjejj��dnd$�e�d}�d~� ���Z�e�ejj��ejjejj��dnd$�e�d�d�� ���Z�eejj��e�ejj��eejj��d�dd�e�d#�d��d������Z�eejj��e�ejj��eejj��d�d*d�e�d$�d��d������Z�eejj��e�ejj��eejj��d�d*d�e�d%�d��d������Z�eejj��e�ejj��eejj��d�d;d�e�d&�d��d������Z�eejj��e�ejj��eejj�d*�d�d�e�d'�d��d������Z�eejj��e�ejj��eejj�d*d*d�e�d(�d��d������Z�eejj��e�ejj��eejj�d�dd�e�d)�d��d������Z�e�ejj��ejjejj��d�d$�e�d��d�� ���Z�e�ejj��ejjejj��d�d$�e�d��d�� ���Z�eejjeejj d*d*d�e�d*�d��d�����Z�eejj �eejj�dd;d�e�d+�d��d�����Z�eejj �eejj�d*dHd�e�d,�d��d�����Z�eejjL�eejj�de�j[d�e�d-�d��d�����Z�eejj�eejj�dd*d�e�d.�d��d�����Z�eejj�eejj�dd*d�e�d/�d��d�����Z�eejj �eejj�dd;d�e�d0�d��d�����Z�eejj �eejj�ddHd�e�d1�d��d�����Z�eejj�eejjڐd�d �e�d2�d��d�����Z�ejjejj�dd$�e�d��d�� ��Z�ejjejj�dd$�e�d��d�� ��Z�eejj �eejj d*dHd�e�d3�d��d�����Z�eejjL�eejj de�j[d�e�d4�d��d�����Z� Z�S (5 r zFirewallD main classTc sd t t| �j|i |�� t� | _|d | _|d | _| �� t| t j j � t | jj | jt j j �| _ d S )Nr � )�superr �__init__r �fw�busname�path�startr r �dbus�DBUS_INTERFACEr ZDBUS_PATH_CONFIG)�self�args�kwargs�� __class__� �=/usr/lib/python3.9/site-packages/firewall/server/firewalld.pyr% G s �zFirewallD.__init__c C s | � � d S �N)�stop�r, r1 r1 r2 �__del__R s zFirewallD.__del__c C s t �d� i | _| j�� S )Nzstart())r �debug1� _timeoutsr& r) r5 r1 r1 r2 r) U s zFirewallD.startc C s t �d� | j�� S )Nzstop())r r7 r& r4 r5 r1 r1 r2 r4 ] s zFirewallD.stopc C s� | j j�� r�|d u r"t�d� d S t�� }t||�}| j j�d|�rHd S t ||�}| j j�d|�rfd S t |�}| j j�d|�r�d S t ||�}| j j�d|�r�d S t t jd��d S )Nz&Lockdown not possible, sender not set.�context�uid�user�commandzlockdown is enabled)r& �policies�query_lockdownr �errorr* Z SystemBusr Z access_checkr r r r" r! Z ACCESS_DENIED)r, �senderZbusr9 r: r; r< r1 r1 r2 � accessCheckf s$ zFirewallD.accessCheckc C s& || j vri | j |< || j | |< d S r3 )r8 )r, �zone�x�tagr1 r1 r2 � addTimeout} s zFirewallD.addTimeoutc C s< || j v r8|| j | v r8t�| j | | � | j | |= d S r3 )r8 r � source_remove�r, rB rC r1 r1 r2 � removeTimeout� s zFirewallD.removeTimeoutc C sL | j D ]6}| j | D ]}t�| j | | � q| j | �� q| j �� d S r3 )r8 r rF �clearrG r1 r1 r2 �cleanup_timeouts� s zFirewallD.cleanup_timeoutsc C sr |dkrt �tj�S |dkr6t �dtj jtj jf �S |dkrNt �| j�� �S |dkrht �| j� d��S |dkr�t � | jj d�S |d kr�t �| j� d ��S |d kr�t �| jj d kr�d nd�S |dkr�t � | jj d�S |dk� r�t �| jj�S |dk�rt �| jj�S |dk�r t � | jjd�S |dk�r2t �d �S |dk�rHt �i d�S |dk�r^t �i d�S t j�d| ��d S )N�version�interface_versionz%d.%d�state�IPv4�ipv4� IPv4ICMPTypes�s�IPv6�ipv6� IPv6_rpfilter�noFT� IPv6ICMPTypes�BRIDGEr � IPSetTypes�nf_conntrack_helper_setting�nf_conntrack_helpers�sas�nf_nat_helpers�Dorg.freedesktop.DBus.Error.InvalidArgs: Property '%s' does not exist)r* �Stringr ZVERSIONZDBUS_INTERFACE_VERSIONZDBUS_INTERFACE_REVISIONr& Z get_stateZBooleanZis_ipv_enabledZArrayZipv4_supported_icmp_typesZ_ipv6_rpfilterZipv6_supported_icmp_typesZebtables_enabledZ ipset_enabledZipset_supported_types� Dictionary� exceptions� DBusException)r, Zpropr1 r1 r2 � _get_property� sF � ��zFirewallD._get_property�ss�v)� in_signature� out_signatureNc C s~ t |t�}t |t�}t�d||� |tjjkr8| �|�S |tjjtjj tjj tjj fv rjtj � d| ��ntj � d| ��d S )NzGet('%s', '%s')r] �Jorg.freedesktop.DBus.Error.UnknownInterface: Interface '%s' does not exist)r �strr r7 r r* r+ rb �DBUS_INTERFACE_ZONE�DBUS_INTERFACE_DIRECT�DBUS_INTERFACE_POLICIES�DBUS_INTERFACE_IPSETr` ra )r, �interface_name� property_namer@ r1 r1 r2 �Get� s( �����z FirewallD.GetrQ za{sv}c C s� t |t�}t�d|� i }|tjjkr@dD ]}| �|�||< q*n2|tjjtjj tjj tjj fv rbntj � d| ��tj|dd�S )Nz GetAll('%s')�rK rL rM rN rR rT rW r rX rY rZ r\ rP rV rg �sv�Z signature)r rh r r7 r r* r+ rb ri rj rk rl r` ra r_ )r, rm r@ �retrC r1 r1 r2 �GetAll� s$ ���zFirewallD.GetAllZssv)re c C s� t |t�}t |t�}t |�}t�d|||� | �|� |tjjkrn|dv r\tj� d| ��q�tj� d| ��nB|tjj tjj tjj tjj fv r�tj� d| ��ntj� d| ��d S )NzSet('%s', '%s', '%s')rp zGorg.freedesktop.DBus.Error.PropertyReadOnly: Property '%s' is read-onlyr] rg )r rh r r7 rA r r* r+ r` ra ri rj rk rl )r, rm rn Z new_valuer@ r1 r1 r2 �Set� sD � ���������z FirewallD.Setzsa{sv}asrr c C s. t |t�}t |�}t |�}t�d|||� d S )Nz#PropertiesChanged('%s', '%s', '%s'))r rh r r7 )r, rm Zchanged_propertiesZinvalidated_propertiesr1 r1 r2 �PropertiesChanged s �zFirewallD.PropertiesChanged)rf c s` t �d� tt| ��| j| j�� �}t| |t j j �}t j j fD ] }t | ||t� jt� j�}q>|S )Nz Introspect())r Zdebug2r$ r � Introspectr( r' Zget_busr r r* r+ rj r r Z deprecatedr )r, r@ �data� interfacer/ r1 r2 rw $ s ���zFirewallD.Introspect� c C s* t �d� | j�� | j�� | �� dS )z#Reload the firewall rules. zreload()N�r r7 r& �reloadr �Reloaded�r, r@ r1 r1 r2 r| : s zFirewallD.reloadc C s, t �d� | j�d� | j�� | �� dS )z�Completely reload the firewall. Completely reload the firewall: Stops firewall, unloads modules and starts the firewall again. zcompleteReload()TNr{ r~ r1 r1 r2 �completeReloadI s zFirewallD.completeReloadc C s t �d� d S )Nz Reloaded()�r r7 r5 r1 r1 r2 r} Y s zFirewallD.Reloadedc C s" t �d� | jj�� | �� dS )zbreset to firewall's builtin defaults. Reloads firewalld to apply changes properly z firewalld.reset_to_defaults()N)r r7 r& r Zreset_defaultsr| r~ r1 r1 r2 �resetToDefaults^ s zFirewallD.resetToDefaultsc C s t �d� t| j� dS )z&Check permanent configuration zcheckPermanentConfig()N)r r7 r r& r~ r1 r1 r2 �checkPermanentConfigi s z FirewallD.checkPermanentConfigc C s� t �d� | jjdkr"ttjd��d}| j�� }| jj � � D ]�}| � |�}zj||v r�| j� |�}|� � |kr�t �d| � |�|� q�t �d| � n t �d| � | j�||� W q< ty� } z"t �d||f � d }W Y d }~q<d }~0 0 q<| j�� }| jj�� D ]�}| �|�}zn||v �rf| j�|�}|� � |k�rVt �d | � |�|� nt �d | � n t �d | � | j�||� W n< t�y� } z"t �d||f � d }W Y d }~n d }~0 0 �q| j�� }| jj�� D ]�}zx| �|�}||v �r:| j� |�}|� � |k�r*t �d| � |�|� nt �d| � n t �d| � | j� ||� W n< t�y� } z"t �d||f � d }W Y d }~n d }~0 0 �q�| j� � }| jj � � D �]h}| �!|�}t"t#�$|��}d} |�%� D ]4} | | jj&v �r�t �d|| f � |�'| � d } �q�|�%� D ]H} z,t(| �} | �rFt)|| ��rF|�'| � d } W n t�y\ Y n0 �q| �rp|�*� }|�%� D ]} t+|| � �qxzP||v �r�| j�,|�}t �d| � |�-|� n t �d| � | j�.||� W n< t�y } z"t �d||f � d }W Y d }~n d }~0 0 �q�| j�/� }| jj0�1� D ]�}| �2|�}zB||v �rd| j�3|�}|�|� n t �d| � | j�4||� W n< t�y� } z"t �d||f � d }W Y d }~n d }~0 0 �q2| j�5� }| jj6�7� D ]�}| �8|�}zn||v �r8| j�9|�}|� � |k�r(t �d| � |�|� nt �d| � n t �d| � | j�:||� W n< t�y� } z"t �d ||f � d }W Y d }~n d }~0 0 �q�| jj;�<� | jj;�=� | jj;�>� f}z6| j� � |k�r�t �d � | j�|� n t �d � W n8 t�y( } z t �d | � d }W Y d }~n d }~0 0 | jj?j@�A� }z6| j� � |k�rbt �d � | j�B|� n t �d!� W n8 t�y� } z t �d"| � d }W Y d }~n d }~0 0 |�r�ttjC��d S )#z-Make runtime configuration permanent zcopyRuntimeToPermanent()ZFAILEDz�Saving runtime to permanent is not allowed while firewalld is in FAILED state. The permanent configuration must be fixed and then firewalld restarted. Try `firewall-offline-cmd --check-config`.Fz Copying service '%s' settingsz$Service '%s' is identical, ignoring.zCreating service '%s'z/Runtime To Permanent failed on service '%s': %sTNz Copying icmptype '%s' settingsz%IcmpType '%s' is identical, ignoring.zCreating icmptype '%s'z0Runtime To Permanent failed on icmptype '%s': %szCopying ipset '%s' settingsz"IPSet '%s' is identical, ignoring.zCreating ipset '%s'z-Runtime To Permanent failed on ipset '%s': %szEZone '%s': interface binding for '%s' has been added by NM, ignoring.zCopying zone '%s' settingszCreating zone '%s'z,Runtime To Permanent failed on zone '%s': %szCreating policy '%s'z.Runtime To Permanent failed on policy '%s': %sz Copying helper '%s' settingsz#Helper '%s' is identical, ignoring.zCreating helper '%s'z.Runtime To Permanent failed on helper '%s': %sz Copying direct configurationz,Direct configuration is identical, ignoring.z7Runtime To Permanent failed on direct configuration: %sz Copying policies configurationz.Policies configuration is identical, ignoring.z9Runtime To Permanent failed on policies configuration: %s)Dr r7 r& �_stater" r! ZRUNNING_BUT_FAILEDr ZgetServiceNames�service� get_services�getServiceSettingsZgetServiceByNameZ getSettings�update� addService� Exception�warningZgetIcmpTypeNames�icmptype� get_icmptypes�getIcmpTypeSettingsZgetIcmpTypeByNameZ addIcmpTypeZ getIPSetNames�ipset� get_ipsets�getIPSetSettingsZgetIPSetByNameZaddIPSetZ getZoneNamesrB � get_zones�getZoneSettings2r �copy�deepcopy� getInterfacesZ_nm_assigned_interfaces�removeInterfacer r ZgetSettingsDictr Z getZoneByNameZupdate2ZaddZone2ZgetPolicyNames�policy�"get_policies_not_derived_from_zone�getPolicySettingsZgetPolicyByNameZ addPolicyZgetHelperNames�helper� get_helpers�getHelperSettingsZgetHelperByNameZ addHelper�direct�get_all_chains� get_all_rules�get_all_passthroughsr= �lockdown_whitelist� export_configZsetLockdownWhitelistZRT_TO_PERM_FAILED) r, r@ r? Z config_names�nameZconfZconf_obj�e�settingsZchangedry Z connectionr1 r1 r2 �runtimeToPermanentu sF � �� �� �� �� �� �� � � ��z FirewallD.runtimeToPermanentc C s, t �d� | �|� | jj�� | �� dS )z!Enable lockdown policies zpolicies.enableLockdown()N)r r7 rA r& r= Zenable_lockdown�LockdownEnabledr~ r1 r1 r2 �enableLockdownG s zFirewallD.enableLockdownc C s, t �d� | �|� | jj�� | �� dS )z"Disable lockdown policies zpolicies.disableLockdown()N)r r7 rA r& r= Zdisable_lockdown�LockdownDisabledr~ r1 r1 r2 �disableLockdownS s zFirewallD.disableLockdown�bc C s t �d� | jj�� S )z,Returns True if lockdown is enabled zpolicies.queryLockdown())r r7 r& r= r> r~ r1 r1 r2 � queryLockdown_ s zFirewallD.queryLockdownc C s t �d� d S )NzLockdownEnabled()r� r5 r1 r1 r2 r� j s zFirewallD.LockdownEnabledc C s t �d� d S )NzLockdownDisabled()r� r5 r1 r1 r2 r� o s zFirewallD.LockdownDisabledc C s@ t |t�}t�d| � | �|� | jjj�|� | � |� dS )� Add lockdown command z*policies.addLockdownWhitelistCommand('%s')N) r rh r r7 rA r& r= r� Z add_command� LockdownWhitelistCommandAdded�r, r< r@ r1 r1 r2 �addLockdownWhitelistCommandx s z%FirewallD.addLockdownWhitelistCommandc C s@ t |t�}t�d| � | �|� | jjj�|� | � |� dS )z Remove lockdown command z-policies.removeLockdownWhitelistCommand('%s')N) r rh r r7 rA r& r= r� Zremove_command� LockdownWhitelistCommandRemovedr� r1 r1 r2 � removeLockdownWhitelistCommand� s z(FirewallD.removeLockdownWhitelistCommandc C s( t |t�}t�d| � | jjj�|�S )z Query lockdown command z,policies.queryLockdownWhitelistCommand('%s'))r rh r r7 r& r= r� Z has_commandr� r1 r1 r2 � queryLockdownWhitelistCommand� s z'FirewallD.queryLockdownWhitelistCommand�asc C s t �d� | jjj�� S )r� z'policies.getLockdownWhitelistCommands())r r7 r& r= r� Z get_commandsr~ r1 r1 r2 � getLockdownWhitelistCommands� s z&FirewallD.getLockdownWhitelistCommandsc C s t �d| � d S )Nz#LockdownWhitelistCommandAdded('%s')r� �r, r< r1 r1 r2 r� � s z'FirewallD.LockdownWhitelistCommandAddedc C s t �d| � d S )Nz%LockdownWhitelistCommandRemoved('%s')r� r� r1 r1 r2 r� � s z)FirewallD.LockdownWhitelistCommandRemoved�ic C s@ t |t�}t�d| � | �|� | jjj�|� | � |� dS )�Add lockdown uid z&policies.addLockdownWhitelistUid('%s')N) r �intr r7 rA r& r= r� Zadd_uid�LockdownWhitelistUidAdded�r, r: r@ r1 r1 r2 �addLockdownWhitelistUid� s z!FirewallD.addLockdownWhitelistUidc C s@ t |t�}t�d| � | �|� | jjj�|� | � |� dS )z Remove lockdown uid z)policies.removeLockdownWhitelistUid('%s')N) r r� r r7 rA r& r= r� Z remove_uid�LockdownWhitelistUidRemovedr� r1 r1 r2 �removeLockdownWhitelistUid� s z$FirewallD.removeLockdownWhitelistUidc C s( t |t�}t�d| � | jjj�|�S )zQuery lockdown uid z(policies.queryLockdownWhitelistUid('%s'))r r� r r7 r& r= r� Zhas_uidr� r1 r1 r2 �queryLockdownWhitelistUid� s z#FirewallD.queryLockdownWhitelistUidZaic C s t �d� | jjj�� S )r� z#policies.getLockdownWhitelistUids())r r7 r& r= r� Zget_uidsr~ r1 r1 r2 �getLockdownWhitelistUids� s z"FirewallD.getLockdownWhitelistUidsc C s t �d| � d S )Nz LockdownWhitelistUidAdded(%d)r� �r, r: r1 r1 r2 r� � s z#FirewallD.LockdownWhitelistUidAddedc C s t �d| � d S )Nz LockdownWhitelistUidRemoved(%d)r� r� r1 r1 r2 r� � s z%FirewallD.LockdownWhitelistUidRemovedc C s@ t |t�}t�d| � | �|� | jjj�|� | � |� dS )�Add lockdown user z'policies.addLockdownWhitelistUser('%s')N) r rh r r7 rA r& r= r� Zadd_user�LockdownWhitelistUserAdded�r, r; r@ r1 r1 r2 �addLockdownWhitelistUser� s z"FirewallD.addLockdownWhitelistUserc C s@ t |t�}t�d| � | �|� | jjj�|� | � |� dS )z Remove lockdown user z*policies.removeLockdownWhitelistUser('%s')N) r rh r r7 rA r& r= r� Z remove_user� LockdownWhitelistUserRemovedr� r1 r1 r2 �removeLockdownWhitelistUser� s z%FirewallD.removeLockdownWhitelistUserc C s( t |t�}t�d| � | jjj�|�S )z Query lockdown user z)policies.queryLockdownWhitelistUser('%s'))r rh r r7 r& r= r� Zhas_userr� r1 r1 r2 �queryLockdownWhitelistUser s z$FirewallD.queryLockdownWhitelistUserc C s t �d� | jjj�� S )r� z$policies.getLockdownWhitelistUsers())r r7 r& r= r� Z get_usersr~ r1 r1 r2 �getLockdownWhitelistUsers s z#FirewallD.getLockdownWhitelistUsersc C s t �d| � d S )Nz LockdownWhitelistUserAdded('%s')r� �r, r; r1 r1 r2 r� # s z$FirewallD.LockdownWhitelistUserAddedc C s t �d| � d S )Nz"LockdownWhitelistUserRemoved('%s')r� r� r1 r1 r2 r� ( s z&FirewallD.LockdownWhitelistUserRemovedc C s@ t |t�}t�d| � | �|� | jjj�|� | � |� dS )� Add lockdown context z*policies.addLockdownWhitelistContext('%s')N) r rh r r7 rA r& r= r� Z add_context� LockdownWhitelistContextAdded�r, r9 r@ r1 r1 r2 �addLockdownWhitelistContext/ s z%FirewallD.addLockdownWhitelistContextc C s@ t |t�}t�d| � | �|� | jjj�|� | � |� dS )z Remove lockdown context z-policies.removeLockdownWhitelistContext('%s')N) r rh r r7 rA r& r= r� Zremove_context� LockdownWhitelistContextRemovedr� r1 r1 r2 � removeLockdownWhitelistContext< s z(FirewallD.removeLockdownWhitelistContextc C s( t |t�}t�d| � | jjj�|�S )z Query lockdown context z,policies.queryLockdownWhitelistContext('%s'))r rh r r7 r& r= r� Z has_contextr� r1 r1 r2 � queryLockdownWhitelistContextI s z'FirewallD.queryLockdownWhitelistContextc C s t �d� | jjj�� S )r� z'policies.getLockdownWhitelistContexts())r r7 r& r= r� Z get_contextsr~ r1 r1 r2 � getLockdownWhitelistContextsU s z&FirewallD.getLockdownWhitelistContextsc C s t �d| � d S )Nz#LockdownWhitelistContextAdded('%s')r� �r, r9 r1 r1 r2 r� ` s z'FirewallD.LockdownWhitelistContextAddedc C s t �d| � d S )Nz%LockdownWhitelistContextRemoved('%s')r� r� r1 r1 r2 r� e s z)FirewallD.LockdownWhitelistContextRemovedc C s* t �d� | �|� | j�� | �� dS )zfEnable panic mode. All ingoing and outgoing connections and packets will be blocked. zenablePanicMode()N)r r7 rA r& Zenable_panic_mode�PanicModeEnabledr~ r1 r1 r2 �enablePanicModen s zFirewallD.enablePanicModec C s* t �d� | �|� | j�� | �� dS )z�Disable panic mode. Enables normal mode: Allowed ingoing and outgoing connections will not be blocked anymore zdisablePanicMode()N)r r7 rA r& Zdisable_panic_mode�PanicModeDisabledr~ r1 r1 r2 �disablePanicMode| s zFirewallD.disablePanicModec C s t �d� | j�� S )NzqueryPanicMode())r r7 r& Zquery_panic_moder~ r1 r1 r2 �queryPanicMode� s zFirewallD.queryPanicModec C s t �d� d S )NzPanicModeEnabled()r� r5 r1 r1 r2 r� � s zFirewallD.PanicModeEnabledc C s t �d� d S )NzPanicModeDisabled()r� r5 r1 r1 r2 r� � s zFirewallD.PanicModeDisabledz&(sssbsasa(ss)asba(ssss)asasasasa(ss)b)c C s$ t |t�}t�d|� | jj�|�S )NzgetZoneSettings(%s))r rh r r7 r& rB Zget_config_with_settings�r, rB r@ r1 r1 r2 �getZoneSettings� s zFirewallD.getZoneSettingsc C s$ t |t�}t�d|� | jj�|�S )NzgetZoneSettings2(%s))r rh r r7 r& rB � get_config_with_settings_dictr� r1 r1 r2 r� � s zFirewallD.getZoneSettings2zsa{sv}c C sF t |t�}t�d|� | �|� | jj�|t |�|� | �||� d S )NzsetZoneSettings2(%s)) r rh r r7 rA r& rB � set_config_with_settings_dict� ZoneUpdated)r, rB r� r@ r1 r1 r2 �setZoneSettings2� s zFirewallD.setZoneSettings2c C s t �d||f � d S )Nz zone.ZoneUpdated('%s', '%s')r� )r, rB r� r1 r1 r2 r� � s zFirewallD.ZoneUpdatedc C s$ t |t�}t�d|� | jj�|�S )Nz policy.getPolicySettings(%s))r rh r r7 r& r� r� )r, r� r@ r1 r1 r2 r� � s zFirewallD.getPolicySettingsc C sF t |t�}t�d|� | �|� | jj�|t |�|� | �||� d S )Nz policy.setPolicySettings(%s)) r rh r r7 rA r& r� r� � PolicyUpdated)r, r� r� r@ r1 r1 r2 �setPolicySettings� s zFirewallD.setPolicySettingsc C s t �d||f � d S )Nz policy.PolicyUpdated('%s', '%s')r� )r, r� r� r1 r1 r2 r� � s zFirewallD.PolicyUpdatedc C s t �d� | jj�� S )NzlistServices())r r7 r& r� r� r~ r1 r1 r2 � listServices� s zFirewallD.listServicesz(sssa(ss)asa{ss}asa(ss))c C s� t |t�}t�d|� | jj�|�}|�� }g }td�D ]P}|j | d |vrp|� t � t ||j | d ��� q8|� ||j | d � q8t|�S )NzgetServiceSettings(%s)� r )r rh r r7 r& r� � get_service�export_config_dict�rangeZIMPORT_EXPORT_STRUCTURE�appendr� r� �getattr�tuple)r, r� r@ �objZ conf_dictZ conf_listr� r1 r1 r2 r� � s "z FirewallD.getServiceSettingsc C s, t |t�}t�d|� | jj�|�}|�� S )NzgetServiceSettings2(%s))r rh r r7 r& r� r� r� )r, r� r@ r� r1 r1 r2 �getServiceSettings2� s z FirewallD.getServiceSettings2c C s t �d� | jj�� S )NzlistIcmpTypes())r r7 r& r� r� r~ r1 r1 r2 � listIcmpTypes s zFirewallD.listIcmpTypesc C s( t |t�}t�d|� | jj�|��� S )NzgetIcmpTypeSettings(%s))r rh r r7 r& r� Z get_icmptyper� )r, r� r@ r1 r1 r2 r� s z FirewallD.getIcmpTypeSettingsc C s t �d� | j�� S )NzgetLogDenied())r r7 r& Zget_log_deniedr~ r1 r1 r2 � getLogDenied s zFirewallD.getLogDeniedc C sX t |t�}t�d| � | �|� | j�|� | �|� | j�� | j �� | � � d S )NzsetLogDenied('%s')) r rh r r7 rA r& Zset_log_denied�LogDeniedChangedr| r r} �r, �valuer@ r1 r1 r2 � setLogDenied' s zFirewallD.setLogDeniedc C s t �d| � d S )NzLogDeniedChanged('%s')r� �r, r� r1 r1 r2 r� 7 s zFirewallD.LogDeniedChangedc C s t �d� dS )NzgetAutomaticHelpers()rU r� r~ r1 r1 r2 �getAutomaticHelpers@ s z FirewallD.getAutomaticHelpersc C s& t |t�}t�d| � | �|� d S )NzsetAutomaticHelpers('%s'))r rh r r7 rA r� r1 r1 r2 �setAutomaticHelpersK s z FirewallD.setAutomaticHelpersc C s t �d| � d S )Nz AutomaticHelpersChanged('%s')r� r� r1 r1 r2 �AutomaticHelpersChangedW s z!FirewallD.AutomaticHelpersChangedc C s t �d� | j�� S )NzgetDefaultZone())r r7 r& Zget_default_zoner~ r1 r1 r2 �getDefaultZone` s zFirewallD.getDefaultZonec C s< t |t�}t�d| � | �|� | j�|� | �|� d S )NzsetDefaultZone('%s'))r rh r r7 rA r& Zset_default_zone�DefaultZoneChangedr� r1 r1 r2 �setDefaultZonei s zFirewallD.setDefaultZonec C s t �d| � d S )NzDefaultZoneChanged('%s')r� �r, rB r1 r1 r2 r� u s z FirewallD.DefaultZoneChangedc C s t �d� | jj�� S )Nzpolicy.getPolicies())r r7 r& r� r� r~ r1 r1 r2 � getPolicies� s zFirewallD.getPoliciesz a{sa{sas}}c C sX t �d� i }| jj�� D ]8}i ||< | jj�|�|| d< | jj�|�|| d< q|S )Nzpolicy.getActivePolicies()Z ingress_zonesZ egress_zones)r r7 r& r� Z)get_active_policies_not_derived_from_zoneZlist_ingress_zonesZlist_egress_zones)r, r@ r= r� r1 r1 r2 �getActivePolicies� s zFirewallD.getActivePoliciesc C s t �d� | jj�� S )Nzzone.getZones())r r7 r& rB r� r~ r1 r1 r2 �getZones� s zFirewallD.getZonesc C s� t �d� i }| jj�� D ]l}| jj�|�}| jj�|�}t|�t|� dkri ||< t|�dkrn||| d< t|�dkr||| d< q|S )Nzzone.getActiveZones()r � interfaces�sources)r r7 r& rB r� �list_interfaces� list_sources�len)r, r@ ZzonesrB r� r� r1 r1 r2 �getActiveZones� s zFirewallD.getActiveZonesc C s2 t |t�}t�d| � | jj�|�}|r.|S dS )z�Return the zone an interface belongs to. :Parameters: `interface` : str Name of the interface :Returns: str. The name of the zone. z zone.getZoneOfInterface('%s')rz )r rh r r7 r& rB Zget_zone_of_interface)r, ry r@ rB r1 r1 r2 �getZoneOfInterface� s z FirewallD.getZoneOfInterfacec C s2 t |t�}t�d| � | jj�|�}|r.|S dS )Nzzone.getZoneOfSource('%s')rz )r rh r r7 r& rB Zget_zone_of_source)r, �sourcer@ rB r1 r1 r2 �getZoneOfSource� s zFirewallD.getZoneOfSourcec C s dS )NFr1 r� r1 r1 r2 � isImmutable� s zFirewallD.isImmutablec C sR t |t�}t |t�}t�d||f � | �|� | jj�|||�}| �||� |S )zPAdd an interface to a zone. If zone is empty, use default zone. z zone.addInterface('%s', '%s')) r rh r r7 rA r& rB Z add_interface�InterfaceAdded�r, rB ry r@ �_zoner1 r1 r2 � addInterface� s zFirewallD.addInterfacec C s" t |t�}t |t�}| �|||�S )z�Change a zone an interface is part of. If zone is empty, use default zone. This function is deprecated, use changeZoneOfInterface instead )r rh �changeZoneOfInterface�r, rB ry r@ r1 r1 r2 � changeZone� s zFirewallD.changeZonec C sR t |t�}t |t�}t�d||f � | �|� | jj�|||�}| �||� |S )z[Change a zone an interface is part of. If zone is empty, use default zone. z&zone.changeZoneOfInterface('%s', '%s')) r rh r r7 rA r& rB Zchange_zone_of_interface�ZoneOfInterfaceChangedr r1 r1 r2 r s z FirewallD.changeZoneOfInterfacec C sP t |t�}t |t�}t�d||f � | �|� | jj�||�}| �||� |S )zkRemove interface from a zone. If zone is empty, remove from zone the interface belongs to. z zone.removeInterface('%s', '%s')) r rh r r7 rA r& rB Zremove_interface�InterfaceRemovedr r1 r1 r2 r� s zFirewallD.removeInterfacec C s6 t |t�}t |t�}t�d||f � | jj�||�S )z^Return true if an interface is in a zone. If zone is empty, use default zone. z zone.queryInterface('%s', '%s'))r rh r r7 r& rB Zquery_interfacer r1 r1 r2 �queryInterface% s zFirewallD.queryInterfacec C s& t |t�}t�d| � | jj�|�S )z]Return the list of interfaces of a zone. If zone is empty, use default zone. zzone.getInterfaces('%s'))r rh r r7 r& rB r� r� r1 r1 r2 r� 2 s zFirewallD.getInterfacesc C s t �d||f � d S )Nz zone.InterfaceAdded('%s', '%s')r� �r, rB ry r1 r1 r2 r @ s zFirewallD.InterfaceAddedc C s t �d||f � dS )z, This signal is deprecated. z zone.ZoneChanged('%s', '%s')Nr� r r1 r1 r2 � ZoneChangedE s zFirewallD.ZoneChangedc C s" t �d||f � | �||� d S )Nz'zone.ZoneOfInterfaceChanged('%s', '%s'))r r7 r r r1 r1 r2 r M s �z FirewallD.ZoneOfInterfaceChangedc C s t �d||f � d S )Nz!zone.InterfaceRemoved('%s', '%s')r� r r1 r1 r2 r T s zFirewallD.InterfaceRemovedc C sR t |t�}t |t�}t�d||f � | �|� | jj�|||�}| �||� |S )zLAdd a source to a zone. If zone is empty, use default zone. zzone.addSource('%s', '%s')) r rh r r7 rA r& rB Z add_source� SourceAdded�r, rB r r@ r r1 r1 r2 � addSource] s zFirewallD.addSourcec C sR t |t�}t |t�}t�d||f � | �|� | jj�|||�}| �||� |S )zXChange a zone an source is part of. If zone is empty, use default zone. z#zone.changeZoneOfSource('%s', '%s')) r rh r r7 rA r& rB Zchange_zone_of_source�ZoneOfSourceChangedr r1 r1 r2 �changeZoneOfSourcen s z FirewallD.changeZoneOfSourcec C sP t |t�}t |t�}t�d||f � | �|� | jj�||�}| �||� |S )zeRemove source from a zone. If zone is empty, remove from zone the source belongs to. z zone.removeSource('%s', '%s')) r rh r r7 rA r& rB Z remove_source� SourceRemovedr r1 r1 r2 � removeSource s zFirewallD.removeSourcec C s6 t |t�}t |t�}t�d||f � | jj�||�S )z[Return true if an source is in a zone. If zone is empty, use default zone. z zone.querySource('%s', '%s'))r rh r r7 r& rB Z query_source)r, rB r r@ r1 r1 r2 � querySource� s zFirewallD.querySourcec C s& t |t�}t�d| � | jj�|�S )zZReturn the list of sources of a zone. If zone is empty, use default zone. zzone.getSources('%s'))r rh r r7 r& rB r� r� r1 r1 r2 � getSources� s zFirewallD.getSourcesc C s t �d||f � d S )Nz zone.SourceAdded('%s', '%s')r� �r, rB r r1 r1 r2 r � s zFirewallD.SourceAddedc C s t �d||f � d S )Nz$zone.ZoneOfSourceChanged('%s', '%s')r� r r1 r1 r2 r � s z FirewallD.ZoneOfSourceChangedc C s t �d||f � d S )Nz zone.SourceRemoved('%s', '%s')r� r r1 r1 r2 r � s zFirewallD.SourceRemovedc C sH t �d||f � | j| |= t|d�}| jj�||� | �||� d S )Nz%zone.disableTimedRichRule('%s', '%s')�Zrule_str)r r7 r8 r r& rB � remove_rule�RichRuleRemoved)r, rB �ruler� r1 r1 r2 �disableTimedRichRule� s z FirewallD.disableTimedRichRuleZssic C s� t |t�}t |t�}t |t�}t�d||f � t|d�}| jj�|||�}|dkrtt � || j ||�}| � |||� | � |||� |S )Nz zone.addRichRule('%s', '%s')r r )r rh r� r r7 r r& rB �add_ruler �timeout_add_secondsr rE � RichRuleAdded)r, rB r �timeoutr@ r� r rD r1 r1 r2 � addRichRule� s �zFirewallD.addRichRulec C s\ t |t�}t |t�}t�d||f � t|d�}| jj�||�}| �||� | � ||� |S )Nz zone.removeRichRule('%s', '%s')r ) r rh r r7 r r& rB r rH r )r, rB r r@ r� r r1 r1 r2 �removeRichRule� s zFirewallD.removeRichRulec C s@ t |t�}t |t�}t�d||f � t|d�}| jj�||�S )Nz zone.queryRichRule('%s', '%s')r )r rh r r7 r r& rB � query_rule)r, rB r r@ r� r1 r1 r2 � queryRichRule� s zFirewallD.queryRichRulec C s& t |t�}t�d| � | jj�|�S )Nzzone.getRichRules('%s'))r rh r r7 r& rB Z list_rulesr� r1 r1 r2 � getRichRules� s zFirewallD.getRichRulesc C s t �d|||f � d S )Nz"zone.RichRuleAdded('%s', '%s', %d)r� )r, rB r r$ r1 r1 r2 r# � s zFirewallD.RichRuleAddedc C s t �d||f � d S )Nz zone.RichRuleRemoved('%s', '%s')r� )r, rB r r1 r1 r2 r s zFirewallD.RichRuleRemovedc C s> t �d||f � | j| |= | jj�||� | �||� d S )Nz$zone.disableTimedService('%s', '%s'))r r7 r8 r& rB �remove_service�ServiceRemoved�r, rB r� r1 r1 r2 �disableTimedService s z FirewallD.disableTimedServicec C s� t |t�}t |t�}t |t�}t�d|||f � | �|� | jj�||||�}|dkrxt � || j ||�}| � |||� | � |||� |S )Nz zone.addService('%s', '%s', %d)r )r rh r� r r7 rA r& rB Z add_servicer r" r- rE � ServiceAdded)r, rB r� r$ r@ r rD r1 r1 r2 r� s �zFirewallD.addServicec C s\ t |t�}t |t�}t�d||f � | �|� | jj�||�}| �||� | � ||� |S )Nz zone.removeService('%s', '%s')) r rh r r7 rA r& rB r* rH r+ )r, rB r� r@ r r1 r1 r2 � removeService* s zFirewallD.removeServicec C s6 t |t�}t |t�}t�d||f � | jj�||�S )Nz zone.queryService('%s', '%s'))r rh r r7 r& rB Z query_service)r, rB r� r@ r1 r1 r2 � queryService; s zFirewallD.queryServicec C s& t |t�}t�d| � | jj�|�S )Nzzone.getServices('%s'))r rh r r7 r& rB Z list_servicesr� r1 r1 r2 � getServicesF s zFirewallD.getServicesc C s t �d|||f � d S )Nz!zone.ServiceAdded('%s', '%s', %d)r� )r, rB r� r$ r1 r1 r2 r. R s �zFirewallD.ServiceAddedc C s t �d||f � d S )Nz zone.ServiceRemoved('%s', '%s')r� r, r1 r1 r2 r+ X s zFirewallD.ServiceRemovedc C sH t �d|||f � | j| ||f= | jj�|||� | �|||� d S )Nz'zone.disableTimedPort('%s', '%s', '%s'))r r7 r8 r& rB � remove_port� PortRemoved�r, rB �port�protocolr1 r1 r2 �disableTimedPorta s �zFirewallD.disableTimedPortZsssic C s� t |t�}t |t�}t |t�}t |t�}t�d|||f � | �|� | jj�|||||�}|dkr�t � || j |||�}| � |||f|� | � ||||� |S )Nz zone.addPort('%s', '%s', '%s')r )r rh r� r r7 rA r& rB Zadd_portr r" r7 rE � PortAdded�r, rB r5 r6 r$ r@ r rD r1 r1 r2 �addPorti s � �zFirewallD.addPortZsssc C sp t |t�}t |t�}t |t�}t�d|||f � | �|� | jj�|||�}| �|||f� | � |||� |S )Nz!zone.removePort('%s', '%s', '%s')) r rh r r7 rA r& rB r2 rH r3 �r, rB r5 r6 r@ r r1 r1 r2 � removePort� s � zFirewallD.removePortc C sD t |t�}t |t�}t |t�}t�d|||f � | jj�|||�S )Nz zone.queryPort('%s', '%s', '%s'))r rh r r7 r& rB Z query_port�r, rB r5 r6 r@ r1 r1 r2 � queryPort� s zFirewallD.queryPortZaasc C s& t |t�}t�d| � | jj�|�S )Nzzone.getPorts('%s'))r rh r r7 r& rB Z list_portsr� r1 r1 r2 �getPorts� s zFirewallD.getPortsr c C s t �d||||f � d S )Nz$zone.PortAdded('%s', '%s', '%s', %d)r� �r, rB r5 r6 r$ r1 r1 r2 r8 � s �zFirewallD.PortAddedc C s t �d|||f � d S )Nz"zone.PortRemoved('%s', '%s', '%s')r� r4 r1 r1 r2 r3 � s �zFirewallD.PortRemovedc C s> t �d||f � | j| |= | jj�||� | �||� d S )Nz%zone.disableTimedProtocol('%s', '%s'))r r7 r8 r& rB �remove_protocol�ProtocolRemoved�r, rB r6 r1 r1 r2 �disableTimedProtocol� s z FirewallD.disableTimedProtocolc C s� t |t�}t |t�}t |t�}t�d||f � | �|� | jj�||||�}|dkrvt � || j ||�}| � |||� | � |||� |S )Nz zone.enableProtocol('%s', '%s')r )r rh r� r r7 rA r& rB Z add_protocolr r" rD rE � ProtocolAdded)r, rB r6 r$ r@ r rD r1 r1 r2 � addProtocol� s �zFirewallD.addProtocolc C s\ t |t�}t |t�}t�d||f � | �|� | jj�||�}| �||� | � ||� |S )Nz zone.removeProtocol('%s', '%s')) r rh r r7 rA r& rB rA rH rB )r, rB r6 r@ r r1 r1 r2 �removeProtocol� s zFirewallD.removeProtocolc C s6 t |t�}t |t�}t�d||f � | jj�||�S )Nz zone.queryProtocol('%s', '%s'))r rh r r7 r& rB Zquery_protocol)r, rB r6 r@ r1 r1 r2 � queryProtocol� s zFirewallD.queryProtocolc C s& t |t�}t�d| � | jj�|�S )Nzzone.getProtocols('%s'))r rh r r7 r& rB Zlist_protocolsr� r1 r1 r2 � getProtocols� s zFirewallD.getProtocolsc C s t �d|||f � d S )Nz"zone.ProtocolAdded('%s', '%s', %d)r� )r, rB r6 r$ r1 r1 r2 rE � s �zFirewallD.ProtocolAddedc C s t �d||f � d S )Nz zone.ProtocolRemoved('%s', '%s')r� rC r1 r1 r2 rB s zFirewallD.ProtocolRemovedc C sJ t �d|||f � | j| d||f= | jj�|||� | �|||� d S )Nz-zone.disableTimedSourcePort('%s', '%s', '%s')�sport)r r7 r8 r& rB �remove_source_port�SourcePortRemovedr4 r1 r1 r2 �disableTimedSourcePort s �z FirewallD.disableTimedSourcePortc C s� t |t�}t |t�}t |t�}t |t�}t�d|||f � | �|� | jj�|||||�}|dkr�t � || j |||�}| � |d||f|� | � ||||� |S )Nz$zone.addSourcePort('%s', '%s', '%s')r rJ )r rh r� r r7 rA r& rB Zadd_source_portr r" rM rE �SourcePortAddedr9 r1 r1 r2 � addSourcePort s$ � � �zFirewallD.addSourcePortc C sr t |t�}t |t�}t |t�}t�d|||f � | �|� | jj�|||�}| �|d||f� | � |||� |S )Nz'zone.removeSourcePort('%s', '%s', '%s')rJ ) r rh r r7 rA r& rB rK rH rL r; r1 r1 r2 �removeSourcePort, s � zFirewallD.removeSourcePortc C sD t |t�}t |t�}t |t�}t�d|||f � | jj�|||�S )Nz&zone.querySourcePort('%s', '%s', '%s'))r rh r r7 r& rB Zquery_source_portr= r1 r1 r2 �querySourcePort> s �zFirewallD.querySourcePortc C s& t |t�}t�d| � | jj�|�S )Nzzone.getSourcePorts('%s'))r rh r r7 r& rB Zlist_source_portsr� r1 r1 r2 �getSourcePortsK s zFirewallD.getSourcePortsc C s t �d||||f � d S )Nz*zone.SourcePortAdded('%s', '%s', '%s', %d)r� r@ r1 r1 r2 rN W s �zFirewallD.SourcePortAddedc C s t �d|||f � d S )Nz(zone.SourcePortRemoved('%s', '%s', '%s')r� r4 r1 r1 r2 rL ] s �zFirewallD.SourcePortRemovedc C s( | j | d= | jj�|� | �|� d S )N� masquerade)r8 r& rB �remove_masquerade�MasqueradeRemovedr� r1 r1 r2 �disableTimedMasqueradeg s z FirewallD.disableTimedMasquerade�sic C st t |t�}t |t�}t�d| � | �|� | jj�|||�}|dkrdt � || j |�}| � |d|� | � ||� |S )Nzzone.addMasquerade('%s')r rS )r rh r� r r7 rA r& rB Zadd_masquerader r" rV rE �MasqueradeAdded)r, rB r$ r@ r rD r1 r1 r2 � addMasqueradem s � zFirewallD.addMasqueradec C sJ t |t�}t�d| � | �|� | jj�|�}| �|d� | � |� |S )Nzzone.removeMasquerade('%s')rS ) r rh r r7 rA r& rB rT rH rU �r, rB r@ r r1 r1 r2 �removeMasquerade� s zFirewallD.removeMasqueradec C s& t |t�}t�d| � | jj�|�S )Nzzone.queryMasquerade('%s'))r rh r r7 r& rB Zquery_masquerader� r1 r1 r2 �queryMasquerade� s zFirewallD.queryMasqueradec C s t �d||f � d S )Nz zone.MasqueradeAdded('%s', %d)r� )r, rB r$ r1 r1 r2 rX � s zFirewallD.MasqueradeAddedc C s t �d| � d S )Nz zone.MasqueradeRemoved('%s')r� r� r1 r1 r2 rU � s zFirewallD.MasqueradeRemovedc C s@ | j | ||||f= | jj�|||||� | �|||||� d S r3 )r8 r& rB �remove_forward_port�ForwardPortRemoved�r, rB r5 r6 �toport�toaddrr1 r1 r2 �disable_forward_port� s z FirewallD.disable_forward_portZsssssic C s� t |t�}t |t�}t |t�}t |t�}t |t�}t |t�}t�d|||||f � | �|� | jj�|||||||�}|dkr�t � || j |||||�} | � |||||f| � | � ||||||� |S )Nz1zone.addForwardPort('%s', '%s', '%s', '%s', '%s')r )r rh r� r r7 rA r& rB Zadd_forward_portr r" rb rE �ForwardPortAdded) r, rB r5 r6 r` ra r$ r@ r rD r1 r1 r2 �addForwardPort� s, � ��zFirewallD.addForwardPortZsssssc C s� t |t�}t |t�}t |t�}t |t�}t |t�}t�d|||||f � | �|� | jj�|||||�}| �|||||f� | � |||||� |S )Nz4zone.removeForwardPort('%s', '%s', '%s', '%s', '%s')) r rh r r7 rA r& rB r] rH r^ )r, rB r5 r6 r` ra r@ r r1 r1 r2 �removeForwardPort� s � �zFirewallD.removeForwardPortc C s` t |t�}t |t�}t |t�}t |t�}t |t�}t�d|||||f � | jj�|||||�S )Nz3zone.queryForwardPort('%s', '%s', '%s', '%s', '%s'))r rh r r7 r& rB Zquery_forward_port)r, rB r5 r6 r` ra r@ r1 r1 r2 �queryForwardPort� s ��zFirewallD.queryForwardPortc C s& t |t�}t�d| � | jj�|�S )Nzzone.getForwardPorts('%s'))r rh r r7 r& rB Zlist_forward_portsr� r1 r1 r2 �getForwardPorts� s zFirewallD.getForwardPortsc C s t �d||||||f � d S )Nz7zone.ForwardPortAdded('%s', '%s', '%s', '%s', '%s', %d)r� )r, rB r5 r6 r` ra r$ r1 r1 r2 rc � s �zFirewallD.ForwardPortAddedc C s t �d|||||f � d S )Nz5zone.ForwardPortRemoved('%s', '%s', '%s', '%s', '%s')r� r_ r1 r1 r2 r^ s �z FirewallD.ForwardPortRemovedc C s> t �d||f � | j| |= | jj�||� | �||� d S )Nz&zone.disableTimedIcmpBlock('%s', '%s'))r r7 r8 r& rB �remove_icmp_block�IcmpBlockRemoved�r, rB �icmpr@ r1 r1 r2 �disableTimedIcmpBlock s z FirewallD.disableTimedIcmpBlockc C s� t |t�}t |t�}t |t�}t�d||f � | �|� | jj�||||�}|dkrxt � || j |||�}| � |||� | � |||� |S )Nz zone.enableIcmpBlock('%s', '%s')r )r rh r� r r7 rA r& rB Zadd_icmp_blockr r" rl rE �IcmpBlockAdded)r, rB rk r$ r@ r rD r1 r1 r2 � addIcmpBlock s �zFirewallD.addIcmpBlockc C s\ t |t�}t |t�}t�d||f � | �|� | jj�||�}| �||� | � ||� |S )Nz zone.removeIcmpBlock('%s', '%s')) r rh r r7 rA r& rB rh rH ri )r, rB rk r@ r r1 r1 r2 �removeIcmpBlock+ s zFirewallD.removeIcmpBlockc C s6 t |t�}t |t�}t�d||f � | jj�||�S )Nz zone.queryIcmpBlock('%s', '%s'))r rh r r7 r& rB Zquery_icmp_blockrj r1 r1 r2 �queryIcmpBlock; s zFirewallD.queryIcmpBlockc C s& t |t�}t�d| � | jj�|�S )Nzzone.getIcmpBlocks('%s'))r rh r r7 r& rB Zlist_icmp_blocksr� r1 r1 r2 � getIcmpBlocksF s zFirewallD.getIcmpBlocksc C s t �d|||f � d S )Nz#zone.IcmpBlockAdded('%s', '%s', %d)r� )r, rB rk r$ r1 r1 r2 rm R s �zFirewallD.IcmpBlockAddedc C s t �d||f � d S )Nz!zone.IcmpBlockRemoved('%s', '%s')r� )r, rB rk r1 r1 r2 ri X s zFirewallD.IcmpBlockRemovedc C s@ t |t�}t�d| � | �|� | jj�||�}| �|� |S )Nz zone.addIcmpBlockInversion('%s')) r rh r r7 rA r& rB Zadd_icmp_block_inversion�IcmpBlockInversionAddedrZ r1 r1 r2 �addIcmpBlockInversiona s z FirewallD.addIcmpBlockInversionc C s> t |t�}t�d| � | �|� | jj�|�}| �|� |S )Nz#zone.removeIcmpBlockInversion('%s')) r rh r r7 rA r& rB Zremove_icmp_block_inversion�IcmpBlockInversionRemovedrZ r1 r1 r2 �removeIcmpBlockInversiono s z"FirewallD.removeIcmpBlockInversionc C s& t |t�}t�d| � | jj�|�S )Nz"zone.queryIcmpBlockInversion('%s'))r rh r r7 r& rB Zquery_icmp_block_inversionr� r1 r1 r2 �queryIcmpBlockInversion} s z!FirewallD.queryIcmpBlockInversionc C s t �d| � d S )Nz"zone.IcmpBlockInversionAdded('%s')r� r� r1 r1 r2 rr � s z!FirewallD.IcmpBlockInversionAddedc C s t �d| � d S )Nz$zone.IcmpBlockInversionRemoved('%s')r� r� r1 r1 r2 rt � s z#FirewallD.IcmpBlockInversionRemovedc C s` t |t�}t |t�}t |t�}t�d|||f � | �|� | jj�|||� | �|||� d S )Nz!direct.addChain('%s', '%s', '%s')) r rh r r7 rA r& r� Z add_chain� ChainAdded�r, �ipv�table�chainr@ r1 r1 r2 �addChain� s zFirewallD.addChainc C s` t |t�}t |t�}t |t�}t�d|||f � | �|� | jj�|||� | �|||� d S )Nz$direct.removeChain('%s', '%s', '%s')) r rh r r7 rA r& r� Z remove_chain� ChainRemovedrx r1 r1 r2 � removeChain� s zFirewallD.removeChainc C sD t |t�}t |t�}t |t�}t�d|||f � | jj�|||�S )Nz#direct.queryChain('%s', '%s', '%s'))r rh r r7 r& r� Z query_chainrx r1 r1 r2 � queryChain� s zFirewallD.queryChainc C s6 t |t�}t |t�}t�d||f � | jj�||�S )Nz direct.getChains('%s', '%s'))r rh r r7 r& r� Z get_chains)r, ry rz r@ r1 r1 r2 � getChains� s zFirewallD.getChainsza(sss)c C s t �d� | jj�� S )Nzdirect.getAllChains())r r7 r& r� r� r~ r1 r1 r2 � getAllChains� s zFirewallD.getAllChainsc C s t �d|||f � d S )Nz#direct.ChainAdded('%s', '%s', '%s')r� �r, ry rz r{ r1 r1 r2 rw � s zFirewallD.ChainAddedc C s t �d|||f � d S )Nz%direct.ChainRemoved('%s', '%s', '%s')r� r� r1 r1 r2 r} � s �zFirewallD.ChainRemovedZsssiasc C s� t |t�}t |t�}t |t�}t |t�}tdd� |D ��}t�d||||d�|�f � | �|� | jj � |||||� | � |||||� d S )Nc s s | ]}t |t�V qd S r3 �r rh ��.0r� r1 r1 r2 � <genexpr>� � z$FirewallD.addRule.<locals>.<genexpr>z*direct.addRule('%s', '%s', '%s', %d, '%s')�',') r rh r� r� r r7 �joinrA r& r� r! � RuleAdded�r, ry rz r{ �priorityr- r@ r1 r1 r2 �addRule� s � zFirewallD.addRulec C s� t |t�}t |t�}t |t�}t |t�}tdd� |D ��}t�d||||d�|�f � | �|� | jj � |||||� | � |||||� d S )Nc s s | ]}t |t�V qd S r3 r� r� r1 r1 r2 r� r� z'FirewallD.removeRule.<locals>.<genexpr>z-direct.removeRule('%s', '%s', '%s', %d, '%s')r� ) r rh r� r� r r7 r� rA r& r� r � RuleRemovedr� r1 r1 r2 � removeRule� s � zFirewallD.removeRulec C s� t |t�}t |t�}t |t�}t�d|||f � | �|� | jj�|||�D ]0\}}| jj�|||||� | � |||||� qNd S )Nz$direct.removeRules('%s', '%s', '%s')) r rh r r7 rA r& r� � get_rulesr r� )r, ry rz r{ r@ r� r- r1 r1 r2 � removeRules s zFirewallD.removeRulesc C sn t |t�}t |t�}t |t�}t |t�}tdd� |D ��}t�d||||d�|�f � | jj� |||||�S )Nc s s | ]}t |t�V qd S r3 r� r� r1 r1 r2 r� ( r� z&FirewallD.queryRule.<locals>.<genexpr>z,direct.queryRule('%s', '%s', '%s', %d, '%s')r� ) r rh r� r� r r7 r� r& r� r' r� r1 r1 r2 � queryRule s �zFirewallD.queryRuleza(ias)c C sD t |t�}t |t�}t |t�}t�d|||f � | jj�|||�S )Nz!direct.getRules('%s', '%s', '%s'))r rh r r7 r& r� r� rx r1 r1 r2 �getRules- s zFirewallD.getRulesz a(sssias)c C s t �d� | jj�� S )Nzdirect.getAllRules())r r7 r& r� r� r~ r1 r1 r2 � getAllRules: s zFirewallD.getAllRulesc C s" t �d||||d�|�f � d S )Nz,direct.RuleAdded('%s', '%s', '%s', %d, '%s')r� �r r7 r� �r, ry rz r{ r� r- r1 r1 r2 r� D s �zFirewallD.RuleAddedc C s" t �d||||d�|�f � d S )Nz.direct.RuleRemoved('%s', '%s', '%s', %d, '%s')r� r� r� r1 r1 r2 r� K s �zFirewallD.RuleRemovedr[ c C s� t |t�}tdd� |D ��}t�d|d�|�f � | �|� z| jj� ||�W S t y� } zj|dv rvt g d��}n t ddg�}t|�}|j t jkr�tt |�|@ �d kr�t�|� t|��� W Y d }~n d }~0 0 d S ) Nc s s | ]}t |t�V qd S r3 r� r� r1 r1 r2 r� ^ r� z(FirewallD.passthrough.<locals>.<genexpr>z direct.passthrough('%s', '%s')r� )rO rS )z-Cz--check�-L�--listr� r� r )r rh r� r r7 r� rA r& r� � passthroughr" �set�coder! ZCOMMAND_FAILEDr r� r )r, ry r- r@ r? Z query_args�msgr1 r1 r2 r� V s zFirewallD.passthroughc C s\ t |�}tdd� |D ��}t�d|d�|�f � | �|� | jj�||� | � ||� d S )Nc s s | ]}t |�V qd S r3 �r r� r1 r1 r2 r� z r� z+FirewallD.addPassthrough.<locals>.<genexpr>z!direct.addPassthrough('%s', '%s')r� ) r r� r r7 r� rA r& r� Zadd_passthrough�PassthroughAdded�r, ry r- r@ r1 r1 r2 �addPassthroughr s � zFirewallD.addPassthroughc C s\ t |�}tdd� |D ��}t�d|d�|�f � | �|� | jj�||� | � ||� d S )Nc s s | ]}t |�V qd S r3 r� r� r1 r1 r2 r� � r� z.FirewallD.removePassthrough.<locals>.<genexpr>z$direct.removePassthrough('%s', '%s')r� ) r r� r r7 r� rA r& r� Zremove_passthrough�PassthroughRemovedr� r1 r1 r2 �removePassthrough� s � zFirewallD.removePassthroughc C sB t |�}tdd� |D ��}t�d|d�|�f � | jj�||�S )Nc s s | ]}t |�V qd S r3 r� r� r1 r1 r2 r� � r� z-FirewallD.queryPassthrough.<locals>.<genexpr>z#direct.queryPassthrough('%s', '%s')r� )r r� r r7 r� r& r� Zquery_passthroughr� r1 r1 r2 �queryPassthrough� s �zFirewallD.queryPassthroughza(sas)c C s t �d� | jj�� S )Nzdirect.getAllPassthroughs())r r7 r& r� r� r~ r1 r1 r2 �getAllPassthroughs� s z FirewallD.getAllPassthroughsc C s* t �d� t| �� �D ]}| j|� qd S )Nz direct.removeAllPassthroughs())r r7 �reversedr� r� )r, r@ r� r1 r1 r2 �removeAllPassthroughs� s z FirewallD.removeAllPassthroughsc C s" t |�}t�d|� | jj�|�S )Nz direct.getPassthroughs('%s'))r r r7 r& r� Zget_passthroughs)r, ry r@ r1 r1 r2 �getPassthroughs� s zFirewallD.getPassthroughsc C s t �d|d�|�f � d S )Nz#direct.PassthroughAdded('%s', '%s')r� r� �r, ry r- r1 r1 r2 r� � s �zFirewallD.PassthroughAddedc C s t �d|d�|�f � d S )Nz%direct.PassthroughRemoved('%s', '%s')r� r� r� r1 r1 r2 r� � s �z FirewallD.PassthroughRemovedc C s dS )z� PK_ACTION_ALL implies all other actions, i.e. once a subject is authorized for PK_ACTION_ALL it's also authorized for any other action. Use-case is GUI (RHBZ#994729). Nr1 r~ r1 r1 r2 � authorizeAll� s zFirewallD.authorizeAllc C s$ t |�}t�d| � | jj�|�S )Nzipset.queryIPSet('%s'))r r r7 r& r� Z query_ipset�r, r� r@ r1 r1 r2 � queryIPSet� s zFirewallD.queryIPSetc C s t �d� | jj�� S )Nzipsets.getIPSets())r r7 r& r� r� r~ r1 r1 r2 � getIPSets� s zFirewallD.getIPSetsc C s( t |t�}t�d|� | jj�|��� S )NzgetIPSetSettings(%s))r rh r r7 r& r� Z get_ipsetr� r� r1 r1 r2 r� � s zFirewallD.getIPSetSettingsc C sL t |�}t |�}t�d||f � | �|� | jj�||� | �||� d S )Nzipset.addEntry('%s', '%s'))r r r7 rA r& r� Z add_entry� EntryAdded�r, r� �entryr@ r1 r1 r2 �addEntry� s zFirewallD.addEntryc C sL t |�}t |�}t�d||f � | �|� | jj�||� | �||� d S )Nz ipset.removeEntry('%s', '%s'))r r r7 rA r& r� Z remove_entry� EntryRemovedr� r1 r1 r2 � removeEntry s zFirewallD.removeEntryc C s2 t |�}t |�}t�d||f � | jj�||�S )Nz ipset.queryEntry('%s', '%s'))r r r7 r& r� Z query_entryr� r1 r1 r2 � queryEntry s zFirewallD.queryEntryc C s$ t |�}t�d| � | jj�|�S )Nzipset.getEntries('%s'))r r r7 r& r� � get_entriesr� r1 r1 r2 � getEntries! s zFirewallD.getEntriesc C s� t |�}t |t�}t�d|d�|�� | jj�|�}| jj�||� t |�}t |�}|| D ]}| � ||� q\|| D ]}| � ||� qvd S )Nz ipset.setEntries('%s', '[%s]')�,) r �listr r7 r� r& r� r� Z set_entriesr� r� r� )r, r� �entriesr@ Z old_entriesZold_entries_setZ entries_setr� r1 r1 r2 � setEntries+ s zFirewallD.setEntriesc C s& t |�}t |�}t�d||f � d S )Nz ipset.EntryAdded('%s', '%s')�r r r7 �r, r� r� r1 r1 r2 r� < s zFirewallD.EntryAddedc C s& t |�}t |�}t�d||f � d S )Nz ipset.EntryRemoved('%s', '%s')r� r� r1 r1 r2 r� C s zFirewallD.EntryRemovedc C s t �d� | jj�� S )Nzhelpers.getHelpers())r r7 r& r� r� r~ r1 r1 r2 � getHelpersN s zFirewallD.getHelpersc C s( t |t�}t�d|� | jj�|��� S )NzgetHelperSettings(%s))r rh r r7 r& r� Z get_helperr� )r, r� r@ r1 r1 r2 r� W s zFirewallD.getHelperSettings)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)r )N)N)N)N)r )N)N)N)N)r )N)N)N)r )N)N)N)N)r )N)N)N)N)r )N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)��__name__� __module__� __qualname__�__doc__Z persistentr r* ZPK_ACTION_CONFIGZ default_polkit_auth_requiredr r% r6 r) r4 r rA rE rH rJ rb r ZPROPERTIES_IFACEro rt r ru r� �signalrv ZPK_ACTION_INFOZINTROSPECTABLE_IFACErw r+ r| r r} r� r� r� ZPK_ACTION_POLICIESrk r� r� ZPK_ACTION_POLICIES_INFOr� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� ZPK_ACTION_CONFIG_INFOr� ri r� r� r� ZDBUS_INTERFACE_POLICYr� r� r� r� r� r� r� r ZDBUS_SIGNATUREr� r� r� r� r� r� r� r� r� r� r� r� r� r r r r r r r r� r r� r r r r r r r r r r r r r r% r& r( r) r# r r- r� r/ r0 r1 r. r+ r7 r: r< r> r? r8 r3 rD rF rG rH rI rE rB rM rO rP rQ rR rN rL rV rY r[ r\ rX rU rb rd re rf rg rc r^ rl rn ro rp rq rm ri rs ru rv rr rt ZPK_ACTION_DIRECTr rj r| r~ ZPK_ACTION_DIRECT_INFOr r� r� r rw r} r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� Z PK_ACTION_ALLr� rl r� r� r r� r� r� r� r� r� r� r� r� r r� � __classcell__r1 r1 r/ r2 r ? s� /�� " � � � � � O � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � �� �� �� �� � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � �)6�__all__Z gi.repositoryr r� r* Z dbus.serviceZfirewallr Zfirewall.core.fwr Zfirewall.core.richr Zfirewall.core.loggerr Zfirewall.clientr Zfirewall.server.dbusr r Zfirewall.server.decoratorsr r r r r r Zfirewall.server.configr Zfirewall.dbus_utilsr r r r r r r r Zfirewall.core.io.functionsr Zfirewall.core.io.ipsetr Zfirewall.core.io.icmptyper Zfirewall.core.io.helperr Zfirewall.core.fw_nmr r Zfirewall.core.fw_ifcfgr r! Zfirewall.errorsr" r r1 r1 r1 r2 �<module> s, ( server/__pycache__/config_ipset.cpython-39.opt-1.pyc 0000644 00000031152 15025011705 0016321 0 ustar 00 a ���gI � @ s� d dl Z d dlZ d dlmZ d dlmZmZmZ d dlm Z d dl m Z m Z m Z mZ d dlmZ d dlmZ d dlmZmZmZmZ d d lmZ d d lmZ G d d � d e�ZdS ) � N)�config)�dbus_to_python�%dbus_introspection_prepare_properties�!dbus_introspection_add_properties)�IPSet)� IPSET_TYPES�normalize_ipset_entry� check_entry_overlaps_existing� check_for_overlapping_entries)�log)�DbusServiceObject)�handle_exceptions�dbus_handle_exceptions�dbus_service_method�dbus_polkit_require_auth)�errors)� FirewallErrorc s e Zd ZdZdZejjZe � fdd��Z e dd� �Z e dd� �Z e d d � �Zeejd d d �e dWdd���Zeejddd �e dXdd���Zeejj�eejdd�e dYdd����Zejjejdd�dd � �Zeejj�eejdd �e dZ� fd d � ���Zeejje j d �e d[d d!���Z eejje j d�e d\d"d#���Z eejj�e d]d$d%���Z ejjejjdd�e d&d'� ��Z!eejj�e d^d(d)���Z"ejjejjdd�e d*d+� ��Z#eejjdd�e d_d,d-���Z$ejjejjdd�e d.d/� ��Z%eejjdd �e d`d0d1���Z&eejjdd�e dad2d3���Z'eejjdd �e dbd4d5���Z(eejjdd�e dcd6d7���Z)eejjdd �e ddd8d9���Z*eejjdd�e ded:d;���Z+eejjdd �e dfd<d=���Z,eejjdd�e dgd>d?���Z-eejjd@d �e dhdAdB���Z.eejjd@d�e didCdD���Z/eejjd d�e djdEdF���Z0eejjdd�e dkdGdH���Z1eejjd dId �e dldJdK���Z2eejjdLd �e dmdMdN���Z3eejjdLd�e dndOdP���Z4eejjdd�e dodQdR���Z5eejjdd�e dpdSdT���Z6eejjddId �e dqdUdV���Z7� Z8S )r�FirewallDConfigIPSetzFirewallD main classTc s` t t| �j|i |�� || _|| _|| _|| _|d | _|d | _d| j | _ t | tj j � d S )Nr � zconfig.ipset.%d) �superr �__init__�parentr �obj�item_id�busname�path� _log_prefixr �dbus�DBUS_INTERFACE_CONFIG_IPSET)�selfr ZconfZipsetr �args�kwargs�� __class__� �@/usr/lib/python3.9/site-packages/firewall/server/config_ipset.pyr 6 s �z FirewallDConfigIPSet.__init__c C s d S �Nr$ �r r$ r$ r% �__del__C s z FirewallDConfigIPSet.__del__c C s | � � d S r& )Zremove_from_connectionr' r$ r$ r% � unregisterG s z FirewallDConfigIPSet.unregisterc C s� |dkrt �| jj�S |dkr,t �| jj�S |dkrBt �| jj�S |dkrXt �| jj�S |dkrnt �| jj�S t j � d| ��d S )N�name�filenamer �default�builtinzDorg.freedesktop.DBus.Error.InvalidArgs: Property '%s' does not exist) r �Stringr r* r+ r ZBooleanr, r- � exceptions� DBusException)r � property_namer$ r$ r% � _get_propertyO s ��z"FirewallDConfigIPSet._get_property�ss�v)� in_signature� out_signatureNc C sL t |t�}t |t�}t�d| j||� |tjjkrBtj� d| ��| � |�S )Nz%s.Get('%s', '%s')�Jorg.freedesktop.DBus.Error.UnknownInterface: Interface '%s' does not exist) r �strr �debug1r r r r r/ r0 r2 )r �interface_namer1 �senderr$ r$ r% �Get` s � ��zFirewallDConfigIPSet.Get�sza{sv}c C s` t |t�}t�d| j|� |tjjkr6tj� d| ��i }dD ]}| � |�||< q>tj |dd�S )Nz%s.GetAll('%s')r7 )r* r+ r r, r- �sv�Z signature) r r8 r r9 r r r r r/ r0 r2 Z Dictionary)r r: r; �ret�xr$ r$ r% �GetAllq s ��zFirewallDConfigIPSet.GetAllZssv)r5 c C sl t |t�}t |t�}t |�}t�d| j|||� | j�|� |tjj krXtj � d| ��tj � d| ��d S )Nz%s.Set('%s', '%s', '%s')r7 zGorg.freedesktop.DBus.Error.PropertyReadOnly: Property '%s' is read-only) r r8 r r9 r r � accessCheckr r r r/ r0 )r r: r1 Z new_valuer; r$ r$ r% �Set� s$ � ����zFirewallDConfigIPSet.Setzsa{sv}asr? c C s2 t |t�}t |�}t |�}t�d| j|||� d S )Nz&%s.PropertiesChanged('%s', '%s', '%s'))r r8 r r9 r )r r: Zchanged_propertiesZinvalidated_propertiesr$ r$ r% �PropertiesChanged� s �z&FirewallDConfigIPSet.PropertiesChanged)r6 c s8 t �d| j� tt| ��| j| j�� �}t | |t j j �S )Nz%s.Introspect()) r Zdebug2r r r � Introspectr r Zget_busr r r r )r r; �datar" r$ r% rF � s � �z FirewallDConfigIPSet.Introspectc C s t �d| j� | j�| j�S )z get settings for ipset z%s.getSettings())r r9 r r Zget_ipset_configr �r r; r$ r$ r% � getSettings� s z FirewallDConfigIPSet.getSettingsc C sF t |�}t�d| j� | j�|� | j�| j|�| _| � | jj � dS )z"update settings for ipset z%s.update('...')N) r r r9 r r rC r Zset_ipset_configr �Updatedr* )r �settingsr; r$ r$ r% �update� s zFirewallDConfigIPSet.updatec C s< t �d| j� | j�|� | j�| j�| _| �| jj � dS )z0load default settings for builtin ipset z%s.loadDefaults()N) r r9 r r rC r Zload_ipset_defaultsr rJ r* rH r$ r$ r% � loadDefaults� s z!FirewallDConfigIPSet.loadDefaultsc C s t �d| j|f � d S )Nz%s.Updated('%s')�r r9 r �r r* r$ r$ r% rJ � s z FirewallDConfigIPSet.Updatedc C s: t �d| j� | j�|� | j�| j� | j�| j� dS )zremove ipset z %s.remove()N) r r9 r r rC r Z remove_ipsetr Z removeIPSetrH r$ r$ r% �remove� s zFirewallDConfigIPSet.removec C s t �d| j|f � d S )Nz%s.Removed('%s')rN rO r$ r$ r% �Removed� s z FirewallDConfigIPSet.Removedc C sF t |t�}t�d| j|� | j�|� | j�| j |�| _ | � |� dS )zrename ipset z%s.rename('%s')N) r r8 r r9 r r rC r Z rename_ipsetr �Renamed)r r* r; r$ r$ r% �rename� s zFirewallDConfigIPSet.renamec C s t �d| j|f � d S )Nz%s.Renamed('%s')rN rO r$ r$ r% rR � s z FirewallDConfigIPSet.Renamedc C s t �d| j� | �� d S )Nz%s.getVersion()r �r r9 r rI rH r$ r$ r% � getVersion� s z FirewallDConfigIPSet.getVersionc C sH t |t�}t�d| j|� | j�|� t| �� �}||d< | � |� d S )Nz%s.setVersion('%s')r � r r8 r r9 r r rC �listrI rL )r �versionr; rK r$ r$ r% � setVersion s z FirewallDConfigIPSet.setVersionc C s t �d| j� | �� d S )Nz %s.getShort()r rT rH r$ r$ r% �getShort s z FirewallDConfigIPSet.getShortc C sH t |t�}t�d| j|� | j�|� t| �� �}||d< | � |� d S )Nz%s.setShort('%s')r rV )r Zshortr; rK r$ r$ r% �setShort s z FirewallDConfigIPSet.setShortc C s t �d| j� | �� d S )Nz%s.getDescription()� rT rH r$ r$ r% �getDescription# s z#FirewallDConfigIPSet.getDescriptionc C sH t |t�}t�d| j|� | j�|� t| �� �}||d< | � |� d S )Nz%s.setDescription('%s')r\ rV )r � descriptionr; rK r$ r$ r% �setDescription* s � z#FirewallDConfigIPSet.setDescriptionc C s t �d| j� | �� d S )Nz %s.getType()� rT rH r$ r$ r% �getType8 s z FirewallDConfigIPSet.getTypec C s\ t |t�}t�d| j|� | j�|� |tvr:tt j |��t | � � �}||d< | � |� d S )Nz%s.setType('%s')r` )r r8 r r9 r r rC r r r Z INVALID_TYPErW rI rL )r Z ipset_typer; rK r$ r$ r% �setType? s z FirewallDConfigIPSet.setTypeza{ss}c C s t �d| j� | �� d S )Nz%s.getOptions()� rT rH r$ r$ r% � getOptionsN s z FirewallDConfigIPSet.getOptionsc C sL t |t�}t�d| jt|�� | j�|� t| � � �}||d< | � |� d S )Nz%s.setOptions('[%s]')rc ) r �dictr r9 r �reprr rC rW rI rL )r �optionsr; rK r$ r$ r% � setOptionsU s � z FirewallDConfigIPSet.setOptionsc C s� t |t�}t |t�}t�d| j||� | j�|� t| �� �}||d v rn|d | |krnt t j d||f ��||d |< | � |� d S )Nz%s.addOption('%s', '%s')rc z '%s': '%s') r r8 r r9 r r rC rW rI r r �ALREADY_ENABLEDrL �r �key�valuer; rK r$ r$ r% � addOptiona s � z FirewallDConfigIPSet.addOptionc C sb t |t�}t�d| j|� | j�|� t| �� �}||d vrJt t j |��|d |= | � |� d S )Nz%s.removeOption('%s')rc ) r r8 r r9 r r rC rW rI r r � NOT_ENABLEDrL )r rk r; rK r$ r$ r% � removeOptionp s z!FirewallDConfigIPSet.removeOption�bc C sN t |t�}t |t�}t�d| j||� t| �� �}||d v oL|d | |kS )Nz%s.queryOption('%s', '%s')rc )r r8 r r9 r rW rI rj r$ r$ r% � queryOption} s � z FirewallDConfigIPSet.queryOption�asc C s t �d| j� | �� d S )Nz%s.getEntries()� rT rH r$ r$ r% � getEntries� s z FirewallDConfigIPSet.getEntriesc C s| t |t�}t|� t�d| jd�|�� | j�|� t| � � �}d|d v rf|d d dkrft t j ��||d< | � |� d S )Nz%s.setEntries('[%s]')�,�timeoutrc �0rs )r rW r r r9 r �joinr rC rI r r �IPSET_WITH_TIMEOUTrL )r �entriesr; rK r$ r$ r% � setEntries� s � z FirewallDConfigIPSet.setEntriesc C s� t |t�}t|�}t�d| j|� | j�|� t| � � �}d|d v r`|d d dkr`t t j ��||d v rxt t j |��t||d � |d �|� | �|� d S )Nz%s.addEntry('%s')rv rc rw rs )r r8 r r r9 r r rC rW rI r r ry ri r �appendrL �r �entryr; rK r$ r$ r% �addEntry� s z FirewallDConfigIPSet.addEntryc C s� t |t�}t|�}t�d| j|� | j�|� t| � � �}d|d v r`|d d dkr`t t j ��||d vrxt t j |��|d �|� | �|� d S )Nz%s.removeEntry('%s')rv rc rw rs )r r8 r r r9 r r rC rW rI r r ry rn rP rL r} r$ r$ r% � removeEntry� s z FirewallDConfigIPSet.removeEntryc C s` t |t�}t|�}t�d| j|� t| �� �}d|d v rT|d d dkrTtt j ��||d v S )Nz%s.queryEntry('%s')rv rc rw rs ) r r8 r r r9 r rW rI r r ry r} r$ r$ r% � queryEntry� s z FirewallDConfigIPSet.queryEntry)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)9�__name__� __module__� __qualname__�__doc__Z persistentr r ZPK_ACTION_CONFIGZ default_polkit_auth_requiredr r r r( r) r2 r ZPROPERTIES_IFACEr< rB r rD Zservice�signalrE ZPK_ACTION_INFOZINTROSPECTABLE_IFACErF r r ZDBUS_SIGNATURErI rL rM rJ rP rQ rS rR rU rY rZ r[ r] r_ ra rb rd rh rm ro rq rt r{ r r� r� � __classcell__r$ r$ r" r% r . s0 �� �� � �� �� �� �� �� � � � �� �� �r ) r Z dbus.serviceZfirewallr Zfirewall.dbus_utilsr r r Zfirewall.core.io.ipsetr Zfirewall.core.ipsetr r r r Zfirewall.core.loggerr Zfirewall.server.dbusr Zfirewall.server.decoratorsr r r r r Zfirewall.errorsr r r$ r$ r$ r% �<module> s server/__pycache__/config.cpython-39.opt-1.pyc 0000644 00000127632 15025011705 0015126 0 ustar 00 a ���gt � @ sL d dl Z d dlZd dlZd dlmZ d dlmZ d dlmZ d dl m Z d dl m Z d dl mZmZmZmZmZmZ d dlmZ d d lmZ d d lmZ d d lmZ d d l m Z d d l m Z d dl m!Z! d dl"m#Z# d dl$m%Z% d dl&m'Z' d dl(m)Z) d dl*m+Z+m,Z,m-Z-m.Z.m/Z/m0Z0m1Z1m2Z2 d dlm3Z3 d dl4m5Z5 G dd� de �Z6dS )� N)�config)�DEFAULT_ZONE_TARGET)�Watcher)�log)�DbusServiceObject)�handle_exceptions�dbus_handle_exceptions�dbus_service_method� dbus_service_method_deprecated� dbus_service_signal_deprecated�dbus_polkit_require_auth)�FirewallDConfigIcmpType)�FirewallDConfigService)�FirewallDConfigZone)�FirewallDConfigPolicy)�FirewallDConfigIPSet)�FirewallDConfigHelper)�IcmpType)�IPSet)�Helper)�LockdownWhitelist)�Direct)�dbus_to_python�command_of_sender�context_of_sender� uid_of_sender� user_of_uid�%dbus_introspection_prepare_properties�!dbus_introspection_add_properties�!dbus_introspection_add_deprecated)�errors)� FirewallErrorc s e Zd ZdZdZejjZe � fdd��Z e dd� �Z e dd� �Z e d d � �Z e d d � �Ze d d� �Ze dd� �Ze dd� �Ze dd� �Ze dd� �Ze dd� �Ze dd� �Ze dd � �Ze d d � �Ze d d � �Ze d!d"� �Ze d#d$� �Ze d%d&� �Ze d'd(� �Z e d)d*� �Z e d+d,� �Z e d-d.� �Z e d/d0� �Z e!d1d2� �Z"e!d3d4� �Z#e!d5d6� �Z$e%ej&d7d8d9�e!d�d;d<���Z'e%ej&d=d>d9�e!d�d?d@���Z(e)ejj�e%ej&dAdB�e!d�dCdD����Z*ej+j,ej&dEdF�dGdH� �Z-e)ejj.�e%ej/d=dI�e!d� fdJdK� ���Z0e%ejj1e2j3dI�e!d�dLdM���Z4e%ejj1e2j3dB�e!d�dNdO���Z5ej+�,ejj1�e!dPdQ� ��Z6e%ejj1d=dB�e!d�dRdS���Z7e%ejj1d=dB�e!d�dTdU���Z8e%ejj1d=dVd9�e!d�dWdX���Z9e%ejj1dYdI�e!d�dZd[���Z:e%ejj1d=dB�e!d�d\d]���Z;e%ejj1d=dB�e!d�d^d_���Z<e%ejj1d=dVd9�e!d�d`da���Z=e%ejj1dYdI�e!d�dbdc���Z>e%ejj1d=dB�e!d�ddde���Z?e%ejj1d=dB�e!d�dfdg���Z@e%ejj1d=dVd9�e!d�dhdi���ZAe%ejj1dYdI�e!d�djdk���ZBe%ejj1dldB�e!�d dmdn���ZCe%ejj1dldB�e!�ddodp���ZDe%ejj1dldVd9�e!�ddqdr���ZEe%ejj1dsdI�e!�ddtdu���ZFe%ejjGdvdI�e!�ddwdx���ZHe%ejjGdYdI�e!�ddydz���ZIe%ejjGd=d{d9�e!�dd|d}���ZJe%ejjGd=eKj3 d{d9�e!�dd~d���ZLej+j,ejjGd=dF�e!d�d�� ��ZMe%ejjGdvdI�e!�dd�d����ZNe%ejjGdYdI�e!�d d�d����ZOe%ejjGd=d{d9�e!�d d�d����ZPe%ejjGd=eQj3 d{d9�e!�d d�d����ZRej+j,ejjGd=dF�e!d�d�� ��ZSe%ejjGdvdI�e!�d d�d����ZTe%ejjGdYdI�e!�d d�d����ZUe%ejjGd=d{d9�e!�dd�d����ZVe%ejjGd�d{d9�e!�dd�d����ZWe%ejjGd�d{d9�e!�dd�d����ZXej+j,ejjGd=dF�e!d�d�� ��ZYe%ejjGdvdI�e!�dd�d����ZZe%ejjGdYdI�e!�dd�d����Z[e%ejjGd=d{d9�e!�dd�d����Z\e%ejjGd=d=d9�e!�dd�d����Z]e%ejjGd=d=d9�e!�dd�d����Z^e%ejjGd�d{d9�e!�dd�d����Z_e%ejjGd�d{d9�e!�dd�d����Z`ej+j,ejjGd=dF�e!d�d�� ��Zae%ejjGdvdI�e!�dd�d����Zbe%ejjGdYdI�e!�dd�d����Zce%ejjGd=d{d9�e!�dd�d����Zde%ejjGd�d{d9�e!�dd�d����Zeej+j,ejjGd=dF�e!d�d�� ��Zfe%ejjGdvdI�e!�d d�d����Zge%ejjGdYdI�e!�d d�d����Zhe%ejjGd=d{d9�e!�d d�d����Zie%ejjGd=ejj3 d{d9�e!�d d�d����Zkej+j,ejjGd=dF�e!d�d�� ��Zlemejjn�e%ejjneoj3dI�e!�d d�d�����Zpemejjn�e%ejjneoj3dB�e!�d!d�d���Zqerejjn�ej+�,ejjn�e!d�dĄ ���Zsemejjn�e%ejjnd�dB�e!�d"d�dDŽ���Ztemejjn�e%ejjnd�dB�e!�d#d�dɄ���Zuemejjn�e%ejjnd�dVd9�e!�d$d�d˄���Zvemejjn�e%ejjnd7dYd9�e!�d%d�d̈́���Zwemejjn�e%ejjnd�d�d9�e!�d&d�dф���Zxemejjn�e%ejjnd�dB�e!�d'd�dԄ���Zyemejjn�e%ejjnd�dB�e!�d(d�dք���Zzemejjn�e%ejjnd�dVd9�e!�d)d�d���Z{emejjn�e%ejjnd�dB�e!�d*d�dڄ���Z|emejjn�e%ejjnd�d�d9�e!�d+d�d݄���Z}emejjn�e%ejjnd�d�d9�e!�d,d�d����Z~emejjn�e%ejjnd�dB�e!�d-d�d����Zemejjn�e%ejjnd�dB�e!�d.d�d����Z�emejjn�e%ejjnd�dVd9�e!�d/d�d����Z�emejjn�e%ejjnd=d�d9�e!�d0d�d����Z�emejjn�e%ejjnd�dI�e!�d1d�d����Z�� Z�S (2 �FirewallDConfigzFirewallD main classTc s� t t| �j|i |�� || _|d | _|d | _| �� t| jd�| _ | j � tj � | j � tj � | j � tj � | j � tj� | j � tj� | j � tj� | j � tj� | j � tj� | j � tj� | j � tj� | j � tj� | j � tj� tj�tj��r>tt�tj��D ].}dtj|f }tj�|��r| j � |� �q| j � tj � | j � tj � | j � tj � t | tj!j"ddddddddddddddd�� d S )Nr � � z%s/%sZ readwrite)� CleanupOnExit�CleanupModulesOnExit� IPv6_rpfilter�IPv6_rpfilter2�Lockdown� MinimalMark�IndividualCalls� LogDenied�AutomaticHelpers�FirewallBackend�FlushAllOnReload� RFC3964_IPv4�AllowZoneDrifting�NftablesTableOwner)#�superr" �__init__r �busname�path� _init_varsr � watch_updater�watcher� add_watch_dir�FIREWALLD_IPSETS�ETC_FIREWALLD_IPSETS�FIREWALLD_ICMPTYPES�ETC_FIREWALLD_ICMPTYPES�FIREWALLD_HELPERS�ETC_FIREWALLD_HELPERS�FIREWALLD_SERVICES�ETC_FIREWALLD_SERVICES�FIREWALLD_ZONES�ETC_FIREWALLD_ZONES�FIREWALLD_POLICIES�ETC_FIREWALLD_POLICIES�os�exists�sorted�listdir�isdirZadd_watch_file�LOCKDOWN_WHITELIST�FIREWALLD_DIRECT�FIREWALLD_CONFr �dbus�DBUS_INTERFACE_CONFIG)�selfZconf�args�kwargs�filenamer6 �� __class__� �:/usr/lib/python3.9/site-packages/firewall/server/config.pyr4 D sV ��zFirewallDConfig.__init__c C s g | _ d| _g | _d| _g | _d| _g | _d| _g | _d| _ g | _ d| _ | j � � D ]}| �| j �|�� qR| j �� D ]}| �| j �|�� qt| j �� D ]}| �| j �|�� q�| j �� D ]}| �| j �|�� q�| j �� D ]}| �| j �|�� q�| j � � D ]}| � | j � |�� q�d S �Nr ) �ipsets� ipset_idx� icmptypes� icmptype_idx�services� service_idx�zones�zone_idx�helpers� helper_idx�policy_objects�policy_object_idxr Z get_ipsets� _addIPSetZ get_ipsetZ get_icmptypes� _addIcmpTypeZ get_icmptypeZ get_services� _addServiceZ get_serviceZ get_zones�_addZoneZget_zoneZ get_helpers� _addHelperZ get_helperZget_policy_objects� _addPolicyZget_policy_object)rQ �ipset�icmptype�service�zone�helper�policyrW rW rX r7 u s0 zFirewallDConfig._init_varsc C s d S �NrW �rQ rW rW rX �__del__� s zFirewallDConfig.__del__c C s� t | j�dkr$| j�� }|�� ~q t | j�dkrH| j�� }|�� ~q$t | j�dkrl| j�� }|�� ~qHt | j�dkr�| j�� }|�� ~qlt | j�dkr�| j�� }|�� ~q�t | j�dkr�| j�� }|�� ~q�| � � d S rY ) �lenrZ �pop� unregisterr\ r^ r` rb rd r7 )rQ �itemrW rW rX �reload� s2 zFirewallDConfig.reloadc C s~ |t jkr�| �t jj�}t�dt j� z| j �� W n8 tyl } z t� d||f � W Y d }~d S d }~0 0 | �t jj�� � }t |� � �D ]"}||v r�|| || kr�||= q�t |�dkr�| �t jj|g � d S |�t j�s�|�t j��r�|�d��r�z| j �|�\}}W n: t�yF } z t� d||f � W Y d }~d S d }~0 0 |dk�r^| �|� n*|dk�rt| �|� n|dk�rz| �|� �n�|�t j��s�|�t j��rH|�d��rHz| j �|�\}}W n: t�y } z t� d ||f � W Y d }~d S d }~0 0 |dk�r| �|� n*|dk�r0| �|� n|dk�rz| � |� �n2|�t j ��sd|�t j ��r�|�d��rz| j � |�\}}W n: t�y� } z t� d ||f � W Y d }~d S d }~0 0 |dk�r�| � |� n*|dk�r�| �!|� n|dk�r�| �"|� n�|�t j ��rz|�#t j d ��$d �}t |�d k �s<d |v �r@d S t%j&�'|��rj| j(�)|��s�| j(�*|� n| j(�)|��rz| j(�+|� �n�|�t j,��s�|�t j-��rD|�d��rDz| j �.|�\}}W n: t�y� } z t� d||f � W Y d }~d S d }~0 0 |dk�r| �/|� n*|dk�r,| �0|� n|dk�rz| �1|� �n6|�t j2��s`|�t j3��r |�d��r z| j �4|�\}}W n: t�y� } z t� d||f � W Y d }~d S d }~0 0 |dk�r�| �5|� n*|dk�r�| �6|� n|dk�rz| �7|� �nz|t j8k�rbz| j �9� W n: t�yT } z t� d||f � W Y d }~d S d }~0 0 | �:� �n|t j;k�r�z| j �<� W n: t�y� } z t� d||f � W Y d }~d S d }~0 0 | �=� n�|�t j>��s�|�t j?��rz|�d��rzz| j �@|�\}}W n: t�y8 } z t� d||f � W Y d }~d S d }~0 0 |dk�rP| �A|� n*|dk�rf| �B|� n|dk�rz| �C|� d S )Nz,config: Reloading firewalld config file '%s'z+Failed to load firewalld.conf file '%s': %sr z.xmlz%Failed to load icmptype file '%s': %s�new�remove�updatez$Failed to load service file '%s': %sz!Failed to load zone file '%s': %s� �/r# z"Failed to load ipset file '%s': %sz#Failed to load helper file '%s': %sz/Failed to load lockdown whitelist file '%s': %sz)Failed to load direct rules file '%s': %sz#Failed to load policy file '%s': %s)Dr rN �GetAllrO rP r �debug1Zupdate_firewalld_conf� Exception�error�copy�list�keysru �PropertiesChanged� startswithr= r> �endswithZupdate_icmptype_from_pathrg �removeIcmpType�_updateIcmpTyperA rB Zupdate_service_from_pathrh � removeService�_updateServicerC rD Zupdate_zone_from_pathri � removeZone� _updateZone�replace�striprG r6 rK r9 Z has_watchr: Z remove_watchr; r< Zupdate_ipset_from_pathrf � removeIPSet� _updateIPSetr? r@ Zupdate_helper_from_pathrj � removeHelper� _updateHelperrL Zupdate_lockdown_whitelist�LockdownWhitelistUpdatedrM Z update_direct�UpdatedrE rF Z update_policy_object_from_pathrk � removePolicy� _updatePolicy) rQ �nameZ old_props�msgZprops�keyZwhat�obj�_namerW rW rX r8 � s& �� � �� �� � ��� ��� � � �� z FirewallDConfig.watch_updaterc C sP t | | j|| j| jdtjj| jf �}| j�|� | jd7 _| �|j � |S �Nz%s/%dr# ) r r r] r5 rO ZDBUS_PATH_CONFIG_ICMPTYPEr\ �append� IcmpTypeAddedr� )rQ r� �config_icmptyperW rW rX rg B s �� z FirewallDConfig._addIcmpTypec C sL | j D ]@}|jj|jkr|jj|jkr|jj|jkr||_|�|j� qd S rr )r\ r� r� r6 rT r� )rQ r� rm rW rW rX r� N s � �z FirewallDConfig._updateIcmpTypec C s� d}| j D ]J}|�� }|j|| v r || �|j� | j�|j|�|_|�|jj� q | jD ]R}|�� }d|v r\|j|d v r\|d �|j� | j� |j|�|_|�|jj� q\| j D ]0}|j|kr�|� |j� |� � | j �|� ~q�d S )N� Z icmp_blocks) r` � getSettingsr� r{ r �set_zone_configr� r� rd � set_policy_object_config_dictr\ �Removedrw )rQ r� �indexro �settingsrq rm rW rW rX r� W s& z FirewallDConfig.removeIcmpTypec C sP t | | j|| j| jdtjj| jf �}| j�|� | jd7 _| �|j � |S r� ) r r r_ r5 rO ZDBUS_PATH_CONFIG_SERVICEr^ r� � ServiceAddedr� )rQ r� �config_servicerW rW rX rh q s � zFirewallDConfig._addServicec C sL | j D ]@}|jj|jkr|jj|jkr|jj|jkr||_|�|j� qd S rr )r^ r� r� r6 rT r� )rQ r� rn rW rW rX r� | s � �z FirewallDConfig._updateServicec C s� d}| j D ]J}|�� }|j|| v r || �|j� | j�|j|�|_|�|jj� q | jD ]R}|�� }d|v r\|j|d v r\|d �|j� | j� |j|�|_|�|jj� q\| j D ]0}|j|kr�|� |j� |� � | j �|� ~q�d S )Nr$ r^ ) r` r� r� r{ r r� r� r� rd r� r^ r� rw )rQ r� r� ro r� rq rn rW rW rX r� � s& z FirewallDConfig.removeServicec C sP t | | j|| j| jdtjj| jf �}| j�|� | jd7 _| �|j � |S r� ) r r ra r5 rO ZDBUS_PATH_CONFIG_ZONEr` r� � ZoneAddedr� )rQ r� � config_zonerW rW rX ri � s � zFirewallDConfig._addZonec C sL | j D ]@}|jj|jkr|jj|jkr|jj|jkr||_|�|j� qd S rr )r` r� r� r6 rT r� �rQ r� ro rW rW rX r� � s �zFirewallDConfig._updateZonec C s< | j D ]0}|j|kr|�|j� |�� | j �|� ~qd S rr )r` r� r� r� rw r{ r� rW rW rX r� � s zFirewallDConfig.removeZonec C sP t | | j|| j| jdtjj| jf �}| j�|� | jd7 _| �|j � |S r� ) r r re r5 rO ZDBUS_PATH_CONFIG_POLICYrd r� � PolicyAddedr� )rQ r� � config_policyrW rW rX rk � s � zFirewallDConfig._addPolicyc C sL | j D ]@}|jj|jkr|jj|jkr|jj|jkr||_|�|j� qd S rr )rd r� r� r6 rT r� �rQ r� rq rW rW rX r� � s �z FirewallDConfig._updatePolicyc C s< | j D ]0}|j|kr|�|j� |�� | j �|� ~qd S rr )rd r� r� r� rw r{ r� rW rW rX r� � s z FirewallDConfig.removePolicyc C sP t | | j|| j| jdtjj| jf �}| j�|� | jd7 _| �|j � |S r� ) r r r[ r5 rO ZDBUS_PATH_CONFIG_IPSETrZ r� � IPSetAddedr� )rQ r� � config_ipsetrW rW rX rf � s � zFirewallDConfig._addIPSetc C sL | j D ]@}|jj|jkr|jj|jkr|jj|jkr||_|�|j� qd S rr )rZ r� r� r6 rT r� �rQ r� rl rW rW rX r� � s �z FirewallDConfig._updateIPSetc C s< | j D ]0}|j|kr|�|j� |�� | j �|� ~qd S rr )rZ r� r� r� rw r{ r� rW rW rX r� � s zFirewallDConfig.removeIPSetc C sP t | | j|| j| jdtjj| jf �}| j�|� | jd7 _| �|j � |S r� ) r r rc r5 rO ZDBUS_PATH_CONFIG_HELPERrb r� � HelperAddedr� )rQ r� � config_helperrW rW rX rj � s � zFirewallDConfig._addHelperc C sL | j D ]@}|jj|jkr|jj|jkr|jj|jkr||_|�|j� qd S rr )rb r� r� r6 rT r� �rQ r� rp rW rW rX r� s �z FirewallDConfig._updateHelperc C s< | j D ]0}|j|kr|�|j� |�� | j �|� ~qd S rr )rb r� r� r� rw r{ r� rW rW rX r� s z FirewallDConfig.removeHelperc C s� | j jjdkrttjd��| j �� r�|d u r:t�d� d S t � � }t ||�}| j � d|�r^d S t ||�}| j � d|�rzd S t|�}| j � d|�r�d S t||�}| j � d|�r�d S ttjd��d S ) NZFAILEDz�Changing permanent configuration is not allowed while firewalld is in FAILED state. The permanent configuration must be fixed and then firewalld restarted. Try `firewall-offline-cmd --check-config`.z&Lockdown not possible, sender not set.�context�uid�user�commandzlockdown is enabled)r Z_fw�_stater! r ZRUNNING_BUT_FAILEDZlockdown_enabledr r� rO Z SystemBusr Z access_checkr r r Z ACCESS_DENIED)rQ �senderZbusr� r� r� r� rW rW rX � accessCheck s, � zFirewallDConfig.accessCheckc C s� |dvrt j�d| ��| j�� �|�}|dkrH|d u r>tj}t �|�S |dkrr|d u r`tj}nt |�}t � |�S |dkr�|d u r�tj r�dnd}t �|�S |dkr�|d u r�tj r�dnd}t �|�S |d kr�|d u r�tj r�dnd}t �|�S |d k�r |d u �s|dk�rt �d�S t �d�S �nv|d k�rD|d u �r:tj}t �|�S |d k�rr|d u �rhtj�rddnd}t �|�S |d k�r�|d u �r�tj}t �|�S |dk�r�|d u �r�tj}t �|�S |dk�r�|d u �r�tj}t �|�S |dk�r |d u �rtj�r�dnd}t �|�S |dk�r:|d u �r0tj�r,dnd}t �|�S |dk�rh|d u �r^tj�rZdnd}t �|�S |dk�r�|d u �r�tj�r�dnd}t �|�S d S )N�� DefaultZoner* r% r& r) r' r+ r, r- r. r/ r0 r1 r( r2 �Dorg.freedesktop.DBus.Error.InvalidArgs: Property '%s' does not existr� r* r% �yes�nor& r) r' r( r+ r, r- r. r/ r0 r1 r2 )rO � exceptions� DBusExceptionr �get_firewalld_conf�getZ FALLBACK_ZONE�StringZFALLBACK_MINIMAL_MARK�int�Int32ZFALLBACK_CLEANUP_ON_EXITZ FALLBACK_CLEANUP_MODULES_ON_EXITZFALLBACK_LOCKDOWNZFALLBACK_IPV6_RPFILTERZFALLBACK_INDIVIDUAL_CALLSZFALLBACK_LOG_DENIEDZFALLBACK_AUTOMATIC_HELPERSZFALLBACK_FIREWALL_BACKENDZ FALLBACK_FLUSH_ALL_ON_RELOADZFALLBACK_RFC3964_IPV4Z FALLBACK_ALLOW_ZONE_DRIFTINGZ FALLBACK_NFTABLES_TABLE_OWNER)rQ �prop�valuerW rW rX � _get_property3 s� �� z FirewallDConfig._get_propertyc C s� |dkrt �| �|��S |dkr0t �| �|��S |dkrHt �| �|��S |dkr`t �| �|��S |dkrxt �| �|��S |dkr�t �| �|��S |dkr�t �| �|��S |dkr�t �| �|��S |d kr�t �| �|��S |d k� r�t �| �|��S |d k�r t �| �|��S |d k�r&t �| �|��S |d k�r@t �| �|��S |dk�rZt �| �|��S |dk�rtt �| �|��S t j�d| ��d S )Nr� r* r% r& r) r' r( r+ r, r- r. r/ r0 r1 r2 r� )rO r� r� r� r� r� )rQ r� rW rW rX �_get_dbus_property� sF ��z"FirewallDConfig._get_dbus_property�ss�v)� in_signature� out_signatureNc C sr t |t�}t |t�}t�d||� |tjjkr8| �|�S |tjjtjj fv r^tj � d| ��ntj � d| ��d S )Nzconfig.Get('%s', '%s')r� �Jorg.freedesktop.DBus.Error.UnknownInterface: Interface '%s' does not exist) r �strr r� r rO rP r� � DBUS_INTERFACE_CONFIG_DIRECT� DBUS_INTERFACE_CONFIG_POLICIESr� r� )rQ �interface_name� property_namer� rW rW rX �Get� s$ �����zFirewallDConfig.Get�sza{sv}c C st t |t�}t�d|� i }|tjjkr@dD ]}| �|�||< q*n&|tjjtjj fv rVntj � d| ��tj |dd�S )Nzconfig.GetAll('%s')r� r� �sv�Z signature) r r� r r� r rO rP r� r� r� r� r� Z Dictionary)rQ r� r� �ret�xrW rW rX r � s ���zFirewallDConfig.GetAllZssv)r� c C s� t |t�}t |t�}t |�}t�d|||� | �|� |tjjk�rR|dv �r4|dv rx|�� dvrvt t j d||f ��n�|dkr�|tj vr�t t j d||f ��n`|dkr�|tj vr�t t j d||f ��n8|dkr�|tjvr�t t j d||f ��ntj�d | ��| j�� �||� | j�� �� | �|||ig � n |d v �r@ntj�d | ��n8|tjjtjjfv �rztj�d | ��ntj�d | ��d S ) Nz config.Set('%s', '%s', '%s')) r% r& r) r' r+ r, r. r/ r0 r( r2 )r% r& r) r' r+ r/ r0 r2 )r� r� �trueZfalsez '%s' for %sr, r. r( r� )r* r- r1 r� )r r� r r� r� r rO rP �lowerr! r Z INVALID_VALUEZLOG_DENIED_VALUESZFIREWALL_BACKEND_VALUESZIPV6_RPFILTER_VALUESr� r� r� �set�writer� r� r� )rQ r� r� Z new_valuer� rW rW rX �Set� s� � �� �� �� ���� �������zFirewallDConfig.Setzsa{sv}asr� c C s. t |t�}t |�}t |�}t�d|||� d S )Nz*config.PropertiesChanged('%s', '%s', '%s')�r r� r r� )rQ r� Zchanged_propertiesZinvalidated_propertiesrW rW rX r� s �z!FirewallDConfig.PropertiesChanged)r� c s` t �d� tt| ��| j| j�� �}t| |t j j �}t j j fD ] }t | ||t� jt� j�}q>|S )Nzconfig.Introspect())r Zdebug2r3 r" � Introspectr6 r5 Zget_busr r rO rP r� r r Z deprecatedr )rQ r� �dataZ interfacerU rW rX r� " s � ��zFirewallDConfig.Introspectc C s t �d� | j�� j�� S )Nz&config.policies.getLockdownWhitelist())r r� r � get_policies�lockdown_whitelist� export_config�rQ r� rW rW rX �getLockdownWhitelist9 s z$FirewallDConfig.getLockdownWhitelistc C sB t �d� t|�}| j�� j�|i � | j�� j�� | �� d S )Nz)config.policies.setLockdownWhitelist(...)) r r� r r r� r� � import_configr� r� �rQ r� r� rW rW rX �setLockdownWhitelist@ s z$FirewallDConfig.setLockdownWhitelistc C s t �d� d S )Nz*config.policies.LockdownWhitelistUpdated()�r r� rs rW rW rX r� J s z(FirewallDConfig.LockdownWhitelistUpdatedc C s^ t |�}t�d|� | �|� t| �� �}||d v rBttj|��|d � |� | � |� d S )Nz1config.policies.addLockdownWhitelistCommand('%s')r � r r r� r� r� r� r! r �ALREADY_ENABLEDr� r� �rQ r� r� r� rW rW rX �addLockdownWhitelistCommandQ s z+FirewallDConfig.addLockdownWhitelistCommandc C s^ t |�}t�d|� | �|� t| �� �}||d vrBttj|��|d � |� | � |� d S )Nz4config.policies.removeLockdownWhitelistCommand('%s')r � r r r� r� r� r� r! r � NOT_ENABLEDr{ r� r� rW rW rX � removeLockdownWhitelistCommand^ s � z.FirewallDConfig.removeLockdownWhitelistCommand�bc C s$ t |�}t�d|� || �� d v S )Nz3config.policies.queryLockdownWhitelistCommand('%s')r �r r r� r� )rQ r� r� rW rW rX � queryLockdownWhitelistCommandl s �z-FirewallDConfig.queryLockdownWhitelistCommand�asc C s t �d� | �� d S )Nz.config.policies.getLockdownWhitelistCommands()r �r r� r� r� rW rW rX � getLockdownWhitelistCommandsu s z,FirewallDConfig.getLockdownWhitelistCommandsc C s^ t |�}t�d|� | �|� t| �� �}||d v rBttj|��|d � |� | � |� d S )Nz1config.policies.addLockdownWhitelistContext('%s')r# r� �rQ r� r� r� rW rW rX �addLockdownWhitelistContext~ s z+FirewallDConfig.addLockdownWhitelistContextc C s^ t |�}t�d|� | �|� t| �� �}||d vrBttj|��|d � |� | � |� d S )Nz4config.policies.removeLockdownWhitelistContext('%s')r# r� r� rW rW rX � removeLockdownWhitelistContext� s � z.FirewallDConfig.removeLockdownWhitelistContextc C s$ t |�}t�d|� || �� d v S )Nz3config.policies.queryLockdownWhitelistContext('%s')r# r� )rQ r� r� rW rW rX � queryLockdownWhitelistContext� s �z-FirewallDConfig.queryLockdownWhitelistContextc C s t �d� | �� d S )Nz.config.policies.getLockdownWhitelistContexts()r# r� r� rW rW rX � getLockdownWhitelistContexts� s z,FirewallDConfig.getLockdownWhitelistContextsc C s^ t |�}t�d|� | �|� t| �� �}||d v rBttj|��|d � |� | � |� d S )Nz.config.policies.addLockdownWhitelistUser('%s')� r� �rQ r� r� r� rW rW rX �addLockdownWhitelistUser� s z(FirewallDConfig.addLockdownWhitelistUserc C s^ t |�}t�d|� | �|� t| �� �}||d vrBttj|��|d � |� | � |� d S )Nz1config.policies.removeLockdownWhitelistUser('%s')r r� r rW rW rX �removeLockdownWhitelistUser� s z+FirewallDConfig.removeLockdownWhitelistUserc C s$ t |�}t�d|� || �� d v S )Nz0config.policies.queryLockdownWhitelistUser('%s')r r� )rQ r� r� rW rW rX �queryLockdownWhitelistUser� s z*FirewallDConfig.queryLockdownWhitelistUserc C s t �d� | �� d S )Nz+config.policies.getLockdownWhitelistUsers()r r� r� rW rW rX �getLockdownWhitelistUsers� s z)FirewallDConfig.getLockdownWhitelistUsers�ic C s^ t |�}t�d|� | �|� t| �� �}||d v rBttj|��|d � |� | � |� d S )Nz+config.policies.addLockdownWhitelistUid(%d)� r� �rQ r� r� r� rW rW rX �addLockdownWhitelistUid� s z'FirewallDConfig.addLockdownWhitelistUidc C s^ t |�}t�d|� | �|� t| �� �}||d vrBttj|��|d � |� | � |� d S )Nz.config.policies.removeLockdownWhitelistUid(%d)r r� r rW rW rX �removeLockdownWhitelistUid� s z*FirewallDConfig.removeLockdownWhitelistUidc C s$ t |�}t�d|� || �� d v S )Nz-config.policies.queryLockdownWhitelistUid(%d)r r� )rQ r� r� rW rW rX �queryLockdownWhitelistUid� s z)FirewallDConfig.queryLockdownWhitelistUidZaic C s t �d� | �� d S )Nz*config.policies.getLockdownWhitelistUids()r r� r� rW rW rX �getLockdownWhitelistUids� s z(FirewallDConfig.getLockdownWhitelistUidsZaoc C s t �d� | jS )z"list ipsets objects paths zconfig.listIPSets())r r� rZ r� rW rW rX � listIPSets s zFirewallDConfig.listIPSetsc C s0 t �d� g }| jD ]}|�|jj� qt|�S )zget ipset names zconfig.getIPSetNames())r r� rZ r� r� r� rI )rQ r� rZ r� rW rW rX � getIPSetNames s z FirewallDConfig.getIPSetNames�oc C sF t |t�}t�d|� | jD ]}|jj|kr | S q ttj |��dS )z-object path of ipset with given name zconfig.getIPSetByName('%s')N) r r� r r� rZ r� r� r! r Z INVALID_IPSET)rQ rl r� r� rW rW rX �getIPSetByName s z FirewallDConfig.getIPSetByNamec C sD t |t�}t |�}t�d|� | �|� | j�||�}| �|�}|S )z/add ipset with given name and settings zconfig.addIPSet('%s'))r r� r r� r� r Z new_ipsetrf )rQ rl r� r� r� r� rW rW rX �addIPSet# s zFirewallDConfig.addIPSetc C s t |t�}t�d| � d S )Nzconfig.IPSetAdded('%s')r� )rQ rl rW rW rX r� 2 s zFirewallDConfig.IPSetAddedc C s t �d� | jS )z%list icmptypes objects paths zconfig.listIcmpTypes())r r� r\ r� rW rW rX � listIcmpTypes: s z FirewallDConfig.listIcmpTypesc C s0 t �d� g }| jD ]}|�|jj� qt|�S )zget icmptype names zconfig.getIcmpTypeNames())r r� r\ r� r� r� rI )rQ r� r\ r� rW rW rX �getIcmpTypeNamesB s z FirewallDConfig.getIcmpTypeNamesc C sF t |t�}t�d|� | jD ]}|jj|kr | S q ttj |��dS )z0object path of icmptype with given name z config.getIcmpTypeByName('%s')N) r r� r r� r\ r� r� r! r ZINVALID_ICMPTYPE)rQ rm r� r� rW rW rX �getIcmpTypeByNameM s z!FirewallDConfig.getIcmpTypeByNamec C sD t |t�}t |�}t�d|� | �|� | j�||�}| �|�}|S )z2add icmptype with given name and settings zconfig.addIcmpType('%s'))r r� r r� r� r Z new_icmptyperg )rQ rm r� r� r� r� rW rW rX � addIcmpTypeZ s zFirewallDConfig.addIcmpTypec C s t �d| � d S )Nzconfig.IcmpTypeAdded('%s')r� )rQ rm rW rW rX r� i s z FirewallDConfig.IcmpTypeAddedc C s t �d� | jS )z$list services objects paths zconfig.listServices())r r� r^ r� rW rW rX � listServicesp s z FirewallDConfig.listServicesc C s0 t �d� g }| jD ]}|�|jj� qt|�S )zget service names zconfig.getServiceNames())r r� r^ r� r� r� rI )rQ r� r^ r� rW rW rX �getServiceNamesx s z FirewallDConfig.getServiceNamesc C sF t |t�}t�d|� | jD ]}|jj|kr | S q ttj |��dS )z/object path of service with given name z config.getServiceByName('%s')N) r r� r r� r^ r� r� r! r ZINVALID_SERVICE)rQ rn r� r� rW rW rX �getServiceByName� s z FirewallDConfig.getServiceByNamezs(sssa(ss)asa{ss}asa(ss))c C sD t |t�}t |�}t�d|� | �|� | j�||�}| �|�}|S )�1add service with given name and settings zconfig.addService('%s'))r r� r r� r� r Z new_servicerh �rQ rn r� r� r� r� rW rW rX � addService� s zFirewallDConfig.addServicezsa{sv}c C sD t |t�}t |�}t�d|� | �|� | j�||�}| �|�}|S )r zconfig.addService2('%s'))r r� r r� r� r Znew_service_dictrh r rW rW rX � addService2� s zFirewallDConfig.addService2c C s t �d| � d S )Nzconfig.ServiceAdded('%s')r� )rQ rn rW rW rX r� � s z FirewallDConfig.ServiceAddedc C s t �d� | jS )z!list zones objects paths zconfig.listZones())r r� r` r� rW rW rX � listZones� s zFirewallDConfig.listZonesc C s0 t �d� g }| jD ]}|�|jj� qt|�S )zget zone names zconfig.getZoneNames())r r� r` r� r� r� rI )rQ r� r` r� rW rW rX � getZoneNames� s z FirewallDConfig.getZoneNamesc C sF t |t�}t�d|� | jD ]}|jj|kr | S q ttj |��dS )z,object path of zone with given name zconfig.getZoneByName('%s')N) r r� r r� r` r� r� r! r Z INVALID_ZONE)rQ ro r� r� rW rW rX � getZoneByName� s z FirewallDConfig.getZoneByNamec C sv t |t�}t�d|� g }| jD ] }||jjv r |�|jj� q t |�dkrfd� |�d|t |�f S |rr|d S dS )z4name of zone the given interface belongs to z config.getZoneOfInterface('%s')r# � zE (ERROR: interface '%s' is in %s zone XML files, can be only in one)r r} ) r r� r r� r` r� Z interfacesr� r� ru �join)rQ Zifacer� r� r� rW rW rX �getZoneOfInterface� s ��z"FirewallDConfig.getZoneOfInterfacec C sv t |t�}t�d|� g }| jD ] }||jjv r |�|jj� q t |�dkrfd� |�d|t |�f S |rr|d S dS )z1name of zone the given source belongs to z config.getZoneOfSource('%s')r# r! zB (ERROR: source '%s' is in %s zone XML files, can be only in one)r r} ) r r� r r� r` r� Zsourcesr� r� ru r" )rQ �sourcer� r� r� rW rW rX �getZoneOfSource� s ��z FirewallDConfig.getZoneOfSourcez's(sssbsasa(ss)asba(ssss)asasasasa(ss)b)c C sh t |t�}t |�}t�d|� | �|� |d dkrLt|�}t|d< t|�}| j� ||�}| � |�}|S )�.add zone with given name and settings �config.addZone('%s')� �default) r r� r r� r� r� r �tupler Znew_zoneri )rQ ro r� r� Z _settingsr� r� rW rW rX �addZone� s zFirewallDConfig.addZonec C s` t |t�}t |�}t�d|� | �|� d|v rD|d dkrDt|d< | j�||�}| �|�}|S )r& r' �targetr) ) r r� r r� r� r r Z new_zone_dictri )rQ ro r� r� r� r� rW rW rX �addZone2 s zFirewallDConfig.addZone2c C s t �d| � d S )Nzconfig.ZoneAdded('%s')r� )rQ ro rW rW rX r� " s zFirewallDConfig.ZoneAddedc C s t �d� | jS )z$list policies objects paths zconfig.listPolicies())r r� rd r� rW rW rX � listPolicies) s z FirewallDConfig.listPoliciesc C s0 t �d� g }| jD ]}|�|jj� qt|�S )zget policy names zconfig.getPolicyNames())r r� rd r� r� r� rI )rQ r� Zpoliciesr� rW rW rX �getPolicyNames1 s z FirewallDConfig.getPolicyNamesc C sF t |t�}t�d|� | jD ]}|jj|kr | S q ttj |��dS )z.object path of policy with given name z config.getPolicyByName('%s')N) r r� r r� rd r� r� r! r ZINVALID_POLICY)rQ rq r� r� rW rW rX �getPolicyByName< s z FirewallDConfig.getPolicyByNamec C sD t |t�}t |�}t�d|� | �|� | j�||�}| �|�}|S )z0add policy with given name and settings zconfig.addPolicy('%s'))r r� r r� r� r Znew_policy_object_dictrk )rQ rq r� r� r� r� rW rW rX � addPolicyI s zFirewallDConfig.addPolicyc C s t �d| � d S )Nzconfig.PolicyAdded('%s')r� )rQ rq rW rW rX r� X s zFirewallDConfig.PolicyAddedc C s t �d� | jS )z#list helpers objects paths zconfig.listHelpers())r r� rb r� rW rW rX � listHelpersa s zFirewallDConfig.listHelpersc C s0 t �d� g }| jD ]}|�|jj� qt|�S )zget helper names zconfig.getHelperNames())r r� rb r� r� r� rI )rQ r� rb r� rW rW rX �getHelperNamesi s z FirewallDConfig.getHelperNamesc C sF t |t�}t�d|� | jD ]}|jj|kr | S q ttj |��dS )z.object path of helper with given name z config.getHelperByName('%s')N) r r� r r� rb r� r� r! r ZINVALID_HELPER)rQ rp r� r� rW rW rX �getHelperByNamet s z FirewallDConfig.getHelperByNamec C sD t |t�}t |�}t�d|� | �|� | j�||�}| �|�}|S )z0add helper with given name and settings zconfig.addHelper('%s'))r r� r r� r� r Z new_helperrj )rQ rp r� r� r� r� rW rW rX � addHelper� s zFirewallDConfig.addHelperc C s t |t�}t�d| � d S )Nzconfig.HelperAdded('%s')r� )rQ rp rW rW rX r� � s zFirewallDConfig.HelperAddedc C s t �d� | j�� �� S )Nzconfig.direct.getSettings())r r� r � get_directr� r� rW rW rX r� � s zFirewallDConfig.getSettingsc C s> t �d� t|�}| j�� �|i � | j�� �� | �� d S )Nzconfig.direct.update())r r� r r r6 r� r� r� r� rW rW rX r| � s zFirewallDConfig.updatec C s t �d� d S )Nzconfig.direct.Updated()r� rs rW rW rX r� � s zFirewallDConfig.UpdatedZsssc C s� t |�}t |�}t |�}t�d|||f � | �|� t|||f�}t| �� �}||d v rrttj d|||f ��|d � |� | � |� d S )Nz(config.direct.addChain('%s', '%s', '%s')r z chain '%s' already is in '%s:%s') r r r� r� r* r� r� r! r r� r� r| �rQ �ipv�table�chainr� �idxr� rW rW rX �addChain� s" � ��zFirewallDConfig.addChainc C s� t |�}t |�}t |�}t�d|||f � | �|� t|||f�}t| �� �}||d vrrttj d|||f ��|d � |� | � |� d S )Nz+config.direct.removeChain('%s', '%s', '%s')r z chain '%s' is not in '%s:%s') r r r� r� r* r� r� r! r r� r{ r| r7 rW rW rX � removeChain� s" � ��zFirewallDConfig.removeChainc C sJ t |�}t |�}t |�}t�d|||f � t|||f�}|| �� d v S )Nz*config.direct.queryChain('%s', '%s', '%s')r )r r r� r* r� )rQ r8 r9 r: r� r; rW rW rX � queryChain� s �zFirewallDConfig.queryChainc C sb t |�}t |�}t�d||f � g }| �� d D ]*}|d |kr2|d |kr2|�|d � q2|S )Nz#config.direct.getChains('%s', '%s')r r# r �r r r� r� r� )rQ r8 r9 r� r� r; rW rW rX � getChains� s zFirewallDConfig.getChainsr} za(sss)c C s t �d� | �� d S )Nz config.direct.getAllChains()r �r r� r� r� rW rW rX � getAllChains� s z FirewallDConfig.getAllChainsZsssiasc C s� t |�}t |�}t |�}t |�}t |�}t�d||||d�|�f � | �|� |||||f}t| �� �}||d v r�ttj d||||f ��|d � |� | � t |�� d S )Nz1config.direct.addRule('%s', '%s', '%s', %d, '%s')�','r# z"rule '%s' already is in '%s:%s:%s') r r r� r" r� r� r� r! r r� r� r| r* � rQ r8 r9 r: �priorityrR r� r; r� rW rW rX �addRule s& � ��zFirewallDConfig.addRulec C s� t |�}t |�}t |�}t |�}t |�}t�d||||d�|�f � | �|� |||||f}t| �� �}||d vr�ttj d||||f ��|d � |� | � t |�� d S )Nz4config.direct.removeRule('%s', '%s', '%s', %d, '%s')rC r# z rule '%s' is not in '%s:%s:%s') r r r� r" r� r� r� r! r r� r{ r| r* rD rW rW rX � removeRule s& � ��zFirewallDConfig.removeRulec C sd t |�}t |�}t |�}t |�}t |�}t�d||||d�|�f � |||||f}|| �� d v S )Nz3config.direct.queryRule('%s', '%s', '%s', %d, '%s')rC r# �r r r� r" r� )rQ r8 r9 r: rE rR r� r; rW rW rX � queryRule/ s �zFirewallDConfig.queryRulec C s� t |�}t |�}t |�}t�d|||f � | �|� t| �� �}|d d d � D ]2}|||f|d |d |d fkrR|d �|� qR| �t|�� d S )Nz+config.direct.removeRules('%s', '%s', '%s')r# r r ) r r r� r� r� r� r{ r| r* )rQ r8 r9 r: r� r� ZrulerW rW rX � removeRules> s � zFirewallDConfig.removeRulesza(ias)c C s� t |�}t |�}t |�}t�d|||f � g }| �� d D ]>}|d |kr<|d |kr<|d |kr<|�|d |d f� q<|S )Nz(config.direct.getRules('%s', '%s', '%s')r# r r r r( r? )rQ r8 r9 r: r� r� r; rW rW rX �getRulesO s �$zFirewallDConfig.getRulesz a(sssias)c C s t �d� | �� d S )Nzconfig.direct.getAllRules()r# rA r� rW rW rX � getAllRules_ s zFirewallDConfig.getAllRulesZsasc C s� t |�}t |�}t�d|d�|�f � | �|� ||f}t| �� �}||d v rfttj d||f ��|d � |� | � |� d S )Nz(config.direct.addPassthrough('%s', '%s')rC r �passthrough '%s', '%s') r r r� r" r� r� r� r! r r� r� r| �rQ r8 rR r� r; r� rW rW rX �addPassthroughi s � �z FirewallDConfig.addPassthroughc C s� t |�}t |�}t�d|d�|�f � | �|� ||f}t| �� �}||d vrfttj d||f ��|d � |� | � |� d S )Nz+config.direct.removePassthrough('%s', '%s')rC r rM ) r r r� r" r� r� r� r! r r� r{ r| rN rW rW rX �removePassthrough| s � �z!FirewallDConfig.removePassthroughc C s@ t |�}t |�}t�d|d�|�f � ||f}|| �� d v S )Nz*config.direct.queryPassthrough('%s', '%s')rC r rH )rQ r8 rR r� r; rW rW rX �queryPassthrough� s �z FirewallDConfig.queryPassthroughZaasc C sJ t |�}t�d| � g }| �� d D ] }|d |kr&|�|d � q&|S )Nz#config.direct.getPassthroughs('%s')r r r# r? )rQ r8 r� r� r; rW rW rX �getPassthroughs� s z FirewallDConfig.getPassthroughsza(sas)c C s t �d� | �� d S )Nz"config.direct.getAllPassthroughs()r rA r� rW rW rX �getAllPassthroughs� s z"FirewallDConfig.getAllPassthroughs)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)��__name__� __module__� __qualname__�__doc__Z persistentr rO ZPK_ACTION_CONFIGZ default_polkit_auth_requiredr r4 r7 rt ry r8 rg r� r� rh r� r� ri r� r� rk r� r� rf r� r� rj r� r� r r� r� r� r ZPROPERTIES_IFACEr� r r r� rn �signalr� ZPK_ACTION_INFOZINTROSPECTABLE_IFACEr� r� r ZDBUS_SIGNATUREr� r� r� r� r� r� r� r� r� r� r r r r r r r r r rP r r r r r r� r r r r r r� r r r r r r� r r r r# r% r+ r- r� r. r/ r0 r1 r� r2 r3 r4 r r5 r� r r� r r� r| r r� r< r= r> r@ rB rF rG rI rJ rK rL rO rP rQ rR rS � __classcell__rW rW rU rX r" < sN 0 L $�� C �� � � ��� � ��� � ��� � �� � � � � � � � � � ��� � � � � � � � � � � � � � � � � � � � � � �r" )7rG rO Z dbus.serviceZfirewallr Zfirewall.core.baser Zfirewall.core.watcherr Zfirewall.core.loggerr Zfirewall.server.dbusr Zfirewall.server.decoratorsr r r r r r Z firewall.server.config_icmptyper Z firewall.server.config_servicer Zfirewall.server.config_zoner Z firewall.server.config_policyr Z firewall.server.config_ipsetr Z firewall.server.config_helperr Zfirewall.core.io.icmptyper Zfirewall.core.io.ipsetr Zfirewall.core.io.helperr Z#firewall.core.io.lockdown_whitelistr Zfirewall.core.io.directr Zfirewall.dbus_utilsr r r r r r r r r Zfirewall.errorsr! r" rW rW rW rX �<module> s. ( server/__pycache__/config_zone.cpython-39.opt-1.pyc 0000644 00000075223 15025011705 0016157 0 ustar 00 a ���g�� � @ s� d dl Z d dlZ d dlmZ d dlmZmZmZ d dlm Z d dl m Z d dl m Z d dlmZ d dlmZ d d lmZ d d lmZmZmZmZ d d lmZ d d lmZ d d l m Z m Z m Z m Z G dd� de�Z!dS )� N)�config)�dbus_to_python�%dbus_introspection_prepare_properties�!dbus_introspection_add_properties)�Zone)�ifcfg_set_zone_of_interface)�DEFAULT_ZONE_TARGET)� Rich_Rule)�log)�DbusServiceObject)�handle_exceptions�dbus_handle_exceptions�dbus_service_method�dbus_polkit_require_auth)�errors)� FirewallError)�portStr�portInPortRange�coalescePortRange�breakPortRangec s� e Zd ZdZdZejjZe � fdd��Z e dd� �Z e dd� �Z e d d � �Zeejd d d �e d�dd���Zeejddd �e d�dd���Zeejj�eejdd�e d�dd����Zejjejdd�dd � �Zeejj�eejdd �e d�� fd d � ���Zeejjd d �e d�d!d"���Z eejjdd �e d�d#d$���Z d%d&� Z eejjd d�e d�d'd(���Z eejjdd�e d�d)d*���Z eejj�e d�d+d,���Z!ejjejjdd�e d-d.� ��Z"eejj�e d�d/d0���Z#ejjejjdd�e d1d2� ��Z$eejjdd�e d�d3d4���Z%ejjejjdd�e d5d6� ��Z&eejjdd �e d�d7d8���Z'eejjdd�e d�d9d:���Z(eejjdd �e d�d;d<���Z)eejjdd�e d�d=d>���Z*eejjdd �e d�d?d@���Z+eejjdd�e d�dAdB���Z,eejjdd �e d�dCdD���Z-eejjdd�e d�dEdF���Z.eejjdGd �e d�dHdI���Z/eejjdGd�e d�dJdK���Z0eejjdd�e d�dLdM���Z1eejjdd�e d�dNdO���Z2eejjddPd �e d�dQdR���Z3eejjdSd �e d�dTdU���Z4eejjdSd�e d�dVdW���Z5eejjd d�e d�dXdY���Z6eejjd d�e d�dZd[���Z7eejjd dPd �e d�d\d]���Z8eejjdGd �e d�d^d_���Z9eejjdGd�e d�d`da���Z:eejjdd�e d�dbdc���Z;eejjdd�e d�ddde���Z<eejjddPd �e d�dfdg���Z=eejjdSd �e d�dhdi���Z>eejjdSd�e d�djdk���Z?eejjd d�e d�dldm���Z@eejjd d�e d�dndo���ZAeejjd dPd �e d�dpdq���ZBeejjdGd �e d�drds���ZCeejjdGd�e d�dtdu���ZDeejjdd�e d�dvdw���ZEeejjdd�e d�dxdy���ZFeejjddPd �e d�dzd{���ZGeejjdPd �e d�d|d}���ZHeejjdPd�e d�d~d���ZIeejj�e d�d�d����ZJeejj�e d�d�d����ZKeejjdPd �e d�d�d����ZLeejjdPd �e d�d�d����ZMeejjdPd�e d�d�d����ZNeejj�e d�d�d����ZOeejj�e d�d�d����ZPeejjdPd �e d�d�d����ZQeejjd�d �e d�d�d����ZReejjd�d�e d�d�d����ZSeejjd�d�e d�d�d����ZTeejjd�d�e d�d�d����ZUeejjd�dPd �e d�d�d����ZVeejjdGd �e d�d�d����ZWeejjdGd�e d�d�d����ZXeejjdd�e d�d�d����ZYeejjdd�e d�d�d����ZZeejjddPd �e d�d�d����Z[eejjdGd �e d�d�d����Z\eejjdGd�e d�d�d����Z]eejjdd�e d�d�d����Z^eejjdd�e d�d�d����Z_eejjddPd �e d�d�d����Z`eejjdGd �e d�d�d����ZaeejjdGd�e �d d�d����Zbeejjdd�e �dd�d����Zceejjdd�e �dd�d����ZdeejjddPd �e �dd�d����Ze� ZfS ( �FirewallDConfigZonezFirewallD main classTc s` t t| �j|i |�� || _|| _|| _|| _|d | _|d | _d| j | _ t | tj j � d S )Nr � zconfig.zone.%d) �superr �__init__�parentr �obj�item_id�busname�path� _log_prefixr �dbus�DBUS_INTERFACE_CONFIG_ZONE)�selfr Zconf�zoner �args�kwargs�� __class__� �?/usr/lib/python3.9/site-packages/firewall/server/config_zone.pyr 8 s �z FirewallDConfigZone.__init__c C s d S �Nr( �r" r( r( r) �__del__E s zFirewallDConfigZone.__del__c C s | � � d S r* )Zremove_from_connectionr+ r( r( r) � unregisterI s z FirewallDConfigZone.unregisterc C s� |dkrt �| jj�S |dkr,t �| jj�S |dkrBt �| jj�S |dkrXt �| jj�S |dkrnt �| jj�S t j � d| ��d S )N�name�filenamer �default�builtinzDorg.freedesktop.DBus.Error.InvalidArgs: Property '%s' does not exist) r �Stringr r. r/ r ZBooleanr0 r1 � exceptions� DBusException)r" � property_namer( r( r) � _get_propertyQ s ��z!FirewallDConfigZone._get_property�ss�v)� in_signature� out_signatureNc C sL t |t�}t |t�}t�d| j||� |tjjkrBtj� d| ��| � |�S )Nz%s.Get('%s', '%s')�Jorg.freedesktop.DBus.Error.UnknownInterface: Interface '%s' does not exist) r �strr �debug1r r r r! r3 r4 r6 )r" �interface_namer5 �senderr( r( r) �Getb s � ��zFirewallDConfigZone.Get�sza{sv}c C s` t |t�}t�d| j|� |tjjkr6tj� d| ��i }dD ]}| � |�||< q>tj |dd�S )Nz%s.GetAll('%s')r; )r. r/ r r0 r1 �sv�Z signature) r r< r r= r r r r! r3 r4 r6 Z Dictionary)r" r> r? �ret�xr( r( r) �GetAlls s ��zFirewallDConfigZone.GetAllZssv)r9 c C sl t |t�}t |t�}t |�}t�d| j|||� | j�|� |tjj krXtj � d| ��tj � d| ��d S )Nz%s.Set('%s', '%s', '%s')r; zGorg.freedesktop.DBus.Error.PropertyReadOnly: Property '%s' is read-only) r r< r r= r r � accessCheckr r r! r3 r4 )r" r> r5 Z new_valuer? r( r( r) �Set� s$ � ����zFirewallDConfigZone.Setzsa{sv}asrC c C s2 t |t�}t |�}t |�}t�d| j|||� d S )Nz&%s.PropertiesChanged('%s', '%s', '%s'))r r< r r= r )r" r> Zchanged_propertiesZinvalidated_propertiesr( r( r) �PropertiesChanged� s �z%FirewallDConfigZone.PropertiesChanged)r: c s8 t �d| j� tt| ��| j| j�� �}t | |t j j �S )Nz%s.Introspect()) r Zdebug2r r r � Introspectr r Zget_busr r r r! )r" r? �datar& r( r) rJ � s � �z FirewallDConfigZone.Introspectz&(sssbsasa(ss)asba(ssss)asasasasa(ss)b)c C sD t �d| j� | j�| j�}|d tkr@t|�}d|d< t|�}|S )� get settings for zone z%s.getSettings()� r0 ) r r= r r Zget_zone_configr r �list�tuple)r" r? �settings� _settingsr( r( r) � getSettings� s z FirewallDConfigZone.getSettingsc C s4 t �d| j� | j�| j�}|d tkr0d|d< |S )rL z%s.getSettings2()�targetr0 )r r= r r �get_zone_config_dictr r �r" r? rP r( r( r) � getSettings2� s z FirewallDConfigZone.getSettings2c C s | j �| j�}d|v r"t|d �nt� }d|v r<t|d �nt� }t|t�rzt|t�d� �| }t|t�d� �| }nDd|v r�t|d �nt� }d|v r�t|d �nt� }|| }|| }|D ] } | j� | �r�t t j | ��q�|D ] } | j� | �r�t t j | ��q�dS )a Assignment of interfaces/sources to zones is different from other zone settings in the sense that particular interface/zone can be part of only one zone. So make sure added interfaces/sources have not already been bound to another zone.� interfaces�sourcesN)r rT r �set� isinstancerO r Zindex_ofr ZgetZoneOfInterfacer r Z ZONE_CONFLICTZgetZoneOfSource) r" rP Z old_settingsZ old_ifacesZ old_sourcesZ added_ifacesZ added_sourcesZ new_ifacesZ new_sourcesZiface�sourcer( r( r) � _checkDuplicateInterfacesSources� s z4FirewallDConfigZone._checkDuplicateInterfacesSourcesc C st t |�}t�d| j� | j�|� |d dkrFt|�}t|d< t|�}| � |� | j � | j |�| _ | � | j j� dS )�!update settings for zone z%s.update('...')rM r0 N)r r r= r r rG rN r rO r\ r Zset_zone_configr �Updatedr. )r" rP r? rQ r( r( r) �update� s zFirewallDConfigZone.updatec C sl t |�}t�d| j� | j�|� d|v r>|d dkr>t|d< | �|� | j� | j |�| _ | � | j j � dS )r] z%s.update2('...')rS r0 N) r r r= r r rG r r\ r Zset_zone_config_dictr r^ r. )r" rP r? r( r( r) �update2� s zFirewallDConfigZone.update2c C s< t �d| j� | j�|� | j�| j�| _| �| jj � dS )z/load default settings for builtin zone z%s.loadDefaults()N) r r= r r rG r Zload_zone_defaultsr r^ r. �r" r? r( r( r) � loadDefaults s z FirewallDConfigZone.loadDefaultsc C s t �d| j|f � d S )Nz%s.Updated('%s')�r r= r �r" r. r( r( r) r^ s zFirewallDConfigZone.Updatedc C s: t �d| j� | j�|� | j�| j� | j�| j� dS )zremove zone z%s.removeZone()N) r r= r r rG r Z remove_zoner Z removeZonera r( r( r) �remove s zFirewallDConfigZone.removec C s t �d| j|f � d S )Nz%s.Removed('%s')rc rd r( r( r) �Removed s zFirewallDConfigZone.Removedc C sF t |t�}t�d| j|� | j�|� | j�| j |�| _ | � |� dS )zrename zone z%s.rename('%s')N) r r< r r= r r rG r Z rename_zoner �Renamed)r" r. r? r( r( r) �rename% s zFirewallDConfigZone.renamec C s t �d| j|f � d S )Nz%s.Renamed('%s')rc rd r( r( r) rg 1 s zFirewallDConfigZone.Renamedc C s t �d| j� | �� d S )Nz%s.getVersion()r �r r= r rR ra r( r( r) � getVersion8 s z FirewallDConfigZone.getVersionc C sH t |t�}t�d| j|� | j�|� t| �� �}||d< | � |� d S )Nz%s.setVersion('%s')r � r r< r r= r r rG rN rR r_ )r" �versionr? rP r( r( r) � setVersion? s z FirewallDConfigZone.setVersionc C s t �d| j� | �� d S )Nz %s.getShort()r ri ra r( r( r) �getShortL s z FirewallDConfigZone.getShortc C sH t |t�}t�d| j|� | j�|� t| �� �}||d< | � |� d S )Nz%s.setShort('%s')r rk )r" Zshortr? rP r( r( r) �setShortS s z FirewallDConfigZone.setShortc C s t �d| j� | �� d S )Nz%s.getDescription()� ri ra r( r( r) �getDescription` s z"FirewallDConfigZone.getDescriptionc C sH t |t�}t�d| j|� | j�|� t| �� �}||d< | � |� d S )Nz%s.setDescription('%s')rp rk )r" � descriptionr? rP r( r( r) �setDescriptiong s z"FirewallDConfigZone.setDescriptionc C s. t �d| j� | �� }|d tkr*|d S dS )Nz%s.getTarget()rM r0 )r r= r rR r rU r( r( r) � getTargetw s z FirewallDConfigZone.getTargetc C sT t |t�}t�d| j|� | j�|� t| �� �}|dkr>|nt |d< | � |� d S )Nz%s.setTarget('%s')r0 rM ) r r< r r= r r rG rN rR r r_ )r" rS r? rP r( r( r) � setTarget s z FirewallDConfigZone.setTarget�asc C s t �d| j� | �� d S )Nz%s.getServices()� ri ra r( r( r) � getServices� s z FirewallDConfigZone.getServicesc C sN t |t�}t�d| jd�|�� | j�|� t| �� �}||d< | � |� d S )Nz%s.setServices('[%s]')�,rw � r rN r r= r �joinr rG rR r_ )r" Zservicesr? rP r( r( r) � setServices� s � z FirewallDConfigZone.setServicesc C sf t |t�}t�d| j|� | j�|� t| �� �}||d v rJt t j |��|d � |� | � |� d S )Nz%s.addService('%s')rw �r r< r r= r r rG rN rR r r �ALREADY_ENABLED�appendr_ �r" �servicer? rP r( r( r) � addService� s z FirewallDConfigZone.addServicec C sf t |t�}t�d| j|� | j�|� t| �� �}||d vrJt t j |��|d � |� | � |� d S )Nz%s.removeService('%s')rw �r r< r r= r r rG rN rR r r � NOT_ENABLEDre r_ r� r( r( r) � removeService� s z!FirewallDConfigZone.removeService�bc C s* t |t�}t�d| j|� || �� d v S )Nz%s.queryService('%s')rw �r r< r r= r rR )r" r� r? r( r( r) � queryService� s z FirewallDConfigZone.queryServiceza(ss)c C s t �d| j� | �� d S )Nz %s.getPorts()� ri ra r( r( r) �getPorts� s z FirewallDConfigZone.getPortsc C s� g }t |t�D ](}t|t�r,|�t|�� q|�|� q|}t�d| jd�dd� |D ��� | j � |� t| � � �}||d< | � |� d S )Nz%s.setPorts('[%s]')ry c s s" | ]}d |d |d f V qdS �z ('%s, '%s')r r Nr( ��.0�portr( r( r) � <genexpr>� � z/FirewallDConfigZone.setPorts.<locals>.<genexpr>r� � r rN rZ r rO r r= r r{ r rG rR r_ �r" Zportsr? Z_portsr� rP r( r( r) �setPorts� s � z FirewallDConfigZone.setPortsc s� t |t�}t � t�� t�d| j|� � | j�|� t| �� �}tt � fdd�|d ��}|D ]&}t ||d �r\t t j d|� f ��q\t|dd� |D ��\}}|D ] } |d �t| d �� f� q�|D ] } |d �t| d �� f� q�| �|� d S ) Nz%s.addPort('%s', '%s')c s | d � kS �Nr r( �rE ��protocolr( r) �<lambda>� r� z-FirewallDConfigZone.addPort.<locals>.<lambda>r� r �%s:%sc S s g | ] \}}|�qS r( r( �r� �_port� _protocolr( r( r) � <listcomp>� r� z/FirewallDConfigZone.addPort.<locals>.<listcomp>�-�r r< r r= r r rG rN rR �filterr r r r~ r re r r r_ � r" r� r� r? rP Zexisting_port_idsZport_idZ added_rangesZremoved_ranges�ranger( r� r) �addPort� s& � �zFirewallDConfigZone.addPortc s� t |t�}t � t�� t�d| j|� � | j�|� t| �� �}tt � fdd�|d ��}|D ]}t ||d �r\ q�q\t t j d|� f ��t|dd� |D ��\}}|D ] } |d �t| d �� f� q�|D ] } |d �t| d �� f� q�| �|� d S ) Nz%s.removePort('%s', '%s')c s | d � kS r� r( r� r� r( r) r� � r� z0FirewallDConfigZone.removePort.<locals>.<lambda>r� r r� c S s g | ] \}}|�qS r( r( r� r( r( r) r� r� z2FirewallDConfigZone.removePort.<locals>.<listcomp>r� �r r< r r= r r rG rN rR r� r r r r� r re r r r_ r� r( r� r) � removePort� s$ � z FirewallDConfigZone.removePortc C sX t |t�}t |t�}t�d| j||� | �� d D ] \}}t||�r2||kr2 dS q2dS )Nz%s.queryPort('%s', '%s')r� TF�r r< r r= r rR r �r" r� r� r? r� r� r( r( r) � queryPort s �z FirewallDConfigZone.queryPortc C s t �d| j� | �� d S )Nz%s.getProtocols()� ri ra r( r( r) � getProtocols s z FirewallDConfigZone.getProtocolsc C sN t |t�}t�d| jd�|�� | j�|� t| �� �}||d< | � |� d S )Nz%s.setProtocols('[%s]')ry r� rz )r" Z protocolsr? rP r( r( r) � setProtocols! s � z FirewallDConfigZone.setProtocolsc C sf t |t�}t�d| j|� | j�|� t| �� �}||d v rJt t j |��|d � |� | � |� d S )Nz%s.addProtocol('%s')r� r} �r" r� r? rP r( r( r) � addProtocol- s z FirewallDConfigZone.addProtocolc C sf t |t�}t�d| j|� | j�|� t| �� �}||d vrJt t j |��|d � |� | � |� d S )Nz%s.removeProtocol('%s')r� r� r� r( r( r) �removeProtocol: s z"FirewallDConfigZone.removeProtocolc C s* t |t�}t�d| j|� || �� d v S )Nz%s.queryProtocol('%s')r� r� )r" r� r? r( r( r) � queryProtocolG s z!FirewallDConfigZone.queryProtocolc C s t �d| j� | �� d S )Nz%s.getSourcePorts()� ri ra r( r( r) �getSourcePortsQ s z"FirewallDConfigZone.getSourcePortsc C s� g }t |t�D ](}t|t�r,|�t|�� q|�|� q|}t�d| jd�dd� |D ��� | j � |� t| � � �}||d< | � |� d S )Nz%s.setSourcePorts('[%s]')ry c s s" | ]}d |d |d f V qdS r� r( r� r( r( r) r� e r� z5FirewallDConfigZone.setSourcePorts.<locals>.<genexpr>r� r� r� r( r( r) �setSourcePortsX s � z"FirewallDConfigZone.setSourcePortsc s� t |t�}t � t�� t�d| j|� � | j�|� t| �� �}tt � fdd�|d ��}|D ]&}t ||d �r\t t j d|� f ��q\t|dd� |D ��\}}|D ] } |d �t| d �� f� q�|D ] } |d �t| d �� f� q�| �|� d S ) Nz %s.addSourcePort('%s', '%s')c s | d � kS r� r( r� r� r( r) r� u r� z3FirewallDConfigZone.addSourcePort.<locals>.<lambda>r� r r� c S s g | ] \}}|�qS r( r( r� r( r( r) r� z r� z5FirewallDConfigZone.addSourcePort.<locals>.<listcomp>r� r� r� r( r� r) � addSourcePortk s& � �z!FirewallDConfigZone.addSourcePortc s� t |t�}t � t�� t�d| j|� � | j�|� t| �� �}tt � fdd�|d ��}|D ]}t ||d �r\ q�q\t t j d|� f ��t|dd� |D ��\}}|D ] } |d �t| d �� f� q�|D ] } |d �t| d �� f� q�| �|� d S ) Nz %s.removeSourcePort('%s', '%s')c s | d � kS r� r( r� r� r( r) r� � r� z6FirewallDConfigZone.removeSourcePort.<locals>.<lambda>r� r r� c S s g | ] \}}|�qS r( r( r� r( r( r) r� � r� z8FirewallDConfigZone.removeSourcePort.<locals>.<listcomp>r� r� r� r( r� r) �removeSourcePort� s$ � z$FirewallDConfigZone.removeSourcePortc C sX t |t�}t |t�}t�d| j||� | �� d D ] \}}t||�r2||kr2 dS q2dS )Nz %s.querySourcePort('%s', '%s')r� TFr� r� r( r( r) �querySourcePort� s �z#FirewallDConfigZone.querySourcePortc C s t �d| j� | �� d S )Nz%s.getIcmpBlocks()� ri ra r( r( r) � getIcmpBlocks� s z!FirewallDConfigZone.getIcmpBlocksc C sN t |t�}t�d| jd�|�� | j�|� t| �� �}||d< | � |� d S )Nz%s.setIcmpBlocks('[%s]')ry r� rz )r" Z icmptypesr? rP r( r( r) � setIcmpBlocks� s � z!FirewallDConfigZone.setIcmpBlocksc C sf t |t�}t�d| j|� | j�|� t| �� �}||d v rJt t j |��|d � |� | � |� d S )Nz%s.addIcmpBlock('%s')r� r} �r" �icmptyper? rP r( r( r) � addIcmpBlock� s z FirewallDConfigZone.addIcmpBlockc C sf t |t�}t�d| j|� | j�|� t| �� �}||d vrJt t j |��|d � |� | � |� d S )Nz%s.removeIcmpBlock('%s')r� r� r� r( r( r) �removeIcmpBlock� s z#FirewallDConfigZone.removeIcmpBlockc C s* t |t�}t�d| j|� || �� d v S )Nz%s.queryIcmpBlock('%s')r� r� )r" r� r? r( r( r) �queryIcmpBlock� s z"FirewallDConfigZone.queryIcmpBlockc C s t �d| j� | �� d S )Nz%s.getIcmpBlockInversion()� ri ra r( r( r) �getIcmpBlockInversion� s z)FirewallDConfigZone.getIcmpBlockInversionc C sH t |t�}t�d| j|� | j�|� t| �� �}||d< | � |� d S )Nz %s.setIcmpBlockInversion('%s')r� � r �boolr r= r r rG rN rR r_ )r" �flagr? rP r( r( r) �setIcmpBlockInversion� s z)FirewallDConfigZone.setIcmpBlockInversionc C sP t �d| j� | j�|� t| �� �}|d r:ttj d��d|d< | � |� d S )Nz%s.addIcmpBlockInversion()r� �icmp-block-inversionT� r r= r r rG rN rR r r r~ r_ rU r( r( r) �addIcmpBlockInversion� s z)FirewallDConfigZone.addIcmpBlockInversionc C sP t �d| j� | j�|� t| �� �}|d s:ttj d��d|d< | � |� d S )Nz %s.removeIcmpBlockInversion()r� r� F� r r= r r rG rN rR r r r� r_ rU r( r( r) �removeIcmpBlockInversion� s z,FirewallDConfigZone.removeIcmpBlockInversionc C s t �d| j� | �� d S )Nz %s.queryIcmpBlockInversion()r� ri ra r( r( r) �queryIcmpBlockInversion s z+FirewallDConfigZone.queryIcmpBlockInversionc C s t �d| j� | �� d S )Nz%s.getMasquerade()� ri ra r( r( r) � getMasquerade s z!FirewallDConfigZone.getMasqueradec C sH t |t�}t�d| j|� | j�|� t| �� �}||d< | � |� d S )Nz%s.setMasquerade('%s')r� r� )r" � masquerader? rP r( r( r) � setMasquerade s z!FirewallDConfigZone.setMasqueradec C sP t �d| j� | j�|� t| �� �}|d r:ttj d��d|d< | � |� d S )Nz%s.addMasquerade()r� r� Tr� rU r( r( r) � addMasquerade" s z!FirewallDConfigZone.addMasqueradec C sP t �d| j� | j�|� t| �� �}|d s:ttj d��d|d< | � |� d S )Nz%s.removeMasquerade()r� r� Fr� rU r( r( r) �removeMasquerade- s z$FirewallDConfigZone.removeMasqueradec C s t �d| j� | �� d S )Nz%s.queryMasquerade()r� ri ra r( r( r) �queryMasquerade8 s z#FirewallDConfigZone.queryMasqueradeza(ssss)c C s t �d| j� | �� d S )Nz%s.getForwardPorts()� ri ra r( r( r) �getForwardPortsA s z#FirewallDConfigZone.getForwardPortsc C s� g }t |t�D ](}t|t�r,|�t|�� q|�|� q|}t�d| jd�dd� |D ��� | j � |� t| � � �}||d< | � |� d S )Nz%s.setForwardPorts('[%s]')ry c s s. | ]&}d |d |d |d |d f V qdS )z('%s, '%s', '%s', '%s')r r rp � Nr( r� r( r( r) r� U s � �z6FirewallDConfigZone.setForwardPorts.<locals>.<genexpr>r� r� r� r( r( r) �setForwardPortsH s �� z#FirewallDConfigZone.setForwardPortsZssssc C s� t |t�}t |t�}t |t�}t |t�}t�d| j||||� | j�|� ||t|�t|�f}t| �� �}||d v r�t t j d||||f ��|d � |� | � |� d S )Nz)%s.addForwardPort('%s', '%s', '%s', '%s')r� � %s:%s:%s:%sr} �r" r� r� �toport�toaddrr? �fwp_idrP r( r( r) �addForwardPort\ s$ � ��z"FirewallDConfigZone.addForwardPortc C s� t |t�}t |t�}t |t�}t |t�}t�d| j||||� | j�|� ||t|�t|�f}t| �� �}||d vr�t t j d||||f ��|d � |� | � |� d S )Nz,%s.removeForwardPort('%s', '%s', '%s', '%s')r� r� r� r� r( r( r) �removeForwardPortp s$ � ��z%FirewallDConfigZone.removeForwardPortc C sb t |t�}t |t�}t |t�}t |t�}t�d| j||||� ||t|�t|�f}|| �� d v S )Nz+%s.queryForwardPort('%s', '%s', '%s', '%s')r� r� )r" r� r� r� r� r? r� r( r( r) �queryForwardPort� s �z$FirewallDConfigZone.queryForwardPortc C s t �d| j� | �� d S )Nz%s.getInterfaces()� ri ra r( r( r) � getInterfaces� s z!FirewallDConfigZone.getInterfacesc C sN t |t�}t�d| jd�|�� | j�|� t| �� �}||d< | � |� d S )Nz%s.setInterfaces('[%s]')ry r� rz )r" rW r? rP r( r( r) � setInterfaces� s � z!FirewallDConfigZone.setInterfacesc C st t |t�}t�d| j|� | j�|� t| �� �}||d v rJt t j |��|d � |� | � |� t| jj|� d S )Nz%s.addInterface('%s')r� )r r< r r= r r rG rN rR r r r~ r r_ r r r. �r" � interfacer? rP r( r( r) � addInterface� s z FirewallDConfigZone.addInterfacec C sp t |t�}t�d| j|� | j�|� t| �� �}||d vrJt t j |��|d � |� | � |� td|� d S )Nz%s.removeInterface('%s')r� � )r r< r r= r r rG rN rR r r r� re r_ r r� r( r( r) �removeInterface� s z#FirewallDConfigZone.removeInterfacec C s* t |t�}t�d| j|� || �� d v S )Nz%s.queryInterface('%s')r� r� )r" r� r? r( r( r) �queryInterface� s z"FirewallDConfigZone.queryInterfacec C s t �d| j� | �� d S )Nz%s.getSources()� ri ra r( r( r) � getSources� s z FirewallDConfigZone.getSourcesc C sN t |t�}t�d| jd�|�� | j�|� t| �� �}||d< | � |� d S )Nz%s.setSources('[%s]')ry r� rz )r" rX r? rP r( r( r) � setSources� s � z FirewallDConfigZone.setSourcesc C sf t |t�}t�d| j|� | j�|� t| �� �}||d v rJt t j |��|d � |� | � |� d S )Nz%s.addSource('%s')r� r} �r" r[ r? rP r( r( r) � addSource� s z FirewallDConfigZone.addSourcec C sf t |t�}t�d| j|� | j�|� t| �� �}||d vrJt t j |��|d � |� | � |� d S )Nz%s.removeSource('%s')r� r� r� r( r( r) � removeSource� s z FirewallDConfigZone.removeSourcec C s* t |t�}t�d| j|� || �� d v S )Nz%s.querySource('%s')r� r� )r" r[ r? r( r( r) � querySource� s z FirewallDConfigZone.querySourcec C s t �d| j� | �� d S )Nz%s.getRichRules()� ri ra r( r( r) � getRichRules s z FirewallDConfigZone.getRichRulesc C s\ t |t�}t�d| jd�|�� | j�|� t| �� �}dd� |D �}||d< | � |� d S )Nz%s.setRichRules('[%s]')ry c S s g | ]}t t|d ���qS )��rule_str)r< r )r� �rr( r( r) r� r� z4FirewallDConfigZone.setRichRules.<locals>.<listcomp>r� rz )r" Zrulesr? rP r( r( r) � setRichRules s � z FirewallDConfigZone.setRichRulesc C st t |t�}t�d| j|� | j�|� t| �� �}tt |d��}||d v rXt t j |��|d � |� | �|� d S )Nz%s.addRichRule('%s')r� r� )r r< r r= r r rG rN rR r r r r~ r r_ �r" �ruler? rP r� r( r( r) � addRichRule s z FirewallDConfigZone.addRichRulec C st t |t�}t�d| j|� | j�|� t| �� �}tt |d��}||d vrXt t j |��|d � |� | �|� d S )Nz%s.removeRichRule('%s')r� r� )r r< r r= r r rG rN rR r r r r� re r_ r� r( r( r) �removeRichRule) s z"FirewallDConfigZone.removeRichRulec C s8 t |t�}t�d| j|� tt|d��}|| �� d v S )Nz%s.queryRichRule('%s')r� r� )r r< r r= r r rR )r" r� r? r� r( r( r) � queryRichRule7 s z!FirewallDConfigZone.queryRichRule)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)g�__name__� __module__� __qualname__�__doc__Z persistentr r ZPK_ACTION_CONFIGZ default_polkit_auth_requiredr r r r, r- r6 r ZPROPERTIES_IFACEr@ rF r rH r� �signalrI ZPK_ACTION_INFOZINTROSPECTABLE_IFACErJ r! rR rV r\ r_ r` rb r^ re rf rh rg rj rm rn ro rq rs rt ru rx r| r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� � __classcell__r( r( r& r) r 0 s� �� � � �� � �� �� �� �� �� � � ������ �� � � ������ �� � � ��� ��� ������ �� � � ��� � � ��� � � �r )"r Z dbus.serviceZfirewallr Zfirewall.dbus_utilsr r r Zfirewall.core.io.zoner Zfirewall.core.fw_ifcfgr Zfirewall.core.baser Zfirewall.core.richr Zfirewall.core.loggerr Zfirewall.server.dbusr Zfirewall.server.decoratorsr r r r r Zfirewall.errorsr Zfirewall.functionsr r r r r r( r( r( r) �<module> s server/__pycache__/__init__.cpython-39.pyc 0000644 00000000227 15025011705 0014447 0 ustar 00 a ���g � @ s d S )N� r r r �</usr/lib/python3.9/site-packages/firewall/server/__init__.py�<module> � server/__pycache__/server.cpython-39.opt-1.pyc 0000644 00000004413 15025011705 0015156 0 ustar 00 a ���gY � @ st d gZ ddlZddlmZ ddlZddlZddlZddlmZ ddl m Z ddl m Z dd� Z d d � Zd d d �ZdS )� run_server� N)�GLib)�config)�log)� FirewallDc C s | � � dS )NT)�reload)�service� r �:/usr/lib/python3.9/site-packages/firewall/server/server.py�sighup0 s r c C s | � � d S )N)�quit)�mainloopr r r �sigterm4 s r Fc sf d}| rFddl m� ddl� � �� � �� j� d�� ���fdd��z�tjjj dd� t� � }tj j t jj|d �}t|t jj�}t�� }| r�t���� ttd �r�tj}ntj}|tjtjt|� |tjtjt |� |� � W nr t y� t � d � Y nX t!�y t �"d � Y n< t#�yR } z"t �"d |j$j%t&|�� W Y d}~n d}~0 0 |�rb|�'� dS )zI Main function for firewall server. Handles D-Bus and GLib mainloop. Nr )�pformat� c sn � � � t� j�dkr^td� tdt� j� � � jD ] } tt| �d� t�| �� q6td� t���� d S )Nr zP >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> zGARBAGE OBJECTS (%d): z zP <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<< )Zcollect�lenZgarbage�print�typer �timeout_add_seconds)�x��gc� gc_collectZ gc_timeoutr r r r H s z run_server.<locals>.gc_collectT)Zset_as_default)�bus�unix_signal_addz Stopping..z Raising SystemExit in run_serverzException %s: %s)(Zpprintr r �enableZ set_debugZ DEBUG_LEAK�dbusr ZglibZ DBusGMainLoopZ SystemBusr ZBusNamer ZDBUS_INTERFACEr Z DBUS_PATHr ZMainLoopr �hasattrr Zunix_signal_add_fullZ PRIORITY_HIGH�signal�SIGHUPr �SIGTERMr �run�KeyboardInterruptr Zdebug1� SystemExit�error� Exception� __class__�__name__�str�stop)Zdebug_gcr r �namer r �er r r r = sD � � ,)F)�__all__r Z gi.repositoryr r Z dbus.serviceZdbus.mainloop.glibZfirewallr Zfirewall.core.loggerr Zfirewall.server.firewalldr r r r r r r r �<module> s server/__pycache__/config.cpython-39.pyc 0000644 00000127632 15025011705 0014167 0 ustar 00 a ���gt � @ sL d dl Z d dlZd dlZd dlmZ d dlmZ d dlmZ d dl m Z d dl m Z d dl mZmZmZmZmZmZ d dlmZ d d lmZ d d lmZ d d lmZ d d l m Z d d l m Z d dl m!Z! d dl"m#Z# d dl$m%Z% d dl&m'Z' d dl(m)Z) d dl*m+Z+m,Z,m-Z-m.Z.m/Z/m0Z0m1Z1m2Z2 d dlm3Z3 d dl4m5Z5 G dd� de �Z6dS )� N)�config)�DEFAULT_ZONE_TARGET)�Watcher)�log)�DbusServiceObject)�handle_exceptions�dbus_handle_exceptions�dbus_service_method� dbus_service_method_deprecated� dbus_service_signal_deprecated�dbus_polkit_require_auth)�FirewallDConfigIcmpType)�FirewallDConfigService)�FirewallDConfigZone)�FirewallDConfigPolicy)�FirewallDConfigIPSet)�FirewallDConfigHelper)�IcmpType)�IPSet)�Helper)�LockdownWhitelist)�Direct)�dbus_to_python�command_of_sender�context_of_sender� uid_of_sender� user_of_uid�%dbus_introspection_prepare_properties�!dbus_introspection_add_properties�!dbus_introspection_add_deprecated)�errors)� FirewallErrorc s e Zd ZdZdZejjZe � fdd��Z e dd� �Z e dd� �Z e d d � �Z e d d � �Ze d d� �Ze dd� �Ze dd� �Ze dd� �Ze dd� �Ze dd� �Ze dd� �Ze dd � �Ze d d � �Ze d d � �Ze d!d"� �Ze d#d$� �Ze d%d&� �Ze d'd(� �Z e d)d*� �Z e d+d,� �Z e d-d.� �Z e d/d0� �Z e!d1d2� �Z"e!d3d4� �Z#e!d5d6� �Z$e%ej&d7d8d9�e!d�d;d<���Z'e%ej&d=d>d9�e!d�d?d@���Z(e)ejj�e%ej&dAdB�e!d�dCdD����Z*ej+j,ej&dEdF�dGdH� �Z-e)ejj.�e%ej/d=dI�e!d� fdJdK� ���Z0e%ejj1e2j3dI�e!d�dLdM���Z4e%ejj1e2j3dB�e!d�dNdO���Z5ej+�,ejj1�e!dPdQ� ��Z6e%ejj1d=dB�e!d�dRdS���Z7e%ejj1d=dB�e!d�dTdU���Z8e%ejj1d=dVd9�e!d�dWdX���Z9e%ejj1dYdI�e!d�dZd[���Z:e%ejj1d=dB�e!d�d\d]���Z;e%ejj1d=dB�e!d�d^d_���Z<e%ejj1d=dVd9�e!d�d`da���Z=e%ejj1dYdI�e!d�dbdc���Z>e%ejj1d=dB�e!d�ddde���Z?e%ejj1d=dB�e!d�dfdg���Z@e%ejj1d=dVd9�e!d�dhdi���ZAe%ejj1dYdI�e!d�djdk���ZBe%ejj1dldB�e!�d dmdn���ZCe%ejj1dldB�e!�ddodp���ZDe%ejj1dldVd9�e!�ddqdr���ZEe%ejj1dsdI�e!�ddtdu���ZFe%ejjGdvdI�e!�ddwdx���ZHe%ejjGdYdI�e!�ddydz���ZIe%ejjGd=d{d9�e!�dd|d}���ZJe%ejjGd=eKj3 d{d9�e!�dd~d���ZLej+j,ejjGd=dF�e!d�d�� ��ZMe%ejjGdvdI�e!�dd�d����ZNe%ejjGdYdI�e!�d d�d����ZOe%ejjGd=d{d9�e!�d d�d����ZPe%ejjGd=eQj3 d{d9�e!�d d�d����ZRej+j,ejjGd=dF�e!d�d�� ��ZSe%ejjGdvdI�e!�d d�d����ZTe%ejjGdYdI�e!�d d�d����ZUe%ejjGd=d{d9�e!�dd�d����ZVe%ejjGd�d{d9�e!�dd�d����ZWe%ejjGd�d{d9�e!�dd�d����ZXej+j,ejjGd=dF�e!d�d�� ��ZYe%ejjGdvdI�e!�dd�d����ZZe%ejjGdYdI�e!�dd�d����Z[e%ejjGd=d{d9�e!�dd�d����Z\e%ejjGd=d=d9�e!�dd�d����Z]e%ejjGd=d=d9�e!�dd�d����Z^e%ejjGd�d{d9�e!�dd�d����Z_e%ejjGd�d{d9�e!�dd�d����Z`ej+j,ejjGd=dF�e!d�d�� ��Zae%ejjGdvdI�e!�dd�d����Zbe%ejjGdYdI�e!�dd�d����Zce%ejjGd=d{d9�e!�dd�d����Zde%ejjGd�d{d9�e!�dd�d����Zeej+j,ejjGd=dF�e!d�d�� ��Zfe%ejjGdvdI�e!�d d�d����Zge%ejjGdYdI�e!�d d�d����Zhe%ejjGd=d{d9�e!�d d�d����Zie%ejjGd=ejj3 d{d9�e!�d d�d����Zkej+j,ejjGd=dF�e!d�d�� ��Zlemejjn�e%ejjneoj3dI�e!�d d�d�����Zpemejjn�e%ejjneoj3dB�e!�d!d�d���Zqerejjn�ej+�,ejjn�e!d�dĄ ���Zsemejjn�e%ejjnd�dB�e!�d"d�dDŽ���Ztemejjn�e%ejjnd�dB�e!�d#d�dɄ���Zuemejjn�e%ejjnd�dVd9�e!�d$d�d˄���Zvemejjn�e%ejjnd7dYd9�e!�d%d�d̈́���Zwemejjn�e%ejjnd�d�d9�e!�d&d�dф���Zxemejjn�e%ejjnd�dB�e!�d'd�dԄ���Zyemejjn�e%ejjnd�dB�e!�d(d�dք���Zzemejjn�e%ejjnd�dVd9�e!�d)d�d���Z{emejjn�e%ejjnd�dB�e!�d*d�dڄ���Z|emejjn�e%ejjnd�d�d9�e!�d+d�d݄���Z}emejjn�e%ejjnd�d�d9�e!�d,d�d����Z~emejjn�e%ejjnd�dB�e!�d-d�d����Zemejjn�e%ejjnd�dB�e!�d.d�d����Z�emejjn�e%ejjnd�dVd9�e!�d/d�d����Z�emejjn�e%ejjnd=d�d9�e!�d0d�d����Z�emejjn�e%ejjnd�dI�e!�d1d�d����Z�� Z�S (2 �FirewallDConfigzFirewallD main classTc s� t t| �j|i |�� || _|d | _|d | _| �� t| jd�| _ | j � tj � | j � tj � | j � tj � | j � tj� | j � tj� | j � tj� | j � tj� | j � tj� | j � tj� | j � tj� | j � tj� | j � tj� tj�tj��r>tt�tj��D ].}dtj|f }tj�|��r| j � |� �q| j � tj � | j � tj � | j � tj � t | tj!j"ddddddddddddddd�� d S )Nr � � z%s/%sZ readwrite)� CleanupOnExit�CleanupModulesOnExit� IPv6_rpfilter�IPv6_rpfilter2�Lockdown� MinimalMark�IndividualCalls� LogDenied�AutomaticHelpers�FirewallBackend�FlushAllOnReload� RFC3964_IPv4�AllowZoneDrifting�NftablesTableOwner)#�superr" �__init__r �busname�path� _init_varsr � watch_updater�watcher� add_watch_dir�FIREWALLD_IPSETS�ETC_FIREWALLD_IPSETS�FIREWALLD_ICMPTYPES�ETC_FIREWALLD_ICMPTYPES�FIREWALLD_HELPERS�ETC_FIREWALLD_HELPERS�FIREWALLD_SERVICES�ETC_FIREWALLD_SERVICES�FIREWALLD_ZONES�ETC_FIREWALLD_ZONES�FIREWALLD_POLICIES�ETC_FIREWALLD_POLICIES�os�exists�sorted�listdir�isdirZadd_watch_file�LOCKDOWN_WHITELIST�FIREWALLD_DIRECT�FIREWALLD_CONFr �dbus�DBUS_INTERFACE_CONFIG)�selfZconf�args�kwargs�filenamer6 �� __class__� �:/usr/lib/python3.9/site-packages/firewall/server/config.pyr4 D sV ��zFirewallDConfig.__init__c C s g | _ d| _g | _d| _g | _d| _g | _d| _g | _d| _ g | _ d| _ | j � � D ]}| �| j �|�� qR| j �� D ]}| �| j �|�� qt| j �� D ]}| �| j �|�� q�| j �� D ]}| �| j �|�� q�| j �� D ]}| �| j �|�� q�| j � � D ]}| � | j � |�� q�d S �Nr ) �ipsets� ipset_idx� icmptypes� icmptype_idx�services� service_idx�zones�zone_idx�helpers� helper_idx�policy_objects�policy_object_idxr Z get_ipsets� _addIPSetZ get_ipsetZ get_icmptypes� _addIcmpTypeZ get_icmptypeZ get_services� _addServiceZ get_serviceZ get_zones�_addZoneZget_zoneZ get_helpers� _addHelperZ get_helperZget_policy_objects� _addPolicyZget_policy_object)rQ �ipset�icmptype�service�zone�helper�policyrW rW rX r7 u s0 zFirewallDConfig._init_varsc C s d S �NrW �rQ rW rW rX �__del__� s zFirewallDConfig.__del__c C s� t | j�dkr$| j�� }|�� ~q t | j�dkrH| j�� }|�� ~q$t | j�dkrl| j�� }|�� ~qHt | j�dkr�| j�� }|�� ~qlt | j�dkr�| j�� }|�� ~q�t | j�dkr�| j�� }|�� ~q�| � � d S rY ) �lenrZ �pop� unregisterr\ r^ r` rb rd r7 )rQ �itemrW rW rX �reload� s2 zFirewallDConfig.reloadc C s~ |t jkr�| �t jj�}t�dt j� z| j �� W n8 tyl } z t� d||f � W Y d }~d S d }~0 0 | �t jj�� � }t |� � �D ]"}||v r�|| || kr�||= q�t |�dkr�| �t jj|g � d S |�t j�s�|�t j��r�|�d��r�z| j �|�\}}W n: t�yF } z t� d||f � W Y d }~d S d }~0 0 |dk�r^| �|� n*|dk�rt| �|� n|dk�rz| �|� �n�|�t j��s�|�t j��rH|�d��rHz| j �|�\}}W n: t�y } z t� d ||f � W Y d }~d S d }~0 0 |dk�r| �|� n*|dk�r0| �|� n|dk�rz| � |� �n2|�t j ��sd|�t j ��r�|�d��rz| j � |�\}}W n: t�y� } z t� d ||f � W Y d }~d S d }~0 0 |dk�r�| � |� n*|dk�r�| �!|� n|dk�r�| �"|� n�|�t j ��rz|�#t j d ��$d �}t |�d k �s<d |v �r@d S t%j&�'|��rj| j(�)|��s�| j(�*|� n| j(�)|��rz| j(�+|� �n�|�t j,��s�|�t j-��rD|�d��rDz| j �.|�\}}W n: t�y� } z t� d||f � W Y d }~d S d }~0 0 |dk�r| �/|� n*|dk�r,| �0|� n|dk�rz| �1|� �n6|�t j2��s`|�t j3��r |�d��r z| j �4|�\}}W n: t�y� } z t� d||f � W Y d }~d S d }~0 0 |dk�r�| �5|� n*|dk�r�| �6|� n|dk�rz| �7|� �nz|t j8k�rbz| j �9� W n: t�yT } z t� d||f � W Y d }~d S d }~0 0 | �:� �n|t j;k�r�z| j �<� W n: t�y� } z t� d||f � W Y d }~d S d }~0 0 | �=� n�|�t j>��s�|�t j?��rz|�d��rzz| j �@|�\}}W n: t�y8 } z t� d||f � W Y d }~d S d }~0 0 |dk�rP| �A|� n*|dk�rf| �B|� n|dk�rz| �C|� d S )Nz,config: Reloading firewalld config file '%s'z+Failed to load firewalld.conf file '%s': %sr z.xmlz%Failed to load icmptype file '%s': %s�new�remove�updatez$Failed to load service file '%s': %sz!Failed to load zone file '%s': %s� �/r# z"Failed to load ipset file '%s': %sz#Failed to load helper file '%s': %sz/Failed to load lockdown whitelist file '%s': %sz)Failed to load direct rules file '%s': %sz#Failed to load policy file '%s': %s)Dr rN �GetAllrO rP r �debug1Zupdate_firewalld_conf� Exception�error�copy�list�keysru �PropertiesChanged� startswithr= r> �endswithZupdate_icmptype_from_pathrg �removeIcmpType�_updateIcmpTyperA rB Zupdate_service_from_pathrh � removeService�_updateServicerC rD Zupdate_zone_from_pathri � removeZone� _updateZone�replace�striprG r6 rK r9 Z has_watchr: Z remove_watchr; r< Zupdate_ipset_from_pathrf � removeIPSet� _updateIPSetr? r@ Zupdate_helper_from_pathrj � removeHelper� _updateHelperrL Zupdate_lockdown_whitelist�LockdownWhitelistUpdatedrM Z update_direct�UpdatedrE rF Z update_policy_object_from_pathrk � removePolicy� _updatePolicy) rQ �nameZ old_props�msgZprops�keyZwhat�obj�_namerW rW rX r8 � s& �� � �� �� � ��� ��� � � �� z FirewallDConfig.watch_updaterc C sP t | | j|| j| jdtjj| jf �}| j�|� | jd7 _| �|j � |S �Nz%s/%dr# ) r r r] r5 rO ZDBUS_PATH_CONFIG_ICMPTYPEr\ �append� IcmpTypeAddedr� )rQ r� �config_icmptyperW rW rX rg B s �� z FirewallDConfig._addIcmpTypec C sL | j D ]@}|jj|jkr|jj|jkr|jj|jkr||_|�|j� qd S rr )r\ r� r� r6 rT r� )rQ r� rm rW rW rX r� N s � �z FirewallDConfig._updateIcmpTypec C s� d}| j D ]J}|�� }|j|| v r || �|j� | j�|j|�|_|�|jj� q | jD ]R}|�� }d|v r\|j|d v r\|d �|j� | j� |j|�|_|�|jj� q\| j D ]0}|j|kr�|� |j� |� � | j �|� ~q�d S )N� Z icmp_blocks) r` � getSettingsr� r{ r �set_zone_configr� r� rd � set_policy_object_config_dictr\ �Removedrw )rQ r� �indexro �settingsrq rm rW rW rX r� W s& z FirewallDConfig.removeIcmpTypec C sP t | | j|| j| jdtjj| jf �}| j�|� | jd7 _| �|j � |S r� ) r r r_ r5 rO ZDBUS_PATH_CONFIG_SERVICEr^ r� � ServiceAddedr� )rQ r� �config_servicerW rW rX rh q s � zFirewallDConfig._addServicec C sL | j D ]@}|jj|jkr|jj|jkr|jj|jkr||_|�|j� qd S rr )r^ r� r� r6 rT r� )rQ r� rn rW rW rX r� | s � �z FirewallDConfig._updateServicec C s� d}| j D ]J}|�� }|j|| v r || �|j� | j�|j|�|_|�|jj� q | jD ]R}|�� }d|v r\|j|d v r\|d �|j� | j� |j|�|_|�|jj� q\| j D ]0}|j|kr�|� |j� |� � | j �|� ~q�d S )Nr$ r^ ) r` r� r� r{ r r� r� r� rd r� r^ r� rw )rQ r� r� ro r� rq rn rW rW rX r� � s& z FirewallDConfig.removeServicec C sP t | | j|| j| jdtjj| jf �}| j�|� | jd7 _| �|j � |S r� ) r r ra r5 rO ZDBUS_PATH_CONFIG_ZONEr` r� � ZoneAddedr� )rQ r� � config_zonerW rW rX ri � s � zFirewallDConfig._addZonec C sL | j D ]@}|jj|jkr|jj|jkr|jj|jkr||_|�|j� qd S rr )r` r� r� r6 rT r� �rQ r� ro rW rW rX r� � s �zFirewallDConfig._updateZonec C s< | j D ]0}|j|kr|�|j� |�� | j �|� ~qd S rr )r` r� r� r� rw r{ r� rW rW rX r� � s zFirewallDConfig.removeZonec C sP t | | j|| j| jdtjj| jf �}| j�|� | jd7 _| �|j � |S r� ) r r re r5 rO ZDBUS_PATH_CONFIG_POLICYrd r� � PolicyAddedr� )rQ r� � config_policyrW rW rX rk � s � zFirewallDConfig._addPolicyc C sL | j D ]@}|jj|jkr|jj|jkr|jj|jkr||_|�|j� qd S rr )rd r� r� r6 rT r� �rQ r� rq rW rW rX r� � s �z FirewallDConfig._updatePolicyc C s< | j D ]0}|j|kr|�|j� |�� | j �|� ~qd S rr )rd r� r� r� rw r{ r� rW rW rX r� � s z FirewallDConfig.removePolicyc C sP t | | j|| j| jdtjj| jf �}| j�|� | jd7 _| �|j � |S r� ) r r r[ r5 rO ZDBUS_PATH_CONFIG_IPSETrZ r� � IPSetAddedr� )rQ r� � config_ipsetrW rW rX rf � s � zFirewallDConfig._addIPSetc C sL | j D ]@}|jj|jkr|jj|jkr|jj|jkr||_|�|j� qd S rr )rZ r� r� r6 rT r� �rQ r� rl rW rW rX r� � s �z FirewallDConfig._updateIPSetc C s< | j D ]0}|j|kr|�|j� |�� | j �|� ~qd S rr )rZ r� r� r� rw r{ r� rW rW rX r� � s zFirewallDConfig.removeIPSetc C sP t | | j|| j| jdtjj| jf �}| j�|� | jd7 _| �|j � |S r� ) r r rc r5 rO ZDBUS_PATH_CONFIG_HELPERrb r� � HelperAddedr� )rQ r� � config_helperrW rW rX rj � s � zFirewallDConfig._addHelperc C sL | j D ]@}|jj|jkr|jj|jkr|jj|jkr||_|�|j� qd S rr )rb r� r� r6 rT r� �rQ r� rp rW rW rX r� s �z FirewallDConfig._updateHelperc C s< | j D ]0}|j|kr|�|j� |�� | j �|� ~qd S rr )rb r� r� r� rw r{ r� rW rW rX r� s z FirewallDConfig.removeHelperc C s� | j jjdkrttjd��| j �� r�|d u r:t�d� d S t � � }t ||�}| j � d|�r^d S t ||�}| j � d|�rzd S t|�}| j � d|�r�d S t||�}| j � d|�r�d S ttjd��d S ) NZFAILEDz�Changing permanent configuration is not allowed while firewalld is in FAILED state. The permanent configuration must be fixed and then firewalld restarted. Try `firewall-offline-cmd --check-config`.z&Lockdown not possible, sender not set.�context�uid�user�commandzlockdown is enabled)r Z_fw�_stater! r ZRUNNING_BUT_FAILEDZlockdown_enabledr r� rO Z SystemBusr Z access_checkr r r Z ACCESS_DENIED)rQ �senderZbusr� r� r� r� rW rW rX � accessCheck s, � zFirewallDConfig.accessCheckc C s� |dvrt j�d| ��| j�� �|�}|dkrH|d u r>tj}t �|�S |dkrr|d u r`tj}nt |�}t � |�S |dkr�|d u r�tj r�dnd}t �|�S |dkr�|d u r�tj r�dnd}t �|�S |d kr�|d u r�tj r�dnd}t �|�S |d k�r |d u �s|dk�rt �d�S t �d�S �nv|d k�rD|d u �r:tj}t �|�S |d k�rr|d u �rhtj�rddnd}t �|�S |d k�r�|d u �r�tj}t �|�S |dk�r�|d u �r�tj}t �|�S |dk�r�|d u �r�tj}t �|�S |dk�r |d u �rtj�r�dnd}t �|�S |dk�r:|d u �r0tj�r,dnd}t �|�S |dk�rh|d u �r^tj�rZdnd}t �|�S |dk�r�|d u �r�tj�r�dnd}t �|�S d S )N�� DefaultZoner* r% r& r) r' r+ r, r- r. r/ r0 r1 r( r2 �Dorg.freedesktop.DBus.Error.InvalidArgs: Property '%s' does not existr� r* r% �yes�nor& r) r' r( r+ r, r- r. r/ r0 r1 r2 )rO � exceptions� DBusExceptionr �get_firewalld_conf�getZ FALLBACK_ZONE�StringZFALLBACK_MINIMAL_MARK�int�Int32ZFALLBACK_CLEANUP_ON_EXITZ FALLBACK_CLEANUP_MODULES_ON_EXITZFALLBACK_LOCKDOWNZFALLBACK_IPV6_RPFILTERZFALLBACK_INDIVIDUAL_CALLSZFALLBACK_LOG_DENIEDZFALLBACK_AUTOMATIC_HELPERSZFALLBACK_FIREWALL_BACKENDZ FALLBACK_FLUSH_ALL_ON_RELOADZFALLBACK_RFC3964_IPV4Z FALLBACK_ALLOW_ZONE_DRIFTINGZ FALLBACK_NFTABLES_TABLE_OWNER)rQ �prop�valuerW rW rX � _get_property3 s� �� z FirewallDConfig._get_propertyc C s� |dkrt �| �|��S |dkr0t �| �|��S |dkrHt �| �|��S |dkr`t �| �|��S |dkrxt �| �|��S |dkr�t �| �|��S |dkr�t �| �|��S |dkr�t �| �|��S |d kr�t �| �|��S |d k� r�t �| �|��S |d k�r t �| �|��S |d k�r&t �| �|��S |d k�r@t �| �|��S |dk�rZt �| �|��S |dk�rtt �| �|��S t j�d| ��d S )Nr� r* r% r& r) r' r( r+ r, r- r. r/ r0 r1 r2 r� )rO r� r� r� r� r� )rQ r� rW rW rX �_get_dbus_property� sF ��z"FirewallDConfig._get_dbus_property�ss�v)� in_signature� out_signatureNc C sr t |t�}t |t�}t�d||� |tjjkr8| �|�S |tjjtjj fv r^tj � d| ��ntj � d| ��d S )Nzconfig.Get('%s', '%s')r� �Jorg.freedesktop.DBus.Error.UnknownInterface: Interface '%s' does not exist) r �strr r� r rO rP r� � DBUS_INTERFACE_CONFIG_DIRECT� DBUS_INTERFACE_CONFIG_POLICIESr� r� )rQ �interface_name� property_namer� rW rW rX �Get� s$ �����zFirewallDConfig.Get�sza{sv}c C st t |t�}t�d|� i }|tjjkr@dD ]}| �|�||< q*n&|tjjtjj fv rVntj � d| ��tj |dd�S )Nzconfig.GetAll('%s')r� r� �sv�Z signature) r r� r r� r rO rP r� r� r� r� r� Z Dictionary)rQ r� r� �ret�xrW rW rX r � s ���zFirewallDConfig.GetAllZssv)r� c C s� t |t�}t |t�}t |�}t�d|||� | �|� |tjjk�rR|dv �r4|dv rx|�� dvrvt t j d||f ��n�|dkr�|tj vr�t t j d||f ��n`|dkr�|tj vr�t t j d||f ��n8|dkr�|tjvr�t t j d||f ��ntj�d | ��| j�� �||� | j�� �� | �|||ig � n |d v �r@ntj�d | ��n8|tjjtjjfv �rztj�d | ��ntj�d | ��d S ) Nz config.Set('%s', '%s', '%s')) r% r& r) r' r+ r, r. r/ r0 r( r2 )r% r& r) r' r+ r/ r0 r2 )r� r� �trueZfalsez '%s' for %sr, r. r( r� )r* r- r1 r� )r r� r r� r� r rO rP �lowerr! r Z INVALID_VALUEZLOG_DENIED_VALUESZFIREWALL_BACKEND_VALUESZIPV6_RPFILTER_VALUESr� r� r� �set�writer� r� r� )rQ r� r� Z new_valuer� rW rW rX �Set� s� � �� �� �� ���� �������zFirewallDConfig.Setzsa{sv}asr� c C s. t |t�}t |�}t |�}t�d|||� d S )Nz*config.PropertiesChanged('%s', '%s', '%s')�r r� r r� )rQ r� Zchanged_propertiesZinvalidated_propertiesrW rW rX r� s �z!FirewallDConfig.PropertiesChanged)r� c s` t �d� tt| ��| j| j�� �}t| |t j j �}t j j fD ] }t | ||t� jt� j�}q>|S )Nzconfig.Introspect())r Zdebug2r3 r" � Introspectr6 r5 Zget_busr r rO rP r� r r Z deprecatedr )rQ r� �dataZ interfacerU rW rX r� " s � ��zFirewallDConfig.Introspectc C s t �d� | j�� j�� S )Nz&config.policies.getLockdownWhitelist())r r� r � get_policies�lockdown_whitelist� export_config�rQ r� rW rW rX �getLockdownWhitelist9 s z$FirewallDConfig.getLockdownWhitelistc C sB t �d� t|�}| j�� j�|i � | j�� j�� | �� d S )Nz)config.policies.setLockdownWhitelist(...)) r r� r r r� r� � import_configr� r� �rQ r� r� rW rW rX �setLockdownWhitelist@ s z$FirewallDConfig.setLockdownWhitelistc C s t �d� d S )Nz*config.policies.LockdownWhitelistUpdated()�r r� rs rW rW rX r� J s z(FirewallDConfig.LockdownWhitelistUpdatedc C s^ t |�}t�d|� | �|� t| �� �}||d v rBttj|��|d � |� | � |� d S )Nz1config.policies.addLockdownWhitelistCommand('%s')r � r r r� r� r� r� r! r �ALREADY_ENABLEDr� r� �rQ r� r� r� rW rW rX �addLockdownWhitelistCommandQ s z+FirewallDConfig.addLockdownWhitelistCommandc C s^ t |�}t�d|� | �|� t| �� �}||d vrBttj|��|d � |� | � |� d S )Nz4config.policies.removeLockdownWhitelistCommand('%s')r � r r r� r� r� r� r! r � NOT_ENABLEDr{ r� r� rW rW rX � removeLockdownWhitelistCommand^ s � z.FirewallDConfig.removeLockdownWhitelistCommand�bc C s$ t |�}t�d|� || �� d v S )Nz3config.policies.queryLockdownWhitelistCommand('%s')r �r r r� r� )rQ r� r� rW rW rX � queryLockdownWhitelistCommandl s �z-FirewallDConfig.queryLockdownWhitelistCommand�asc C s t �d� | �� d S )Nz.config.policies.getLockdownWhitelistCommands()r �r r� r� r� rW rW rX � getLockdownWhitelistCommandsu s z,FirewallDConfig.getLockdownWhitelistCommandsc C s^ t |�}t�d|� | �|� t| �� �}||d v rBttj|��|d � |� | � |� d S )Nz1config.policies.addLockdownWhitelistContext('%s')r# r� �rQ r� r� r� rW rW rX �addLockdownWhitelistContext~ s z+FirewallDConfig.addLockdownWhitelistContextc C s^ t |�}t�d|� | �|� t| �� �}||d vrBttj|��|d � |� | � |� d S )Nz4config.policies.removeLockdownWhitelistContext('%s')r# r� r� rW rW rX � removeLockdownWhitelistContext� s � z.FirewallDConfig.removeLockdownWhitelistContextc C s$ t |�}t�d|� || �� d v S )Nz3config.policies.queryLockdownWhitelistContext('%s')r# r� )rQ r� r� rW rW rX � queryLockdownWhitelistContext� s �z-FirewallDConfig.queryLockdownWhitelistContextc C s t �d� | �� d S )Nz.config.policies.getLockdownWhitelistContexts()r# r� r� rW rW rX � getLockdownWhitelistContexts� s z,FirewallDConfig.getLockdownWhitelistContextsc C s^ t |�}t�d|� | �|� t| �� �}||d v rBttj|��|d � |� | � |� d S )Nz.config.policies.addLockdownWhitelistUser('%s')� r� �rQ r� r� r� rW rW rX �addLockdownWhitelistUser� s z(FirewallDConfig.addLockdownWhitelistUserc C s^ t |�}t�d|� | �|� t| �� �}||d vrBttj|��|d � |� | � |� d S )Nz1config.policies.removeLockdownWhitelistUser('%s')r r� r rW rW rX �removeLockdownWhitelistUser� s z+FirewallDConfig.removeLockdownWhitelistUserc C s$ t |�}t�d|� || �� d v S )Nz0config.policies.queryLockdownWhitelistUser('%s')r r� )rQ r� r� rW rW rX �queryLockdownWhitelistUser� s z*FirewallDConfig.queryLockdownWhitelistUserc C s t �d� | �� d S )Nz+config.policies.getLockdownWhitelistUsers()r r� r� rW rW rX �getLockdownWhitelistUsers� s z)FirewallDConfig.getLockdownWhitelistUsers�ic C s^ t |�}t�d|� | �|� t| �� �}||d v rBttj|��|d � |� | � |� d S )Nz+config.policies.addLockdownWhitelistUid(%d)� r� �rQ r� r� r� rW rW rX �addLockdownWhitelistUid� s z'FirewallDConfig.addLockdownWhitelistUidc C s^ t |�}t�d|� | �|� t| �� �}||d vrBttj|��|d � |� | � |� d S )Nz.config.policies.removeLockdownWhitelistUid(%d)r r� r rW rW rX �removeLockdownWhitelistUid� s z*FirewallDConfig.removeLockdownWhitelistUidc C s$ t |�}t�d|� || �� d v S )Nz-config.policies.queryLockdownWhitelistUid(%d)r r� )rQ r� r� rW rW rX �queryLockdownWhitelistUid� s z)FirewallDConfig.queryLockdownWhitelistUidZaic C s t �d� | �� d S )Nz*config.policies.getLockdownWhitelistUids()r r� r� rW rW rX �getLockdownWhitelistUids� s z(FirewallDConfig.getLockdownWhitelistUidsZaoc C s t �d� | jS )z"list ipsets objects paths zconfig.listIPSets())r r� rZ r� rW rW rX � listIPSets s zFirewallDConfig.listIPSetsc C s0 t �d� g }| jD ]}|�|jj� qt|�S )zget ipset names zconfig.getIPSetNames())r r� rZ r� r� r� rI )rQ r� rZ r� rW rW rX � getIPSetNames s z FirewallDConfig.getIPSetNames�oc C sF t |t�}t�d|� | jD ]}|jj|kr | S q ttj |��dS )z-object path of ipset with given name zconfig.getIPSetByName('%s')N) r r� r r� rZ r� r� r! r Z INVALID_IPSET)rQ rl r� r� rW rW rX �getIPSetByName s z FirewallDConfig.getIPSetByNamec C sD t |t�}t |�}t�d|� | �|� | j�||�}| �|�}|S )z/add ipset with given name and settings zconfig.addIPSet('%s'))r r� r r� r� r Z new_ipsetrf )rQ rl r� r� r� r� rW rW rX �addIPSet# s zFirewallDConfig.addIPSetc C s t |t�}t�d| � d S )Nzconfig.IPSetAdded('%s')r� )rQ rl rW rW rX r� 2 s zFirewallDConfig.IPSetAddedc C s t �d� | jS )z%list icmptypes objects paths zconfig.listIcmpTypes())r r� r\ r� rW rW rX � listIcmpTypes: s z FirewallDConfig.listIcmpTypesc C s0 t �d� g }| jD ]}|�|jj� qt|�S )zget icmptype names zconfig.getIcmpTypeNames())r r� r\ r� r� r� rI )rQ r� r\ r� rW rW rX �getIcmpTypeNamesB s z FirewallDConfig.getIcmpTypeNamesc C sF t |t�}t�d|� | jD ]}|jj|kr | S q ttj |��dS )z0object path of icmptype with given name z config.getIcmpTypeByName('%s')N) r r� r r� r\ r� r� r! r ZINVALID_ICMPTYPE)rQ rm r� r� rW rW rX �getIcmpTypeByNameM s z!FirewallDConfig.getIcmpTypeByNamec C sD t |t�}t |�}t�d|� | �|� | j�||�}| �|�}|S )z2add icmptype with given name and settings zconfig.addIcmpType('%s'))r r� r r� r� r Z new_icmptyperg )rQ rm r� r� r� r� rW rW rX � addIcmpTypeZ s zFirewallDConfig.addIcmpTypec C s t �d| � d S )Nzconfig.IcmpTypeAdded('%s')r� )rQ rm rW rW rX r� i s z FirewallDConfig.IcmpTypeAddedc C s t �d� | jS )z$list services objects paths zconfig.listServices())r r� r^ r� rW rW rX � listServicesp s z FirewallDConfig.listServicesc C s0 t �d� g }| jD ]}|�|jj� qt|�S )zget service names zconfig.getServiceNames())r r� r^ r� r� r� rI )rQ r� r^ r� rW rW rX �getServiceNamesx s z FirewallDConfig.getServiceNamesc C sF t |t�}t�d|� | jD ]}|jj|kr | S q ttj |��dS )z/object path of service with given name z config.getServiceByName('%s')N) r r� r r� r^ r� r� r! r ZINVALID_SERVICE)rQ rn r� r� rW rW rX �getServiceByName� s z FirewallDConfig.getServiceByNamezs(sssa(ss)asa{ss}asa(ss))c C sD t |t�}t |�}t�d|� | �|� | j�||�}| �|�}|S )�1add service with given name and settings zconfig.addService('%s'))r r� r r� r� r Z new_servicerh �rQ rn r� r� r� r� rW rW rX � addService� s zFirewallDConfig.addServicezsa{sv}c C sD t |t�}t |�}t�d|� | �|� | j�||�}| �|�}|S )r zconfig.addService2('%s'))r r� r r� r� r Znew_service_dictrh r rW rW rX � addService2� s zFirewallDConfig.addService2c C s t �d| � d S )Nzconfig.ServiceAdded('%s')r� )rQ rn rW rW rX r� � s z FirewallDConfig.ServiceAddedc C s t �d� | jS )z!list zones objects paths zconfig.listZones())r r� r` r� rW rW rX � listZones� s zFirewallDConfig.listZonesc C s0 t �d� g }| jD ]}|�|jj� qt|�S )zget zone names zconfig.getZoneNames())r r� r` r� r� r� rI )rQ r� r` r� rW rW rX � getZoneNames� s z FirewallDConfig.getZoneNamesc C sF t |t�}t�d|� | jD ]}|jj|kr | S q ttj |��dS )z,object path of zone with given name zconfig.getZoneByName('%s')N) r r� r r� r` r� r� r! r Z INVALID_ZONE)rQ ro r� r� rW rW rX � getZoneByName� s z FirewallDConfig.getZoneByNamec C sv t |t�}t�d|� g }| jD ] }||jjv r |�|jj� q t |�dkrfd� |�d|t |�f S |rr|d S dS )z4name of zone the given interface belongs to z config.getZoneOfInterface('%s')r# � zE (ERROR: interface '%s' is in %s zone XML files, can be only in one)r r} ) r r� r r� r` r� Z interfacesr� r� ru �join)rQ Zifacer� r� r� rW rW rX �getZoneOfInterface� s ��z"FirewallDConfig.getZoneOfInterfacec C sv t |t�}t�d|� g }| jD ] }||jjv r |�|jj� q t |�dkrfd� |�d|t |�f S |rr|d S dS )z1name of zone the given source belongs to z config.getZoneOfSource('%s')r# r! zB (ERROR: source '%s' is in %s zone XML files, can be only in one)r r} ) r r� r r� r` r� Zsourcesr� r� ru r" )rQ �sourcer� r� r� rW rW rX �getZoneOfSource� s ��z FirewallDConfig.getZoneOfSourcez's(sssbsasa(ss)asba(ssss)asasasasa(ss)b)c C sh t |t�}t |�}t�d|� | �|� |d dkrLt|�}t|d< t|�}| j� ||�}| � |�}|S )�.add zone with given name and settings �config.addZone('%s')� �default) r r� r r� r� r� r �tupler Znew_zoneri )rQ ro r� r� Z _settingsr� r� rW rW rX �addZone� s zFirewallDConfig.addZonec C s` t |t�}t |�}t�d|� | �|� d|v rD|d dkrDt|d< | j�||�}| �|�}|S )r& r' �targetr) ) r r� r r� r� r r Z new_zone_dictri )rQ ro r� r� r� r� rW rW rX �addZone2 s zFirewallDConfig.addZone2c C s t �d| � d S )Nzconfig.ZoneAdded('%s')r� )rQ ro rW rW rX r� " s zFirewallDConfig.ZoneAddedc C s t �d� | jS )z$list policies objects paths zconfig.listPolicies())r r� rd r� rW rW rX � listPolicies) s z FirewallDConfig.listPoliciesc C s0 t �d� g }| jD ]}|�|jj� qt|�S )zget policy names zconfig.getPolicyNames())r r� rd r� r� r� rI )rQ r� Zpoliciesr� rW rW rX �getPolicyNames1 s z FirewallDConfig.getPolicyNamesc C sF t |t�}t�d|� | jD ]}|jj|kr | S q ttj |��dS )z.object path of policy with given name z config.getPolicyByName('%s')N) r r� r r� rd r� r� r! r ZINVALID_POLICY)rQ rq r� r� rW rW rX �getPolicyByName< s z FirewallDConfig.getPolicyByNamec C sD t |t�}t |�}t�d|� | �|� | j�||�}| �|�}|S )z0add policy with given name and settings zconfig.addPolicy('%s'))r r� r r� r� r Znew_policy_object_dictrk )rQ rq r� r� r� r� rW rW rX � addPolicyI s zFirewallDConfig.addPolicyc C s t �d| � d S )Nzconfig.PolicyAdded('%s')r� )rQ rq rW rW rX r� X s zFirewallDConfig.PolicyAddedc C s t �d� | jS )z#list helpers objects paths zconfig.listHelpers())r r� rb r� rW rW rX � listHelpersa s zFirewallDConfig.listHelpersc C s0 t �d� g }| jD ]}|�|jj� qt|�S )zget helper names zconfig.getHelperNames())r r� rb r� r� r� rI )rQ r� rb r� rW rW rX �getHelperNamesi s z FirewallDConfig.getHelperNamesc C sF t |t�}t�d|� | jD ]}|jj|kr | S q ttj |��dS )z.object path of helper with given name z config.getHelperByName('%s')N) r r� r r� rb r� r� r! r ZINVALID_HELPER)rQ rp r� r� rW rW rX �getHelperByNamet s z FirewallDConfig.getHelperByNamec C sD t |t�}t |�}t�d|� | �|� | j�||�}| �|�}|S )z0add helper with given name and settings zconfig.addHelper('%s'))r r� r r� r� r Z new_helperrj )rQ rp r� r� r� r� rW rW rX � addHelper� s zFirewallDConfig.addHelperc C s t |t�}t�d| � d S )Nzconfig.HelperAdded('%s')r� )rQ rp rW rW rX r� � s zFirewallDConfig.HelperAddedc C s t �d� | j�� �� S )Nzconfig.direct.getSettings())r r� r � get_directr� r� rW rW rX r� � s zFirewallDConfig.getSettingsc C s> t �d� t|�}| j�� �|i � | j�� �� | �� d S )Nzconfig.direct.update())r r� r r r6 r� r� r� r� rW rW rX r| � s zFirewallDConfig.updatec C s t �d� d S )Nzconfig.direct.Updated()r� rs rW rW rX r� � s zFirewallDConfig.UpdatedZsssc C s� t |�}t |�}t |�}t�d|||f � | �|� t|||f�}t| �� �}||d v rrttj d|||f ��|d � |� | � |� d S )Nz(config.direct.addChain('%s', '%s', '%s')r z chain '%s' already is in '%s:%s') r r r� r� r* r� r� r! r r� r� r| �rQ �ipv�table�chainr� �idxr� rW rW rX �addChain� s" � ��zFirewallDConfig.addChainc C s� t |�}t |�}t |�}t�d|||f � | �|� t|||f�}t| �� �}||d vrrttj d|||f ��|d � |� | � |� d S )Nz+config.direct.removeChain('%s', '%s', '%s')r z chain '%s' is not in '%s:%s') r r r� r� r* r� r� r! r r� r{ r| r7 rW rW rX � removeChain� s" � ��zFirewallDConfig.removeChainc C sJ t |�}t |�}t |�}t�d|||f � t|||f�}|| �� d v S )Nz*config.direct.queryChain('%s', '%s', '%s')r )r r r� r* r� )rQ r8 r9 r: r� r; rW rW rX � queryChain� s �zFirewallDConfig.queryChainc C sb t |�}t |�}t�d||f � g }| �� d D ]*}|d |kr2|d |kr2|�|d � q2|S )Nz#config.direct.getChains('%s', '%s')r r# r �r r r� r� r� )rQ r8 r9 r� r� r; rW rW rX � getChains� s zFirewallDConfig.getChainsr} za(sss)c C s t �d� | �� d S )Nz config.direct.getAllChains()r �r r� r� r� rW rW rX � getAllChains� s z FirewallDConfig.getAllChainsZsssiasc C s� t |�}t |�}t |�}t |�}t |�}t�d||||d�|�f � | �|� |||||f}t| �� �}||d v r�ttj d||||f ��|d � |� | � t |�� d S )Nz1config.direct.addRule('%s', '%s', '%s', %d, '%s')�','r# z"rule '%s' already is in '%s:%s:%s') r r r� r" r� r� r� r! r r� r� r| r* � rQ r8 r9 r: �priorityrR r� r; r� rW rW rX �addRule s& � ��zFirewallDConfig.addRulec C s� t |�}t |�}t |�}t |�}t |�}t�d||||d�|�f � | �|� |||||f}t| �� �}||d vr�ttj d||||f ��|d � |� | � t |�� d S )Nz4config.direct.removeRule('%s', '%s', '%s', %d, '%s')rC r# z rule '%s' is not in '%s:%s:%s') r r r� r" r� r� r� r! r r� r{ r| r* rD rW rW rX � removeRule s& � ��zFirewallDConfig.removeRulec C sd t |�}t |�}t |�}t |�}t |�}t�d||||d�|�f � |||||f}|| �� d v S )Nz3config.direct.queryRule('%s', '%s', '%s', %d, '%s')rC r# �r r r� r" r� )rQ r8 r9 r: rE rR r� r; rW rW rX � queryRule/ s �zFirewallDConfig.queryRulec C s� t |�}t |�}t |�}t�d|||f � | �|� t| �� �}|d d d � D ]2}|||f|d |d |d fkrR|d �|� qR| �t|�� d S )Nz+config.direct.removeRules('%s', '%s', '%s')r# r r ) r r r� r� r� r� r{ r| r* )rQ r8 r9 r: r� r� ZrulerW rW rX � removeRules> s � zFirewallDConfig.removeRulesza(ias)c C s� t |�}t |�}t |�}t�d|||f � g }| �� d D ]>}|d |kr<|d |kr<|d |kr<|�|d |d f� q<|S )Nz(config.direct.getRules('%s', '%s', '%s')r# r r r r( r? )rQ r8 r9 r: r� r� r; rW rW rX �getRulesO s �$zFirewallDConfig.getRulesz a(sssias)c C s t �d� | �� d S )Nzconfig.direct.getAllRules()r# rA r� rW rW rX � getAllRules_ s zFirewallDConfig.getAllRulesZsasc C s� t |�}t |�}t�d|d�|�f � | �|� ||f}t| �� �}||d v rfttj d||f ��|d � |� | � |� d S )Nz(config.direct.addPassthrough('%s', '%s')rC r �passthrough '%s', '%s') r r r� r" r� r� r� r! r r� r� r| �rQ r8 rR r� r; r� rW rW rX �addPassthroughi s � �z FirewallDConfig.addPassthroughc C s� t |�}t |�}t�d|d�|�f � | �|� ||f}t| �� �}||d vrfttj d||f ��|d � |� | � |� d S )Nz+config.direct.removePassthrough('%s', '%s')rC r rM ) r r r� r" r� r� r� r! r r� r{ r| rN rW rW rX �removePassthrough| s � �z!FirewallDConfig.removePassthroughc C s@ t |�}t |�}t�d|d�|�f � ||f}|| �� d v S )Nz*config.direct.queryPassthrough('%s', '%s')rC r rH )rQ r8 rR r� r; rW rW rX �queryPassthrough� s �z FirewallDConfig.queryPassthroughZaasc C sJ t |�}t�d| � g }| �� d D ] }|d |kr&|�|d � q&|S )Nz#config.direct.getPassthroughs('%s')r r r# r? )rQ r8 r� r� r; rW rW rX �getPassthroughs� s z FirewallDConfig.getPassthroughsza(sas)c C s t �d� | �� d S )Nz"config.direct.getAllPassthroughs()r rA r� rW rW rX �getAllPassthroughs� s z"FirewallDConfig.getAllPassthroughs)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)��__name__� __module__� __qualname__�__doc__Z persistentr rO ZPK_ACTION_CONFIGZ default_polkit_auth_requiredr r4 r7 rt ry r8 rg r� r� rh r� r� ri r� r� rk r� r� rf r� r� rj r� r� r r� r� r� r ZPROPERTIES_IFACEr� r r r� rn �signalr� ZPK_ACTION_INFOZINTROSPECTABLE_IFACEr� r� r ZDBUS_SIGNATUREr� r� r� r� r� r� r� r� r� r� r r r r r r r r r rP r r r r r r� r r r r r r� r r r r r r� r r r r# r% r+ r- r� r. r/ r0 r1 r� r2 r3 r4 r r5 r� r r� r r� r| r r� r< r= r> r@ rB rF rG rI rJ rK rL rO rP rQ rR rS � __classcell__rW rW rU rX r" < sN 0 L $�� C �� � � ��� � ��� � ��� � �� � � � � � � � � � ��� � � � � � � � � � � � � � � � � � � � � � �r" )7rG rO Z dbus.serviceZfirewallr Zfirewall.core.baser Zfirewall.core.watcherr Zfirewall.core.loggerr Zfirewall.server.dbusr Zfirewall.server.decoratorsr r r r r r Z firewall.server.config_icmptyper Z firewall.server.config_servicer Zfirewall.server.config_zoner Z firewall.server.config_policyr Z firewall.server.config_ipsetr Z firewall.server.config_helperr Zfirewall.core.io.icmptyper Zfirewall.core.io.ipsetr Zfirewall.core.io.helperr Z#firewall.core.io.lockdown_whitelistr Zfirewall.core.io.directr Zfirewall.dbus_utilsr r r r r r r r r Zfirewall.errorsr! r" rW rW rW rX �<module> s. ( server/__pycache__/config_policy.cpython-39.opt-1.pyc 0000644 00000015124 15025011705 0016475 0 ustar 00 a ���g� � @ st d dl Z d dlZ d dlmZ d dlmZmZmZ d dlm Z d dl m Z d dl m Z mZmZmZ G dd� de �ZdS ) � N)�config)�dbus_to_python�%dbus_introspection_prepare_properties�!dbus_introspection_add_properties)�log)�DbusServiceObject)�handle_exceptions�dbus_handle_exceptions�dbus_service_method�dbus_polkit_require_authc s� e Zd ZdZejjZe� fdd��Z e dd� �Z e dd� �Z e dd � �Z eejd d d �e d/dd���Zeejddd �e d0dd���Zeejj�eejdd�e d1dd����Zejjejdd�dd� �Zeejj�eejdd �e d2� fd d � ���Zeejjdd �e d3d d ���Zeejjdd�e d4d!d"���Z eejj�e d5d#d$���Z ejjejjdd�e d%d&� ��Z eejj�e d6d'd(���Z ejjejjdd�e d)d*� ��Z eejjdd�e d7d+d,���Z!ejjejjdd�e d-d.� ��Z"� Z#S )8�FirewallDConfigPolicyTc s` t t| �j|i |�� || _|| _|| _|| _|d | _|d | _d| j | _ t | tj j � d S )Nr � zconfig.policy.%d) �superr �__init__�parentr �obj�item_id�busname�path� _log_prefixr �dbus� DBUS_INTERFACE_CONFIG_POLICY)�selfr ZconfZpolicyr �args�kwargs�� __class__� �A/usr/lib/python3.9/site-packages/firewall/server/config_policy.pyr s �z FirewallDConfigPolicy.__init__c C s d S �Nr �r r r r �__del__# s z FirewallDConfigPolicy.__del__c C s | � � d S r )Zremove_from_connectionr r r r � unregister' s z FirewallDConfigPolicy.unregisterc C s� |dkrt �| jj�S |dkr,t �| jj�S |dkrBt �| jj�S |dkrXt �| jj�S |dkrnt �| jj�S t j � d| ��d S )N�name�filenamer �default�builtinzDorg.freedesktop.DBus.Error.InvalidArgs: Property '%s' does not exist) r �Stringr r# r$ r ZBooleanr% r& � exceptions� DBusException)r � property_namer r r � _get_property/ s ��z#FirewallDConfigPolicy._get_property�ss�v)� in_signature� out_signatureNc C sL t |t�}t |t�}t�d| j||� |tjjkrBtj� d| ��| � |�S )Nz%s.Get('%s', '%s')�Jorg.freedesktop.DBus.Error.UnknownInterface: Interface '%s' does not exist) r �strr �debug1r r r r r( r) r+ )r �interface_namer* �senderr r r �Get@ s � ��zFirewallDConfigPolicy.Get�sza{sv}c C s` t |t�}t�d| j|� |tjjkr6tj� d| ��i }dD ]}| � |�||< q>tj |dd�S )Nz%s.GetAll('%s')r0 )r# r$ r r% r& �sv�Z signature) r r1 r r2 r r r r r( r) r+ Z Dictionary)r r3 r4 �ret�xr r r �GetAllQ s ��z FirewallDConfigPolicy.GetAllZssv)r. c C sl t |t�}t |t�}t |�}t�d| j|||� | j�|� |tjj krXtj � d| ��tj � d| ��d S )Nz%s.Set('%s', '%s', '%s')r0 zGorg.freedesktop.DBus.Error.PropertyReadOnly: Property '%s' is read-only) r r1 r r2 r r � accessCheckr r r r( r) )r r3 r* Z new_valuer4 r r r �Setb s$ � ����zFirewallDConfigPolicy.Setzsa{sv}asr8 c C s2 t |t�}t |�}t |�}t�d| j|||� d S )Nz&%s.PropertiesChanged('%s', '%s', '%s'))r r1 r r2 r )r r3 Zchanged_propertiesZinvalidated_propertiesr r r �PropertiesChangedv s �z'FirewallDConfigPolicy.PropertiesChanged)r/ c s8 t �d| j� tt| ��| j| j�� �}t | |t j j �S )Nz%s.Introspect()) r Zdebug2r r r � Introspectr r Zget_busr r r r )r r4 �datar r r r? s � �z FirewallDConfigPolicy.Introspectc C s t �d| j� | j�| j�}|S )z get settings for policy z%s.getSettings())r r2 r r Z get_policy_object_config_dictr )r r4 �settingsr r r � getSettings� s z!FirewallDConfigPolicy.getSettingsc C sF t |�}t�d| j� | j�|� | j�| j|�| _| � | jj � dS )z#update settings for policy z%s.update('...')N) r r r2 r r r< r Z set_policy_object_config_dictr �Updatedr# )r rA r4 r r r �update� s z FirewallDConfigPolicy.updatec C s< t �d| j� | j�|� | j�| j�| _| �| jj � dS )z1load default settings for builtin policy z%s.loadDefaults()N) r r2 r r r< r Zload_policy_object_defaultsr rC r# �r r4 r r r � loadDefaults� s z"FirewallDConfigPolicy.loadDefaultsc C s t �d| j|f � d S )Nz%s.Updated('%s')�r r2 r �r r# r r r rC � s z FirewallDConfigPolicy.Updatedc C s: t �d| j� | j�|� | j�| j� | j�| j� dS )zremove policy z%s.removePolicy()N) r r2 r r r< r Zremove_policy_objectr Z removePolicyrE r r r �remove� s z FirewallDConfigPolicy.removec C s t �d| j|f � d S )Nz%s.Removed('%s')rG rH r r r �Removed� s z FirewallDConfigPolicy.Removedc C sF t |t�}t�d| j|� | j�|� | j�| j |�| _ | � |� dS )zrename policy z%s.rename('%s')N) r r1 r r2 r r r< r Zrename_policy_objectr �Renamed)r r# r4 r r r �rename� s z FirewallDConfigPolicy.renamec C s t �d| j|f � d S )Nz%s.Renamed('%s')rG rH r r r rK � s z FirewallDConfigPolicy.Renamed)N)N)N)N)N)N)N)N)N)$�__name__� __module__� __qualname__Z persistentr r ZPK_ACTION_CONFIGZ default_polkit_auth_requiredr r r r! r" r+ r ZPROPERTIES_IFACEr5 r; r r= Zservice�signalr> ZPK_ACTION_INFOZINTROSPECTABLE_IFACEr? r rB rD rF rC rI rJ rL rK � __classcell__r r r r r sx �� �� � r )r Z dbus.serviceZfirewallr Zfirewall.dbus_utilsr r r Zfirewall.core.loggerr Zfirewall.server.dbusr Zfirewall.server.decoratorsr r r r r r r r r �<module> s server/__pycache__/config_zone.cpython-39.pyc 0000644 00000075223 15025011705 0015220 0 ustar 00 a ���g�� � @ s� d dl Z d dlZ d dlmZ d dlmZmZmZ d dlm Z d dl m Z d dl m Z d dlmZ d dlmZ d d lmZ d d lmZmZmZmZ d d lmZ d d lmZ d d l m Z m Z m Z m Z G dd� de�Z!dS )� N)�config)�dbus_to_python�%dbus_introspection_prepare_properties�!dbus_introspection_add_properties)�Zone)�ifcfg_set_zone_of_interface)�DEFAULT_ZONE_TARGET)� Rich_Rule)�log)�DbusServiceObject)�handle_exceptions�dbus_handle_exceptions�dbus_service_method�dbus_polkit_require_auth)�errors)� FirewallError)�portStr�portInPortRange�coalescePortRange�breakPortRangec s� e Zd ZdZdZejjZe � fdd��Z e dd� �Z e dd� �Z e d d � �Zeejd d d �e d�dd���Zeejddd �e d�dd���Zeejj�eejdd�e d�dd����Zejjejdd�dd � �Zeejj�eejdd �e d�� fd d � ���Zeejjd d �e d�d!d"���Z eejjdd �e d�d#d$���Z d%d&� Z eejjd d�e d�d'd(���Z eejjdd�e d�d)d*���Z eejj�e d�d+d,���Z!ejjejjdd�e d-d.� ��Z"eejj�e d�d/d0���Z#ejjejjdd�e d1d2� ��Z$eejjdd�e d�d3d4���Z%ejjejjdd�e d5d6� ��Z&eejjdd �e d�d7d8���Z'eejjdd�e d�d9d:���Z(eejjdd �e d�d;d<���Z)eejjdd�e d�d=d>���Z*eejjdd �e d�d?d@���Z+eejjdd�e d�dAdB���Z,eejjdd �e d�dCdD���Z-eejjdd�e d�dEdF���Z.eejjdGd �e d�dHdI���Z/eejjdGd�e d�dJdK���Z0eejjdd�e d�dLdM���Z1eejjdd�e d�dNdO���Z2eejjddPd �e d�dQdR���Z3eejjdSd �e d�dTdU���Z4eejjdSd�e d�dVdW���Z5eejjd d�e d�dXdY���Z6eejjd d�e d�dZd[���Z7eejjd dPd �e d�d\d]���Z8eejjdGd �e d�d^d_���Z9eejjdGd�e d�d`da���Z:eejjdd�e d�dbdc���Z;eejjdd�e d�ddde���Z<eejjddPd �e d�dfdg���Z=eejjdSd �e d�dhdi���Z>eejjdSd�e d�djdk���Z?eejjd d�e d�dldm���Z@eejjd d�e d�dndo���ZAeejjd dPd �e d�dpdq���ZBeejjdGd �e d�drds���ZCeejjdGd�e d�dtdu���ZDeejjdd�e d�dvdw���ZEeejjdd�e d�dxdy���ZFeejjddPd �e d�dzd{���ZGeejjdPd �e d�d|d}���ZHeejjdPd�e d�d~d���ZIeejj�e d�d�d����ZJeejj�e d�d�d����ZKeejjdPd �e d�d�d����ZLeejjdPd �e d�d�d����ZMeejjdPd�e d�d�d����ZNeejj�e d�d�d����ZOeejj�e d�d�d����ZPeejjdPd �e d�d�d����ZQeejjd�d �e d�d�d����ZReejjd�d�e d�d�d����ZSeejjd�d�e d�d�d����ZTeejjd�d�e d�d�d����ZUeejjd�dPd �e d�d�d����ZVeejjdGd �e d�d�d����ZWeejjdGd�e d�d�d����ZXeejjdd�e d�d�d����ZYeejjdd�e d�d�d����ZZeejjddPd �e d�d�d����Z[eejjdGd �e d�d�d����Z\eejjdGd�e d�d�d����Z]eejjdd�e d�d�d����Z^eejjdd�e d�d�d����Z_eejjddPd �e d�d�d����Z`eejjdGd �e d�d�d����ZaeejjdGd�e �d d�d����Zbeejjdd�e �dd�d����Zceejjdd�e �dd�d����ZdeejjddPd �e �dd�d����Ze� ZfS ( �FirewallDConfigZonezFirewallD main classTc s` t t| �j|i |�� || _|| _|| _|| _|d | _|d | _d| j | _ t | tj j � d S )Nr � zconfig.zone.%d) �superr �__init__�parentr �obj�item_id�busname�path� _log_prefixr �dbus�DBUS_INTERFACE_CONFIG_ZONE)�selfr Zconf�zoner �args�kwargs�� __class__� �?/usr/lib/python3.9/site-packages/firewall/server/config_zone.pyr 8 s �z FirewallDConfigZone.__init__c C s d S �Nr( �r" r( r( r) �__del__E s zFirewallDConfigZone.__del__c C s | � � d S r* )Zremove_from_connectionr+ r( r( r) � unregisterI s z FirewallDConfigZone.unregisterc C s� |dkrt �| jj�S |dkr,t �| jj�S |dkrBt �| jj�S |dkrXt �| jj�S |dkrnt �| jj�S t j � d| ��d S )N�name�filenamer �default�builtinzDorg.freedesktop.DBus.Error.InvalidArgs: Property '%s' does not exist) r �Stringr r. r/ r ZBooleanr0 r1 � exceptions� DBusException)r" � property_namer( r( r) � _get_propertyQ s ��z!FirewallDConfigZone._get_property�ss�v)� in_signature� out_signatureNc C sL t |t�}t |t�}t�d| j||� |tjjkrBtj� d| ��| � |�S )Nz%s.Get('%s', '%s')�Jorg.freedesktop.DBus.Error.UnknownInterface: Interface '%s' does not exist) r �strr �debug1r r r r! r3 r4 r6 )r" �interface_namer5 �senderr( r( r) �Getb s � ��zFirewallDConfigZone.Get�sza{sv}c C s` t |t�}t�d| j|� |tjjkr6tj� d| ��i }dD ]}| � |�||< q>tj |dd�S )Nz%s.GetAll('%s')r; )r. r/ r r0 r1 �sv�Z signature) r r< r r= r r r r! r3 r4 r6 Z Dictionary)r" r> r? �ret�xr( r( r) �GetAlls s ��zFirewallDConfigZone.GetAllZssv)r9 c C sl t |t�}t |t�}t |�}t�d| j|||� | j�|� |tjj krXtj � d| ��tj � d| ��d S )Nz%s.Set('%s', '%s', '%s')r; zGorg.freedesktop.DBus.Error.PropertyReadOnly: Property '%s' is read-only) r r< r r= r r � accessCheckr r r! r3 r4 )r" r> r5 Z new_valuer? r( r( r) �Set� s$ � ����zFirewallDConfigZone.Setzsa{sv}asrC c C s2 t |t�}t |�}t |�}t�d| j|||� d S )Nz&%s.PropertiesChanged('%s', '%s', '%s'))r r< r r= r )r" r> Zchanged_propertiesZinvalidated_propertiesr( r( r) �PropertiesChanged� s �z%FirewallDConfigZone.PropertiesChanged)r: c s8 t �d| j� tt| ��| j| j�� �}t | |t j j �S )Nz%s.Introspect()) r Zdebug2r r r � Introspectr r Zget_busr r r r! )r" r? �datar& r( r) rJ � s � �z FirewallDConfigZone.Introspectz&(sssbsasa(ss)asba(ssss)asasasasa(ss)b)c C sD t �d| j� | j�| j�}|d tkr@t|�}d|d< t|�}|S )� get settings for zone z%s.getSettings()� r0 ) r r= r r Zget_zone_configr r �list�tuple)r" r? �settings� _settingsr( r( r) � getSettings� s z FirewallDConfigZone.getSettingsc C s4 t �d| j� | j�| j�}|d tkr0d|d< |S )rL z%s.getSettings2()�targetr0 )r r= r r �get_zone_config_dictr r �r" r? rP r( r( r) � getSettings2� s z FirewallDConfigZone.getSettings2c C s | j �| j�}d|v r"t|d �nt� }d|v r<t|d �nt� }t|t�rzt|t�d� �| }t|t�d� �| }nDd|v r�t|d �nt� }d|v r�t|d �nt� }|| }|| }|D ] } | j� | �r�t t j | ��q�|D ] } | j� | �r�t t j | ��q�dS )a Assignment of interfaces/sources to zones is different from other zone settings in the sense that particular interface/zone can be part of only one zone. So make sure added interfaces/sources have not already been bound to another zone.� interfaces�sourcesN)r rT r �set� isinstancerO r Zindex_ofr ZgetZoneOfInterfacer r Z ZONE_CONFLICTZgetZoneOfSource) r" rP Z old_settingsZ old_ifacesZ old_sourcesZ added_ifacesZ added_sourcesZ new_ifacesZ new_sourcesZiface�sourcer( r( r) � _checkDuplicateInterfacesSources� s z4FirewallDConfigZone._checkDuplicateInterfacesSourcesc C st t |�}t�d| j� | j�|� |d dkrFt|�}t|d< t|�}| � |� | j � | j |�| _ | � | j j� dS )�!update settings for zone z%s.update('...')rM r0 N)r r r= r r rG rN r rO r\ r Zset_zone_configr �Updatedr. )r" rP r? rQ r( r( r) �update� s zFirewallDConfigZone.updatec C sl t |�}t�d| j� | j�|� d|v r>|d dkr>t|d< | �|� | j� | j |�| _ | � | j j � dS )r] z%s.update2('...')rS r0 N) r r r= r r rG r r\ r Zset_zone_config_dictr r^ r. )r" rP r? r( r( r) �update2� s zFirewallDConfigZone.update2c C s< t �d| j� | j�|� | j�| j�| _| �| jj � dS )z/load default settings for builtin zone z%s.loadDefaults()N) r r= r r rG r Zload_zone_defaultsr r^ r. �r" r? r( r( r) � loadDefaults s z FirewallDConfigZone.loadDefaultsc C s t �d| j|f � d S )Nz%s.Updated('%s')�r r= r �r" r. r( r( r) r^ s zFirewallDConfigZone.Updatedc C s: t �d| j� | j�|� | j�| j� | j�| j� dS )zremove zone z%s.removeZone()N) r r= r r rG r Z remove_zoner Z removeZonera r( r( r) �remove s zFirewallDConfigZone.removec C s t �d| j|f � d S )Nz%s.Removed('%s')rc rd r( r( r) �Removed s zFirewallDConfigZone.Removedc C sF t |t�}t�d| j|� | j�|� | j�| j |�| _ | � |� dS )zrename zone z%s.rename('%s')N) r r< r r= r r rG r Z rename_zoner �Renamed)r" r. r? r( r( r) �rename% s zFirewallDConfigZone.renamec C s t �d| j|f � d S )Nz%s.Renamed('%s')rc rd r( r( r) rg 1 s zFirewallDConfigZone.Renamedc C s t �d| j� | �� d S )Nz%s.getVersion()r �r r= r rR ra r( r( r) � getVersion8 s z FirewallDConfigZone.getVersionc C sH t |t�}t�d| j|� | j�|� t| �� �}||d< | � |� d S )Nz%s.setVersion('%s')r � r r< r r= r r rG rN rR r_ )r" �versionr? rP r( r( r) � setVersion? s z FirewallDConfigZone.setVersionc C s t �d| j� | �� d S )Nz %s.getShort()r ri ra r( r( r) �getShortL s z FirewallDConfigZone.getShortc C sH t |t�}t�d| j|� | j�|� t| �� �}||d< | � |� d S )Nz%s.setShort('%s')r rk )r" Zshortr? rP r( r( r) �setShortS s z FirewallDConfigZone.setShortc C s t �d| j� | �� d S )Nz%s.getDescription()� ri ra r( r( r) �getDescription` s z"FirewallDConfigZone.getDescriptionc C sH t |t�}t�d| j|� | j�|� t| �� �}||d< | � |� d S )Nz%s.setDescription('%s')rp rk )r" � descriptionr? rP r( r( r) �setDescriptiong s z"FirewallDConfigZone.setDescriptionc C s. t �d| j� | �� }|d tkr*|d S dS )Nz%s.getTarget()rM r0 )r r= r rR r rU r( r( r) � getTargetw s z FirewallDConfigZone.getTargetc C sT t |t�}t�d| j|� | j�|� t| �� �}|dkr>|nt |d< | � |� d S )Nz%s.setTarget('%s')r0 rM ) r r< r r= r r rG rN rR r r_ )r" rS r? rP r( r( r) � setTarget s z FirewallDConfigZone.setTarget�asc C s t �d| j� | �� d S )Nz%s.getServices()� ri ra r( r( r) � getServices� s z FirewallDConfigZone.getServicesc C sN t |t�}t�d| jd�|�� | j�|� t| �� �}||d< | � |� d S )Nz%s.setServices('[%s]')�,rw � r rN r r= r �joinr rG rR r_ )r" Zservicesr? rP r( r( r) � setServices� s � z FirewallDConfigZone.setServicesc C sf t |t�}t�d| j|� | j�|� t| �� �}||d v rJt t j |��|d � |� | � |� d S )Nz%s.addService('%s')rw �r r< r r= r r rG rN rR r r �ALREADY_ENABLED�appendr_ �r" �servicer? rP r( r( r) � addService� s z FirewallDConfigZone.addServicec C sf t |t�}t�d| j|� | j�|� t| �� �}||d vrJt t j |��|d � |� | � |� d S )Nz%s.removeService('%s')rw �r r< r r= r r rG rN rR r r � NOT_ENABLEDre r_ r� r( r( r) � removeService� s z!FirewallDConfigZone.removeService�bc C s* t |t�}t�d| j|� || �� d v S )Nz%s.queryService('%s')rw �r r< r r= r rR )r" r� r? r( r( r) � queryService� s z FirewallDConfigZone.queryServiceza(ss)c C s t �d| j� | �� d S )Nz %s.getPorts()� ri ra r( r( r) �getPorts� s z FirewallDConfigZone.getPortsc C s� g }t |t�D ](}t|t�r,|�t|�� q|�|� q|}t�d| jd�dd� |D ��� | j � |� t| � � �}||d< | � |� d S )Nz%s.setPorts('[%s]')ry c s s" | ]}d |d |d f V qdS �z ('%s, '%s')r r Nr( ��.0�portr( r( r) � <genexpr>� � z/FirewallDConfigZone.setPorts.<locals>.<genexpr>r� � r rN rZ r rO r r= r r{ r rG rR r_ �r" Zportsr? Z_portsr� rP r( r( r) �setPorts� s � z FirewallDConfigZone.setPortsc s� t |t�}t � t�� t�d| j|� � | j�|� t| �� �}tt � fdd�|d ��}|D ]&}t ||d �r\t t j d|� f ��q\t|dd� |D ��\}}|D ] } |d �t| d �� f� q�|D ] } |d �t| d �� f� q�| �|� d S ) Nz%s.addPort('%s', '%s')c s | d � kS �Nr r( �rE ��protocolr( r) �<lambda>� r� z-FirewallDConfigZone.addPort.<locals>.<lambda>r� r �%s:%sc S s g | ] \}}|�qS r( r( �r� �_port� _protocolr( r( r) � <listcomp>� r� z/FirewallDConfigZone.addPort.<locals>.<listcomp>�-�r r< r r= r r rG rN rR �filterr r r r~ r re r r r_ � r" r� r� r? rP Zexisting_port_idsZport_idZ added_rangesZremoved_ranges�ranger( r� r) �addPort� s& � �zFirewallDConfigZone.addPortc s� t |t�}t � t�� t�d| j|� � | j�|� t| �� �}tt � fdd�|d ��}|D ]}t ||d �r\ q�q\t t j d|� f ��t|dd� |D ��\}}|D ] } |d �t| d �� f� q�|D ] } |d �t| d �� f� q�| �|� d S ) Nz%s.removePort('%s', '%s')c s | d � kS r� r( r� r� r( r) r� � r� z0FirewallDConfigZone.removePort.<locals>.<lambda>r� r r� c S s g | ] \}}|�qS r( r( r� r( r( r) r� r� z2FirewallDConfigZone.removePort.<locals>.<listcomp>r� �r r< r r= r r rG rN rR r� r r r r� r re r r r_ r� r( r� r) � removePort� s$ � z FirewallDConfigZone.removePortc C sX t |t�}t |t�}t�d| j||� | �� d D ] \}}t||�r2||kr2 dS q2dS )Nz%s.queryPort('%s', '%s')r� TF�r r< r r= r rR r �r" r� r� r? r� r� r( r( r) � queryPort s �z FirewallDConfigZone.queryPortc C s t �d| j� | �� d S )Nz%s.getProtocols()� ri ra r( r( r) � getProtocols s z FirewallDConfigZone.getProtocolsc C sN t |t�}t�d| jd�|�� | j�|� t| �� �}||d< | � |� d S )Nz%s.setProtocols('[%s]')ry r� rz )r" Z protocolsr? rP r( r( r) � setProtocols! s � z FirewallDConfigZone.setProtocolsc C sf t |t�}t�d| j|� | j�|� t| �� �}||d v rJt t j |��|d � |� | � |� d S )Nz%s.addProtocol('%s')r� r} �r" r� r? rP r( r( r) � addProtocol- s z FirewallDConfigZone.addProtocolc C sf t |t�}t�d| j|� | j�|� t| �� �}||d vrJt t j |��|d � |� | � |� d S )Nz%s.removeProtocol('%s')r� r� r� r( r( r) �removeProtocol: s z"FirewallDConfigZone.removeProtocolc C s* t |t�}t�d| j|� || �� d v S )Nz%s.queryProtocol('%s')r� r� )r" r� r? r( r( r) � queryProtocolG s z!FirewallDConfigZone.queryProtocolc C s t �d| j� | �� d S )Nz%s.getSourcePorts()� ri ra r( r( r) �getSourcePortsQ s z"FirewallDConfigZone.getSourcePortsc C s� g }t |t�D ](}t|t�r,|�t|�� q|�|� q|}t�d| jd�dd� |D ��� | j � |� t| � � �}||d< | � |� d S )Nz%s.setSourcePorts('[%s]')ry c s s" | ]}d |d |d f V qdS r� r( r� r( r( r) r� e r� z5FirewallDConfigZone.setSourcePorts.<locals>.<genexpr>r� r� r� r( r( r) �setSourcePortsX s � z"FirewallDConfigZone.setSourcePortsc s� t |t�}t � t�� t�d| j|� � | j�|� t| �� �}tt � fdd�|d ��}|D ]&}t ||d �r\t t j d|� f ��q\t|dd� |D ��\}}|D ] } |d �t| d �� f� q�|D ] } |d �t| d �� f� q�| �|� d S ) Nz %s.addSourcePort('%s', '%s')c s | d � kS r� r( r� r� r( r) r� u r� z3FirewallDConfigZone.addSourcePort.<locals>.<lambda>r� r r� c S s g | ] \}}|�qS r( r( r� r( r( r) r� z r� z5FirewallDConfigZone.addSourcePort.<locals>.<listcomp>r� r� r� r( r� r) � addSourcePortk s& � �z!FirewallDConfigZone.addSourcePortc s� t |t�}t � t�� t�d| j|� � | j�|� t| �� �}tt � fdd�|d ��}|D ]}t ||d �r\ q�q\t t j d|� f ��t|dd� |D ��\}}|D ] } |d �t| d �� f� q�|D ] } |d �t| d �� f� q�| �|� d S ) Nz %s.removeSourcePort('%s', '%s')c s | d � kS r� r( r� r� r( r) r� � r� z6FirewallDConfigZone.removeSourcePort.<locals>.<lambda>r� r r� c S s g | ] \}}|�qS r( r( r� r( r( r) r� � r� z8FirewallDConfigZone.removeSourcePort.<locals>.<listcomp>r� r� r� r( r� r) �removeSourcePort� s$ � z$FirewallDConfigZone.removeSourcePortc C sX t |t�}t |t�}t�d| j||� | �� d D ] \}}t||�r2||kr2 dS q2dS )Nz %s.querySourcePort('%s', '%s')r� TFr� r� r( r( r) �querySourcePort� s �z#FirewallDConfigZone.querySourcePortc C s t �d| j� | �� d S )Nz%s.getIcmpBlocks()� ri ra r( r( r) � getIcmpBlocks� s z!FirewallDConfigZone.getIcmpBlocksc C sN t |t�}t�d| jd�|�� | j�|� t| �� �}||d< | � |� d S )Nz%s.setIcmpBlocks('[%s]')ry r� rz )r" Z icmptypesr? rP r( r( r) � setIcmpBlocks� s � z!FirewallDConfigZone.setIcmpBlocksc C sf t |t�}t�d| j|� | j�|� t| �� �}||d v rJt t j |��|d � |� | � |� d S )Nz%s.addIcmpBlock('%s')r� r} �r" �icmptyper? rP r( r( r) � addIcmpBlock� s z FirewallDConfigZone.addIcmpBlockc C sf t |t�}t�d| j|� | j�|� t| �� �}||d vrJt t j |��|d � |� | � |� d S )Nz%s.removeIcmpBlock('%s')r� r� r� r( r( r) �removeIcmpBlock� s z#FirewallDConfigZone.removeIcmpBlockc C s* t |t�}t�d| j|� || �� d v S )Nz%s.queryIcmpBlock('%s')r� r� )r" r� r? r( r( r) �queryIcmpBlock� s z"FirewallDConfigZone.queryIcmpBlockc C s t �d| j� | �� d S )Nz%s.getIcmpBlockInversion()� ri ra r( r( r) �getIcmpBlockInversion� s z)FirewallDConfigZone.getIcmpBlockInversionc C sH t |t�}t�d| j|� | j�|� t| �� �}||d< | � |� d S )Nz %s.setIcmpBlockInversion('%s')r� � r �boolr r= r r rG rN rR r_ )r" �flagr? rP r( r( r) �setIcmpBlockInversion� s z)FirewallDConfigZone.setIcmpBlockInversionc C sP t �d| j� | j�|� t| �� �}|d r:ttj d��d|d< | � |� d S )Nz%s.addIcmpBlockInversion()r� �icmp-block-inversionT� r r= r r rG rN rR r r r~ r_ rU r( r( r) �addIcmpBlockInversion� s z)FirewallDConfigZone.addIcmpBlockInversionc C sP t �d| j� | j�|� t| �� �}|d s:ttj d��d|d< | � |� d S )Nz %s.removeIcmpBlockInversion()r� r� F� r r= r r rG rN rR r r r� r_ rU r( r( r) �removeIcmpBlockInversion� s z,FirewallDConfigZone.removeIcmpBlockInversionc C s t �d| j� | �� d S )Nz %s.queryIcmpBlockInversion()r� ri ra r( r( r) �queryIcmpBlockInversion s z+FirewallDConfigZone.queryIcmpBlockInversionc C s t �d| j� | �� d S )Nz%s.getMasquerade()� ri ra r( r( r) � getMasquerade s z!FirewallDConfigZone.getMasqueradec C sH t |t�}t�d| j|� | j�|� t| �� �}||d< | � |� d S )Nz%s.setMasquerade('%s')r� r� )r" � masquerader? rP r( r( r) � setMasquerade s z!FirewallDConfigZone.setMasqueradec C sP t �d| j� | j�|� t| �� �}|d r:ttj d��d|d< | � |� d S )Nz%s.addMasquerade()r� r� Tr� rU r( r( r) � addMasquerade" s z!FirewallDConfigZone.addMasqueradec C sP t �d| j� | j�|� t| �� �}|d s:ttj d��d|d< | � |� d S )Nz%s.removeMasquerade()r� r� Fr� rU r( r( r) �removeMasquerade- s z$FirewallDConfigZone.removeMasqueradec C s t �d| j� | �� d S )Nz%s.queryMasquerade()r� ri ra r( r( r) �queryMasquerade8 s z#FirewallDConfigZone.queryMasqueradeza(ssss)c C s t �d| j� | �� d S )Nz%s.getForwardPorts()� ri ra r( r( r) �getForwardPortsA s z#FirewallDConfigZone.getForwardPortsc C s� g }t |t�D ](}t|t�r,|�t|�� q|�|� q|}t�d| jd�dd� |D ��� | j � |� t| � � �}||d< | � |� d S )Nz%s.setForwardPorts('[%s]')ry c s s. | ]&}d |d |d |d |d f V qdS )z('%s, '%s', '%s', '%s')r r rp � Nr( r� r( r( r) r� U s � �z6FirewallDConfigZone.setForwardPorts.<locals>.<genexpr>r� r� r� r( r( r) �setForwardPortsH s �� z#FirewallDConfigZone.setForwardPortsZssssc C s� t |t�}t |t�}t |t�}t |t�}t�d| j||||� | j�|� ||t|�t|�f}t| �� �}||d v r�t t j d||||f ��|d � |� | � |� d S )Nz)%s.addForwardPort('%s', '%s', '%s', '%s')r� � %s:%s:%s:%sr} �r" r� r� �toport�toaddrr? �fwp_idrP r( r( r) �addForwardPort\ s$ � ��z"FirewallDConfigZone.addForwardPortc C s� t |t�}t |t�}t |t�}t |t�}t�d| j||||� | j�|� ||t|�t|�f}t| �� �}||d vr�t t j d||||f ��|d � |� | � |� d S )Nz,%s.removeForwardPort('%s', '%s', '%s', '%s')r� r� r� r� r( r( r) �removeForwardPortp s$ � ��z%FirewallDConfigZone.removeForwardPortc C sb t |t�}t |t�}t |t�}t |t�}t�d| j||||� ||t|�t|�f}|| �� d v S )Nz+%s.queryForwardPort('%s', '%s', '%s', '%s')r� r� )r" r� r� r� r� r? r� r( r( r) �queryForwardPort� s �z$FirewallDConfigZone.queryForwardPortc C s t �d| j� | �� d S )Nz%s.getInterfaces()� ri ra r( r( r) � getInterfaces� s z!FirewallDConfigZone.getInterfacesc C sN t |t�}t�d| jd�|�� | j�|� t| �� �}||d< | � |� d S )Nz%s.setInterfaces('[%s]')ry r� rz )r" rW r? rP r( r( r) � setInterfaces� s � z!FirewallDConfigZone.setInterfacesc C st t |t�}t�d| j|� | j�|� t| �� �}||d v rJt t j |��|d � |� | � |� t| jj|� d S )Nz%s.addInterface('%s')r� )r r< r r= r r rG rN rR r r r~ r r_ r r r. �r" � interfacer? rP r( r( r) � addInterface� s z FirewallDConfigZone.addInterfacec C sp t |t�}t�d| j|� | j�|� t| �� �}||d vrJt t j |��|d � |� | � |� td|� d S )Nz%s.removeInterface('%s')r� � )r r< r r= r r rG rN rR r r r� re r_ r r� r( r( r) �removeInterface� s z#FirewallDConfigZone.removeInterfacec C s* t |t�}t�d| j|� || �� d v S )Nz%s.queryInterface('%s')r� r� )r" r� r? r( r( r) �queryInterface� s z"FirewallDConfigZone.queryInterfacec C s t �d| j� | �� d S )Nz%s.getSources()� ri ra r( r( r) � getSources� s z FirewallDConfigZone.getSourcesc C sN t |t�}t�d| jd�|�� | j�|� t| �� �}||d< | � |� d S )Nz%s.setSources('[%s]')ry r� rz )r" rX r? rP r( r( r) � setSources� s � z FirewallDConfigZone.setSourcesc C sf t |t�}t�d| j|� | j�|� t| �� �}||d v rJt t j |��|d � |� | � |� d S )Nz%s.addSource('%s')r� r} �r" r[ r? rP r( r( r) � addSource� s z FirewallDConfigZone.addSourcec C sf t |t�}t�d| j|� | j�|� t| �� �}||d vrJt t j |��|d � |� | � |� d S )Nz%s.removeSource('%s')r� r� r� r( r( r) � removeSource� s z FirewallDConfigZone.removeSourcec C s* t |t�}t�d| j|� || �� d v S )Nz%s.querySource('%s')r� r� )r" r[ r? r( r( r) � querySource� s z FirewallDConfigZone.querySourcec C s t �d| j� | �� d S )Nz%s.getRichRules()� ri ra r( r( r) � getRichRules s z FirewallDConfigZone.getRichRulesc C s\ t |t�}t�d| jd�|�� | j�|� t| �� �}dd� |D �}||d< | � |� d S )Nz%s.setRichRules('[%s]')ry c S s g | ]}t t|d ���qS )��rule_str)r< r )r� �rr( r( r) r� r� z4FirewallDConfigZone.setRichRules.<locals>.<listcomp>r� rz )r" Zrulesr? rP r( r( r) � setRichRules s � z FirewallDConfigZone.setRichRulesc C st t |t�}t�d| j|� | j�|� t| �� �}tt |d��}||d v rXt t j |��|d � |� | �|� d S )Nz%s.addRichRule('%s')r� r� )r r< r r= r r rG rN rR r r r r~ r r_ �r" �ruler? rP r� r( r( r) � addRichRule s z FirewallDConfigZone.addRichRulec C st t |t�}t�d| j|� | j�|� t| �� �}tt |d��}||d vrXt t j |��|d � |� | �|� d S )Nz%s.removeRichRule('%s')r� r� )r r< r r= r r rG rN rR r r r r� re r_ r� r( r( r) �removeRichRule) s z"FirewallDConfigZone.removeRichRulec C s8 t |t�}t�d| j|� tt|d��}|| �� d v S )Nz%s.queryRichRule('%s')r� r� )r r< r r= r r rR )r" r� r? r� r( r( r) � queryRichRule7 s z!FirewallDConfigZone.queryRichRule)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)g�__name__� __module__� __qualname__�__doc__Z persistentr r ZPK_ACTION_CONFIGZ default_polkit_auth_requiredr r r r, r- r6 r ZPROPERTIES_IFACEr@ rF r rH r� �signalrI ZPK_ACTION_INFOZINTROSPECTABLE_IFACErJ r! rR rV r\ r_ r` rb r^ re rf rh rg rj rm rn ro rq rs rt ru rx r| r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� � __classcell__r( r( r& r) r 0 s� �� � � �� � �� �� �� �� �� � � ������ �� � � ������ �� � � ��� ��� ������ �� � � ��� � � ��� � � �r )"r Z dbus.serviceZfirewallr Zfirewall.dbus_utilsr r r Zfirewall.core.io.zoner Zfirewall.core.fw_ifcfgr Zfirewall.core.baser Zfirewall.core.richr Zfirewall.core.loggerr Zfirewall.server.dbusr Zfirewall.server.decoratorsr r r r r Zfirewall.errorsr Zfirewall.functionsr r r r r r( r( r( r) �<module> s server/__pycache__/firewalld.cpython-39.pyc 0000644 00000216355 15025011705 0014674 0 ustar 00 a ���gG� � @ sB d gZ ddlmZ ddlZddlZddlZddlmZ ddlm Z ddl m Z ddl m Z ddlmZ dd lmZmZ dd lmZmZmZmZmZmZ dd lmZ dd l m Z m Z m Z m Z m!Z!m"Z"m#Z#m$Z$ dd l%m&Z& ddl'm(Z( ddl)m*Z* ddl+m,Z, ddl-m.Z.m/Z/ ddl0m1Z1 ddlm2Z2 ddl3m4Z4 G dd � d e�Z5dS )� FirewallD� )�GLibN)�config)�Firewall)� Rich_Rule)�log)�FirewallClientZoneSettings)�FirewallDBusException�DbusServiceObject)�dbus_handle_exceptions�dbus_service_method�handle_exceptions� dbus_service_method_deprecated� dbus_service_signal_deprecated�dbus_polkit_require_auth)�FirewallDConfig)�dbus_to_python�command_of_sender�context_of_sender� uid_of_sender� user_of_uid�%dbus_introspection_prepare_properties�!dbus_introspection_add_properties�!dbus_introspection_add_deprecated)�check_on_disk_config)�IPSet)�IcmpType)�Helper)� nm_get_connection_of_interface�nm_set_zone_of_connection)�ifcfg_set_zone_of_interface)�errors)� FirewallErrorc s ! e Zd ZdZdZejjZe � fdd��Z dd� Z e dd� �Z e d d � �Z ed d � �Zed d� �Zedd� �Zedd� �Zedd� �Zeejddd�e�d�dd���Zeejdd d�e�d�d d ���Zeejj�eejd d �e�d�d!d"����Zejjejd#d$�d%d&� �Z eejj �eej dd'�e�d�� fd(d)� ���Z eejj�eejj d*d*d�e�d�d+d,����Z!eejj�eejj d*d*d�e�d�d-d.����Z"ej�ejj �ed/d0� ��Z#eejj�eejj d*d*d��d�d1d2���Z$eejj�eejj d*d*d�e�d�d3d4����Z%eejj�eejj d*d*d�e�d�d5d6����Z&eejj'�eejj(d*d*d�e�d�d7d8����Z)eejj'�eejj(d*d*d�e�d�d9d:����Z*eejj+�eejj(d*d;d�e�d�d<d=����Z,ejjejj(d*d$�ed>d?� ��Z-ejjejj(d*d$�ed@dA� ��Z.eejj'�eejj(dd*d�e�d�dBdC����Z/eejj'�eejj(dd*d�e�d�dDdE����Z0eejj+�eejj(dd;d�e�d�dFdG����Z1eejj+�eejj(d*dHd�e�d�dIdJ����Z2ejjejj(dd$�edKdL� ��Z3ejjejj(dd$�edMdN� ��Z4eejj'�eejj(dOd*d�e�d�dPdQ����Z5eejj'�eejj(dOd*d�e�d�dRdS����Z6eejj+�eejj(dOd;d�e�d�dTdU����Z7eejj+�eejj(d*dVd�e�d�dWdX����Z8ejjejj(dOd$�edYdZ� ��Z9ejjejj(dOd$�ed[d\� ��Z:eejj'�eejj(dd*d�e�d�d]d^����Z;eejj'�eejj(dd*d�e�d�d_d`����Z<eejj+�eejj(dd;d�e�d�dadb����Z=eejj+�eejj(d*dHd�e�d�dcdd����Z>ejjejj(dd$�ededf� ��Z?ejjejj(dd$�edgdh� ��Z@eejj'�eejj(dd*d�e�d�didj����ZAeejj'�eejj(dd*d�e�d�dkdl����ZBeejj+�eejj(dd;d�e�d�dmdn����ZCeejj+�eejj(d*dHd�e�d�dodp����ZDejjejj(dd$�edqdr� ��ZEejjejj(dd$�edsdt� ��ZFeejj�eejj d*d*d�e�d�dudv����ZGeejj�eejj d*d*d�e�d�dwdx����ZHeejj �eejj d*d;d�e�d�dydz����ZIejjejj d*d$�ed{d|� ��ZJejjejj d*d$�ed}d~� ��ZKeejjL�eejj ddd�e�d�d�d�����ZMeejjL�eejjNdd d�e�d�d�d�����ZOeejjL�eejjNd�d �e�d�d�d�����ZPejjejjNd�d$�ed�d�� ��ZQeejjL�eejjRdd d�e�d�d�d�����ZSeejjL�eejjRd�d �e�d�d�d�����ZTejjejjRd�d$�ed�d�� ��ZUeejj �eejj d*dHd�e�d�d�d�����ZVeejjL�eejj dd�d�e�d�d�d�����ZWeejjL�eejj dd d�e�d�d�d�����ZXeejj �eejj d*dHd�e�d�d�d�����ZYeejjL�eejj deZj[d�e�d�d�d�����Z\eejjL�eejj d*dd�e�d�d�d�����Z]eejj�eejj dd*d�e�d�d�d�����Z^ejjejj dd$�ed�d�� ��Z_eejjL�eejj d*dd�e�d�d�d�����Z`eejj�eejj dd*d�e�d�d�d�����Zaejjejj dd$�ed�d�� ��Zbeejj �eejj d*dd�e�d�d�d�����Zceejj�eejj dd*d�e�d�d�d�����Zdejjejj dd$�ed�d�� ��Zeeejj �eejjRd*dHd�e�d�d�d�����Zfeejj �eejjRd*d�d�e�d�d�d�����Zgeejj �eejjNd*dHd�e�d�d�d�����Zheejj �eejjNd*d�d�e�d�d�d�����Zieejj �eejjNddd�e�d�d�d�����Zjeejj �eejjNddd�e�d�d�d�����ZkeejjL�eejjNdd;d�e�d�d�d�����Zleejj�eejjNddd�e�d�d�d�����Zmeejj�eejjNddd�e�d�d�d�����Zneejj�eejjNddd�e�d�d�d�����Zoeejj�eejjNddd�e�d�d�d���ZpeejjL�eejjNdd;d�e�d�d�dĄ���ZqeejjL�eejjNddHd�e�d�d�dƄ���ZrejjejjNdd$�ed�dȄ ��ZsejjejjNdd$�ed�dʄ ��ZtejjejjNdd$�ed�d̄ ��ZuejjejjNdd$�ed�d΄ ��Zveejj�eejjNddd�e�d�d�dЄ���Zweejj�eejjNddd�e�d�d�d҄���Zxeejj�eejjNddd�e�d�d�dԄ���ZyeejjL�eejjNdd;d�e�d�d�dք���ZzeejjL�eejjNddHd�e�d�d�d���Z{ejjejjNdd$�ed�dڄ ��Z|ejjejjNdd$�ed�d܄ ��Z}ejjejjNdd$�ed�dބ ��Z~ed�d� �Zeejj�eejjNd�dd�e�d�d�d����Z�eejj�eejjNddd�e�d�d�d����Z�eejjL�eejjNdd;d�e�d�d�d����Z�eejjL�eejjNddHd�e�d�d�d����Z�ejjejjNd�d$�ed�d� ��Z�ejjejjNdd$�ed�d� ��Z�ed�d� �Z�eejj�eejjNd�dd�e�d�d�d����Z�eejj�eejjNddd�e�d�d�d����Z�eejjL�eejjNdd;d�e�d�d�d�����Z�eejjL�eejjNddHd�e�d�d�d�����Z�ejjejjNd�d$�ed�d�� ��Z�ejjejjNdd$�ed�d�� ��Z�ed�d�� �Z�eejj�eejjNd�dd�e�d�d��d ����Z�eejj�eejjN�ddd�e�d��d�d����Z�eejjL�eejjN�dd;d�e�d��d�d����Z�eejjL�eejjNd�dd�e�d��d�d����Z�ejjejjNd�d$�e�d��d �d ���Z�ejjejjN�dd$�e�d �d � ��Z�e�d�d� �Z�eejj�eejjNd�dd�e�d��d�d����Z�eejj�eejjNddd�e�d��d�d����Z�eejjL�eejjNdd;d�e�d��d�d����Z�eejjL�eejjNddHd�e�d �d�d����Z�ejjejjNd�d$�e�d�d�d���Z�ejjejjNdd$�e�d�d� ��Z�e�d �d � �Z�eejj�eejjNd�dd�e�d�d �d ����Z�eejj�eejjN�ddd�e�d�d �d!����Z�eejjL�eejjN�dd;d�e�d�d"�d#����Z�eejjL�eejjNd�dd�e�d�d$�d%����Z�ejjejjNd�d$�e�d�d&�d'���Z�ejjejjN�dd$�e�d(�d)� ��Z�e�d*�d+� �Z�eejj�eejjN�d,dd�e�d�d-�d.����Z�eejj�eejjNddd�e�d�d/�d0����Z�eejjL�eejjNdd;d�e�d �d1�d2����Z�ejjejjN�d,d$�e�d �d3�d4���Z�ejjejjNdd$�e�d5�d6� ��Z�e�d7�d8� �Z�eejj�eejjN�d9dd�e�d �d:�d;����Z�eejj�eejjN�d<dd�e�d �d=�d>����Z�eejjL�eejjN�d<d;d�e�d �d?�d@����Z�eejjL�eejjNd�dd�e�d�dA�dB����Z�ejjejjN�d9d$�e�d�dC�dD���Z�ejjejjN�d<d$�e�dE�dF� ��Z�e�dG�dH� �Z�eejj�eejjNd�dd�e�d�dI�dJ����Z�eejj�eejjNddd�e�d�dK�dL����Z�eejjL�eejjNdd;d�e�d�dM�dN����Z�eejjL�eejjNddHd�e�d�dO�dP����Z�ejjejjNd�d$�e�d�dQ�dR���Z�ejjejjNdd$�e�dS�dT� ��Z�eejj�eejjNddd�e�d�dU�dV����Z�eejj�eejjNddd�e�d�dW�dX����Z�eejjL�eejjNdd;d�e�d�dY�dZ����Z�ejjejjNdd$�e�d[�d\� ��Z�ejjejjNdd$�e�d]�d^� ��Z�eejj��e�ejj��eejj��dd*d�e�d�d_�d`�����Z�eejj��e�ejj��eejj��dd*d�e�d�da�db�����Z�eejj��e�ejj��eejj��dd;d�e�d�dc�dd�����Z�eejj��e�ejj��eejj�ddHd�e�d�de�df�����Z�eejj��e�ejj��eejj�d*�dgd�e�d �dh�di�����Z�e�ejj��ejjejj��dd$�e�dj�dk� ���Z�e�ejj��ejjejj��dd$�e�dl�dm� ���Z�eejj��e�ejj��eejj��dnd*d�e�d �do�dp�����Z�eejj��e�ejj��eejj��dnd*d�e�d �dq�dr�����Z�eejj��e�ejj��eejj��dd*d�e�d �ds�dt�����Z�eejj��e�ejj��eejj��dnd;d�e�d �du�dv�����Z�eejj��e�ejj��eejj��d�dwd�e�d!�dx�dy�����Z�eejj��e�ejj��eejj�d*�dzd�e�d"�d{�d|�����Z�e�ejj��ejjejj��dnd$�e�d}�d~� ���Z�e�ejj��ejjejj��dnd$�e�d�d�� ���Z�eejj��e�ejj��eejj��d�dd�e�d#�d��d������Z�eejj��e�ejj��eejj��d�d*d�e�d$�d��d������Z�eejj��e�ejj��eejj��d�d*d�e�d%�d��d������Z�eejj��e�ejj��eejj��d�d;d�e�d&�d��d������Z�eejj��e�ejj��eejj�d*�d�d�e�d'�d��d������Z�eejj��e�ejj��eejj�d*d*d�e�d(�d��d������Z�eejj��e�ejj��eejj�d�dd�e�d)�d��d������Z�e�ejj��ejjejj��d�d$�e�d��d�� ���Z�e�ejj��ejjejj��d�d$�e�d��d�� ���Z�eejjeejj d*d*d�e�d*�d��d�����Z�eejj �eejj�dd;d�e�d+�d��d�����Z�eejj �eejj�d*dHd�e�d,�d��d�����Z�eejjL�eejj�de�j[d�e�d-�d��d�����Z�eejj�eejj�dd*d�e�d.�d��d�����Z�eejj�eejj�dd*d�e�d/�d��d�����Z�eejj �eejj�dd;d�e�d0�d��d�����Z�eejj �eejj�ddHd�e�d1�d��d�����Z�eejj�eejjڐd�d �e�d2�d��d�����Z�ejjejj�dd$�e�d��d�� ��Z�ejjejj�dd$�e�d��d�� ��Z�eejj �eejj d*dHd�e�d3�d��d�����Z�eejjL�eejj de�j[d�e�d4�d��d�����Z� Z�S (5 r zFirewallD main classTc sd t t| �j|i |�� t� | _|d | _|d | _| �� t| t j j � t | jj | jt j j �| _ d S )Nr � )�superr �__init__r �fw�busname�path�startr r �dbus�DBUS_INTERFACEr ZDBUS_PATH_CONFIG)�self�args�kwargs�� __class__� �=/usr/lib/python3.9/site-packages/firewall/server/firewalld.pyr% G s �zFirewallD.__init__c C s | � � d S �N)�stop�r, r1 r1 r2 �__del__R s zFirewallD.__del__c C s t �d� i | _| j�� S )Nzstart())r �debug1� _timeoutsr& r) r5 r1 r1 r2 r) U s zFirewallD.startc C s t �d� | j�� S )Nzstop())r r7 r& r4 r5 r1 r1 r2 r4 ] s zFirewallD.stopc C s� | j j�� r�|d u r"t�d� d S t�� }t||�}| j j�d|�rHd S t ||�}| j j�d|�rfd S t |�}| j j�d|�r�d S t ||�}| j j�d|�r�d S t t jd��d S )Nz&Lockdown not possible, sender not set.�context�uid�user�commandzlockdown is enabled)r& �policies�query_lockdownr �errorr* Z SystemBusr Z access_checkr r r r" r! Z ACCESS_DENIED)r, �senderZbusr9 r: r; r< r1 r1 r2 � accessCheckf s$ zFirewallD.accessCheckc C s& || j vri | j |< || j | |< d S r3 )r8 )r, �zone�x�tagr1 r1 r2 � addTimeout} s zFirewallD.addTimeoutc C s< || j v r8|| j | v r8t�| j | | � | j | |= d S r3 )r8 r � source_remove�r, rB rC r1 r1 r2 � removeTimeout� s zFirewallD.removeTimeoutc C sL | j D ]6}| j | D ]}t�| j | | � q| j | �� q| j �� d S r3 )r8 r rF �clearrG r1 r1 r2 �cleanup_timeouts� s zFirewallD.cleanup_timeoutsc C sr |dkrt �tj�S |dkr6t �dtj jtj jf �S |dkrNt �| j�� �S |dkrht �| j� d��S |dkr�t � | jj d�S |d kr�t �| j� d ��S |d kr�t �| jj d kr�d nd�S |dkr�t � | jj d�S |dk� r�t �| jj�S |dk�rt �| jj�S |dk�r t � | jjd�S |dk�r2t �d �S |dk�rHt �i d�S |dk�r^t �i d�S t j�d| ��d S )N�version�interface_versionz%d.%d�state�IPv4�ipv4� IPv4ICMPTypes�s�IPv6�ipv6� IPv6_rpfilter�noFT� IPv6ICMPTypes�BRIDGEr � IPSetTypes�nf_conntrack_helper_setting�nf_conntrack_helpers�sas�nf_nat_helpers�Dorg.freedesktop.DBus.Error.InvalidArgs: Property '%s' does not exist)r* �Stringr ZVERSIONZDBUS_INTERFACE_VERSIONZDBUS_INTERFACE_REVISIONr& Z get_stateZBooleanZis_ipv_enabledZArrayZipv4_supported_icmp_typesZ_ipv6_rpfilterZipv6_supported_icmp_typesZebtables_enabledZ ipset_enabledZipset_supported_types� Dictionary� exceptions� DBusException)r, Zpropr1 r1 r2 � _get_property� sF � ��zFirewallD._get_property�ss�v)� in_signature� out_signatureNc C s~ t |t�}t |t�}t�d||� |tjjkr8| �|�S |tjjtjj tjj tjj fv rjtj � d| ��ntj � d| ��d S )NzGet('%s', '%s')r] �Jorg.freedesktop.DBus.Error.UnknownInterface: Interface '%s' does not exist)r �strr r7 r r* r+ rb �DBUS_INTERFACE_ZONE�DBUS_INTERFACE_DIRECT�DBUS_INTERFACE_POLICIES�DBUS_INTERFACE_IPSETr` ra )r, �interface_name� property_namer@ r1 r1 r2 �Get� s( �����z FirewallD.GetrQ za{sv}c C s� t |t�}t�d|� i }|tjjkr@dD ]}| �|�||< q*n2|tjjtjj tjj tjj fv rbntj � d| ��tj|dd�S )Nz GetAll('%s')�rK rL rM rN rR rT rW r rX rY rZ r\ rP rV rg �sv�Z signature)r rh r r7 r r* r+ rb ri rj rk rl r` ra r_ )r, rm r@ �retrC r1 r1 r2 �GetAll� s$ ���zFirewallD.GetAllZssv)re c C s� t |t�}t |t�}t |�}t�d|||� | �|� |tjjkrn|dv r\tj� d| ��q�tj� d| ��nB|tjj tjj tjj tjj fv r�tj� d| ��ntj� d| ��d S )NzSet('%s', '%s', '%s')rp zGorg.freedesktop.DBus.Error.PropertyReadOnly: Property '%s' is read-onlyr] rg )r rh r r7 rA r r* r+ r` ra ri rj rk rl )r, rm rn Z new_valuer@ r1 r1 r2 �Set� sD � ���������z FirewallD.Setzsa{sv}asrr c C s. t |t�}t |�}t |�}t�d|||� d S )Nz#PropertiesChanged('%s', '%s', '%s'))r rh r r7 )r, rm Zchanged_propertiesZinvalidated_propertiesr1 r1 r2 �PropertiesChanged s �zFirewallD.PropertiesChanged)rf c s` t �d� tt| ��| j| j�� �}t| |t j j �}t j j fD ] }t | ||t� jt� j�}q>|S )Nz Introspect())r Zdebug2r$ r � Introspectr( r' Zget_busr r r* r+ rj r r Z deprecatedr )r, r@ �data� interfacer/ r1 r2 rw $ s ���zFirewallD.Introspect� c C s* t �d� | j�� | j�� | �� dS )z#Reload the firewall rules. zreload()N�r r7 r& �reloadr �Reloaded�r, r@ r1 r1 r2 r| : s zFirewallD.reloadc C s, t �d� | j�d� | j�� | �� dS )z�Completely reload the firewall. Completely reload the firewall: Stops firewall, unloads modules and starts the firewall again. zcompleteReload()TNr{ r~ r1 r1 r2 �completeReloadI s zFirewallD.completeReloadc C s t �d� d S )Nz Reloaded()�r r7 r5 r1 r1 r2 r} Y s zFirewallD.Reloadedc C s" t �d� | jj�� | �� dS )zbreset to firewall's builtin defaults. Reloads firewalld to apply changes properly z firewalld.reset_to_defaults()N)r r7 r& r Zreset_defaultsr| r~ r1 r1 r2 �resetToDefaults^ s zFirewallD.resetToDefaultsc C s t �d� t| j� dS )z&Check permanent configuration zcheckPermanentConfig()N)r r7 r r& r~ r1 r1 r2 �checkPermanentConfigi s z FirewallD.checkPermanentConfigc C s� t �d� | jjdkr"ttjd��d}| j�� }| jj � � D ]�}| � |�}zj||v r�| j� |�}|� � |kr�t �d| � |�|� q�t �d| � n t �d| � | j�||� W q< ty� } z"t �d||f � d }W Y d }~q<d }~0 0 q<| j�� }| jj�� D ]�}| �|�}zn||v �rf| j�|�}|� � |k�rVt �d | � |�|� nt �d | � n t �d | � | j�||� W n< t�y� } z"t �d||f � d }W Y d }~n d }~0 0 �q| j�� }| jj�� D ]�}zx| �|�}||v �r:| j� |�}|� � |k�r*t �d| � |�|� nt �d| � n t �d| � | j� ||� W n< t�y� } z"t �d||f � d }W Y d }~n d }~0 0 �q�| j� � }| jj � � D �]h}| �!|�}t"t#�$|��}d} |�%� D ]4} | | jj&v �r�t �d|| f � |�'| � d } �q�|�%� D ]H} z,t(| �} | �rFt)|| ��rF|�'| � d } W n t�y\ Y n0 �q| �rp|�*� }|�%� D ]} t+|| � �qxzP||v �r�| j�,|�}t �d| � |�-|� n t �d| � | j�.||� W n< t�y } z"t �d||f � d }W Y d }~n d }~0 0 �q�| j�/� }| jj0�1� D ]�}| �2|�}zB||v �rd| j�3|�}|�|� n t �d| � | j�4||� W n< t�y� } z"t �d||f � d }W Y d }~n d }~0 0 �q2| j�5� }| jj6�7� D ]�}| �8|�}zn||v �r8| j�9|�}|� � |k�r(t �d| � |�|� nt �d| � n t �d| � | j�:||� W n< t�y� } z"t �d ||f � d }W Y d }~n d }~0 0 �q�| jj;�<� | jj;�=� | jj;�>� f}z6| j� � |k�r�t �d � | j�|� n t �d � W n8 t�y( } z t �d | � d }W Y d }~n d }~0 0 | jj?j@�A� }z6| j� � |k�rbt �d � | j�B|� n t �d!� W n8 t�y� } z t �d"| � d }W Y d }~n d }~0 0 |�r�ttjC��d S )#z-Make runtime configuration permanent zcopyRuntimeToPermanent()ZFAILEDz�Saving runtime to permanent is not allowed while firewalld is in FAILED state. The permanent configuration must be fixed and then firewalld restarted. Try `firewall-offline-cmd --check-config`.Fz Copying service '%s' settingsz$Service '%s' is identical, ignoring.zCreating service '%s'z/Runtime To Permanent failed on service '%s': %sTNz Copying icmptype '%s' settingsz%IcmpType '%s' is identical, ignoring.zCreating icmptype '%s'z0Runtime To Permanent failed on icmptype '%s': %szCopying ipset '%s' settingsz"IPSet '%s' is identical, ignoring.zCreating ipset '%s'z-Runtime To Permanent failed on ipset '%s': %szEZone '%s': interface binding for '%s' has been added by NM, ignoring.zCopying zone '%s' settingszCreating zone '%s'z,Runtime To Permanent failed on zone '%s': %szCreating policy '%s'z.Runtime To Permanent failed on policy '%s': %sz Copying helper '%s' settingsz#Helper '%s' is identical, ignoring.zCreating helper '%s'z.Runtime To Permanent failed on helper '%s': %sz Copying direct configurationz,Direct configuration is identical, ignoring.z7Runtime To Permanent failed on direct configuration: %sz Copying policies configurationz.Policies configuration is identical, ignoring.z9Runtime To Permanent failed on policies configuration: %s)Dr r7 r& �_stater" r! ZRUNNING_BUT_FAILEDr ZgetServiceNames�service� get_services�getServiceSettingsZgetServiceByNameZ getSettings�update� addService� Exception�warningZgetIcmpTypeNames�icmptype� get_icmptypes�getIcmpTypeSettingsZgetIcmpTypeByNameZ addIcmpTypeZ getIPSetNames�ipset� get_ipsets�getIPSetSettingsZgetIPSetByNameZaddIPSetZ getZoneNamesrB � get_zones�getZoneSettings2r �copy�deepcopy� getInterfacesZ_nm_assigned_interfaces�removeInterfacer r ZgetSettingsDictr Z getZoneByNameZupdate2ZaddZone2ZgetPolicyNames�policy�"get_policies_not_derived_from_zone�getPolicySettingsZgetPolicyByNameZ addPolicyZgetHelperNames�helper� get_helpers�getHelperSettingsZgetHelperByNameZ addHelper�direct�get_all_chains� get_all_rules�get_all_passthroughsr= �lockdown_whitelist� export_configZsetLockdownWhitelistZRT_TO_PERM_FAILED) r, r@ r? Z config_names�nameZconfZconf_obj�e�settingsZchangedry Z connectionr1 r1 r2 �runtimeToPermanentu sF � �� �� �� �� �� �� � � ��z FirewallD.runtimeToPermanentc C s, t �d� | �|� | jj�� | �� dS )z!Enable lockdown policies zpolicies.enableLockdown()N)r r7 rA r& r= Zenable_lockdown�LockdownEnabledr~ r1 r1 r2 �enableLockdownG s zFirewallD.enableLockdownc C s, t �d� | �|� | jj�� | �� dS )z"Disable lockdown policies zpolicies.disableLockdown()N)r r7 rA r& r= Zdisable_lockdown�LockdownDisabledr~ r1 r1 r2 �disableLockdownS s zFirewallD.disableLockdown�bc C s t �d� | jj�� S )z,Returns True if lockdown is enabled zpolicies.queryLockdown())r r7 r& r= r> r~ r1 r1 r2 � queryLockdown_ s zFirewallD.queryLockdownc C s t �d� d S )NzLockdownEnabled()r� r5 r1 r1 r2 r� j s zFirewallD.LockdownEnabledc C s t �d� d S )NzLockdownDisabled()r� r5 r1 r1 r2 r� o s zFirewallD.LockdownDisabledc C s@ t |t�}t�d| � | �|� | jjj�|� | � |� dS )� Add lockdown command z*policies.addLockdownWhitelistCommand('%s')N) r rh r r7 rA r& r= r� Z add_command� LockdownWhitelistCommandAdded�r, r< r@ r1 r1 r2 �addLockdownWhitelistCommandx s z%FirewallD.addLockdownWhitelistCommandc C s@ t |t�}t�d| � | �|� | jjj�|� | � |� dS )z Remove lockdown command z-policies.removeLockdownWhitelistCommand('%s')N) r rh r r7 rA r& r= r� Zremove_command� LockdownWhitelistCommandRemovedr� r1 r1 r2 � removeLockdownWhitelistCommand� s z(FirewallD.removeLockdownWhitelistCommandc C s( t |t�}t�d| � | jjj�|�S )z Query lockdown command z,policies.queryLockdownWhitelistCommand('%s'))r rh r r7 r& r= r� Z has_commandr� r1 r1 r2 � queryLockdownWhitelistCommand� s z'FirewallD.queryLockdownWhitelistCommand�asc C s t �d� | jjj�� S )r� z'policies.getLockdownWhitelistCommands())r r7 r& r= r� Z get_commandsr~ r1 r1 r2 � getLockdownWhitelistCommands� s z&FirewallD.getLockdownWhitelistCommandsc C s t �d| � d S )Nz#LockdownWhitelistCommandAdded('%s')r� �r, r< r1 r1 r2 r� � s z'FirewallD.LockdownWhitelistCommandAddedc C s t �d| � d S )Nz%LockdownWhitelistCommandRemoved('%s')r� r� r1 r1 r2 r� � s z)FirewallD.LockdownWhitelistCommandRemoved�ic C s@ t |t�}t�d| � | �|� | jjj�|� | � |� dS )�Add lockdown uid z&policies.addLockdownWhitelistUid('%s')N) r �intr r7 rA r& r= r� Zadd_uid�LockdownWhitelistUidAdded�r, r: r@ r1 r1 r2 �addLockdownWhitelistUid� s z!FirewallD.addLockdownWhitelistUidc C s@ t |t�}t�d| � | �|� | jjj�|� | � |� dS )z Remove lockdown uid z)policies.removeLockdownWhitelistUid('%s')N) r r� r r7 rA r& r= r� Z remove_uid�LockdownWhitelistUidRemovedr� r1 r1 r2 �removeLockdownWhitelistUid� s z$FirewallD.removeLockdownWhitelistUidc C s( t |t�}t�d| � | jjj�|�S )zQuery lockdown uid z(policies.queryLockdownWhitelistUid('%s'))r r� r r7 r& r= r� Zhas_uidr� r1 r1 r2 �queryLockdownWhitelistUid� s z#FirewallD.queryLockdownWhitelistUidZaic C s t �d� | jjj�� S )r� z#policies.getLockdownWhitelistUids())r r7 r& r= r� Zget_uidsr~ r1 r1 r2 �getLockdownWhitelistUids� s z"FirewallD.getLockdownWhitelistUidsc C s t �d| � d S )Nz LockdownWhitelistUidAdded(%d)r� �r, r: r1 r1 r2 r� � s z#FirewallD.LockdownWhitelistUidAddedc C s t �d| � d S )Nz LockdownWhitelistUidRemoved(%d)r� r� r1 r1 r2 r� � s z%FirewallD.LockdownWhitelistUidRemovedc C s@ t |t�}t�d| � | �|� | jjj�|� | � |� dS )�Add lockdown user z'policies.addLockdownWhitelistUser('%s')N) r rh r r7 rA r& r= r� Zadd_user�LockdownWhitelistUserAdded�r, r; r@ r1 r1 r2 �addLockdownWhitelistUser� s z"FirewallD.addLockdownWhitelistUserc C s@ t |t�}t�d| � | �|� | jjj�|� | � |� dS )z Remove lockdown user z*policies.removeLockdownWhitelistUser('%s')N) r rh r r7 rA r& r= r� Z remove_user� LockdownWhitelistUserRemovedr� r1 r1 r2 �removeLockdownWhitelistUser� s z%FirewallD.removeLockdownWhitelistUserc C s( t |t�}t�d| � | jjj�|�S )z Query lockdown user z)policies.queryLockdownWhitelistUser('%s'))r rh r r7 r& r= r� Zhas_userr� r1 r1 r2 �queryLockdownWhitelistUser s z$FirewallD.queryLockdownWhitelistUserc C s t �d� | jjj�� S )r� z$policies.getLockdownWhitelistUsers())r r7 r& r= r� Z get_usersr~ r1 r1 r2 �getLockdownWhitelistUsers s z#FirewallD.getLockdownWhitelistUsersc C s t �d| � d S )Nz LockdownWhitelistUserAdded('%s')r� �r, r; r1 r1 r2 r� # s z$FirewallD.LockdownWhitelistUserAddedc C s t �d| � d S )Nz"LockdownWhitelistUserRemoved('%s')r� r� r1 r1 r2 r� ( s z&FirewallD.LockdownWhitelistUserRemovedc C s@ t |t�}t�d| � | �|� | jjj�|� | � |� dS )� Add lockdown context z*policies.addLockdownWhitelistContext('%s')N) r rh r r7 rA r& r= r� Z add_context� LockdownWhitelistContextAdded�r, r9 r@ r1 r1 r2 �addLockdownWhitelistContext/ s z%FirewallD.addLockdownWhitelistContextc C s@ t |t�}t�d| � | �|� | jjj�|� | � |� dS )z Remove lockdown context z-policies.removeLockdownWhitelistContext('%s')N) r rh r r7 rA r& r= r� Zremove_context� LockdownWhitelistContextRemovedr� r1 r1 r2 � removeLockdownWhitelistContext< s z(FirewallD.removeLockdownWhitelistContextc C s( t |t�}t�d| � | jjj�|�S )z Query lockdown context z,policies.queryLockdownWhitelistContext('%s'))r rh r r7 r& r= r� Z has_contextr� r1 r1 r2 � queryLockdownWhitelistContextI s z'FirewallD.queryLockdownWhitelistContextc C s t �d� | jjj�� S )r� z'policies.getLockdownWhitelistContexts())r r7 r& r= r� Z get_contextsr~ r1 r1 r2 � getLockdownWhitelistContextsU s z&FirewallD.getLockdownWhitelistContextsc C s t �d| � d S )Nz#LockdownWhitelistContextAdded('%s')r� �r, r9 r1 r1 r2 r� ` s z'FirewallD.LockdownWhitelistContextAddedc C s t �d| � d S )Nz%LockdownWhitelistContextRemoved('%s')r� r� r1 r1 r2 r� e s z)FirewallD.LockdownWhitelistContextRemovedc C s* t �d� | �|� | j�� | �� dS )zfEnable panic mode. All ingoing and outgoing connections and packets will be blocked. zenablePanicMode()N)r r7 rA r& Zenable_panic_mode�PanicModeEnabledr~ r1 r1 r2 �enablePanicModen s zFirewallD.enablePanicModec C s* t �d� | �|� | j�� | �� dS )z�Disable panic mode. Enables normal mode: Allowed ingoing and outgoing connections will not be blocked anymore zdisablePanicMode()N)r r7 rA r& Zdisable_panic_mode�PanicModeDisabledr~ r1 r1 r2 �disablePanicMode| s zFirewallD.disablePanicModec C s t �d� | j�� S )NzqueryPanicMode())r r7 r& Zquery_panic_moder~ r1 r1 r2 �queryPanicMode� s zFirewallD.queryPanicModec C s t �d� d S )NzPanicModeEnabled()r� r5 r1 r1 r2 r� � s zFirewallD.PanicModeEnabledc C s t �d� d S )NzPanicModeDisabled()r� r5 r1 r1 r2 r� � s zFirewallD.PanicModeDisabledz&(sssbsasa(ss)asba(ssss)asasasasa(ss)b)c C s$ t |t�}t�d|� | jj�|�S )NzgetZoneSettings(%s))r rh r r7 r& rB Zget_config_with_settings�r, rB r@ r1 r1 r2 �getZoneSettings� s zFirewallD.getZoneSettingsc C s$ t |t�}t�d|� | jj�|�S )NzgetZoneSettings2(%s))r rh r r7 r& rB � get_config_with_settings_dictr� r1 r1 r2 r� � s zFirewallD.getZoneSettings2zsa{sv}c C sF t |t�}t�d|� | �|� | jj�|t |�|� | �||� d S )NzsetZoneSettings2(%s)) r rh r r7 rA r& rB � set_config_with_settings_dict� ZoneUpdated)r, rB r� r@ r1 r1 r2 �setZoneSettings2� s zFirewallD.setZoneSettings2c C s t �d||f � d S )Nz zone.ZoneUpdated('%s', '%s')r� )r, rB r� r1 r1 r2 r� � s zFirewallD.ZoneUpdatedc C s$ t |t�}t�d|� | jj�|�S )Nz policy.getPolicySettings(%s))r rh r r7 r& r� r� )r, r� r@ r1 r1 r2 r� � s zFirewallD.getPolicySettingsc C sF t |t�}t�d|� | �|� | jj�|t |�|� | �||� d S )Nz policy.setPolicySettings(%s)) r rh r r7 rA r& r� r� � PolicyUpdated)r, r� r� r@ r1 r1 r2 �setPolicySettings� s zFirewallD.setPolicySettingsc C s t �d||f � d S )Nz policy.PolicyUpdated('%s', '%s')r� )r, r� r� r1 r1 r2 r� � s zFirewallD.PolicyUpdatedc C s t �d� | jj�� S )NzlistServices())r r7 r& r� r� r~ r1 r1 r2 � listServices� s zFirewallD.listServicesz(sssa(ss)asa{ss}asa(ss))c C s� t |t�}t�d|� | jj�|�}|�� }g }td�D ]P}|j | d |vrp|� t � t ||j | d ��� q8|� ||j | d � q8t|�S )NzgetServiceSettings(%s)� r )r rh r r7 r& r� � get_service�export_config_dict�rangeZIMPORT_EXPORT_STRUCTURE�appendr� r� �getattr�tuple)r, r� r@ �objZ conf_dictZ conf_listr� r1 r1 r2 r� � s "z FirewallD.getServiceSettingsc C s, t |t�}t�d|� | jj�|�}|�� S )NzgetServiceSettings2(%s))r rh r r7 r& r� r� r� )r, r� r@ r� r1 r1 r2 �getServiceSettings2� s z FirewallD.getServiceSettings2c C s t �d� | jj�� S )NzlistIcmpTypes())r r7 r& r� r� r~ r1 r1 r2 � listIcmpTypes s zFirewallD.listIcmpTypesc C s( t |t�}t�d|� | jj�|��� S )NzgetIcmpTypeSettings(%s))r rh r r7 r& r� Z get_icmptyper� )r, r� r@ r1 r1 r2 r� s z FirewallD.getIcmpTypeSettingsc C s t �d� | j�� S )NzgetLogDenied())r r7 r& Zget_log_deniedr~ r1 r1 r2 � getLogDenied s zFirewallD.getLogDeniedc C sX t |t�}t�d| � | �|� | j�|� | �|� | j�� | j �� | � � d S )NzsetLogDenied('%s')) r rh r r7 rA r& Zset_log_denied�LogDeniedChangedr| r r} �r, �valuer@ r1 r1 r2 � setLogDenied' s zFirewallD.setLogDeniedc C s t �d| � d S )NzLogDeniedChanged('%s')r� �r, r� r1 r1 r2 r� 7 s zFirewallD.LogDeniedChangedc C s t �d� dS )NzgetAutomaticHelpers()rU r� r~ r1 r1 r2 �getAutomaticHelpers@ s z FirewallD.getAutomaticHelpersc C s& t |t�}t�d| � | �|� d S )NzsetAutomaticHelpers('%s'))r rh r r7 rA r� r1 r1 r2 �setAutomaticHelpersK s z FirewallD.setAutomaticHelpersc C s t �d| � d S )Nz AutomaticHelpersChanged('%s')r� r� r1 r1 r2 �AutomaticHelpersChangedW s z!FirewallD.AutomaticHelpersChangedc C s t �d� | j�� S )NzgetDefaultZone())r r7 r& Zget_default_zoner~ r1 r1 r2 �getDefaultZone` s zFirewallD.getDefaultZonec C s< t |t�}t�d| � | �|� | j�|� | �|� d S )NzsetDefaultZone('%s'))r rh r r7 rA r& Zset_default_zone�DefaultZoneChangedr� r1 r1 r2 �setDefaultZonei s zFirewallD.setDefaultZonec C s t �d| � d S )NzDefaultZoneChanged('%s')r� �r, rB r1 r1 r2 r� u s z FirewallD.DefaultZoneChangedc C s t �d� | jj�� S )Nzpolicy.getPolicies())r r7 r& r� r� r~ r1 r1 r2 � getPolicies� s zFirewallD.getPoliciesz a{sa{sas}}c C sX t �d� i }| jj�� D ]8}i ||< | jj�|�|| d< | jj�|�|| d< q|S )Nzpolicy.getActivePolicies()Z ingress_zonesZ egress_zones)r r7 r& r� Z)get_active_policies_not_derived_from_zoneZlist_ingress_zonesZlist_egress_zones)r, r@ r= r� r1 r1 r2 �getActivePolicies� s zFirewallD.getActivePoliciesc C s t �d� | jj�� S )Nzzone.getZones())r r7 r& rB r� r~ r1 r1 r2 �getZones� s zFirewallD.getZonesc C s� t �d� i }| jj�� D ]l}| jj�|�}| jj�|�}t|�t|� dkri ||< t|�dkrn||| d< t|�dkr||| d< q|S )Nzzone.getActiveZones()r � interfaces�sources)r r7 r& rB r� �list_interfaces� list_sources�len)r, r@ ZzonesrB r� r� r1 r1 r2 �getActiveZones� s zFirewallD.getActiveZonesc C s2 t |t�}t�d| � | jj�|�}|r.|S dS )z�Return the zone an interface belongs to. :Parameters: `interface` : str Name of the interface :Returns: str. The name of the zone. z zone.getZoneOfInterface('%s')rz )r rh r r7 r& rB Zget_zone_of_interface)r, ry r@ rB r1 r1 r2 �getZoneOfInterface� s z FirewallD.getZoneOfInterfacec C s2 t |t�}t�d| � | jj�|�}|r.|S dS )Nzzone.getZoneOfSource('%s')rz )r rh r r7 r& rB Zget_zone_of_source)r, �sourcer@ rB r1 r1 r2 �getZoneOfSource� s zFirewallD.getZoneOfSourcec C s dS )NFr1 r� r1 r1 r2 � isImmutable� s zFirewallD.isImmutablec C sR t |t�}t |t�}t�d||f � | �|� | jj�|||�}| �||� |S )zPAdd an interface to a zone. If zone is empty, use default zone. z zone.addInterface('%s', '%s')) r rh r r7 rA r& rB Z add_interface�InterfaceAdded�r, rB ry r@ �_zoner1 r1 r2 � addInterface� s zFirewallD.addInterfacec C s" t |t�}t |t�}| �|||�S )z�Change a zone an interface is part of. If zone is empty, use default zone. This function is deprecated, use changeZoneOfInterface instead )r rh �changeZoneOfInterface�r, rB ry r@ r1 r1 r2 � changeZone� s zFirewallD.changeZonec C sR t |t�}t |t�}t�d||f � | �|� | jj�|||�}| �||� |S )z[Change a zone an interface is part of. If zone is empty, use default zone. z&zone.changeZoneOfInterface('%s', '%s')) r rh r r7 rA r& rB Zchange_zone_of_interface�ZoneOfInterfaceChangedr r1 r1 r2 r s z FirewallD.changeZoneOfInterfacec C sP t |t�}t |t�}t�d||f � | �|� | jj�||�}| �||� |S )zkRemove interface from a zone. If zone is empty, remove from zone the interface belongs to. z zone.removeInterface('%s', '%s')) r rh r r7 rA r& rB Zremove_interface�InterfaceRemovedr r1 r1 r2 r� s zFirewallD.removeInterfacec C s6 t |t�}t |t�}t�d||f � | jj�||�S )z^Return true if an interface is in a zone. If zone is empty, use default zone. z zone.queryInterface('%s', '%s'))r rh r r7 r& rB Zquery_interfacer r1 r1 r2 �queryInterface% s zFirewallD.queryInterfacec C s& t |t�}t�d| � | jj�|�S )z]Return the list of interfaces of a zone. If zone is empty, use default zone. zzone.getInterfaces('%s'))r rh r r7 r& rB r� r� r1 r1 r2 r� 2 s zFirewallD.getInterfacesc C s t �d||f � d S )Nz zone.InterfaceAdded('%s', '%s')r� �r, rB ry r1 r1 r2 r @ s zFirewallD.InterfaceAddedc C s t �d||f � dS )z, This signal is deprecated. z zone.ZoneChanged('%s', '%s')Nr� r r1 r1 r2 � ZoneChangedE s zFirewallD.ZoneChangedc C s" t �d||f � | �||� d S )Nz'zone.ZoneOfInterfaceChanged('%s', '%s'))r r7 r r r1 r1 r2 r M s �z FirewallD.ZoneOfInterfaceChangedc C s t �d||f � d S )Nz!zone.InterfaceRemoved('%s', '%s')r� r r1 r1 r2 r T s zFirewallD.InterfaceRemovedc C sR t |t�}t |t�}t�d||f � | �|� | jj�|||�}| �||� |S )zLAdd a source to a zone. If zone is empty, use default zone. zzone.addSource('%s', '%s')) r rh r r7 rA r& rB Z add_source� SourceAdded�r, rB r r@ r r1 r1 r2 � addSource] s zFirewallD.addSourcec C sR t |t�}t |t�}t�d||f � | �|� | jj�|||�}| �||� |S )zXChange a zone an source is part of. If zone is empty, use default zone. z#zone.changeZoneOfSource('%s', '%s')) r rh r r7 rA r& rB Zchange_zone_of_source�ZoneOfSourceChangedr r1 r1 r2 �changeZoneOfSourcen s z FirewallD.changeZoneOfSourcec C sP t |t�}t |t�}t�d||f � | �|� | jj�||�}| �||� |S )zeRemove source from a zone. If zone is empty, remove from zone the source belongs to. z zone.removeSource('%s', '%s')) r rh r r7 rA r& rB Z remove_source� SourceRemovedr r1 r1 r2 � removeSource s zFirewallD.removeSourcec C s6 t |t�}t |t�}t�d||f � | jj�||�S )z[Return true if an source is in a zone. If zone is empty, use default zone. z zone.querySource('%s', '%s'))r rh r r7 r& rB Z query_source)r, rB r r@ r1 r1 r2 � querySource� s zFirewallD.querySourcec C s& t |t�}t�d| � | jj�|�S )zZReturn the list of sources of a zone. If zone is empty, use default zone. zzone.getSources('%s'))r rh r r7 r& rB r� r� r1 r1 r2 � getSources� s zFirewallD.getSourcesc C s t �d||f � d S )Nz zone.SourceAdded('%s', '%s')r� �r, rB r r1 r1 r2 r � s zFirewallD.SourceAddedc C s t �d||f � d S )Nz$zone.ZoneOfSourceChanged('%s', '%s')r� r r1 r1 r2 r � s z FirewallD.ZoneOfSourceChangedc C s t �d||f � d S )Nz zone.SourceRemoved('%s', '%s')r� r r1 r1 r2 r � s zFirewallD.SourceRemovedc C sH t �d||f � | j| |= t|d�}| jj�||� | �||� d S )Nz%zone.disableTimedRichRule('%s', '%s')�Zrule_str)r r7 r8 r r& rB � remove_rule�RichRuleRemoved)r, rB �ruler� r1 r1 r2 �disableTimedRichRule� s z FirewallD.disableTimedRichRuleZssic C s� t |t�}t |t�}t |t�}t�d||f � t|d�}| jj�|||�}|dkrtt � || j ||�}| � |||� | � |||� |S )Nz zone.addRichRule('%s', '%s')r r )r rh r� r r7 r r& rB �add_ruler �timeout_add_secondsr rE � RichRuleAdded)r, rB r �timeoutr@ r� r rD r1 r1 r2 � addRichRule� s �zFirewallD.addRichRulec C s\ t |t�}t |t�}t�d||f � t|d�}| jj�||�}| �||� | � ||� |S )Nz zone.removeRichRule('%s', '%s')r ) r rh r r7 r r& rB r rH r )r, rB r r@ r� r r1 r1 r2 �removeRichRule� s zFirewallD.removeRichRulec C s@ t |t�}t |t�}t�d||f � t|d�}| jj�||�S )Nz zone.queryRichRule('%s', '%s')r )r rh r r7 r r& rB � query_rule)r, rB r r@ r� r1 r1 r2 � queryRichRule� s zFirewallD.queryRichRulec C s& t |t�}t�d| � | jj�|�S )Nzzone.getRichRules('%s'))r rh r r7 r& rB Z list_rulesr� r1 r1 r2 � getRichRules� s zFirewallD.getRichRulesc C s t �d|||f � d S )Nz"zone.RichRuleAdded('%s', '%s', %d)r� )r, rB r r$ r1 r1 r2 r# � s zFirewallD.RichRuleAddedc C s t �d||f � d S )Nz zone.RichRuleRemoved('%s', '%s')r� )r, rB r r1 r1 r2 r s zFirewallD.RichRuleRemovedc C s> t �d||f � | j| |= | jj�||� | �||� d S )Nz$zone.disableTimedService('%s', '%s'))r r7 r8 r& rB �remove_service�ServiceRemoved�r, rB r� r1 r1 r2 �disableTimedService s z FirewallD.disableTimedServicec C s� t |t�}t |t�}t |t�}t�d|||f � | �|� | jj�||||�}|dkrxt � || j ||�}| � |||� | � |||� |S )Nz zone.addService('%s', '%s', %d)r )r rh r� r r7 rA r& rB Z add_servicer r" r- rE � ServiceAdded)r, rB r� r$ r@ r rD r1 r1 r2 r� s �zFirewallD.addServicec C s\ t |t�}t |t�}t�d||f � | �|� | jj�||�}| �||� | � ||� |S )Nz zone.removeService('%s', '%s')) r rh r r7 rA r& rB r* rH r+ )r, rB r� r@ r r1 r1 r2 � removeService* s zFirewallD.removeServicec C s6 t |t�}t |t�}t�d||f � | jj�||�S )Nz zone.queryService('%s', '%s'))r rh r r7 r& rB Z query_service)r, rB r� r@ r1 r1 r2 � queryService; s zFirewallD.queryServicec C s& t |t�}t�d| � | jj�|�S )Nzzone.getServices('%s'))r rh r r7 r& rB Z list_servicesr� r1 r1 r2 � getServicesF s zFirewallD.getServicesc C s t �d|||f � d S )Nz!zone.ServiceAdded('%s', '%s', %d)r� )r, rB r� r$ r1 r1 r2 r. R s �zFirewallD.ServiceAddedc C s t �d||f � d S )Nz zone.ServiceRemoved('%s', '%s')r� r, r1 r1 r2 r+ X s zFirewallD.ServiceRemovedc C sH t �d|||f � | j| ||f= | jj�|||� | �|||� d S )Nz'zone.disableTimedPort('%s', '%s', '%s'))r r7 r8 r& rB � remove_port� PortRemoved�r, rB �port�protocolr1 r1 r2 �disableTimedPorta s �zFirewallD.disableTimedPortZsssic C s� t |t�}t |t�}t |t�}t |t�}t�d|||f � | �|� | jj�|||||�}|dkr�t � || j |||�}| � |||f|� | � ||||� |S )Nz zone.addPort('%s', '%s', '%s')r )r rh r� r r7 rA r& rB Zadd_portr r" r7 rE � PortAdded�r, rB r5 r6 r$ r@ r rD r1 r1 r2 �addPorti s � �zFirewallD.addPortZsssc C sp t |t�}t |t�}t |t�}t�d|||f � | �|� | jj�|||�}| �|||f� | � |||� |S )Nz!zone.removePort('%s', '%s', '%s')) r rh r r7 rA r& rB r2 rH r3 �r, rB r5 r6 r@ r r1 r1 r2 � removePort� s � zFirewallD.removePortc C sD t |t�}t |t�}t |t�}t�d|||f � | jj�|||�S )Nz zone.queryPort('%s', '%s', '%s'))r rh r r7 r& rB Z query_port�r, rB r5 r6 r@ r1 r1 r2 � queryPort� s zFirewallD.queryPortZaasc C s& t |t�}t�d| � | jj�|�S )Nzzone.getPorts('%s'))r rh r r7 r& rB Z list_portsr� r1 r1 r2 �getPorts� s zFirewallD.getPortsr c C s t �d||||f � d S )Nz$zone.PortAdded('%s', '%s', '%s', %d)r� �r, rB r5 r6 r$ r1 r1 r2 r8 � s �zFirewallD.PortAddedc C s t �d|||f � d S )Nz"zone.PortRemoved('%s', '%s', '%s')r� r4 r1 r1 r2 r3 � s �zFirewallD.PortRemovedc C s> t �d||f � | j| |= | jj�||� | �||� d S )Nz%zone.disableTimedProtocol('%s', '%s'))r r7 r8 r& rB �remove_protocol�ProtocolRemoved�r, rB r6 r1 r1 r2 �disableTimedProtocol� s z FirewallD.disableTimedProtocolc C s� t |t�}t |t�}t |t�}t�d||f � | �|� | jj�||||�}|dkrvt � || j ||�}| � |||� | � |||� |S )Nz zone.enableProtocol('%s', '%s')r )r rh r� r r7 rA r& rB Z add_protocolr r" rD rE � ProtocolAdded)r, rB r6 r$ r@ r rD r1 r1 r2 � addProtocol� s �zFirewallD.addProtocolc C s\ t |t�}t |t�}t�d||f � | �|� | jj�||�}| �||� | � ||� |S )Nz zone.removeProtocol('%s', '%s')) r rh r r7 rA r& rB rA rH rB )r, rB r6 r@ r r1 r1 r2 �removeProtocol� s zFirewallD.removeProtocolc C s6 t |t�}t |t�}t�d||f � | jj�||�S )Nz zone.queryProtocol('%s', '%s'))r rh r r7 r& rB Zquery_protocol)r, rB r6 r@ r1 r1 r2 � queryProtocol� s zFirewallD.queryProtocolc C s& t |t�}t�d| � | jj�|�S )Nzzone.getProtocols('%s'))r rh r r7 r& rB Zlist_protocolsr� r1 r1 r2 � getProtocols� s zFirewallD.getProtocolsc C s t �d|||f � d S )Nz"zone.ProtocolAdded('%s', '%s', %d)r� )r, rB r6 r$ r1 r1 r2 rE � s �zFirewallD.ProtocolAddedc C s t �d||f � d S )Nz zone.ProtocolRemoved('%s', '%s')r� rC r1 r1 r2 rB s zFirewallD.ProtocolRemovedc C sJ t �d|||f � | j| d||f= | jj�|||� | �|||� d S )Nz-zone.disableTimedSourcePort('%s', '%s', '%s')�sport)r r7 r8 r& rB �remove_source_port�SourcePortRemovedr4 r1 r1 r2 �disableTimedSourcePort s �z FirewallD.disableTimedSourcePortc C s� t |t�}t |t�}t |t�}t |t�}t�d|||f � | �|� | jj�|||||�}|dkr�t � || j |||�}| � |d||f|� | � ||||� |S )Nz$zone.addSourcePort('%s', '%s', '%s')r rJ )r rh r� r r7 rA r& rB Zadd_source_portr r" rM rE �SourcePortAddedr9 r1 r1 r2 � addSourcePort s$ � � �zFirewallD.addSourcePortc C sr t |t�}t |t�}t |t�}t�d|||f � | �|� | jj�|||�}| �|d||f� | � |||� |S )Nz'zone.removeSourcePort('%s', '%s', '%s')rJ ) r rh r r7 rA r& rB rK rH rL r; r1 r1 r2 �removeSourcePort, s � zFirewallD.removeSourcePortc C sD t |t�}t |t�}t |t�}t�d|||f � | jj�|||�S )Nz&zone.querySourcePort('%s', '%s', '%s'))r rh r r7 r& rB Zquery_source_portr= r1 r1 r2 �querySourcePort> s �zFirewallD.querySourcePortc C s& t |t�}t�d| � | jj�|�S )Nzzone.getSourcePorts('%s'))r rh r r7 r& rB Zlist_source_portsr� r1 r1 r2 �getSourcePortsK s zFirewallD.getSourcePortsc C s t �d||||f � d S )Nz*zone.SourcePortAdded('%s', '%s', '%s', %d)r� r@ r1 r1 r2 rN W s �zFirewallD.SourcePortAddedc C s t �d|||f � d S )Nz(zone.SourcePortRemoved('%s', '%s', '%s')r� r4 r1 r1 r2 rL ] s �zFirewallD.SourcePortRemovedc C s( | j | d= | jj�|� | �|� d S )N� masquerade)r8 r& rB �remove_masquerade�MasqueradeRemovedr� r1 r1 r2 �disableTimedMasqueradeg s z FirewallD.disableTimedMasquerade�sic C st t |t�}t |t�}t�d| � | �|� | jj�|||�}|dkrdt � || j |�}| � |d|� | � ||� |S )Nzzone.addMasquerade('%s')r rS )r rh r� r r7 rA r& rB Zadd_masquerader r" rV rE �MasqueradeAdded)r, rB r$ r@ r rD r1 r1 r2 � addMasqueradem s � zFirewallD.addMasqueradec C sJ t |t�}t�d| � | �|� | jj�|�}| �|d� | � |� |S )Nzzone.removeMasquerade('%s')rS ) r rh r r7 rA r& rB rT rH rU �r, rB r@ r r1 r1 r2 �removeMasquerade� s zFirewallD.removeMasqueradec C s& t |t�}t�d| � | jj�|�S )Nzzone.queryMasquerade('%s'))r rh r r7 r& rB Zquery_masquerader� r1 r1 r2 �queryMasquerade� s zFirewallD.queryMasqueradec C s t �d||f � d S )Nz zone.MasqueradeAdded('%s', %d)r� )r, rB r$ r1 r1 r2 rX � s zFirewallD.MasqueradeAddedc C s t �d| � d S )Nz zone.MasqueradeRemoved('%s')r� r� r1 r1 r2 rU � s zFirewallD.MasqueradeRemovedc C s@ | j | ||||f= | jj�|||||� | �|||||� d S r3 )r8 r& rB �remove_forward_port�ForwardPortRemoved�r, rB r5 r6 �toport�toaddrr1 r1 r2 �disable_forward_port� s z FirewallD.disable_forward_portZsssssic C s� t |t�}t |t�}t |t�}t |t�}t |t�}t |t�}t�d|||||f � | �|� | jj�|||||||�}|dkr�t � || j |||||�} | � |||||f| � | � ||||||� |S )Nz1zone.addForwardPort('%s', '%s', '%s', '%s', '%s')r )r rh r� r r7 rA r& rB Zadd_forward_portr r" rb rE �ForwardPortAdded) r, rB r5 r6 r` ra r$ r@ r rD r1 r1 r2 �addForwardPort� s, � ��zFirewallD.addForwardPortZsssssc C s� t |t�}t |t�}t |t�}t |t�}t |t�}t�d|||||f � | �|� | jj�|||||�}| �|||||f� | � |||||� |S )Nz4zone.removeForwardPort('%s', '%s', '%s', '%s', '%s')) r rh r r7 rA r& rB r] rH r^ )r, rB r5 r6 r` ra r@ r r1 r1 r2 �removeForwardPort� s � �zFirewallD.removeForwardPortc C s` t |t�}t |t�}t |t�}t |t�}t |t�}t�d|||||f � | jj�|||||�S )Nz3zone.queryForwardPort('%s', '%s', '%s', '%s', '%s'))r rh r r7 r& rB Zquery_forward_port)r, rB r5 r6 r` ra r@ r1 r1 r2 �queryForwardPort� s ��zFirewallD.queryForwardPortc C s& t |t�}t�d| � | jj�|�S )Nzzone.getForwardPorts('%s'))r rh r r7 r& rB Zlist_forward_portsr� r1 r1 r2 �getForwardPorts� s zFirewallD.getForwardPortsc C s t �d||||||f � d S )Nz7zone.ForwardPortAdded('%s', '%s', '%s', '%s', '%s', %d)r� )r, rB r5 r6 r` ra r$ r1 r1 r2 rc � s �zFirewallD.ForwardPortAddedc C s t �d|||||f � d S )Nz5zone.ForwardPortRemoved('%s', '%s', '%s', '%s', '%s')r� r_ r1 r1 r2 r^ s �z FirewallD.ForwardPortRemovedc C s> t �d||f � | j| |= | jj�||� | �||� d S )Nz&zone.disableTimedIcmpBlock('%s', '%s'))r r7 r8 r& rB �remove_icmp_block�IcmpBlockRemoved�r, rB �icmpr@ r1 r1 r2 �disableTimedIcmpBlock s z FirewallD.disableTimedIcmpBlockc C s� t |t�}t |t�}t |t�}t�d||f � | �|� | jj�||||�}|dkrxt � || j |||�}| � |||� | � |||� |S )Nz zone.enableIcmpBlock('%s', '%s')r )r rh r� r r7 rA r& rB Zadd_icmp_blockr r" rl rE �IcmpBlockAdded)r, rB rk r$ r@ r rD r1 r1 r2 � addIcmpBlock s �zFirewallD.addIcmpBlockc C s\ t |t�}t |t�}t�d||f � | �|� | jj�||�}| �||� | � ||� |S )Nz zone.removeIcmpBlock('%s', '%s')) r rh r r7 rA r& rB rh rH ri )r, rB rk r@ r r1 r1 r2 �removeIcmpBlock+ s zFirewallD.removeIcmpBlockc C s6 t |t�}t |t�}t�d||f � | jj�||�S )Nz zone.queryIcmpBlock('%s', '%s'))r rh r r7 r& rB Zquery_icmp_blockrj r1 r1 r2 �queryIcmpBlock; s zFirewallD.queryIcmpBlockc C s& t |t�}t�d| � | jj�|�S )Nzzone.getIcmpBlocks('%s'))r rh r r7 r& rB Zlist_icmp_blocksr� r1 r1 r2 � getIcmpBlocksF s zFirewallD.getIcmpBlocksc C s t �d|||f � d S )Nz#zone.IcmpBlockAdded('%s', '%s', %d)r� )r, rB rk r$ r1 r1 r2 rm R s �zFirewallD.IcmpBlockAddedc C s t �d||f � d S )Nz!zone.IcmpBlockRemoved('%s', '%s')r� )r, rB rk r1 r1 r2 ri X s zFirewallD.IcmpBlockRemovedc C s@ t |t�}t�d| � | �|� | jj�||�}| �|� |S )Nz zone.addIcmpBlockInversion('%s')) r rh r r7 rA r& rB Zadd_icmp_block_inversion�IcmpBlockInversionAddedrZ r1 r1 r2 �addIcmpBlockInversiona s z FirewallD.addIcmpBlockInversionc C s> t |t�}t�d| � | �|� | jj�|�}| �|� |S )Nz#zone.removeIcmpBlockInversion('%s')) r rh r r7 rA r& rB Zremove_icmp_block_inversion�IcmpBlockInversionRemovedrZ r1 r1 r2 �removeIcmpBlockInversiono s z"FirewallD.removeIcmpBlockInversionc C s& t |t�}t�d| � | jj�|�S )Nz"zone.queryIcmpBlockInversion('%s'))r rh r r7 r& rB Zquery_icmp_block_inversionr� r1 r1 r2 �queryIcmpBlockInversion} s z!FirewallD.queryIcmpBlockInversionc C s t �d| � d S )Nz"zone.IcmpBlockInversionAdded('%s')r� r� r1 r1 r2 rr � s z!FirewallD.IcmpBlockInversionAddedc C s t �d| � d S )Nz$zone.IcmpBlockInversionRemoved('%s')r� r� r1 r1 r2 rt � s z#FirewallD.IcmpBlockInversionRemovedc C s` t |t�}t |t�}t |t�}t�d|||f � | �|� | jj�|||� | �|||� d S )Nz!direct.addChain('%s', '%s', '%s')) r rh r r7 rA r& r� Z add_chain� ChainAdded�r, �ipv�table�chainr@ r1 r1 r2 �addChain� s zFirewallD.addChainc C s` t |t�}t |t�}t |t�}t�d|||f � | �|� | jj�|||� | �|||� d S )Nz$direct.removeChain('%s', '%s', '%s')) r rh r r7 rA r& r� Z remove_chain� ChainRemovedrx r1 r1 r2 � removeChain� s zFirewallD.removeChainc C sD t |t�}t |t�}t |t�}t�d|||f � | jj�|||�S )Nz#direct.queryChain('%s', '%s', '%s'))r rh r r7 r& r� Z query_chainrx r1 r1 r2 � queryChain� s zFirewallD.queryChainc C s6 t |t�}t |t�}t�d||f � | jj�||�S )Nz direct.getChains('%s', '%s'))r rh r r7 r& r� Z get_chains)r, ry rz r@ r1 r1 r2 � getChains� s zFirewallD.getChainsza(sss)c C s t �d� | jj�� S )Nzdirect.getAllChains())r r7 r& r� r� r~ r1 r1 r2 � getAllChains� s zFirewallD.getAllChainsc C s t �d|||f � d S )Nz#direct.ChainAdded('%s', '%s', '%s')r� �r, ry rz r{ r1 r1 r2 rw � s zFirewallD.ChainAddedc C s t �d|||f � d S )Nz%direct.ChainRemoved('%s', '%s', '%s')r� r� r1 r1 r2 r} � s �zFirewallD.ChainRemovedZsssiasc C s� t |t�}t |t�}t |t�}t |t�}tdd� |D ��}t�d||||d�|�f � | �|� | jj � |||||� | � |||||� d S )Nc s s | ]}t |t�V qd S r3 �r rh ��.0r� r1 r1 r2 � <genexpr>� � z$FirewallD.addRule.<locals>.<genexpr>z*direct.addRule('%s', '%s', '%s', %d, '%s')�',') r rh r� r� r r7 �joinrA r& r� r! � RuleAdded�r, ry rz r{ �priorityr- r@ r1 r1 r2 �addRule� s � zFirewallD.addRulec C s� t |t�}t |t�}t |t�}t |t�}tdd� |D ��}t�d||||d�|�f � | �|� | jj � |||||� | � |||||� d S )Nc s s | ]}t |t�V qd S r3 r� r� r1 r1 r2 r� r� z'FirewallD.removeRule.<locals>.<genexpr>z-direct.removeRule('%s', '%s', '%s', %d, '%s')r� ) r rh r� r� r r7 r� rA r& r� r � RuleRemovedr� r1 r1 r2 � removeRule� s � zFirewallD.removeRulec C s� t |t�}t |t�}t |t�}t�d|||f � | �|� | jj�|||�D ]0\}}| jj�|||||� | � |||||� qNd S )Nz$direct.removeRules('%s', '%s', '%s')) r rh r r7 rA r& r� � get_rulesr r� )r, ry rz r{ r@ r� r- r1 r1 r2 � removeRules s zFirewallD.removeRulesc C sn t |t�}t |t�}t |t�}t |t�}tdd� |D ��}t�d||||d�|�f � | jj� |||||�S )Nc s s | ]}t |t�V qd S r3 r� r� r1 r1 r2 r� ( r� z&FirewallD.queryRule.<locals>.<genexpr>z,direct.queryRule('%s', '%s', '%s', %d, '%s')r� ) r rh r� r� r r7 r� r& r� r' r� r1 r1 r2 � queryRule s �zFirewallD.queryRuleza(ias)c C sD t |t�}t |t�}t |t�}t�d|||f � | jj�|||�S )Nz!direct.getRules('%s', '%s', '%s'))r rh r r7 r& r� r� rx r1 r1 r2 �getRules- s zFirewallD.getRulesz a(sssias)c C s t �d� | jj�� S )Nzdirect.getAllRules())r r7 r& r� r� r~ r1 r1 r2 � getAllRules: s zFirewallD.getAllRulesc C s" t �d||||d�|�f � d S )Nz,direct.RuleAdded('%s', '%s', '%s', %d, '%s')r� �r r7 r� �r, ry rz r{ r� r- r1 r1 r2 r� D s �zFirewallD.RuleAddedc C s" t �d||||d�|�f � d S )Nz.direct.RuleRemoved('%s', '%s', '%s', %d, '%s')r� r� r� r1 r1 r2 r� K s �zFirewallD.RuleRemovedr[ c C s� t |t�}tdd� |D ��}t�d|d�|�f � | �|� z| jj� ||�W S t y� } zj|dv rvt g d��}n t ddg�}t|�}|j t jkr�tt |�|@ �d kr�t�|� t|��� W Y d }~n d }~0 0 d S ) Nc s s | ]}t |t�V qd S r3 r� r� r1 r1 r2 r� ^ r� z(FirewallD.passthrough.<locals>.<genexpr>z direct.passthrough('%s', '%s')r� )rO rS )z-Cz--check�-L�--listr� r� r )r rh r� r r7 r� rA r& r� � passthroughr" �set�coder! ZCOMMAND_FAILEDr r� r )r, ry r- r@ r? Z query_args�msgr1 r1 r2 r� V s zFirewallD.passthroughc C s\ t |�}tdd� |D ��}t�d|d�|�f � | �|� | jj�||� | � ||� d S )Nc s s | ]}t |�V qd S r3 �r r� r1 r1 r2 r� z r� z+FirewallD.addPassthrough.<locals>.<genexpr>z!direct.addPassthrough('%s', '%s')r� ) r r� r r7 r� rA r& r� Zadd_passthrough�PassthroughAdded�r, ry r- r@ r1 r1 r2 �addPassthroughr s � zFirewallD.addPassthroughc C s\ t |�}tdd� |D ��}t�d|d�|�f � | �|� | jj�||� | � ||� d S )Nc s s | ]}t |�V qd S r3 r� r� r1 r1 r2 r� � r� z.FirewallD.removePassthrough.<locals>.<genexpr>z$direct.removePassthrough('%s', '%s')r� ) r r� r r7 r� rA r& r� Zremove_passthrough�PassthroughRemovedr� r1 r1 r2 �removePassthrough� s � zFirewallD.removePassthroughc C sB t |�}tdd� |D ��}t�d|d�|�f � | jj�||�S )Nc s s | ]}t |�V qd S r3 r� r� r1 r1 r2 r� � r� z-FirewallD.queryPassthrough.<locals>.<genexpr>z#direct.queryPassthrough('%s', '%s')r� )r r� r r7 r� r& r� Zquery_passthroughr� r1 r1 r2 �queryPassthrough� s �zFirewallD.queryPassthroughza(sas)c C s t �d� | jj�� S )Nzdirect.getAllPassthroughs())r r7 r& r� r� r~ r1 r1 r2 �getAllPassthroughs� s z FirewallD.getAllPassthroughsc C s* t �d� t| �� �D ]}| j|� qd S )Nz direct.removeAllPassthroughs())r r7 �reversedr� r� )r, r@ r� r1 r1 r2 �removeAllPassthroughs� s z FirewallD.removeAllPassthroughsc C s" t |�}t�d|� | jj�|�S )Nz direct.getPassthroughs('%s'))r r r7 r& r� Zget_passthroughs)r, ry r@ r1 r1 r2 �getPassthroughs� s zFirewallD.getPassthroughsc C s t �d|d�|�f � d S )Nz#direct.PassthroughAdded('%s', '%s')r� r� �r, ry r- r1 r1 r2 r� � s �zFirewallD.PassthroughAddedc C s t �d|d�|�f � d S )Nz%direct.PassthroughRemoved('%s', '%s')r� r� r� r1 r1 r2 r� � s �z FirewallD.PassthroughRemovedc C s dS )z� PK_ACTION_ALL implies all other actions, i.e. once a subject is authorized for PK_ACTION_ALL it's also authorized for any other action. Use-case is GUI (RHBZ#994729). Nr1 r~ r1 r1 r2 � authorizeAll� s zFirewallD.authorizeAllc C s$ t |�}t�d| � | jj�|�S )Nzipset.queryIPSet('%s'))r r r7 r& r� Z query_ipset�r, r� r@ r1 r1 r2 � queryIPSet� s zFirewallD.queryIPSetc C s t �d� | jj�� S )Nzipsets.getIPSets())r r7 r& r� r� r~ r1 r1 r2 � getIPSets� s zFirewallD.getIPSetsc C s( t |t�}t�d|� | jj�|��� S )NzgetIPSetSettings(%s))r rh r r7 r& r� Z get_ipsetr� r� r1 r1 r2 r� � s zFirewallD.getIPSetSettingsc C sL t |�}t |�}t�d||f � | �|� | jj�||� | �||� d S )Nzipset.addEntry('%s', '%s'))r r r7 rA r& r� Z add_entry� EntryAdded�r, r� �entryr@ r1 r1 r2 �addEntry� s zFirewallD.addEntryc C sL t |�}t |�}t�d||f � | �|� | jj�||� | �||� d S )Nz ipset.removeEntry('%s', '%s'))r r r7 rA r& r� Z remove_entry� EntryRemovedr� r1 r1 r2 � removeEntry s zFirewallD.removeEntryc C s2 t |�}t |�}t�d||f � | jj�||�S )Nz ipset.queryEntry('%s', '%s'))r r r7 r& r� Z query_entryr� r1 r1 r2 � queryEntry s zFirewallD.queryEntryc C s$ t |�}t�d| � | jj�|�S )Nzipset.getEntries('%s'))r r r7 r& r� � get_entriesr� r1 r1 r2 � getEntries! s zFirewallD.getEntriesc C s� t |�}t |t�}t�d|d�|�� | jj�|�}| jj�||� t |�}t |�}|| D ]}| � ||� q\|| D ]}| � ||� qvd S )Nz ipset.setEntries('%s', '[%s]')�,) r �listr r7 r� r& r� r� Z set_entriesr� r� r� )r, r� �entriesr@ Z old_entriesZold_entries_setZ entries_setr� r1 r1 r2 � setEntries+ s zFirewallD.setEntriesc C s& t |�}t |�}t�d||f � d S )Nz ipset.EntryAdded('%s', '%s')�r r r7 �r, r� r� r1 r1 r2 r� < s zFirewallD.EntryAddedc C s& t |�}t |�}t�d||f � d S )Nz ipset.EntryRemoved('%s', '%s')r� r� r1 r1 r2 r� C s zFirewallD.EntryRemovedc C s t �d� | jj�� S )Nzhelpers.getHelpers())r r7 r& r� r� r~ r1 r1 r2 � getHelpersN s zFirewallD.getHelpersc C s( t |t�}t�d|� | jj�|��� S )NzgetHelperSettings(%s))r rh r r7 r& r� Z get_helperr� )r, r� r@ r1 r1 r2 r� W s zFirewallD.getHelperSettings)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)r )N)N)N)N)r )N)N)N)N)r )N)N)N)r )N)N)N)N)r )N)N)N)N)r )N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)��__name__� __module__� __qualname__�__doc__Z persistentr r* ZPK_ACTION_CONFIGZ default_polkit_auth_requiredr r% r6 r) r4 r rA rE rH rJ rb r ZPROPERTIES_IFACEro rt r ru r� �signalrv ZPK_ACTION_INFOZINTROSPECTABLE_IFACErw r+ r| r r} r� r� r� ZPK_ACTION_POLICIESrk r� r� ZPK_ACTION_POLICIES_INFOr� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� ZPK_ACTION_CONFIG_INFOr� ri r� r� r� ZDBUS_INTERFACE_POLICYr� r� r� r� r� r� r� r ZDBUS_SIGNATUREr� r� r� r� r� r� r� r� r� r� r� r� r� r r r r r r r r� r r� r r r r r r r r r r r r r r% r& r( r) r# r r- r� r/ r0 r1 r. r+ r7 r: r< r> r? r8 r3 rD rF rG rH rI rE rB rM rO rP rQ rR rN rL rV rY r[ r\ rX rU rb rd re rf rg rc r^ rl rn ro rp rq rm ri rs ru rv rr rt ZPK_ACTION_DIRECTr rj r| r~ ZPK_ACTION_DIRECT_INFOr r� r� r rw r} r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� Z PK_ACTION_ALLr� rl r� r� r r� r� r� r� r� r� r� r� r� r r� � __classcell__r1 r1 r/ r2 r ? s� /�� " � � � � � O � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � �� �� �� �� � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � �)6�__all__Z gi.repositoryr r� r* Z dbus.serviceZfirewallr Zfirewall.core.fwr Zfirewall.core.richr Zfirewall.core.loggerr Zfirewall.clientr Zfirewall.server.dbusr r Zfirewall.server.decoratorsr r r r r r Zfirewall.server.configr Zfirewall.dbus_utilsr r r r r r r r Zfirewall.core.io.functionsr Zfirewall.core.io.ipsetr Zfirewall.core.io.icmptyper Zfirewall.core.io.helperr Zfirewall.core.fw_nmr r Zfirewall.core.fw_ifcfgr r! Zfirewall.errorsr" r r1 r1 r1 r2 �<module> s, ( server/__pycache__/__init__.cpython-39.opt-1.pyc 0000644 00000000227 15025011705 0015406 0 ustar 00 a ���g � @ s d S )N� r r r �</usr/lib/python3.9/site-packages/firewall/server/__init__.py�<module> � server/config_ipset.py 0000644 00000044432 15025011705 0011100 0 ustar 00 # -*- coding: utf-8 -*- # # Copyright (C) 2015-2016 Red Hat, Inc. # # Authors: # Thomas Woerner <twoerner@redhat.com> # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see <http://www.gnu.org/licenses/>. import dbus import dbus.service from firewall import config from firewall.dbus_utils import dbus_to_python, \ dbus_introspection_prepare_properties, \ dbus_introspection_add_properties from firewall.core.io.ipset import IPSet from firewall.core.ipset import IPSET_TYPES, normalize_ipset_entry, \ check_entry_overlaps_existing, \ check_for_overlapping_entries from firewall.core.logger import log from firewall.server.dbus import DbusServiceObject from firewall.server.decorators import handle_exceptions, \ dbus_handle_exceptions, dbus_service_method, \ dbus_polkit_require_auth from firewall import errors from firewall.errors import FirewallError ############################################################################ # # class FirewallDConfigIPSet # ############################################################################ class FirewallDConfigIPSet(DbusServiceObject): """FirewallD main class""" persistent = True """ Make FirewallD persistent. """ default_polkit_auth_required = config.dbus.PK_ACTION_CONFIG """ Use PK_ACTION_INFO as a default """ @handle_exceptions def __init__(self, parent, conf, ipset, item_id, *args, **kwargs): super(FirewallDConfigIPSet, self).__init__(*args, **kwargs) self.parent = parent self.config = conf self.obj = ipset self.item_id = item_id self.busname = args[0] self.path = args[1] self._log_prefix = "config.ipset.%d" % self.item_id dbus_introspection_prepare_properties( self, config.dbus.DBUS_INTERFACE_CONFIG_IPSET) @dbus_handle_exceptions def __del__(self): pass @dbus_handle_exceptions def unregister(self): self.remove_from_connection() # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # P R O P E R T I E S @dbus_handle_exceptions def _get_property(self, property_name): if property_name == "name": return dbus.String(self.obj.name) elif property_name == "filename": return dbus.String(self.obj.filename) elif property_name == "path": return dbus.String(self.obj.path) elif property_name == "default": return dbus.Boolean(self.obj.default) elif property_name == "builtin": return dbus.Boolean(self.obj.builtin) else: raise dbus.exceptions.DBusException( "org.freedesktop.DBus.Error.InvalidArgs: " "Property '%s' does not exist" % property_name) @dbus_service_method(dbus.PROPERTIES_IFACE, in_signature='ss', out_signature='v') @dbus_handle_exceptions def Get(self, interface_name, property_name, sender=None): # pylint: disable=W0613 # get a property interface_name = dbus_to_python(interface_name, str) property_name = dbus_to_python(property_name, str) log.debug1("%s.Get('%s', '%s')", self._log_prefix, interface_name, property_name) if interface_name != config.dbus.DBUS_INTERFACE_CONFIG_IPSET: raise dbus.exceptions.DBusException( "org.freedesktop.DBus.Error.UnknownInterface: " "Interface '%s' does not exist" % interface_name) return self._get_property(property_name) @dbus_service_method(dbus.PROPERTIES_IFACE, in_signature='s', out_signature='a{sv}') @dbus_handle_exceptions def GetAll(self, interface_name, sender=None): # pylint: disable=W0613 interface_name = dbus_to_python(interface_name, str) log.debug1("%s.GetAll('%s')", self._log_prefix, interface_name) if interface_name != config.dbus.DBUS_INTERFACE_CONFIG_IPSET: raise dbus.exceptions.DBusException( "org.freedesktop.DBus.Error.UnknownInterface: " "Interface '%s' does not exist" % interface_name) ret = { } for x in [ "name", "filename", "path", "default", "builtin" ]: ret[x] = self._get_property(x) return dbus.Dictionary(ret, signature="sv") @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG) @dbus_service_method(dbus.PROPERTIES_IFACE, in_signature='ssv') @dbus_handle_exceptions def Set(self, interface_name, property_name, new_value, sender=None): interface_name = dbus_to_python(interface_name, str) property_name = dbus_to_python(property_name, str) new_value = dbus_to_python(new_value) log.debug1("%s.Set('%s', '%s', '%s')", self._log_prefix, interface_name, property_name, new_value) self.parent.accessCheck(sender) if interface_name != config.dbus.DBUS_INTERFACE_CONFIG_IPSET: raise dbus.exceptions.DBusException( "org.freedesktop.DBus.Error.UnknownInterface: " "Interface '%s' does not exist" % interface_name) raise dbus.exceptions.DBusException( "org.freedesktop.DBus.Error.PropertyReadOnly: " "Property '%s' is read-only" % property_name) @dbus.service.signal(dbus.PROPERTIES_IFACE, signature='sa{sv}as') def PropertiesChanged(self, interface_name, changed_properties, invalidated_properties): interface_name = dbus_to_python(interface_name, str) changed_properties = dbus_to_python(changed_properties) invalidated_properties = dbus_to_python(invalidated_properties) log.debug1("%s.PropertiesChanged('%s', '%s', '%s')", self._log_prefix, interface_name, changed_properties, invalidated_properties) @dbus_polkit_require_auth(config.dbus.PK_ACTION_INFO) @dbus_service_method(dbus.INTROSPECTABLE_IFACE, out_signature='s') @dbus_handle_exceptions def Introspect(self, sender=None): # pylint: disable=W0613 log.debug2("%s.Introspect()", self._log_prefix) data = super(FirewallDConfigIPSet, self).Introspect( self.path, self.busname.get_bus()) return dbus_introspection_add_properties( self, data, config.dbus.DBUS_INTERFACE_CONFIG_IPSET) # S E T T I N G S @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_IPSET, out_signature=IPSet.DBUS_SIGNATURE) @dbus_handle_exceptions def getSettings(self, sender=None): # pylint: disable=W0613 """get settings for ipset """ log.debug1("%s.getSettings()", self._log_prefix) return self.config.get_ipset_config(self.obj) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_IPSET, in_signature=IPSet.DBUS_SIGNATURE) @dbus_handle_exceptions def update(self, settings, sender=None): """update settings for ipset """ settings = dbus_to_python(settings) log.debug1("%s.update('...')", self._log_prefix) self.parent.accessCheck(sender) self.obj = self.config.set_ipset_config(self.obj, settings) self.Updated(self.obj.name) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_IPSET) @dbus_handle_exceptions def loadDefaults(self, sender=None): """load default settings for builtin ipset """ log.debug1("%s.loadDefaults()", self._log_prefix) self.parent.accessCheck(sender) self.obj = self.config.load_ipset_defaults(self.obj) self.Updated(self.obj.name) #self.PropertiesChanged(config.dbus.DBUS_INTERFACE_CONFIG_IPSET, # { "default": True }, [ ]) @dbus.service.signal(config.dbus.DBUS_INTERFACE_CONFIG_IPSET, signature='s') @dbus_handle_exceptions def Updated(self, name): log.debug1("%s.Updated('%s')" % (self._log_prefix, name)) # R E M O V E @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_IPSET) @dbus_handle_exceptions def remove(self, sender=None): """remove ipset """ log.debug1("%s.remove()", self._log_prefix) self.parent.accessCheck(sender) self.config.remove_ipset(self.obj) self.parent.removeIPSet(self.obj) @dbus.service.signal(config.dbus.DBUS_INTERFACE_CONFIG_IPSET, signature='s') @dbus_handle_exceptions def Removed(self, name): log.debug1("%s.Removed('%s')" % (self._log_prefix, name)) # R E N A M E @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_IPSET, in_signature='s') @dbus_handle_exceptions def rename(self, name, sender=None): """rename ipset """ name = dbus_to_python(name, str) log.debug1("%s.rename('%s')", self._log_prefix, name) self.parent.accessCheck(sender) self.obj = self.config.rename_ipset(self.obj, name) self.Renamed(name) #self.PropertiesChanged(config.dbus.DBUS_INTERFACE_CONFIG_IPSET, # { "name": name }, [ ]) @dbus.service.signal(config.dbus.DBUS_INTERFACE_CONFIG_IPSET, signature='s') @dbus_handle_exceptions def Renamed(self, name): log.debug1("%s.Renamed('%s')" % (self._log_prefix, name)) # version @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_IPSET, out_signature='s') @dbus_handle_exceptions def getVersion(self, sender=None): # pylint: disable=W0613 log.debug1("%s.getVersion()", self._log_prefix) return self.getSettings()[0] @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_IPSET, in_signature='s') @dbus_handle_exceptions def setVersion(self, version, sender=None): version = dbus_to_python(version, str) log.debug1("%s.setVersion('%s')", self._log_prefix, version) self.parent.accessCheck(sender) settings = list(self.getSettings()) settings[0] = version self.update(settings) # short @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_IPSET, out_signature='s') @dbus_handle_exceptions def getShort(self, sender=None): # pylint: disable=W0613 log.debug1("%s.getShort()", self._log_prefix) return self.getSettings()[1] @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_IPSET, in_signature='s') @dbus_handle_exceptions def setShort(self, short, sender=None): short = dbus_to_python(short, str) log.debug1("%s.setShort('%s')", self._log_prefix, short) self.parent.accessCheck(sender) settings = list(self.getSettings()) settings[1] = short self.update(settings) # description @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_IPSET, out_signature='s') @dbus_handle_exceptions def getDescription(self, sender=None): # pylint: disable=W0613 log.debug1("%s.getDescription()", self._log_prefix) return self.getSettings()[2] @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_IPSET, in_signature='s') @dbus_handle_exceptions def setDescription(self, description, sender=None): description = dbus_to_python(description, str) log.debug1("%s.setDescription('%s')", self._log_prefix, description) self.parent.accessCheck(sender) settings = list(self.getSettings()) settings[2] = description self.update(settings) # type @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_IPSET, out_signature='s') @dbus_handle_exceptions def getType(self, sender=None): # pylint: disable=W0613 log.debug1("%s.getType()", self._log_prefix) return self.getSettings()[3] @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_IPSET, in_signature='s') @dbus_handle_exceptions def setType(self, ipset_type, sender=None): ipset_type = dbus_to_python(ipset_type, str) log.debug1("%s.setType('%s')", self._log_prefix, ipset_type) self.parent.accessCheck(sender) if ipset_type not in IPSET_TYPES: raise FirewallError(errors.INVALID_TYPE, ipset_type) settings = list(self.getSettings()) settings[3] = ipset_type self.update(settings) # options @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_IPSET, out_signature='a{ss}') @dbus_handle_exceptions def getOptions(self, sender=None): # pylint: disable=W0613 log.debug1("%s.getOptions()", self._log_prefix) return self.getSettings()[4] @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_IPSET, in_signature='a{ss}') @dbus_handle_exceptions def setOptions(self, options, sender=None): options = dbus_to_python(options, dict) log.debug1("%s.setOptions('[%s]')", self._log_prefix, repr(options)) self.parent.accessCheck(sender) settings = list(self.getSettings()) settings[4] = options self.update(settings) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_IPSET, in_signature='ss') @dbus_handle_exceptions def addOption(self, key, value, sender=None): key = dbus_to_python(key, str) value = dbus_to_python(value, str) log.debug1("%s.addOption('%s', '%s')", self._log_prefix, key, value) self.parent.accessCheck(sender) settings = list(self.getSettings()) if key in settings[4] and settings[4][key] == value: raise FirewallError(errors.ALREADY_ENABLED, "'%s': '%s'" % (key, value)) settings[4][key] = value self.update(settings) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_IPSET, in_signature='s') @dbus_handle_exceptions def removeOption(self, key, sender=None): key = dbus_to_python(key, str) log.debug1("%s.removeOption('%s')", self._log_prefix, key) self.parent.accessCheck(sender) settings = list(self.getSettings()) if key not in settings[4]: raise FirewallError(errors.NOT_ENABLED, key) del settings[4][key] self.update(settings) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_IPSET, in_signature='ss', out_signature='b') @dbus_handle_exceptions def queryOption(self, key, value, sender=None): # pylint: disable=W0613 key = dbus_to_python(key, str) value = dbus_to_python(value, str) log.debug1("%s.queryOption('%s', '%s')", self._log_prefix, key, value) settings = list(self.getSettings()) return (key in settings[4] and settings[4][key] == value) # entries @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_IPSET, out_signature='as') @dbus_handle_exceptions def getEntries(self, sender=None): # pylint: disable=W0613 log.debug1("%s.getEntries()", self._log_prefix) return self.getSettings()[5] @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_IPSET, in_signature='as') @dbus_handle_exceptions def setEntries(self, entries, sender=None): entries = dbus_to_python(entries, list) check_for_overlapping_entries(entries) log.debug1("%s.setEntries('[%s]')", self._log_prefix, ",".join(entries)) self.parent.accessCheck(sender) settings = list(self.getSettings()) if "timeout" in settings[4] and settings[4]["timeout"] != "0": raise FirewallError(errors.IPSET_WITH_TIMEOUT) settings[5] = entries self.update(settings) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_IPSET, in_signature='s') @dbus_handle_exceptions def addEntry(self, entry, sender=None): entry = dbus_to_python(entry, str) entry = normalize_ipset_entry(entry) log.debug1("%s.addEntry('%s')", self._log_prefix, entry) self.parent.accessCheck(sender) settings = list(self.getSettings()) if "timeout" in settings[4] and settings[4]["timeout"] != "0": raise FirewallError(errors.IPSET_WITH_TIMEOUT) if entry in settings[5]: raise FirewallError(errors.ALREADY_ENABLED, entry) check_entry_overlaps_existing(entry, settings[5]) settings[5].append(entry) self.update(settings) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_IPSET, in_signature='s') @dbus_handle_exceptions def removeEntry(self, entry, sender=None): entry = dbus_to_python(entry, str) entry = normalize_ipset_entry(entry) log.debug1("%s.removeEntry('%s')", self._log_prefix, entry) self.parent.accessCheck(sender) settings = list(self.getSettings()) if "timeout" in settings[4] and settings[4]["timeout"] != "0": raise FirewallError(errors.IPSET_WITH_TIMEOUT) if entry not in settings[5]: raise FirewallError(errors.NOT_ENABLED, entry) settings[5].remove(entry) self.update(settings) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_IPSET, in_signature='s', out_signature='b') @dbus_handle_exceptions def queryEntry(self, entry, sender=None): # pylint: disable=W0613 entry = dbus_to_python(entry, str) entry = normalize_ipset_entry(entry) log.debug1("%s.queryEntry('%s')", self._log_prefix, entry) settings = list(self.getSettings()) if "timeout" in settings[4] and settings[4]["timeout"] != "0": raise FirewallError(errors.IPSET_WITH_TIMEOUT) return entry in settings[5] server/config_icmptype.py 0000644 00000034763 15025011705 0011614 0 ustar 00 # -*- coding: utf-8 -*- # # Copyright (C) 2010-2016 Red Hat, Inc. # # Authors: # Thomas Woerner <twoerner@redhat.com> # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see <http://www.gnu.org/licenses/>. import dbus import dbus.service from firewall import config from firewall.dbus_utils import dbus_to_python, \ dbus_introspection_prepare_properties, \ dbus_introspection_add_properties from firewall.core.io.icmptype import IcmpType from firewall.core.logger import log from firewall.server.dbus import DbusServiceObject from firewall.server.decorators import handle_exceptions, \ dbus_handle_exceptions, dbus_service_method, \ dbus_polkit_require_auth from firewall import errors from firewall.errors import FirewallError ############################################################################ # # class FirewallDConfigIcmpType # ############################################################################ class FirewallDConfigIcmpType(DbusServiceObject): """FirewallD main class""" persistent = True """ Make FirewallD persistent. """ default_polkit_auth_required = config.dbus.PK_ACTION_CONFIG """ Use PK_ACTION_INFO as a default """ @handle_exceptions def __init__(self, parent, conf, icmptype, item_id, *args, **kwargs): super(FirewallDConfigIcmpType, self).__init__(*args, **kwargs) self.parent = parent self.config = conf self.obj = icmptype self.item_id = item_id self.busname = args[0] self.path = args[1] self._log_prefix = "config.icmptype.%d" % self.item_id dbus_introspection_prepare_properties( self, config.dbus.DBUS_INTERFACE_CONFIG_ICMPTYPE) @dbus_handle_exceptions def __del__(self): pass @dbus_handle_exceptions def unregister(self): self.remove_from_connection() # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # P R O P E R T I E S @dbus_handle_exceptions def _get_property(self, property_name): if property_name == "name": return dbus.String(self.obj.name) elif property_name == "filename": return dbus.String(self.obj.filename) elif property_name == "path": return dbus.String(self.obj.path) elif property_name == "default": return dbus.Boolean(self.obj.default) elif property_name == "builtin": return dbus.Boolean(self.obj.builtin) else: raise dbus.exceptions.DBusException( "org.freedesktop.DBus.Error.InvalidArgs: " "Property '%s' does not exist" % property_name) @dbus_service_method(dbus.PROPERTIES_IFACE, in_signature='ss', out_signature='v') @dbus_handle_exceptions def Get(self, interface_name, property_name, sender=None): # pylint: disable=W0613 # get a property interface_name = dbus_to_python(interface_name, str) property_name = dbus_to_python(property_name, str) log.debug1("%s.Get('%s', '%s')", self._log_prefix, interface_name, property_name) if interface_name != config.dbus.DBUS_INTERFACE_CONFIG_ICMPTYPE: raise dbus.exceptions.DBusException( "org.freedesktop.DBus.Error.UnknownInterface: " "Interface '%s' does not exist" % interface_name) return self._get_property(property_name) @dbus_service_method(dbus.PROPERTIES_IFACE, in_signature='s', out_signature='a{sv}') @dbus_handle_exceptions def GetAll(self, interface_name, sender=None): # pylint: disable=W0613 interface_name = dbus_to_python(interface_name, str) log.debug1("%s.GetAll('%s')", self._log_prefix, interface_name) if interface_name != config.dbus.DBUS_INTERFACE_CONFIG_ICMPTYPE: raise dbus.exceptions.DBusException( "org.freedesktop.DBus.Error.UnknownInterface: " "Interface '%s' does not exist" % interface_name) ret = { } for x in [ "name", "filename", "path", "default", "builtin" ]: ret[x] = self._get_property(x) return dbus.Dictionary(ret, signature="sv") @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG) @dbus_service_method(dbus.PROPERTIES_IFACE, in_signature='ssv') @dbus_handle_exceptions def Set(self, interface_name, property_name, new_value, sender=None): interface_name = dbus_to_python(interface_name, str) property_name = dbus_to_python(property_name, str) new_value = dbus_to_python(new_value) log.debug1("%s.Set('%s', '%s', '%s')", self._log_prefix, interface_name, property_name, new_value) self.parent.accessCheck(sender) if interface_name != config.dbus.DBUS_INTERFACE_CONFIG_ICMPTYPE: raise dbus.exceptions.DBusException( "org.freedesktop.DBus.Error.UnknownInterface: " "Interface '%s' does not exist" % interface_name) raise dbus.exceptions.DBusException( "org.freedesktop.DBus.Error.PropertyReadOnly: " "Property '%s' is read-only" % property_name) @dbus.service.signal(dbus.PROPERTIES_IFACE, signature='sa{sv}as') def PropertiesChanged(self, interface_name, changed_properties, invalidated_properties): interface_name = dbus_to_python(interface_name, str) changed_properties = dbus_to_python(changed_properties) invalidated_properties = dbus_to_python(invalidated_properties) log.debug1("%s.PropertiesChanged('%s', '%s', '%s')", self._log_prefix, interface_name, changed_properties, invalidated_properties) @dbus_polkit_require_auth(config.dbus.PK_ACTION_INFO) @dbus_service_method(dbus.INTROSPECTABLE_IFACE, out_signature='s') @dbus_handle_exceptions def Introspect(self, sender=None): # pylint: disable=W0613 log.debug2("%s.Introspect()", self._log_prefix) data = super(FirewallDConfigIcmpType, self).Introspect( self.path, self.busname.get_bus()) return dbus_introspection_add_properties( self, data, config.dbus.DBUS_INTERFACE_CONFIG_ICMPTYPE) # S E T T I N G S @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ICMPTYPE, out_signature=IcmpType.DBUS_SIGNATURE) @dbus_handle_exceptions def getSettings(self, sender=None): # pylint: disable=W0613 """get settings for icmptype """ log.debug1("%s.getSettings()", self._log_prefix) return self.config.get_icmptype_config(self.obj) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ICMPTYPE, in_signature=IcmpType.DBUS_SIGNATURE) @dbus_handle_exceptions def update(self, settings, sender=None): """update settings for icmptype """ settings = dbus_to_python(settings) log.debug1("%s.update('...')", self._log_prefix) self.parent.accessCheck(sender) self.obj = self.config.set_icmptype_config(self.obj, settings) self.Updated(self.obj.name) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ICMPTYPE) @dbus_handle_exceptions def loadDefaults(self, sender=None): """load default settings for builtin icmptype """ log.debug1("%s.loadDefaults()", self._log_prefix) self.parent.accessCheck(sender) self.obj = self.config.load_icmptype_defaults(self.obj) self.Updated(self.obj.name) @dbus.service.signal(config.dbus.DBUS_INTERFACE_CONFIG_ICMPTYPE, signature='s') @dbus_handle_exceptions def Updated(self, name): log.debug1("%s.Updated('%s')" % (self._log_prefix, name)) # R E M O V E @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ICMPTYPE) @dbus_handle_exceptions def remove(self, sender=None): """remove icmptype """ log.debug1("%s.removeIcmpType()", self._log_prefix) self.parent.accessCheck(sender) self.config.remove_icmptype(self.obj) self.parent.removeIcmpType(self.obj) @dbus.service.signal(config.dbus.DBUS_INTERFACE_CONFIG_ICMPTYPE, signature='s') @dbus_handle_exceptions def Removed(self, name): log.debug1("%s.Removed('%s')" % (self._log_prefix, name)) # R E N A M E @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ICMPTYPE, in_signature='s') @dbus_handle_exceptions def rename(self, name, sender=None): """rename icmptype """ name = dbus_to_python(name, str) log.debug1("%s.rename('%s')", self._log_prefix, name) self.parent.accessCheck(sender) self.obj = self.config.rename_icmptype(self.obj, name) self.Renamed(name) @dbus.service.signal(config.dbus.DBUS_INTERFACE_CONFIG_ICMPTYPE, signature='s') @dbus_handle_exceptions def Renamed(self, name): log.debug1("%s.Renamed('%s')" % (self._log_prefix, name)) # version @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ICMPTYPE, out_signature='s') @dbus_handle_exceptions def getVersion(self, sender=None): # pylint: disable=W0613 log.debug1("%s.getVersion()", self._log_prefix) return self.getSettings()[0] @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ICMPTYPE, in_signature='s') @dbus_handle_exceptions def setVersion(self, version, sender=None): version = dbus_to_python(version, str) log.debug1("%s.setVersion('%s')", self._log_prefix, version) self.parent.accessCheck(sender) settings = list(self.getSettings()) settings[0] = version self.update(settings) # short @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ICMPTYPE, out_signature='s') @dbus_handle_exceptions def getShort(self, sender=None): # pylint: disable=W0613 log.debug1("%s.getShort()", self._log_prefix) return self.getSettings()[1] @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ICMPTYPE, in_signature='s') @dbus_handle_exceptions def setShort(self, short, sender=None): short = dbus_to_python(short, str) log.debug1("%s.setShort('%s')", self._log_prefix, short) self.parent.accessCheck(sender) settings = list(self.getSettings()) settings[1] = short self.update(settings) # description @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ICMPTYPE, out_signature='s') @dbus_handle_exceptions def getDescription(self, sender=None): # pylint: disable=W0613 log.debug1("%s.getDescription()", self._log_prefix) return self.getSettings()[2] @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ICMPTYPE, in_signature='s') @dbus_handle_exceptions def setDescription(self, description, sender=None): description = dbus_to_python(description, str) log.debug1("%s.setDescription('%s')", self._log_prefix, description) self.parent.accessCheck(sender) settings = list(self.getSettings()) settings[2] = description self.update(settings) # destination @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ICMPTYPE, out_signature='as') @dbus_handle_exceptions def getDestinations(self, sender=None): # pylint: disable=W0613 log.debug1("%s.getDestinations()", self._log_prefix) return sorted(self.getSettings()[3]) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ICMPTYPE, in_signature='as') @dbus_handle_exceptions def setDestinations(self, destinations, sender=None): destinations = dbus_to_python(destinations, list) log.debug1("%s.setDestinations('[%s]')", self._log_prefix, ",".join(destinations)) self.parent.accessCheck(sender) settings = list(self.getSettings()) settings[3] = destinations self.update(settings) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ICMPTYPE, in_signature='s') @dbus_handle_exceptions def addDestination(self, destination, sender=None): destination = dbus_to_python(destination, str) log.debug1("%s.addDestination('%s')", self._log_prefix, destination) self.parent.accessCheck(sender) settings = list(self.getSettings()) if destination in settings[3]: raise FirewallError(errors.ALREADY_ENABLED, destination) settings[3].append(destination) self.update(settings) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ICMPTYPE, in_signature='s') @dbus_handle_exceptions def removeDestination(self, destination, sender=None): destination = dbus_to_python(destination, str) log.debug1("%s.removeDestination('%s')", self._log_prefix, destination) self.parent.accessCheck(sender) settings = list(self.getSettings()) if settings[3]: if destination not in settings[3]: raise FirewallError(errors.NOT_ENABLED, destination) else: settings[3].remove(destination) else: # empty means all settings[3] = list(set(['ipv4', 'ipv6']) - set([destination])) self.update(settings) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ICMPTYPE, in_signature='s', out_signature='b') @dbus_handle_exceptions def queryDestination(self, destination, sender=None): # pylint: disable=W0613 destination = dbus_to_python(destination, str) log.debug1("%s.queryDestination('%s')", self._log_prefix, destination) settings = self.getSettings() # empty means all return (not settings[3] or destination in settings[3]) server/decorators.py 0000644 00000016610 15025011705 0010571 0 ustar 00 # -*- coding: utf-8 -*- # # Copyright (C) 2012-2016 Red Hat, Inc. # # Authors: # Thomas Woerner <twoerner@redhat.com> # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see <http://www.gnu.org/licenses/>. """This module contains decorators for use with and without D-Bus""" __all__ = ["handle_exceptions", "dbus_handle_exceptions", "dbus_service_method"] import dbus import dbus.service import traceback import functools import inspect from dbus.exceptions import DBusException from firewall.errors import FirewallError from firewall import errors from firewall.core.logger import log from firewall.server.dbus import FirewallDBusException, NotAuthorizedException from firewall.dbus_utils import uid_of_sender ############################################################################ # # Exception handler decorators # ############################################################################ def handle_exceptions(func): """Decorator to handle exceptions and log them. Used if not conneced to D-Bus. """ @functools.wraps(func) def _impl(*args, **kwargs): try: return func(*args, **kwargs) except FirewallError as error: log.debug1(traceback.format_exc()) log.error(error) except Exception: # pylint: disable=W0703 log.exception() return _impl def dbus_handle_exceptions(func): """Decorator to handle exceptions, log and report them into D-Bus :Raises DBusException: on a firewall error code problems. """ @functools.wraps(func) def _impl(*args, **kwargs): try: return func(*args, **kwargs) except FirewallError as error: code = FirewallError.get_code(str(error)) if code in [ errors.ALREADY_ENABLED, errors.NOT_ENABLED, errors.ZONE_ALREADY_SET, errors.ALREADY_SET ]: log.warning(str(error)) else: log.debug1(traceback.format_exc()) log.error(str(error)) raise FirewallDBusException(str(error)) except DBusException as ex: # only log DBusExceptions once raise ex except Exception as ex: log.exception() raise FirewallDBusException(str(ex)) # HACK: functools.wraps() does not copy the function signature and # dbus-python doesn't support varargs. As such we need to copy the # signature from the function to the newly decorated function otherwise the # decorators in dbus-python will manipulate the arg stack and fail # miserably. # # Note: This can be removed if we ever stop using dbus-python. # # Ref: https://gitlab.freedesktop.org/dbus/dbus-python/-/issues/12 # _impl.__signature__ = inspect.signature(func) return _impl def dbus_service_method(*args, **kwargs): """Add sender argument for D-Bus""" kwargs.setdefault("sender_keyword", "sender") return dbus.service.method(*args, **kwargs) class dbus_service_method_deprecated: """Decorator that maintains a list of deprecated methods in dbus interfaces. """ deprecated = {} def __init__(self, interface=None): self.interface = interface if self.interface: if self.interface not in self.deprecated: self.deprecated[self.interface] = set() def __call__(self, func): if self.interface: self.deprecated[self.interface].add(func.__name__) @functools.wraps(func) def _impl(*args, **kwargs): return func(*args, **kwargs) return _impl class dbus_service_signal_deprecated(dbus_service_method_deprecated): """Decorator that maintains a list of deprecated signals in dbus interfaces. """ pass class dbus_polkit_require_auth: """Decorator factory that checks if the interface/method can be used by the sender/user. Assumes wrapped function is a method inside a class derived from DbusServiceObject. """ _polkit_name = "org.freedesktop.PolicyKit1" _polkit_path = "/org/freedesktop/PolicyKit1/Authority" _polkit_interface = "org.freedesktop.PolicyKit1.Authority" _bus = None _bus_signal_receiver = None _interface_polkit = None def __init__(self, polkit_auth_required): self._polkit_auth_required = polkit_auth_required @classmethod def _polkit_name_owner_changed(cls, name, old_owner, new_owner): cls._bus.remove_signal_receiver(cls._bus_signal_receiver) cls._bus_signal_receiver = None cls._interface_polkit = None def __call__(self, func): @functools.wraps(func) def _impl(*args, **kwargs): if not type(self)._bus: type(self)._bus = dbus.SystemBus() if not type(self)._bus_signal_receiver: type(self)._bus_signal_receiver = type(self)._bus.add_signal_receiver( handler_function=type(self)._polkit_name_owner_changed, signal_name="NameOwnerChanged", dbus_interface="org.freedesktop.DBus", arg0=self._polkit_name) if not type(self)._interface_polkit: try: type(self)._interface_polkit = dbus.Interface(type(self)._bus.get_object( type(self)._polkit_name, type(self)._polkit_path), type(self)._polkit_interface) except dbus.DBusException: # polkit must not be available pass action_id = self._polkit_auth_required if not action_id: raise dbus.DBusException("Not Authorized: No action_id specified.") sender = kwargs.get("sender") if sender: # use polkit if it's available if type(self)._interface_polkit: (result, _, _) = type(self)._interface_polkit.CheckAuthorization( ("system-bus-name", {"name": sender}), action_id, {}, 1, "") if not result: raise NotAuthorizedException(action_id, "polkit") # fallback to checking UID else: uid = uid_of_sender(type(self)._bus, sender) if uid != 0: raise NotAuthorizedException(action_id, "uid") return func(*args, **kwargs) _impl._polkit_auth_required = self._polkit_auth_required return _impl server/config_service.py 0000644 00000072537 15025011705 0011423 0 ustar 00 # -*- coding: utf-8 -*- # # Copyright (C) 2010-2016 Red Hat, Inc. # # Authors: # Thomas Woerner <twoerner@redhat.com> # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see <http://www.gnu.org/licenses/>. import dbus import dbus.service from firewall import config from firewall.dbus_utils import dbus_to_python, \ dbus_introspection_prepare_properties, \ dbus_introspection_add_properties from firewall.core.logger import log from firewall.server.dbus import DbusServiceObject from firewall.server.decorators import handle_exceptions, \ dbus_handle_exceptions, dbus_service_method, \ dbus_polkit_require_auth from firewall import errors from firewall.errors import FirewallError ############################################################################ # # class FirewallDConfig # ############################################################################ class FirewallDConfigService(DbusServiceObject): """FirewallD main class""" persistent = True """ Make FirewallD persistent. """ default_polkit_auth_required = config.dbus.PK_ACTION_CONFIG """ Use PK_ACTION_INFO as a default """ @handle_exceptions def __init__(self, parent, conf, service, item_id, *args, **kwargs): super(FirewallDConfigService, self).__init__(*args, **kwargs) self.parent = parent self.config = conf self.obj = service self.item_id = item_id self.busname = args[0] self.path = args[1] self._log_prefix = "config.service.%d" % self.item_id dbus_introspection_prepare_properties( self, config.dbus.DBUS_INTERFACE_CONFIG_SERVICE) @dbus_handle_exceptions def __del__(self): pass @dbus_handle_exceptions def unregister(self): self.remove_from_connection() # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # P R O P E R T I E S @dbus_handle_exceptions def _get_property(self, property_name): if property_name == "name": return dbus.String(self.obj.name) elif property_name == "filename": return dbus.String(self.obj.filename) elif property_name == "path": return dbus.String(self.obj.path) elif property_name == "default": return dbus.Boolean(self.obj.default) elif property_name == "builtin": return dbus.Boolean(self.obj.builtin) else: raise dbus.exceptions.DBusException( "org.freedesktop.DBus.Error.InvalidArgs: " "Property '%s' does not exist" % property_name) @dbus_service_method(dbus.PROPERTIES_IFACE, in_signature='ss', out_signature='v') @dbus_handle_exceptions def Get(self, interface_name, property_name, sender=None): # pylint: disable=W0613 # get a property interface_name = dbus_to_python(interface_name, str) property_name = dbus_to_python(property_name, str) log.debug1("%s.Get('%s', '%s')", self._log_prefix, interface_name, property_name) if interface_name != config.dbus.DBUS_INTERFACE_CONFIG_SERVICE: raise dbus.exceptions.DBusException( "org.freedesktop.DBus.Error.UnknownInterface: " "Interface '%s' does not exist" % interface_name) return self._get_property(property_name) @dbus_service_method(dbus.PROPERTIES_IFACE, in_signature='s', out_signature='a{sv}') @dbus_handle_exceptions def GetAll(self, interface_name, sender=None): # pylint: disable=W0613 interface_name = dbus_to_python(interface_name, str) log.debug1("%s.GetAll('%s')", self._log_prefix, interface_name) if interface_name != config.dbus.DBUS_INTERFACE_CONFIG_SERVICE: raise dbus.exceptions.DBusException( "org.freedesktop.DBus.Error.UnknownInterface: " "Interface '%s' does not exist" % interface_name) ret = { } for x in [ "name", "filename", "path", "default", "builtin" ]: ret[x] = self._get_property(x) return dbus.Dictionary(ret, signature="sv") @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG) @dbus_service_method(dbus.PROPERTIES_IFACE, in_signature='ssv') @dbus_handle_exceptions def Set(self, interface_name, property_name, new_value, sender=None): interface_name = dbus_to_python(interface_name, str) property_name = dbus_to_python(property_name, str) new_value = dbus_to_python(new_value) log.debug1("%s.Set('%s', '%s', '%s')", self._log_prefix, interface_name, property_name, new_value) self.parent.accessCheck(sender) if interface_name != config.dbus.DBUS_INTERFACE_CONFIG_SERVICE: raise dbus.exceptions.DBusException( "org.freedesktop.DBus.Error.UnknownInterface: " "Interface '%s' does not exist" % interface_name) raise dbus.exceptions.DBusException( "org.freedesktop.DBus.Error.PropertyReadOnly: " "Property '%s' is read-only" % property_name) @dbus.service.signal(dbus.PROPERTIES_IFACE, signature='sa{sv}as') def PropertiesChanged(self, interface_name, changed_properties, invalidated_properties): interface_name = dbus_to_python(interface_name, str) changed_properties = dbus_to_python(changed_properties) invalidated_properties = dbus_to_python(invalidated_properties) log.debug1("%s.PropertiesChanged('%s', '%s', '%s')", self._log_prefix, interface_name, changed_properties, invalidated_properties) @dbus_polkit_require_auth(config.dbus.PK_ACTION_INFO) @dbus_service_method(dbus.INTROSPECTABLE_IFACE, out_signature='s') @dbus_handle_exceptions def Introspect(self, sender=None): # pylint: disable=W0613 log.debug2("%s.Introspect()", self._log_prefix) data = super(FirewallDConfigService, self).Introspect( self.path, self.busname.get_bus()) return dbus_introspection_add_properties( self, data, config.dbus.DBUS_INTERFACE_CONFIG_SERVICE) # S E T T I N G S @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE, out_signature='(sssa(ss)asa{ss}asa(ss))') @dbus_handle_exceptions def getSettings(self, sender=None): # pylint: disable=W0613 """get settings for service """ log.debug1("%s.getSettings()", self._log_prefix) return self.config.get_service_config(self.obj) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE, out_signature='a{sv}') @dbus_handle_exceptions def getSettings2(self, sender=None): """get settings for service """ log.debug1("%s.getSettings2()", self._log_prefix) return self.config.get_service_config_dict(self.obj) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE, in_signature='(sssa(ss)asa{ss}asa(ss))') @dbus_handle_exceptions def update(self, settings, sender=None): """update settings for service """ settings = dbus_to_python(settings) log.debug1("%s.update('...')", self._log_prefix) self.parent.accessCheck(sender) self.obj = self.config.set_service_config(self.obj, settings) self.Updated(self.obj.name) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE, in_signature='a{sv}') @dbus_handle_exceptions def update2(self, settings, sender=None): settings = dbus_to_python(settings) log.debug1("%s.update2('...')", self._log_prefix) self.parent.accessCheck(sender) self.obj = self.config.set_service_config_dict(self.obj, settings) self.Updated(self.obj.name) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE) @dbus_handle_exceptions def loadDefaults(self, sender=None): """load default settings for builtin service """ log.debug1("%s.loadDefaults()", self._log_prefix) self.parent.accessCheck(sender) self.obj = self.config.load_service_defaults(self.obj) self.Updated(self.obj.name) @dbus.service.signal(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE, signature='s') @dbus_handle_exceptions def Updated(self, name): log.debug1("%s.Updated('%s')" % (self._log_prefix, name)) # R E M O V E @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE) @dbus_handle_exceptions def remove(self, sender=None): """remove service """ log.debug1("%s.removeService()", self._log_prefix) self.parent.accessCheck(sender) self.config.remove_service(self.obj) self.parent.removeService(self.obj) @dbus.service.signal(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE, signature='s') @dbus_handle_exceptions def Removed(self, name): log.debug1("%s.Removed('%s')" % (self._log_prefix, name)) # R E N A M E @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE, in_signature='s') @dbus_handle_exceptions def rename(self, name, sender=None): """rename service """ name = dbus_to_python(name, str) log.debug1("%s.rename('%s')", self._log_prefix, name) self.parent.accessCheck(sender) self.obj = self.config.rename_service(self.obj, name) self.Renamed(name) @dbus.service.signal(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE, signature='s') @dbus_handle_exceptions def Renamed(self, name): log.debug1("%s.Renamed('%s')" % (self._log_prefix, name)) # version @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE, out_signature='s') @dbus_handle_exceptions def getVersion(self, sender=None): # pylint: disable=W0613 log.debug1("%s.getVersion()", self._log_prefix) return self.getSettings()[0] @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE, in_signature='s') @dbus_handle_exceptions def setVersion(self, version, sender=None): version = dbus_to_python(version, str) log.debug1("%s.setVersion('%s')", self._log_prefix, version) self.parent.accessCheck(sender) settings = list(self.getSettings()) settings[0] = version self.update(settings) # short @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE, out_signature='s') @dbus_handle_exceptions def getShort(self, sender=None): # pylint: disable=W0613 log.debug1("%s.getShort()", self._log_prefix) return self.getSettings()[1] @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE, in_signature='s') @dbus_handle_exceptions def setShort(self, short, sender=None): short = dbus_to_python(short, str) log.debug1("%s.setShort('%s')", self._log_prefix, short) self.parent.accessCheck(sender) settings = list(self.getSettings()) settings[1] = short self.update(settings) # description @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE, out_signature='s') @dbus_handle_exceptions def getDescription(self, sender=None): # pylint: disable=W0613 log.debug1("%s.getDescription()", self._log_prefix) return self.getSettings()[2] @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE, in_signature='s') @dbus_handle_exceptions def setDescription(self, description, sender=None): description = dbus_to_python(description, str) log.debug1("%s.setDescription('%s')", self._log_prefix, description) self.parent.accessCheck(sender) settings = list(self.getSettings()) settings[2] = description self.update(settings) # port @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE, out_signature='a(ss)') @dbus_handle_exceptions def getPorts(self, sender=None): # pylint: disable=W0613 log.debug1("%s.getPorts()", self._log_prefix) return self.getSettings()[3] @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE, in_signature='a(ss)') @dbus_handle_exceptions def setPorts(self, ports, sender=None): _ports = [ ] # convert embedded lists to tuples for port in dbus_to_python(ports, list): if isinstance(port, list): _ports.append(tuple(port)) else: _ports.append(port) ports = _ports log.debug1("%s.setPorts('[%s]')", self._log_prefix, ",".join("('%s, '%s')" % (port[0], port[1]) for port in ports)) self.parent.accessCheck(sender) settings = list(self.getSettings()) settings[3] = ports self.update(settings) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE, in_signature='ss') @dbus_handle_exceptions def addPort(self, port, protocol, sender=None): port = dbus_to_python(port, str) protocol = dbus_to_python(protocol, str) log.debug1("%s.addPort('%s', '%s')", self._log_prefix, port, protocol) self.parent.accessCheck(sender) settings = list(self.getSettings()) if (port,protocol) in settings[3]: raise FirewallError(errors.ALREADY_ENABLED, "%s:%s" % (port, protocol)) settings[3].append((port,protocol)) self.update(settings) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE, in_signature='ss') @dbus_handle_exceptions def removePort(self, port, protocol, sender=None): port = dbus_to_python(port, str) protocol = dbus_to_python(protocol, str) log.debug1("%s.removePort('%s', '%s')", self._log_prefix, port, protocol) self.parent.accessCheck(sender) settings = list(self.getSettings()) if (port,protocol) not in settings[3]: raise FirewallError(errors.NOT_ENABLED, "%s:%s" % (port, protocol)) settings[3].remove((port,protocol)) self.update(settings) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE, in_signature='ss', out_signature='b') @dbus_handle_exceptions def queryPort(self, port, protocol, sender=None): # pylint: disable=W0613 port = dbus_to_python(port, str) protocol = dbus_to_python(protocol, str) log.debug1("%s.queryPort('%s', '%s')", self._log_prefix, port, protocol) return (port,protocol) in self.getSettings()[3] # protocol @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE, out_signature='as') @dbus_handle_exceptions def getProtocols(self, sender=None): # pylint: disable=W0613 log.debug1("%s.getProtocols()", self._log_prefix) return self.getSettings()[6] @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE, in_signature='as') @dbus_handle_exceptions def setProtocols(self, protocols, sender=None): protocols = dbus_to_python(protocols, list) log.debug1("%s.setProtocols('[%s]')", self._log_prefix, ",".join(protocols)) self.parent.accessCheck(sender) settings = list(self.getSettings()) settings[6] = protocols self.update(settings) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE, in_signature='s') @dbus_handle_exceptions def addProtocol(self, protocol, sender=None): protocol = dbus_to_python(protocol, str) log.debug1("%s.addProtocol('%s')", self._log_prefix, protocol) self.parent.accessCheck(sender) settings = list(self.getSettings()) if protocol in settings[6]: raise FirewallError(errors.ALREADY_ENABLED, protocol) settings[6].append(protocol) self.update(settings) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE, in_signature='s') @dbus_handle_exceptions def removeProtocol(self, protocol, sender=None): protocol = dbus_to_python(protocol, str) log.debug1("%s.removeProtocol('%s')", self._log_prefix, protocol) self.parent.accessCheck(sender) settings = list(self.getSettings()) if protocol not in settings[6]: raise FirewallError(errors.NOT_ENABLED, protocol) settings[6].remove(protocol) self.update(settings) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE, in_signature='s', out_signature='b') @dbus_handle_exceptions def queryProtocol(self, protocol, sender=None): # pylint: disable=W0613 protocol = dbus_to_python(protocol, str) log.debug1("%s.queryProtocol(%s')", self._log_prefix, protocol) return protocol in self.getSettings()[6] # source port @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE, out_signature='a(ss)') @dbus_handle_exceptions def getSourcePorts(self, sender=None): # pylint: disable=W0613 log.debug1("%s.getSourcePorts()", self._log_prefix) return self.getSettings()[7] @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE, in_signature='a(ss)') @dbus_handle_exceptions def setSourcePorts(self, ports, sender=None): _ports = [ ] # convert embedded lists to tuples for port in dbus_to_python(ports, list): if isinstance(port, list): _ports.append(tuple(port)) else: _ports.append(port) ports = _ports log.debug1("%s.setSourcePorts('[%s]')", self._log_prefix, ",".join("('%s, '%s')" % (port[0], port[1]) for port in ports)) self.parent.accessCheck(sender) settings = list(self.getSettings()) settings[7] = ports self.update(settings) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE, in_signature='ss') @dbus_handle_exceptions def addSourcePort(self, port, protocol, sender=None): port = dbus_to_python(port, str) protocol = dbus_to_python(protocol, str) log.debug1("%s.addSourcePort('%s', '%s')", self._log_prefix, port, protocol) self.parent.accessCheck(sender) settings = list(self.getSettings()) if (port,protocol) in settings[7]: raise FirewallError(errors.ALREADY_ENABLED, "%s:%s" % (port, protocol)) settings[7].append((port,protocol)) self.update(settings) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE, in_signature='ss') @dbus_handle_exceptions def removeSourcePort(self, port, protocol, sender=None): port = dbus_to_python(port, str) protocol = dbus_to_python(protocol, str) log.debug1("%s.removeSourcePort('%s', '%s')", self._log_prefix, port, protocol) self.parent.accessCheck(sender) settings = list(self.getSettings()) if (port,protocol) not in settings[7]: raise FirewallError(errors.NOT_ENABLED, "%s:%s" % (port, protocol)) settings[7].remove((port,protocol)) self.update(settings) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE, in_signature='ss', out_signature='b') @dbus_handle_exceptions def querySourcePort(self, port, protocol, sender=None): # pylint: disable=W0613 port = dbus_to_python(port, str) protocol = dbus_to_python(protocol, str) log.debug1("%s.querySourcePort('%s', '%s')", self._log_prefix, port, protocol) return (port,protocol) in self.getSettings()[7] # module @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE, out_signature='as') @dbus_handle_exceptions def getModules(self, sender=None): # pylint: disable=W0613 log.debug1("%s.getModules()", self._log_prefix) return self.getSettings()[4] @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE, in_signature='as') @dbus_handle_exceptions def setModules(self, modules, sender=None): modules = dbus_to_python(modules, list) _modules = [ ] for module in modules: if module.startswith("nf_conntrack_"): module = module.replace("nf_conntrack_", "") if "_" in module: module = module.replace("_", "-") _modules.append(module) modules = _modules log.debug1("%s.setModules('[%s]')", self._log_prefix, ",".join(modules)) self.parent.accessCheck(sender) settings = list(self.getSettings()) settings[4] = modules self.update(settings) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE, in_signature='s') @dbus_handle_exceptions def addModule(self, module, sender=None): module = dbus_to_python(module, str) if module.startswith("nf_conntrack_"): module = module.replace("nf_conntrack_", "") if "_" in module: module = module.replace("_", "-") log.debug1("%s.addModule('%s')", self._log_prefix, module) self.parent.accessCheck(sender) settings = list(self.getSettings()) if module in settings[4]: raise FirewallError(errors.ALREADY_ENABLED, module) settings[4].append(module) self.update(settings) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE, in_signature='s') @dbus_handle_exceptions def removeModule(self, module, sender=None): module = dbus_to_python(module, str) if module.startswith("nf_conntrack_"): module = module.replace("nf_conntrack_", "") if "_" in module: module = module.replace("_", "-") log.debug1("%s.removeModule('%s')", self._log_prefix, module) self.parent.accessCheck(sender) settings = list(self.getSettings()) if module not in settings[4]: raise FirewallError(errors.NOT_ENABLED, module) settings[4].remove(module) self.update(settings) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE, in_signature='s', out_signature='b') @dbus_handle_exceptions def queryModule(self, module, sender=None): # pylint: disable=W0613 module = dbus_to_python(module, str) if module.startswith("nf_conntrack_"): module = module.replace("nf_conntrack_", "") if "_" in module: module = module.replace("_", "-") log.debug1("%s.queryModule('%s')", self._log_prefix, module) return module in self.getSettings()[4] # destination @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE, out_signature='a{ss}') @dbus_handle_exceptions def getDestinations(self, sender=None): # pylint: disable=W0613 log.debug1("%s.getDestinations()", self._log_prefix) return self.getSettings()[5] @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE, in_signature='a{ss}') @dbus_handle_exceptions def setDestinations(self, destinations, sender=None): destinations = dbus_to_python(destinations, dict) log.debug1("%s.setDestinations({ipv4:'%s', ipv6:'%s'})", self._log_prefix, destinations.get('ipv4'), destinations.get('ipv6')) self.parent.accessCheck(sender) settings = list(self.getSettings()) settings[5] = destinations self.update(settings) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE, in_signature='s', out_signature='s') @dbus_handle_exceptions def getDestination(self, family, sender=None): family = dbus_to_python(family, str) log.debug1("%s.getDestination('%s')", self._log_prefix, family) self.parent.accessCheck(sender) settings = list(self.getSettings()) if family not in settings[5]: raise FirewallError(errors.NOT_ENABLED, family) return settings[5][family] @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE, in_signature='ss') @dbus_handle_exceptions def setDestination(self, family, address, sender=None): family = dbus_to_python(family, str) address = dbus_to_python(address, str) log.debug1("%s.setDestination('%s', '%s')", self._log_prefix, family, address) self.parent.accessCheck(sender) settings = list(self.getSettings()) if family in settings[5] and settings[5][family] == address: raise FirewallError(errors.ALREADY_ENABLED, "'%s': '%s'" % (family, address)) settings[5][family] = address self.update(settings) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE, in_signature='s') @dbus_handle_exceptions def removeDestination(self, family, sender=None): family = dbus_to_python(family, str) log.debug1("%s.removeDestination('%s')", self._log_prefix, family) self.parent.accessCheck(sender) settings = list(self.getSettings()) if family not in settings[5]: raise FirewallError(errors.NOT_ENABLED, family) del settings[5][family] self.update(settings) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE, in_signature='ss', out_signature='b') @dbus_handle_exceptions def queryDestination(self, family, address, sender=None): # pylint: disable=W0613 family = dbus_to_python(family, str) address = dbus_to_python(address, str) log.debug1("%s.queryDestination('%s', '%s')", self._log_prefix, family, address) settings = self.getSettings() return (family in settings[5] and address == settings[5][family]) # includes @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE, out_signature='as') @dbus_handle_exceptions def getIncludes(self, sender=None): log.debug1("%s.getIncludes()", self._log_prefix) self.parent.accessCheck(sender) settings = self.config.get_service_config_dict(self.obj) return settings["includes"] if "includes" in settings else [] @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE, in_signature='as') @dbus_handle_exceptions def setIncludes(self, includes, sender=None): includes = dbus_to_python(includes, list) log.debug1("%s.setIncludes('%s')", self._log_prefix, includes) self.parent.accessCheck(sender) settings = {"includes": includes[:]} self.obj = self.config.set_service_config_dict(self.obj, settings) self.Updated(self.obj.name) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE, in_signature='s') @dbus_handle_exceptions def addInclude(self, include, sender=None): include = dbus_to_python(include, str) log.debug1("%s.addInclude('%s')", self._log_prefix, include) self.parent.accessCheck(sender) settings = self.config.get_service_config_dict(self.obj) settings.setdefault("includes", []).append(include) self.obj = self.config.set_service_config_dict(self.obj, settings) self.Updated(self.obj.name) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE, in_signature='s') @dbus_handle_exceptions def removeInclude(self, include, sender=None): include = dbus_to_python(include, str) log.debug1("%s.removeInclude('%s')", self._log_prefix, include) self.parent.accessCheck(sender) settings = self.config.get_service_config_dict(self.obj) settings["includes"].remove(include) self.obj = self.config.set_service_config_dict(self.obj, settings) self.Updated(self.obj.name) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE, in_signature='s', out_signature='b') @dbus_handle_exceptions def queryInclude(self, include, sender=None): include = dbus_to_python(include, str) log.debug1("%s.queryInclude('%s')", self._log_prefix, include) settings = self.config.get_service_config_dict(self.obj) return include in settings["includes"] if "includes" in settings else False server/dbus.py 0000644 00000002264 15025011705 0007361 0 ustar 00 # -*- coding: utf-8 -*- # # SPDX-License-Identifier: GPL-2.0-or-later import dbus from firewall import config class FirewallDBusException(dbus.DBusException): """FirewallDBusException""" _dbus_error_name = "%s.Exception" % config.dbus.DBUS_INTERFACE class NotAuthorizedException(dbus.DBusException): def __init__(self, action_id, method, *args, **kwargs): self._dbus_error_name = config.dbus.DBUS_INTERFACE + ".NotAuthorizedException" super().__init__("Not Authorized({}): {}".format(method, action_id)) class DbusServiceObject(dbus.service.Object): def __new__(cls, *args, **kwargs): # Check each dbus method. If it does not have an explicit polkit auth # then implicitly wrap it with the default from firewall.server.decorators import dbus_polkit_require_auth for attr_name in dir(cls): method = getattr(cls, attr_name) if hasattr(method, "_dbus_is_method") and \ not hasattr(method, "_polkit_auth_required"): _decorator = dbus_polkit_require_auth(cls.default_polkit_auth_required) setattr(cls, attr_name, _decorator(method)) return super().__new__(cls) server/config_zone.py 0000644 00000131767 15025011705 0010737 0 ustar 00 # -*- coding: utf-8 -*- # # Copyright (C) 2010-2016 Red Hat, Inc. # # Authors: # Thomas Woerner <twoerner@redhat.com> # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see <http://www.gnu.org/licenses/>. import dbus import dbus.service from firewall import config from firewall.dbus_utils import dbus_to_python, \ dbus_introspection_prepare_properties, \ dbus_introspection_add_properties from firewall.core.io.zone import Zone from firewall.core.fw_ifcfg import ifcfg_set_zone_of_interface from firewall.core.base import DEFAULT_ZONE_TARGET from firewall.core.rich import Rich_Rule from firewall.core.logger import log from firewall.server.dbus import DbusServiceObject from firewall.server.decorators import handle_exceptions, \ dbus_handle_exceptions, dbus_service_method, \ dbus_polkit_require_auth from firewall import errors from firewall.errors import FirewallError from firewall.functions import portStr, portInPortRange, coalescePortRange, \ breakPortRange ############################################################################ # # class FirewallDConfig # ############################################################################ class FirewallDConfigZone(DbusServiceObject): """FirewallD main class""" persistent = True """ Make FirewallD persistent. """ default_polkit_auth_required = config.dbus.PK_ACTION_CONFIG """ Use PK_ACTION_INFO as a default """ @handle_exceptions def __init__(self, parent, conf, zone, item_id, *args, **kwargs): super(FirewallDConfigZone, self).__init__(*args, **kwargs) self.parent = parent self.config = conf self.obj = zone self.item_id = item_id self.busname = args[0] self.path = args[1] self._log_prefix = "config.zone.%d" % self.item_id dbus_introspection_prepare_properties( self, config.dbus.DBUS_INTERFACE_CONFIG_ZONE) @dbus_handle_exceptions def __del__(self): pass @dbus_handle_exceptions def unregister(self): self.remove_from_connection() # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # P R O P E R T I E S @dbus_handle_exceptions def _get_property(self, property_name): if property_name == "name": return dbus.String(self.obj.name) elif property_name == "filename": return dbus.String(self.obj.filename) elif property_name == "path": return dbus.String(self.obj.path) elif property_name == "default": return dbus.Boolean(self.obj.default) elif property_name == "builtin": return dbus.Boolean(self.obj.builtin) else: raise dbus.exceptions.DBusException( "org.freedesktop.DBus.Error.InvalidArgs: " "Property '%s' does not exist" % property_name) @dbus_service_method(dbus.PROPERTIES_IFACE, in_signature='ss', out_signature='v') @dbus_handle_exceptions def Get(self, interface_name, property_name, sender=None): # pylint: disable=W0613 # get a property interface_name = dbus_to_python(interface_name, str) property_name = dbus_to_python(property_name, str) log.debug1("%s.Get('%s', '%s')", self._log_prefix, interface_name, property_name) if interface_name != config.dbus.DBUS_INTERFACE_CONFIG_ZONE: raise dbus.exceptions.DBusException( "org.freedesktop.DBus.Error.UnknownInterface: " "Interface '%s' does not exist" % interface_name) return self._get_property(property_name) @dbus_service_method(dbus.PROPERTIES_IFACE, in_signature='s', out_signature='a{sv}') @dbus_handle_exceptions def GetAll(self, interface_name, sender=None): # pylint: disable=W0613 interface_name = dbus_to_python(interface_name, str) log.debug1("%s.GetAll('%s')", self._log_prefix, interface_name) if interface_name != config.dbus.DBUS_INTERFACE_CONFIG_ZONE: raise dbus.exceptions.DBusException( "org.freedesktop.DBus.Error.UnknownInterface: " "Interface '%s' does not exist" % interface_name) ret = { } for x in [ "name", "filename", "path", "default", "builtin" ]: ret[x] = self._get_property(x) return dbus.Dictionary(ret, signature="sv") @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG) @dbus_service_method(dbus.PROPERTIES_IFACE, in_signature='ssv') @dbus_handle_exceptions def Set(self, interface_name, property_name, new_value, sender=None): interface_name = dbus_to_python(interface_name, str) property_name = dbus_to_python(property_name, str) new_value = dbus_to_python(new_value) log.debug1("%s.Set('%s', '%s', '%s')", self._log_prefix, interface_name, property_name, new_value) self.parent.accessCheck(sender) if interface_name != config.dbus.DBUS_INTERFACE_CONFIG_ZONE: raise dbus.exceptions.DBusException( "org.freedesktop.DBus.Error.UnknownInterface: " "Interface '%s' does not exist" % interface_name) raise dbus.exceptions.DBusException( "org.freedesktop.DBus.Error.PropertyReadOnly: " "Property '%s' is read-only" % property_name) @dbus.service.signal(dbus.PROPERTIES_IFACE, signature='sa{sv}as') def PropertiesChanged(self, interface_name, changed_properties, invalidated_properties): interface_name = dbus_to_python(interface_name, str) changed_properties = dbus_to_python(changed_properties) invalidated_properties = dbus_to_python(invalidated_properties) log.debug1("%s.PropertiesChanged('%s', '%s', '%s')", self._log_prefix, interface_name, changed_properties, invalidated_properties) @dbus_polkit_require_auth(config.dbus.PK_ACTION_INFO) @dbus_service_method(dbus.INTROSPECTABLE_IFACE, out_signature='s') @dbus_handle_exceptions def Introspect(self, sender=None): # pylint: disable=W0613 log.debug2("%s.Introspect()", self._log_prefix) data = super(FirewallDConfigZone, self).Introspect( self.path, self.busname.get_bus()) return dbus_introspection_add_properties( self, data, config.dbus.DBUS_INTERFACE_CONFIG_ZONE) # S E T T I N G S @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE, out_signature="(sssbsasa(ss)asba(ssss)asasasasa(ss)b)") @dbus_handle_exceptions def getSettings(self, sender=None): # pylint: disable=W0613 """get settings for zone """ log.debug1("%s.getSettings()", self._log_prefix) settings = self.config.get_zone_config(self.obj) if settings[4] == DEFAULT_ZONE_TARGET: # convert to list, fix target, convert back to tuple _settings = list(settings) _settings[4] = "default" settings = tuple(_settings) return settings @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE, out_signature="a{sv}") @dbus_handle_exceptions def getSettings2(self, sender=None): """get settings for zone """ log.debug1("%s.getSettings2()", self._log_prefix) settings = self.config.get_zone_config_dict(self.obj) if settings["target"] == DEFAULT_ZONE_TARGET: settings["target"] = "default" return settings def _checkDuplicateInterfacesSources(self, settings): """Assignment of interfaces/sources to zones is different from other zone settings in the sense that particular interface/zone can be part of only one zone. So make sure added interfaces/sources have not already been bound to another zone.""" old_settings = self.config.get_zone_config_dict(self.obj) old_ifaces = set(old_settings["interfaces"]) if "interfaces" in old_settings else set() old_sources = set(old_settings["sources"]) if "sources" in old_settings else set() if isinstance(settings, tuple): added_ifaces = set(settings[Zone.index_of("interfaces")]) - old_ifaces added_sources = set(settings[Zone.index_of("sources")]) - old_sources else: # dict new_ifaces = set(settings["interfaces"]) if "interfaces" in settings else set() new_sources = set(settings["sources"]) if "sources" in settings else set() added_ifaces = new_ifaces - old_ifaces added_sources = new_sources - old_sources for iface in added_ifaces: if self.parent.getZoneOfInterface(iface): raise FirewallError(errors.ZONE_CONFLICT, iface) # or move to new zone ? for source in added_sources: if self.parent.getZoneOfSource(source): raise FirewallError(errors.ZONE_CONFLICT, source) # or move to new zone ? @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE, in_signature="(sssbsasa(ss)asba(ssss)asasasasa(ss)b)") @dbus_handle_exceptions def update(self, settings, sender=None): """update settings for zone """ settings = dbus_to_python(settings) log.debug1("%s.update('...')", self._log_prefix) self.parent.accessCheck(sender) if settings[4] == "default": # convert to list, fix target, convert back to tuple _settings = list(settings) _settings[4] = DEFAULT_ZONE_TARGET settings = tuple(_settings) self._checkDuplicateInterfacesSources(settings) self.obj = self.config.set_zone_config(self.obj, settings) self.Updated(self.obj.name) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE, in_signature="a{sv}") @dbus_handle_exceptions def update2(self, settings, sender=None): """update settings for zone """ settings = dbus_to_python(settings) log.debug1("%s.update2('...')", self._log_prefix) self.parent.accessCheck(sender) if "target" in settings and settings["target"] == "default": settings["target"] = DEFAULT_ZONE_TARGET self._checkDuplicateInterfacesSources(settings) self.obj = self.config.set_zone_config_dict(self.obj, settings) self.Updated(self.obj.name) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE) @dbus_handle_exceptions def loadDefaults(self, sender=None): """load default settings for builtin zone """ log.debug1("%s.loadDefaults()", self._log_prefix) self.parent.accessCheck(sender) self.obj = self.config.load_zone_defaults(self.obj) self.Updated(self.obj.name) @dbus.service.signal(config.dbus.DBUS_INTERFACE_CONFIG_ZONE, signature='s') @dbus_handle_exceptions def Updated(self, name): log.debug1("%s.Updated('%s')" % (self._log_prefix, name)) # R E M O V E @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE) @dbus_handle_exceptions def remove(self, sender=None): """remove zone """ log.debug1("%s.removeZone()", self._log_prefix) self.parent.accessCheck(sender) self.config.remove_zone(self.obj) self.parent.removeZone(self.obj) @dbus.service.signal(config.dbus.DBUS_INTERFACE_CONFIG_ZONE, signature='s') @dbus_handle_exceptions def Removed(self, name): log.debug1("%s.Removed('%s')" % (self._log_prefix, name)) # R E N A M E @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE, in_signature='s') @dbus_handle_exceptions def rename(self, name, sender=None): """rename zone """ name = dbus_to_python(name, str) log.debug1("%s.rename('%s')", self._log_prefix, name) self.parent.accessCheck(sender) self.obj = self.config.rename_zone(self.obj, name) self.Renamed(name) @dbus.service.signal(config.dbus.DBUS_INTERFACE_CONFIG_ZONE, signature='s') @dbus_handle_exceptions def Renamed(self, name): log.debug1("%s.Renamed('%s')" % (self._log_prefix, name)) # version @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE, out_signature='s') @dbus_handle_exceptions def getVersion(self, sender=None): # pylint: disable=W0613 log.debug1("%s.getVersion()", self._log_prefix) return self.getSettings()[0] @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE, in_signature='s') @dbus_handle_exceptions def setVersion(self, version, sender=None): version = dbus_to_python(version, str) log.debug1("%s.setVersion('%s')", self._log_prefix, version) self.parent.accessCheck(sender) settings = list(self.getSettings()) settings[0] = version self.update(settings) # short @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE, out_signature='s') @dbus_handle_exceptions def getShort(self, sender=None): # pylint: disable=W0613 log.debug1("%s.getShort()", self._log_prefix) return self.getSettings()[1] @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE, in_signature='s') @dbus_handle_exceptions def setShort(self, short, sender=None): short = dbus_to_python(short, str) log.debug1("%s.setShort('%s')", self._log_prefix, short) self.parent.accessCheck(sender) settings = list(self.getSettings()) settings[1] = short self.update(settings) # description @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE, out_signature='s') @dbus_handle_exceptions def getDescription(self, sender=None): # pylint: disable=W0613 log.debug1("%s.getDescription()", self._log_prefix) return self.getSettings()[2] @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE, in_signature='s') @dbus_handle_exceptions def setDescription(self, description, sender=None): description = dbus_to_python(description, str) log.debug1("%s.setDescription('%s')", self._log_prefix, description) self.parent.accessCheck(sender) settings = list(self.getSettings()) settings[2] = description self.update(settings) # immutable (deprecated) # settings[3] was used for 'immutable' # target @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE, out_signature='s') @dbus_handle_exceptions def getTarget(self, sender=None): # pylint: disable=W0613 log.debug1("%s.getTarget()", self._log_prefix) settings = self.getSettings() return settings[4] if settings[4] != DEFAULT_ZONE_TARGET else "default" @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE, in_signature='s') @dbus_handle_exceptions def setTarget(self, target, sender=None): target = dbus_to_python(target, str) log.debug1("%s.setTarget('%s')", self._log_prefix, target) self.parent.accessCheck(sender) settings = list(self.getSettings()) settings[4] = target if target != "default" else DEFAULT_ZONE_TARGET self.update(settings) # service @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE, out_signature='as') @dbus_handle_exceptions def getServices(self, sender=None): # pylint: disable=W0613 log.debug1("%s.getServices()", self._log_prefix) return self.getSettings()[5] @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE, in_signature='as') @dbus_handle_exceptions def setServices(self, services, sender=None): services = dbus_to_python(services, list) log.debug1("%s.setServices('[%s]')", self._log_prefix, ",".join(services)) self.parent.accessCheck(sender) settings = list(self.getSettings()) settings[5] = services self.update(settings) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE, in_signature='s') @dbus_handle_exceptions def addService(self, service, sender=None): service = dbus_to_python(service, str) log.debug1("%s.addService('%s')", self._log_prefix, service) self.parent.accessCheck(sender) settings = list(self.getSettings()) if service in settings[5]: raise FirewallError(errors.ALREADY_ENABLED, service) settings[5].append(service) self.update(settings) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE, in_signature='s') @dbus_handle_exceptions def removeService(self, service, sender=None): service = dbus_to_python(service, str) log.debug1("%s.removeService('%s')", self._log_prefix, service) self.parent.accessCheck(sender) settings = list(self.getSettings()) if service not in settings[5]: raise FirewallError(errors.NOT_ENABLED, service) settings[5].remove(service) self.update(settings) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE, in_signature='s', out_signature='b') @dbus_handle_exceptions def queryService(self, service, sender=None): # pylint: disable=W0613 service = dbus_to_python(service, str) log.debug1("%s.queryService('%s')", self._log_prefix, service) return service in self.getSettings()[5] # port @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE, out_signature='a(ss)') @dbus_handle_exceptions def getPorts(self, sender=None): # pylint: disable=W0613 log.debug1("%s.getPorts()", self._log_prefix) return self.getSettings()[6] @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE, in_signature='a(ss)') @dbus_handle_exceptions def setPorts(self, ports, sender=None): _ports = [ ] # convert embedded lists to tuples for port in dbus_to_python(ports, list): if isinstance(port, list): _ports.append(tuple(port)) else: _ports.append(port) ports = _ports log.debug1("%s.setPorts('[%s]')", self._log_prefix, ",".join("('%s, '%s')" % (port[0], port[1]) for port in ports)) self.parent.accessCheck(sender) settings = list(self.getSettings()) settings[6] = ports self.update(settings) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE, in_signature='ss') @dbus_handle_exceptions def addPort(self, port, protocol, sender=None): port = dbus_to_python(port, str) protocol = dbus_to_python(protocol, str) log.debug1("%s.addPort('%s', '%s')", self._log_prefix, port, protocol) self.parent.accessCheck(sender) settings = list(self.getSettings()) existing_port_ids = list(filter(lambda x: x[1] == protocol, settings[6])) for port_id in existing_port_ids: if portInPortRange(port, port_id[0]): raise FirewallError(errors.ALREADY_ENABLED, "%s:%s" % (port, protocol)) added_ranges, removed_ranges = coalescePortRange(port, [_port for (_port, _protocol) in existing_port_ids]) for range in removed_ranges: settings[6].remove((portStr(range, "-"), protocol)) for range in added_ranges: settings[6].append((portStr(range, "-"), protocol)) self.update(settings) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE, in_signature='ss') @dbus_handle_exceptions def removePort(self, port, protocol, sender=None): port = dbus_to_python(port, str) protocol = dbus_to_python(protocol, str) log.debug1("%s.removePort('%s', '%s')", self._log_prefix, port, protocol) self.parent.accessCheck(sender) settings = list(self.getSettings()) existing_port_ids = list(filter(lambda x: x[1] == protocol, settings[6])) for port_id in existing_port_ids: if portInPortRange(port, port_id[0]): break else: raise FirewallError(errors.NOT_ENABLED, "%s:%s" % (port, protocol)) added_ranges, removed_ranges = breakPortRange(port, [_port for (_port, _protocol) in existing_port_ids]) for range in removed_ranges: settings[6].remove((portStr(range, "-"), protocol)) for range in added_ranges: settings[6].append((portStr(range, "-"), protocol)) self.update(settings) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE, in_signature='ss', out_signature='b') @dbus_handle_exceptions def queryPort(self, port, protocol, sender=None): # pylint: disable=W0613 port = dbus_to_python(port, str) protocol = dbus_to_python(protocol, str) log.debug1("%s.queryPort('%s', '%s')", self._log_prefix, port, protocol) for (_port, _protocol) in self.getSettings()[6]: if portInPortRange(port, _port) and protocol == _protocol: return True return False # protocol @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE, out_signature='as') @dbus_handle_exceptions def getProtocols(self, sender=None): # pylint: disable=W0613 log.debug1("%s.getProtocols()", self._log_prefix) return self.getSettings()[13] @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE, in_signature='as') @dbus_handle_exceptions def setProtocols(self, protocols, sender=None): protocols = dbus_to_python(protocols, list) log.debug1("%s.setProtocols('[%s]')", self._log_prefix, ",".join(protocols)) self.parent.accessCheck(sender) settings = list(self.getSettings()) settings[13] = protocols self.update(settings) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE, in_signature='s') @dbus_handle_exceptions def addProtocol(self, protocol, sender=None): protocol = dbus_to_python(protocol, str) log.debug1("%s.addProtocol('%s')", self._log_prefix, protocol) self.parent.accessCheck(sender) settings = list(self.getSettings()) if protocol in settings[13]: raise FirewallError(errors.ALREADY_ENABLED, protocol) settings[13].append(protocol) self.update(settings) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE, in_signature='s') @dbus_handle_exceptions def removeProtocol(self, protocol, sender=None): protocol = dbus_to_python(protocol, str) log.debug1("%s.removeProtocol('%s')", self._log_prefix, protocol) self.parent.accessCheck(sender) settings = list(self.getSettings()) if protocol not in settings[13]: raise FirewallError(errors.NOT_ENABLED, protocol) settings[13].remove(protocol) self.update(settings) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE, in_signature='s', out_signature='b') @dbus_handle_exceptions def queryProtocol(self, protocol, sender=None): # pylint: disable=W0613 protocol = dbus_to_python(protocol, str) log.debug1("%s.queryProtocol('%s')", self._log_prefix, protocol) return protocol in self.getSettings()[13] # source port @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE, out_signature='a(ss)') @dbus_handle_exceptions def getSourcePorts(self, sender=None): # pylint: disable=W0613 log.debug1("%s.getSourcePorts()", self._log_prefix) return self.getSettings()[14] @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE, in_signature='a(ss)') @dbus_handle_exceptions def setSourcePorts(self, ports, sender=None): _ports = [ ] # convert embedded lists to tuples for port in dbus_to_python(ports, list): if isinstance(port, list): _ports.append(tuple(port)) else: _ports.append(port) ports = _ports log.debug1("%s.setSourcePorts('[%s]')", self._log_prefix, ",".join("('%s, '%s')" % (port[0], port[1]) for port in ports)) self.parent.accessCheck(sender) settings = list(self.getSettings()) settings[14] = ports self.update(settings) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE, in_signature='ss') @dbus_handle_exceptions def addSourcePort(self, port, protocol, sender=None): port = dbus_to_python(port, str) protocol = dbus_to_python(protocol, str) log.debug1("%s.addSourcePort('%s', '%s')", self._log_prefix, port, protocol) self.parent.accessCheck(sender) settings = list(self.getSettings()) existing_port_ids = list(filter(lambda x: x[1] == protocol, settings[14])) for port_id in existing_port_ids: if portInPortRange(port, port_id[0]): raise FirewallError(errors.ALREADY_ENABLED, "%s:%s" % (port, protocol)) added_ranges, removed_ranges = coalescePortRange(port, [_port for (_port, _protocol) in existing_port_ids]) for range in removed_ranges: settings[14].remove((portStr(range, "-"), protocol)) for range in added_ranges: settings[14].append((portStr(range, "-"), protocol)) self.update(settings) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE, in_signature='ss') @dbus_handle_exceptions def removeSourcePort(self, port, protocol, sender=None): port = dbus_to_python(port, str) protocol = dbus_to_python(protocol, str) log.debug1("%s.removeSourcePort('%s', '%s')", self._log_prefix, port, protocol) self.parent.accessCheck(sender) settings = list(self.getSettings()) existing_port_ids = list(filter(lambda x: x[1] == protocol, settings[14])) for port_id in existing_port_ids: if portInPortRange(port, port_id[0]): break else: raise FirewallError(errors.NOT_ENABLED, "%s:%s" % (port, protocol)) added_ranges, removed_ranges = breakPortRange(port, [_port for (_port, _protocol) in existing_port_ids]) for range in removed_ranges: settings[14].remove((portStr(range, "-"), protocol)) for range in added_ranges: settings[14].append((portStr(range, "-"), protocol)) self.update(settings) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE, in_signature='ss', out_signature='b') @dbus_handle_exceptions def querySourcePort(self, port, protocol, sender=None): # pylint: disable=W0613 port = dbus_to_python(port, str) protocol = dbus_to_python(protocol, str) log.debug1("%s.querySourcePort('%s', '%s')", self._log_prefix, port, protocol) for (_port, _protocol) in self.getSettings()[14]: if portInPortRange(port, _port) and protocol == _protocol: return True return False # icmp block @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE, out_signature='as') @dbus_handle_exceptions def getIcmpBlocks(self, sender=None): # pylint: disable=W0613 log.debug1("%s.getIcmpBlocks()", self._log_prefix) return self.getSettings()[7] @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE, in_signature='as') @dbus_handle_exceptions def setIcmpBlocks(self, icmptypes, sender=None): icmptypes = dbus_to_python(icmptypes, list) log.debug1("%s.setIcmpBlocks('[%s]')", self._log_prefix, ",".join(icmptypes)) self.parent.accessCheck(sender) settings = list(self.getSettings()) settings[7] = icmptypes self.update(settings) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE, in_signature='s') @dbus_handle_exceptions def addIcmpBlock(self, icmptype, sender=None): icmptype = dbus_to_python(icmptype, str) log.debug1("%s.addIcmpBlock('%s')", self._log_prefix, icmptype) self.parent.accessCheck(sender) settings = list(self.getSettings()) if icmptype in settings[7]: raise FirewallError(errors.ALREADY_ENABLED, icmptype) settings[7].append(icmptype) self.update(settings) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE, in_signature='s') @dbus_handle_exceptions def removeIcmpBlock(self, icmptype, sender=None): icmptype = dbus_to_python(icmptype, str) log.debug1("%s.removeIcmpBlock('%s')", self._log_prefix, icmptype) self.parent.accessCheck(sender) settings = list(self.getSettings()) if icmptype not in settings[7]: raise FirewallError(errors.NOT_ENABLED, icmptype) settings[7].remove(icmptype) self.update(settings) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE, in_signature='s', out_signature='b') @dbus_handle_exceptions def queryIcmpBlock(self, icmptype, sender=None): # pylint: disable=W0613 icmptype = dbus_to_python(icmptype, str) log.debug1("%s.queryIcmpBlock('%s')", self._log_prefix, icmptype) return icmptype in self.getSettings()[7] # icmp block inversion @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE, out_signature='b') @dbus_handle_exceptions def getIcmpBlockInversion(self, sender=None): # pylint: disable=W0613 log.debug1("%s.getIcmpBlockInversion()", self._log_prefix) return self.getSettings()[15] @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE, in_signature='b') @dbus_handle_exceptions def setIcmpBlockInversion(self, flag, sender=None): flag = dbus_to_python(flag, bool) log.debug1("%s.setIcmpBlockInversion('%s')", self._log_prefix, flag) self.parent.accessCheck(sender) settings = list(self.getSettings()) settings[15] = flag self.update(settings) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE) @dbus_handle_exceptions def addIcmpBlockInversion(self, sender=None): log.debug1("%s.addIcmpBlockInversion()", self._log_prefix) self.parent.accessCheck(sender) settings = list(self.getSettings()) if settings[15]: raise FirewallError(errors.ALREADY_ENABLED, "icmp-block-inversion") settings[15] = True self.update(settings) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE) @dbus_handle_exceptions def removeIcmpBlockInversion(self, sender=None): log.debug1("%s.removeIcmpBlockInversion()", self._log_prefix) self.parent.accessCheck(sender) settings = list(self.getSettings()) if not settings[15]: raise FirewallError(errors.NOT_ENABLED, "icmp-block-inversion") settings[15] = False self.update(settings) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE, out_signature='b') @dbus_handle_exceptions def queryIcmpBlockInversion(self, sender=None): # pylint: disable=W0613 log.debug1("%s.queryIcmpBlockInversion()", self._log_prefix) return self.getSettings()[15] # masquerade @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE, out_signature='b') @dbus_handle_exceptions def getMasquerade(self, sender=None): # pylint: disable=W0613 log.debug1("%s.getMasquerade()", self._log_prefix) return self.getSettings()[8] @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE, in_signature='b') @dbus_handle_exceptions def setMasquerade(self, masquerade, sender=None): masquerade = dbus_to_python(masquerade, bool) log.debug1("%s.setMasquerade('%s')", self._log_prefix, masquerade) self.parent.accessCheck(sender) settings = list(self.getSettings()) settings[8] = masquerade self.update(settings) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE) @dbus_handle_exceptions def addMasquerade(self, sender=None): log.debug1("%s.addMasquerade()", self._log_prefix) self.parent.accessCheck(sender) settings = list(self.getSettings()) if settings[8]: raise FirewallError(errors.ALREADY_ENABLED, "masquerade") settings[8] = True self.update(settings) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE) @dbus_handle_exceptions def removeMasquerade(self, sender=None): log.debug1("%s.removeMasquerade()", self._log_prefix) self.parent.accessCheck(sender) settings = list(self.getSettings()) if not settings[8]: raise FirewallError(errors.NOT_ENABLED, "masquerade") settings[8] = False self.update(settings) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE, out_signature='b') @dbus_handle_exceptions def queryMasquerade(self, sender=None): # pylint: disable=W0613 log.debug1("%s.queryMasquerade()", self._log_prefix) return self.getSettings()[8] # forward port @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE, out_signature='a(ssss)') @dbus_handle_exceptions def getForwardPorts(self, sender=None): # pylint: disable=W0613 log.debug1("%s.getForwardPorts()", self._log_prefix) return self.getSettings()[9] @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE, in_signature='a(ssss)') @dbus_handle_exceptions def setForwardPorts(self, ports, sender=None): _ports = [ ] # convert embedded lists to tuples for port in dbus_to_python(ports, list): if isinstance(port, list): _ports.append(tuple(port)) else: _ports.append(port) ports = _ports log.debug1("%s.setForwardPorts('[%s]')", self._log_prefix, ",".join("('%s, '%s', '%s', '%s')" % (port[0], port[1], \ port[2], port[3]) for port in ports)) self.parent.accessCheck(sender) settings = list(self.getSettings()) settings[9] = ports self.update(settings) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE, in_signature='ssss') @dbus_handle_exceptions def addForwardPort(self, port, protocol, toport, toaddr, sender=None): # pylint: disable=R0913 port = dbus_to_python(port, str) protocol = dbus_to_python(protocol, str) toport = dbus_to_python(toport, str) toaddr = dbus_to_python(toaddr, str) log.debug1("%s.addForwardPort('%s', '%s', '%s', '%s')", self._log_prefix, port, protocol, toport, toaddr) self.parent.accessCheck(sender) fwp_id = (port, protocol, str(toport), str(toaddr)) settings = list(self.getSettings()) if fwp_id in settings[9]: raise FirewallError(errors.ALREADY_ENABLED, "%s:%s:%s:%s" % (port, protocol, toport, toaddr)) settings[9].append(fwp_id) self.update(settings) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE, in_signature='ssss') @dbus_handle_exceptions def removeForwardPort(self, port, protocol, toport, toaddr, sender=None): # pylint: disable=R0913 port = dbus_to_python(port, str) protocol = dbus_to_python(protocol, str) toport = dbus_to_python(toport, str) toaddr = dbus_to_python(toaddr, str) log.debug1("%s.removeForwardPort('%s', '%s', '%s', '%s')", self._log_prefix, port, protocol, toport, toaddr) self.parent.accessCheck(sender) fwp_id = (port, protocol, str(toport), str(toaddr)) settings = list(self.getSettings()) if fwp_id not in settings[9]: raise FirewallError(errors.NOT_ENABLED, "%s:%s:%s:%s" % (port, protocol, toport, toaddr)) settings[9].remove(fwp_id) self.update(settings) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE, in_signature='ssss', out_signature='b') @dbus_handle_exceptions def queryForwardPort(self, port, protocol, toport, toaddr, sender=None): # pylint: disable=W0613, R0913 port = dbus_to_python(port, str) protocol = dbus_to_python(protocol, str) toport = dbus_to_python(toport, str) toaddr = dbus_to_python(toaddr, str) log.debug1("%s.queryForwardPort('%s', '%s', '%s', '%s')", self._log_prefix, port, protocol, toport, toaddr) fwp_id = (port, protocol, str(toport), str(toaddr)) return fwp_id in self.getSettings()[9] # interface @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE, out_signature='as') @dbus_handle_exceptions def getInterfaces(self, sender=None): # pylint: disable=W0613 log.debug1("%s.getInterfaces()", self._log_prefix) return self.getSettings()[10] @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE, in_signature='as') @dbus_handle_exceptions def setInterfaces(self, interfaces, sender=None): interfaces = dbus_to_python(interfaces, list) log.debug1("%s.setInterfaces('[%s]')", self._log_prefix, ",".join(interfaces)) self.parent.accessCheck(sender) settings = list(self.getSettings()) settings[10] = interfaces self.update(settings) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE, in_signature='s') @dbus_handle_exceptions def addInterface(self, interface, sender=None): interface = dbus_to_python(interface, str) log.debug1("%s.addInterface('%s')", self._log_prefix, interface) self.parent.accessCheck(sender) settings = list(self.getSettings()) if interface in settings[10]: raise FirewallError(errors.ALREADY_ENABLED, interface) settings[10].append(interface) self.update(settings) ifcfg_set_zone_of_interface(self.obj.name, interface) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE, in_signature='s') @dbus_handle_exceptions def removeInterface(self, interface, sender=None): interface = dbus_to_python(interface, str) log.debug1("%s.removeInterface('%s')", self._log_prefix, interface) self.parent.accessCheck(sender) settings = list(self.getSettings()) if interface not in settings[10]: raise FirewallError(errors.NOT_ENABLED, interface) settings[10].remove(interface) self.update(settings) ifcfg_set_zone_of_interface("", interface) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE, in_signature='s', out_signature='b') @dbus_handle_exceptions def queryInterface(self, interface, sender=None): # pylint: disable=W0613 interface = dbus_to_python(interface, str) log.debug1("%s.queryInterface('%s')", self._log_prefix, interface) return interface in self.getSettings()[10] # source @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE, out_signature='as') @dbus_handle_exceptions def getSources(self, sender=None): # pylint: disable=W0613 log.debug1("%s.getSources()", self._log_prefix) return self.getSettings()[11] @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE, in_signature='as') @dbus_handle_exceptions def setSources(self, sources, sender=None): sources = dbus_to_python(sources, list) log.debug1("%s.setSources('[%s]')", self._log_prefix, ",".join(sources)) self.parent.accessCheck(sender) settings = list(self.getSettings()) settings[11] = sources self.update(settings) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE, in_signature='s') @dbus_handle_exceptions def addSource(self, source, sender=None): source = dbus_to_python(source, str) log.debug1("%s.addSource('%s')", self._log_prefix, source) self.parent.accessCheck(sender) settings = list(self.getSettings()) if source in settings[11]: raise FirewallError(errors.ALREADY_ENABLED, source) settings[11].append(source) self.update(settings) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE, in_signature='s') @dbus_handle_exceptions def removeSource(self, source, sender=None): source = dbus_to_python(source, str) log.debug1("%s.removeSource('%s')", self._log_prefix, source) self.parent.accessCheck(sender) settings = list(self.getSettings()) if source not in settings[11]: raise FirewallError(errors.NOT_ENABLED, source) settings[11].remove(source) self.update(settings) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE, in_signature='s', out_signature='b') @dbus_handle_exceptions def querySource(self, source, sender=None): # pylint: disable=W0613 source = dbus_to_python(source, str) log.debug1("%s.querySource('%s')", self._log_prefix, source) return source in self.getSettings()[11] # rich rule @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE, out_signature='as') @dbus_handle_exceptions def getRichRules(self, sender=None): # pylint: disable=W0613 log.debug1("%s.getRichRules()", self._log_prefix) return self.getSettings()[12] @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE, in_signature='as') @dbus_handle_exceptions def setRichRules(self, rules, sender=None): rules = dbus_to_python(rules, list) log.debug1("%s.setRichRules('[%s]')", self._log_prefix, ",".join(rules)) self.parent.accessCheck(sender) settings = list(self.getSettings()) rules = [ str(Rich_Rule(rule_str=r)) for r in rules ] settings[12] = rules self.update(settings) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE, in_signature='s') @dbus_handle_exceptions def addRichRule(self, rule, sender=None): rule = dbus_to_python(rule, str) log.debug1("%s.addRichRule('%s')", self._log_prefix, rule) self.parent.accessCheck(sender) settings = list(self.getSettings()) rule_str = str(Rich_Rule(rule_str=rule)) if rule_str in settings[12]: raise FirewallError(errors.ALREADY_ENABLED, rule) settings[12].append(rule_str) self.update(settings) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE, in_signature='s') @dbus_handle_exceptions def removeRichRule(self, rule, sender=None): rule = dbus_to_python(rule, str) log.debug1("%s.removeRichRule('%s')", self._log_prefix, rule) self.parent.accessCheck(sender) settings = list(self.getSettings()) rule_str = str(Rich_Rule(rule_str=rule)) if rule_str not in settings[12]: raise FirewallError(errors.NOT_ENABLED, rule) settings[12].remove(rule_str) self.update(settings) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE, in_signature='s', out_signature='b') @dbus_handle_exceptions def queryRichRule(self, rule, sender=None): # pylint: disable=W0613 rule = dbus_to_python(rule, str) log.debug1("%s.queryRichRule('%s')", self._log_prefix, rule) rule_str = str(Rich_Rule(rule_str=rule)) return rule_str in self.getSettings()[12] server/config_helper.py 0000644 00000042052 15025011705 0011227 0 ustar 00 # -*- coding: utf-8 -*- # # Copyright (C) 2010-2016 Red Hat, Inc. # # Authors: # Thomas Woerner <twoerner@redhat.com> # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see <http://www.gnu.org/licenses/>. import dbus import dbus.service from firewall import config from firewall.dbus_utils import dbus_to_python, \ dbus_introspection_prepare_properties, \ dbus_introspection_add_properties from firewall.core.io.helper import Helper from firewall.core.logger import log from firewall.server.dbus import DbusServiceObject from firewall.server.decorators import handle_exceptions, \ dbus_handle_exceptions, dbus_service_method, \ dbus_polkit_require_auth from firewall import errors from firewall.errors import FirewallError ############################################################################ # # class FirewallDConfig # ############################################################################ class FirewallDConfigHelper(DbusServiceObject): """FirewallD main class""" persistent = True """ Make FirewallD persistent. """ default_polkit_auth_required = config.dbus.PK_ACTION_CONFIG """ Use PK_ACTION_INFO as a default """ @handle_exceptions def __init__(self, parent, conf, helper, item_id, *args, **kwargs): super(FirewallDConfigHelper, self).__init__(*args, **kwargs) self.parent = parent self.config = conf self.obj = helper self.item_id = item_id self.busname = args[0] self.path = args[1] self._log_prefix = "config.helper.%d" % self.item_id dbus_introspection_prepare_properties( self, config.dbus.DBUS_INTERFACE_CONFIG_HELPER) @dbus_handle_exceptions def __del__(self): pass @dbus_handle_exceptions def unregister(self): self.remove_from_connection() # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # P R O P E R T I E S @dbus_handle_exceptions def _get_property(self, property_name): if property_name == "name": return dbus.String(self.obj.name) elif property_name == "filename": return dbus.String(self.obj.filename) elif property_name == "path": return dbus.String(self.obj.path) elif property_name == "default": return dbus.Boolean(self.obj.default) elif property_name == "builtin": return dbus.Boolean(self.obj.builtin) else: raise dbus.exceptions.DBusException( "org.freedesktop.DBus.Error.InvalidArgs: " "Property '%s' does not exist" % property_name) @dbus_service_method(dbus.PROPERTIES_IFACE, in_signature='ss', out_signature='v') @dbus_handle_exceptions def Get(self, interface_name, property_name, sender=None): # pylint: disable=W0613 # get a property interface_name = dbus_to_python(interface_name, str) property_name = dbus_to_python(property_name, str) log.debug1("%s.Get('%s', '%s')", self._log_prefix, interface_name, property_name) if interface_name != config.dbus.DBUS_INTERFACE_CONFIG_HELPER: raise dbus.exceptions.DBusException( "org.freedesktop.DBus.Error.UnknownInterface: " "Interface '%s' does not exist" % interface_name) return self._get_property(property_name) @dbus_service_method(dbus.PROPERTIES_IFACE, in_signature='s', out_signature='a{sv}') @dbus_handle_exceptions def GetAll(self, interface_name, sender=None): # pylint: disable=W0613 interface_name = dbus_to_python(interface_name, str) log.debug1("%s.GetAll('%s')", self._log_prefix, interface_name) if interface_name != config.dbus.DBUS_INTERFACE_CONFIG_HELPER: raise dbus.exceptions.DBusException( "org.freedesktop.DBus.Error.UnknownInterface: " "Interface '%s' does not exist" % interface_name) ret = { } for x in [ "name", "filename", "path", "default", "builtin" ]: ret[x] = self._get_property(x) return dbus.Dictionary(ret, signature="sv") @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG) @dbus_service_method(dbus.PROPERTIES_IFACE, in_signature='ssv') @dbus_handle_exceptions def Set(self, interface_name, property_name, new_value, sender=None): interface_name = dbus_to_python(interface_name, str) property_name = dbus_to_python(property_name, str) new_value = dbus_to_python(new_value) log.debug1("%s.Set('%s', '%s', '%s')", self._log_prefix, interface_name, property_name, new_value) self.parent.accessCheck(sender) if interface_name != config.dbus.DBUS_INTERFACE_CONFIG_HELPER: raise dbus.exceptions.DBusException( "org.freedesktop.DBus.Error.UnknownInterface: " "Interface '%s' does not exist" % interface_name) raise dbus.exceptions.DBusException( "org.freedesktop.DBus.Error.PropertyReadOnly: " "Property '%s' is read-only" % property_name) @dbus.service.signal(dbus.PROPERTIES_IFACE, signature='sa{sv}as') def PropertiesChanged(self, interface_name, changed_properties, invalidated_properties): interface_name = dbus_to_python(interface_name, str) changed_properties = dbus_to_python(changed_properties) invalidated_properties = dbus_to_python(invalidated_properties) log.debug1("%s.PropertiesChanged('%s', '%s', '%s')", self._log_prefix, interface_name, changed_properties, invalidated_properties) @dbus_polkit_require_auth(config.dbus.PK_ACTION_INFO) @dbus_service_method(dbus.INTROSPECTABLE_IFACE, out_signature='s') @dbus_handle_exceptions def Introspect(self, sender=None): # pylint: disable=W0613 log.debug2("%s.Introspect()", self._log_prefix) data = super(FirewallDConfigHelper, self).Introspect( self.path, self.busname.get_bus()) return dbus_introspection_add_properties( self, data, config.dbus.DBUS_INTERFACE_CONFIG_HELPER) # S E T T I N G S @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_HELPER, out_signature=Helper.DBUS_SIGNATURE) @dbus_handle_exceptions def getSettings(self, sender=None): # pylint: disable=W0613 """get settings for helper """ log.debug1("%s.getSettings()", self._log_prefix) return self.config.get_helper_config(self.obj) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_HELPER, in_signature=Helper.DBUS_SIGNATURE) @dbus_handle_exceptions def update(self, settings, sender=None): """update settings for helper """ settings = dbus_to_python(settings) log.debug1("%s.update('...')", self._log_prefix) self.parent.accessCheck(sender) self.obj = self.config.set_helper_config(self.obj, settings) self.Updated(self.obj.name) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_HELPER) @dbus_handle_exceptions def loadDefaults(self, sender=None): """load default settings for builtin helper """ log.debug1("%s.loadDefaults()", self._log_prefix) self.parent.accessCheck(sender) self.obj = self.config.load_helper_defaults(self.obj) self.Updated(self.obj.name) @dbus.service.signal(config.dbus.DBUS_INTERFACE_CONFIG_HELPER, signature='s') @dbus_handle_exceptions def Updated(self, name): log.debug1("%s.Updated('%s')" % (self._log_prefix, name)) # R E M O V E @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_HELPER) @dbus_handle_exceptions def remove(self, sender=None): """remove helper """ log.debug1("%s.removeHelper()", self._log_prefix) self.parent.accessCheck(sender) self.config.remove_helper(self.obj) self.parent.removeHelper(self.obj) @dbus.service.signal(config.dbus.DBUS_INTERFACE_CONFIG_HELPER, signature='s') @dbus_handle_exceptions def Removed(self, name): log.debug1("%s.Removed('%s')" % (self._log_prefix, name)) # R E N A M E @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_HELPER, in_signature='s') @dbus_handle_exceptions def rename(self, name, sender=None): """rename helper """ name = dbus_to_python(name, str) log.debug1("%s.rename('%s')", self._log_prefix, name) self.parent.accessCheck(sender) self.obj = self.config.rename_helper(self.obj, name) self.Renamed(name) @dbus.service.signal(config.dbus.DBUS_INTERFACE_CONFIG_HELPER, signature='s') @dbus_handle_exceptions def Renamed(self, name): log.debug1("%s.Renamed('%s')" % (self._log_prefix, name)) # version @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_HELPER, out_signature='s') @dbus_handle_exceptions def getVersion(self, sender=None): # pylint: disable=W0613 log.debug1("%s.getVersion()", self._log_prefix) return self.getSettings()[0] @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_HELPER, in_signature='s') @dbus_handle_exceptions def setVersion(self, version, sender=None): version = dbus_to_python(version, str) log.debug1("%s.setVersion('%s')", self._log_prefix, version) self.parent.accessCheck(sender) settings = list(self.getSettings()) settings[0] = version self.update(settings) # short @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_HELPER, out_signature='s') @dbus_handle_exceptions def getShort(self, sender=None): # pylint: disable=W0613 log.debug1("%s.getShort()", self._log_prefix) return self.getSettings()[1] @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_HELPER, in_signature='s') @dbus_handle_exceptions def setShort(self, short, sender=None): short = dbus_to_python(short, str) log.debug1("%s.setShort('%s')", self._log_prefix, short) self.parent.accessCheck(sender) settings = list(self.getSettings()) settings[1] = short self.update(settings) # description @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_HELPER, out_signature='s') @dbus_handle_exceptions def getDescription(self, sender=None): # pylint: disable=W0613 log.debug1("%s.getDescription()", self._log_prefix) return self.getSettings()[2] @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_HELPER, in_signature='s') @dbus_handle_exceptions def setDescription(self, description, sender=None): description = dbus_to_python(description, str) log.debug1("%s.setDescription('%s')", self._log_prefix, description) self.parent.accessCheck(sender) settings = list(self.getSettings()) settings[2] = description self.update(settings) # family @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_HELPER, out_signature='s') @dbus_handle_exceptions def getFamily(self, sender=None): log.debug1("%s.getFamily()", self._log_prefix) self.parent.accessCheck(sender) settings = list(self.getSettings()) return settings[3] @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_HELPER, in_signature='s') @dbus_handle_exceptions def setFamily(self, ipv, sender=None): ipv = dbus_to_python(ipv, str) log.debug1("%s.setFamily('%s')", self._log_prefix, ipv) self.parent.accessCheck(sender) settings = list(self.getSettings()) if settings[3] == ipv: raise FirewallError(errors.ALREADY_ENABLED, "'%s'" % ipv) settings[3] = ipv self.update(settings) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_HELPER, in_signature='s', out_signature='b') @dbus_handle_exceptions def queryFamily(self, ipv, sender=None): # pylint: disable=W0613 ipv = dbus_to_python(ipv, str) log.debug1("%s.queryFamily('%s')", self._log_prefix, ipv) settings = self.getSettings() return (settings[3] == ipv) # module @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_HELPER, out_signature='s') @dbus_handle_exceptions def getModule(self, sender=None): log.debug1("%s.getModule()", self._log_prefix) self.parent.accessCheck(sender) settings = list(self.getSettings()) return settings[4] @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_HELPER, in_signature='s') @dbus_handle_exceptions def setModule(self, module, sender=None): module = dbus_to_python(module, str) log.debug1("%s.setModule('%s')", self._log_prefix, module) self.parent.accessCheck(sender) settings = list(self.getSettings()) if settings[4] == module: raise FirewallError(errors.ALREADY_ENABLED, "'%s'" % module) settings[4] = module self.update(settings) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_HELPER, in_signature='s', out_signature='b') @dbus_handle_exceptions def queryModule(self, module, sender=None): # pylint: disable=W0613 module = dbus_to_python(module, str) log.debug1("%s.queryModule('%s')", self._log_prefix, module) settings = self.getSettings() return (settings[4] == module) # port @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_HELPER, out_signature='a(ss)') @dbus_handle_exceptions def getPorts(self, sender=None): # pylint: disable=W0613 log.debug1("%s.getPorts()", self._log_prefix) return self.getSettings()[5] @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_HELPER, in_signature='a(ss)') @dbus_handle_exceptions def setPorts(self, ports, sender=None): _ports = [ ] # convert embedded lists to tuples for port in dbus_to_python(ports, list): if isinstance(port, list): _ports.append(tuple(port)) else: _ports.append(port) ports = _ports log.debug1("%s.setPorts('[%s]')", self._log_prefix, ",".join("('%s, '%s')" % (port[0], port[1]) for port in ports)) self.parent.accessCheck(sender) settings = list(self.getSettings()) settings[5] = ports self.update(settings) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_HELPER, in_signature='ss') @dbus_handle_exceptions def addPort(self, port, protocol, sender=None): port = dbus_to_python(port, str) protocol = dbus_to_python(protocol, str) log.debug1("%s.addPort('%s', '%s')", self._log_prefix, port, protocol) self.parent.accessCheck(sender) settings = list(self.getSettings()) if (port,protocol) in settings[5]: raise FirewallError(errors.ALREADY_ENABLED, "%s:%s" % (port, protocol)) settings[5].append((port,protocol)) self.update(settings) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_HELPER, in_signature='ss') @dbus_handle_exceptions def removePort(self, port, protocol, sender=None): port = dbus_to_python(port, str) protocol = dbus_to_python(protocol, str) log.debug1("%s.removePort('%s', '%s')", self._log_prefix, port, protocol) self.parent.accessCheck(sender) settings = list(self.getSettings()) if (port,protocol) not in settings[5]: raise FirewallError(errors.NOT_ENABLED, "%s:%s" % (port, protocol)) settings[5].remove((port,protocol)) self.update(settings) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_HELPER, in_signature='ss', out_signature='b') @dbus_handle_exceptions def queryPort(self, port, protocol, sender=None): # pylint: disable=W0613 port = dbus_to_python(port, str) protocol = dbus_to_python(protocol, str) log.debug1("%s.queryPort('%s', '%s')", self._log_prefix, port, protocol) return (port,protocol) in self.getSettings()[5] server/config_policy.py 0000644 00000020315 15025011705 0011245 0 ustar 00 # -*- coding: utf-8 -*- # # SPDX-License-Identifier: GPL-2.0-or-later import dbus import dbus.service from firewall import config from firewall.dbus_utils import dbus_to_python, \ dbus_introspection_prepare_properties, \ dbus_introspection_add_properties from firewall.core.logger import log from firewall.server.dbus import DbusServiceObject from firewall.server.decorators import handle_exceptions, \ dbus_handle_exceptions, dbus_service_method, \ dbus_polkit_require_auth class FirewallDConfigPolicy(DbusServiceObject): persistent = True default_polkit_auth_required = config.dbus.PK_ACTION_CONFIG @handle_exceptions def __init__(self, parent, conf, policy, item_id, *args, **kwargs): super(FirewallDConfigPolicy, self).__init__(*args, **kwargs) self.parent = parent self.config = conf self.obj = policy self.item_id = item_id self.busname = args[0] self.path = args[1] self._log_prefix = "config.policy.%d" % self.item_id dbus_introspection_prepare_properties( self, config.dbus.DBUS_INTERFACE_CONFIG_POLICY) @dbus_handle_exceptions def __del__(self): pass @dbus_handle_exceptions def unregister(self): self.remove_from_connection() # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # P R O P E R T I E S @dbus_handle_exceptions def _get_property(self, property_name): if property_name == "name": return dbus.String(self.obj.name) elif property_name == "filename": return dbus.String(self.obj.filename) elif property_name == "path": return dbus.String(self.obj.path) elif property_name == "default": return dbus.Boolean(self.obj.default) elif property_name == "builtin": return dbus.Boolean(self.obj.builtin) else: raise dbus.exceptions.DBusException( "org.freedesktop.DBus.Error.InvalidArgs: " "Property '%s' does not exist" % property_name) @dbus_service_method(dbus.PROPERTIES_IFACE, in_signature='ss', out_signature='v') @dbus_handle_exceptions def Get(self, interface_name, property_name, sender=None): # get a property interface_name = dbus_to_python(interface_name, str) property_name = dbus_to_python(property_name, str) log.debug1("%s.Get('%s', '%s')", self._log_prefix, interface_name, property_name) if interface_name != config.dbus.DBUS_INTERFACE_CONFIG_POLICY: raise dbus.exceptions.DBusException( "org.freedesktop.DBus.Error.UnknownInterface: " "Interface '%s' does not exist" % interface_name) return self._get_property(property_name) @dbus_service_method(dbus.PROPERTIES_IFACE, in_signature='s', out_signature='a{sv}') @dbus_handle_exceptions def GetAll(self, interface_name, sender=None): interface_name = dbus_to_python(interface_name, str) log.debug1("%s.GetAll('%s')", self._log_prefix, interface_name) if interface_name != config.dbus.DBUS_INTERFACE_CONFIG_POLICY: raise dbus.exceptions.DBusException( "org.freedesktop.DBus.Error.UnknownInterface: " "Interface '%s' does not exist" % interface_name) ret = { } for x in [ "name", "filename", "path", "default", "builtin" ]: ret[x] = self._get_property(x) return dbus.Dictionary(ret, signature="sv") @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG) @dbus_service_method(dbus.PROPERTIES_IFACE, in_signature='ssv') @dbus_handle_exceptions def Set(self, interface_name, property_name, new_value, sender=None): interface_name = dbus_to_python(interface_name, str) property_name = dbus_to_python(property_name, str) new_value = dbus_to_python(new_value) log.debug1("%s.Set('%s', '%s', '%s')", self._log_prefix, interface_name, property_name, new_value) self.parent.accessCheck(sender) if interface_name != config.dbus.DBUS_INTERFACE_CONFIG_POLICY: raise dbus.exceptions.DBusException( "org.freedesktop.DBus.Error.UnknownInterface: " "Interface '%s' does not exist" % interface_name) raise dbus.exceptions.DBusException( "org.freedesktop.DBus.Error.PropertyReadOnly: " "Property '%s' is read-only" % property_name) @dbus.service.signal(dbus.PROPERTIES_IFACE, signature='sa{sv}as') def PropertiesChanged(self, interface_name, changed_properties, invalidated_properties): interface_name = dbus_to_python(interface_name, str) changed_properties = dbus_to_python(changed_properties) invalidated_properties = dbus_to_python(invalidated_properties) log.debug1("%s.PropertiesChanged('%s', '%s', '%s')", self._log_prefix, interface_name, changed_properties, invalidated_properties) @dbus_polkit_require_auth(config.dbus.PK_ACTION_INFO) @dbus_service_method(dbus.INTROSPECTABLE_IFACE, out_signature='s') @dbus_handle_exceptions def Introspect(self, sender=None): log.debug2("%s.Introspect()", self._log_prefix) data = super(FirewallDConfigPolicy, self).Introspect( self.path, self.busname.get_bus()) return dbus_introspection_add_properties( self, data, config.dbus.DBUS_INTERFACE_CONFIG_POLICY) # S E T T I N G S @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_POLICY, out_signature="a{sv}") @dbus_handle_exceptions def getSettings(self, sender=None): """get settings for policy """ log.debug1("%s.getSettings()", self._log_prefix) settings = self.config.get_policy_object_config_dict(self.obj) return settings @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_POLICY, in_signature="a{sv}") @dbus_handle_exceptions def update(self, settings, sender=None): """update settings for policy """ settings = dbus_to_python(settings) log.debug1("%s.update('...')", self._log_prefix) self.parent.accessCheck(sender) self.obj = self.config.set_policy_object_config_dict(self.obj, settings) self.Updated(self.obj.name) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_POLICY) @dbus_handle_exceptions def loadDefaults(self, sender=None): """load default settings for builtin policy """ log.debug1("%s.loadDefaults()", self._log_prefix) self.parent.accessCheck(sender) self.obj = self.config.load_policy_object_defaults(self.obj) self.Updated(self.obj.name) @dbus.service.signal(config.dbus.DBUS_INTERFACE_CONFIG_POLICY, signature='s') @dbus_handle_exceptions def Updated(self, name): log.debug1("%s.Updated('%s')" % (self._log_prefix, name)) # R E M O V E @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_POLICY) @dbus_handle_exceptions def remove(self, sender=None): """remove policy """ log.debug1("%s.removePolicy()", self._log_prefix) self.parent.accessCheck(sender) self.config.remove_policy_object(self.obj) self.parent.removePolicy(self.obj) @dbus.service.signal(config.dbus.DBUS_INTERFACE_CONFIG_POLICY, signature='s') @dbus_handle_exceptions def Removed(self, name): log.debug1("%s.Removed('%s')" % (self._log_prefix, name)) # R E N A M E @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_POLICY, in_signature='s') @dbus_handle_exceptions def rename(self, name, sender=None): """rename policy """ name = dbus_to_python(name, str) log.debug1("%s.rename('%s')", self._log_prefix, name) self.parent.accessCheck(sender) self.obj = self.config.rename_policy_object(self.obj, name) self.Renamed(name) @dbus.service.signal(config.dbus.DBUS_INTERFACE_CONFIG_POLICY, signature='s') @dbus_handle_exceptions def Renamed(self, name): log.debug1("%s.Renamed('%s')" % (self._log_prefix, name)) server/config.py 0000644 00000216164 15025011705 0007677 0 ustar 00 # -*- coding: utf-8 -*- # # Copyright (C) 2010-2016 Red Hat, Inc. # # Authors: # Thomas Woerner <twoerner@redhat.com> # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see <http://www.gnu.org/licenses/>. import os import dbus import dbus.service from firewall import config from firewall.core.base import DEFAULT_ZONE_TARGET from firewall.core.watcher import Watcher from firewall.core.logger import log from firewall.server.dbus import DbusServiceObject from firewall.server.decorators import handle_exceptions, \ dbus_handle_exceptions, dbus_service_method, \ dbus_service_method_deprecated, dbus_service_signal_deprecated, \ dbus_polkit_require_auth from firewall.server.config_icmptype import FirewallDConfigIcmpType from firewall.server.config_service import FirewallDConfigService from firewall.server.config_zone import FirewallDConfigZone from firewall.server.config_policy import FirewallDConfigPolicy from firewall.server.config_ipset import FirewallDConfigIPSet from firewall.server.config_helper import FirewallDConfigHelper from firewall.core.io.icmptype import IcmpType from firewall.core.io.ipset import IPSet from firewall.core.io.helper import Helper from firewall.core.io.lockdown_whitelist import LockdownWhitelist from firewall.core.io.direct import Direct from firewall.dbus_utils import dbus_to_python, \ command_of_sender, context_of_sender, uid_of_sender, user_of_uid, \ dbus_introspection_prepare_properties, \ dbus_introspection_add_properties, \ dbus_introspection_add_deprecated from firewall import errors from firewall.errors import FirewallError ############################################################################ # # class FirewallDConfig # ############################################################################ class FirewallDConfig(DbusServiceObject): """FirewallD main class""" persistent = True """ Make FirewallD persistent. """ default_polkit_auth_required = config.dbus.PK_ACTION_CONFIG """ Use config.dbus.PK_ACTION_INFO as a default """ @handle_exceptions def __init__(self, conf, *args, **kwargs): super(FirewallDConfig, self).__init__(*args, **kwargs) self.config = conf self.busname = args[0] self.path = args[1] self._init_vars() self.watcher = Watcher(self.watch_updater, 5) self.watcher.add_watch_dir(config.FIREWALLD_IPSETS) self.watcher.add_watch_dir(config.ETC_FIREWALLD_IPSETS) self.watcher.add_watch_dir(config.FIREWALLD_ICMPTYPES) self.watcher.add_watch_dir(config.ETC_FIREWALLD_ICMPTYPES) self.watcher.add_watch_dir(config.FIREWALLD_HELPERS) self.watcher.add_watch_dir(config.ETC_FIREWALLD_HELPERS) self.watcher.add_watch_dir(config.FIREWALLD_SERVICES) self.watcher.add_watch_dir(config.ETC_FIREWALLD_SERVICES) self.watcher.add_watch_dir(config.FIREWALLD_ZONES) self.watcher.add_watch_dir(config.ETC_FIREWALLD_ZONES) self.watcher.add_watch_dir(config.FIREWALLD_POLICIES) self.watcher.add_watch_dir(config.ETC_FIREWALLD_POLICIES) # Add watches for combined zone directories if os.path.exists(config.ETC_FIREWALLD_ZONES): for filename in sorted(os.listdir(config.ETC_FIREWALLD_ZONES)): path = "%s/%s" % (config.ETC_FIREWALLD_ZONES, filename) if os.path.isdir(path): self.watcher.add_watch_dir(path) self.watcher.add_watch_file(config.LOCKDOWN_WHITELIST) self.watcher.add_watch_file(config.FIREWALLD_DIRECT) self.watcher.add_watch_file(config.FIREWALLD_CONF) dbus_introspection_prepare_properties(self, config.dbus.DBUS_INTERFACE_CONFIG, { "CleanupOnExit": "readwrite", "CleanupModulesOnExit": "readwrite", "IPv6_rpfilter": "readwrite", "IPv6_rpfilter2": "readwrite", "Lockdown": "readwrite", "MinimalMark": "readwrite", "IndividualCalls": "readwrite", "LogDenied": "readwrite", "AutomaticHelpers": "readwrite", "FirewallBackend": "readwrite", "FlushAllOnReload": "readwrite", "RFC3964_IPv4": "readwrite", "AllowZoneDrifting": "readwrite", "NftablesTableOwner": "readwrite", } ) @handle_exceptions def _init_vars(self): self.ipsets = [ ] self.ipset_idx = 0 self.icmptypes = [ ] self.icmptype_idx = 0 self.services = [ ] self.service_idx = 0 self.zones = [ ] self.zone_idx = 0 self.helpers = [ ] self.helper_idx = 0 self.policy_objects = [ ] self.policy_object_idx = 0 for ipset in self.config.get_ipsets(): self._addIPSet(self.config.get_ipset(ipset)) for icmptype in self.config.get_icmptypes(): self._addIcmpType(self.config.get_icmptype(icmptype)) for service in self.config.get_services(): self._addService(self.config.get_service(service)) for zone in self.config.get_zones(): self._addZone(self.config.get_zone(zone)) for helper in self.config.get_helpers(): self._addHelper(self.config.get_helper(helper)) for policy in self.config.get_policy_objects(): self._addPolicy(self.config.get_policy_object(policy)) @handle_exceptions def __del__(self): pass @handle_exceptions def reload(self): while len(self.ipsets) > 0: item = self.ipsets.pop() item.unregister() del item while len(self.icmptypes) > 0: item = self.icmptypes.pop() item.unregister() del item while len(self.services) > 0: item = self.services.pop() item.unregister() del item while len(self.zones) > 0: item = self.zones.pop() item.unregister() del item while len(self.helpers) > 0: item = self.helpers.pop() item.unregister() del item while len(self.policy_objects) > 0: item = self.policy_objects.pop() item.unregister() del item self._init_vars() @handle_exceptions def watch_updater(self, name): if name == config.FIREWALLD_CONF: old_props = self.GetAll(config.dbus.DBUS_INTERFACE_CONFIG) log.debug1("config: Reloading firewalld config file '%s'", config.FIREWALLD_CONF) try: self.config.update_firewalld_conf() except Exception as msg: log.error("Failed to load firewalld.conf file '%s': %s" % \ (name, msg)) return props = self.GetAll(config.dbus.DBUS_INTERFACE_CONFIG).copy() for key in list(props.keys()): if key in old_props and old_props[key] == props[key]: del props[key] if len(props) > 0: self.PropertiesChanged(config.dbus.DBUS_INTERFACE_CONFIG, props, []) return if (name.startswith(config.FIREWALLD_ICMPTYPES) or \ name.startswith(config.ETC_FIREWALLD_ICMPTYPES)) and \ name.endswith(".xml"): try: (what, obj) = self.config.update_icmptype_from_path(name) except Exception as msg: log.error("Failed to load icmptype file '%s': %s" % (name, msg)) return if what == "new": self._addIcmpType(obj) elif what == "remove": self.removeIcmpType(obj) elif what == "update": self._updateIcmpType(obj) elif (name.startswith(config.FIREWALLD_SERVICES) or \ name.startswith(config.ETC_FIREWALLD_SERVICES)) and \ name.endswith(".xml"): try: (what, obj) = self.config.update_service_from_path(name) except Exception as msg: log.error("Failed to load service file '%s': %s" % (name, msg)) return if what == "new": self._addService(obj) elif what == "remove": self.removeService(obj) elif what == "update": self._updateService(obj) elif name.startswith(config.FIREWALLD_ZONES) or \ name.startswith(config.ETC_FIREWALLD_ZONES): if name.endswith(".xml"): try: (what, obj) = self.config.update_zone_from_path(name) except Exception as msg: log.error("Failed to load zone file '%s': %s" % (name, msg)) return if what == "new": self._addZone(obj) elif what == "remove": self.removeZone(obj) elif what == "update": self._updateZone(obj) elif name.startswith(config.ETC_FIREWALLD_ZONES): # possible combined zone base directory _name = name.replace(config.ETC_FIREWALLD_ZONES, "").strip("/") if len(_name) < 1 or "/" in _name: # if there is a / in x, then it is a sub sub directory # ignore it return if os.path.isdir(name): if not self.watcher.has_watch(name): self.watcher.add_watch_dir(name) elif self.watcher.has_watch(name): self.watcher.remove_watch(name) elif (name.startswith(config.FIREWALLD_IPSETS) or \ name.startswith(config.ETC_FIREWALLD_IPSETS)) and \ name.endswith(".xml"): try: (what, obj) = self.config.update_ipset_from_path(name) except Exception as msg: log.error("Failed to load ipset file '%s': %s" % (name, msg)) return if what == "new": self._addIPSet(obj) elif what == "remove": self.removeIPSet(obj) elif what == "update": self._updateIPSet(obj) elif (name.startswith(config.FIREWALLD_HELPERS) or \ name.startswith(config.ETC_FIREWALLD_HELPERS)) and \ name.endswith(".xml"): try: (what, obj) = self.config.update_helper_from_path(name) except Exception as msg: log.error("Failed to load helper file '%s': %s" % (name, msg)) return if what == "new": self._addHelper(obj) elif what == "remove": self.removeHelper(obj) elif what == "update": self._updateHelper(obj) elif name == config.LOCKDOWN_WHITELIST: try: self.config.update_lockdown_whitelist() except Exception as msg: log.error("Failed to load lockdown whitelist file '%s': %s" % \ (name, msg)) return self.LockdownWhitelistUpdated() elif name == config.FIREWALLD_DIRECT: try: self.config.update_direct() except Exception as msg: log.error("Failed to load direct rules file '%s': %s" % (name, msg)) return self.Updated() elif (name.startswith(config.FIREWALLD_POLICIES) or \ name.startswith(config.ETC_FIREWALLD_POLICIES)) and \ name.endswith(".xml"): try: (what, obj) = self.config.update_policy_object_from_path(name) except Exception as msg: log.error("Failed to load policy file '%s': %s" % (name, msg)) return if what == "new": self._addPolicy(obj) elif what == "remove": self.removePolicy(obj) elif what == "update": self._updatePolicy(obj) @handle_exceptions def _addIcmpType(self, obj): # TODO: check for idx overflow config_icmptype = FirewallDConfigIcmpType( self, self.config, obj, self.icmptype_idx, self.busname, "%s/%d" % (config.dbus.DBUS_PATH_CONFIG_ICMPTYPE, self.icmptype_idx)) self.icmptypes.append(config_icmptype) self.icmptype_idx += 1 self.IcmpTypeAdded(obj.name) return config_icmptype @handle_exceptions def _updateIcmpType(self, obj): for icmptype in self.icmptypes: if icmptype.obj.name == obj.name and \ icmptype.obj.path == obj.path and \ icmptype.obj.filename == obj.filename: icmptype.obj = obj icmptype.Updated(obj.name) @handle_exceptions def removeIcmpType(self, obj): index = 7 # see IMPORT_EXPORT_STRUCTURE in class Zone(IO_Object) for zone in self.zones: settings = zone.getSettings() # if this IcmpType is used in a zone remove it from that zone first if obj.name in settings[index]: settings[index].remove(obj.name) zone.obj = self.config.set_zone_config(zone.obj, settings) zone.Updated(zone.obj.name) for policy in self.policy_objects: settings = policy.getSettings() # if this IcmpType is used in a policy remove it from that policy first if "icmp_blocks" in settings and obj.name in settings["icmp_blocks"]: settings["icmp_blocks"].remove(obj.name) policy.obj = self.config.set_policy_object_config_dict(policy.obj, settings) policy.Updated(policy.obj.name) for icmptype in self.icmptypes: if icmptype.obj == obj: icmptype.Removed(obj.name) icmptype.unregister() self.icmptypes.remove(icmptype) del icmptype @handle_exceptions def _addService(self, obj): # TODO: check for idx overflow config_service = FirewallDConfigService( self, self.config, obj, self.service_idx, self.busname, "%s/%d" % (config.dbus.DBUS_PATH_CONFIG_SERVICE, self.service_idx)) self.services.append(config_service) self.service_idx += 1 self.ServiceAdded(obj.name) return config_service @handle_exceptions def _updateService(self, obj): for service in self.services: if service.obj.name == obj.name and \ service.obj.path == obj.path and \ service.obj.filename == obj.filename: service.obj = obj service.Updated(obj.name) @handle_exceptions def removeService(self, obj): index = 5 # see IMPORT_EXPORT_STRUCTURE in class Zone(IO_Object) for zone in self.zones: settings = zone.getSettings() # if this Service is used in a zone remove it from that zone first if obj.name in settings[index]: settings[index].remove(obj.name) zone.obj = self.config.set_zone_config(zone.obj, settings) zone.Updated(zone.obj.name) for policy in self.policy_objects: settings = policy.getSettings() # if this Service is used in a policy remove it from that policy first if "services" in settings and obj.name in settings["services"]: settings["services"].remove(obj.name) policy.obj = self.config.set_policy_object_config_dict(policy.obj, settings) policy.Updated(policy.obj.name) for service in self.services: if service.obj == obj: service.Removed(obj.name) service.unregister() self.services.remove(service) del service @handle_exceptions def _addZone(self, obj): # TODO: check for idx overflow config_zone = FirewallDConfigZone( self, self.config, obj, self.zone_idx, self.busname, "%s/%d" % (config.dbus.DBUS_PATH_CONFIG_ZONE, self.zone_idx)) self.zones.append(config_zone) self.zone_idx += 1 self.ZoneAdded(obj.name) return config_zone @handle_exceptions def _updateZone(self, obj): for zone in self.zones: if zone.obj.name == obj.name and zone.obj.path == obj.path and \ zone.obj.filename == obj.filename: zone.obj = obj zone.Updated(obj.name) @handle_exceptions def removeZone(self, obj): for zone in self.zones: if zone.obj == obj: zone.Removed(obj.name) zone.unregister() self.zones.remove(zone) del zone @handle_exceptions def _addPolicy(self, obj): # TODO: check for idx overflow config_policy = FirewallDConfigPolicy( self, self.config, obj, self.policy_object_idx, self.busname, "%s/%d" % (config.dbus.DBUS_PATH_CONFIG_POLICY, self.policy_object_idx)) self.policy_objects.append(config_policy) self.policy_object_idx += 1 self.PolicyAdded(obj.name) return config_policy @handle_exceptions def _updatePolicy(self, obj): for policy in self.policy_objects: if policy.obj.name == obj.name and policy.obj.path == obj.path and \ policy.obj.filename == obj.filename: policy.obj = obj policy.Updated(obj.name) @handle_exceptions def removePolicy(self, obj): for policy in self.policy_objects: if policy.obj == obj: policy.Removed(obj.name) policy.unregister() self.policy_objects.remove(policy) del policy @handle_exceptions def _addIPSet(self, obj): # TODO: check for idx overflow config_ipset = FirewallDConfigIPSet( self, self.config, obj, self.ipset_idx, self.busname, "%s/%d" % (config.dbus.DBUS_PATH_CONFIG_IPSET, self.ipset_idx)) self.ipsets.append(config_ipset) self.ipset_idx += 1 self.IPSetAdded(obj.name) return config_ipset @handle_exceptions def _updateIPSet(self, obj): for ipset in self.ipsets: if ipset.obj.name == obj.name and ipset.obj.path == obj.path and \ ipset.obj.filename == obj.filename: ipset.obj = obj ipset.Updated(obj.name) @handle_exceptions def removeIPSet(self, obj): for ipset in self.ipsets: if ipset.obj == obj: ipset.Removed(obj.name) ipset.unregister() self.ipsets.remove(ipset) del ipset # access check @handle_exceptions def _addHelper(self, obj): # TODO: check for idx overflow config_helper = FirewallDConfigHelper( self, self.config, obj, self.helper_idx, self.busname, "%s/%d" % (config.dbus.DBUS_PATH_CONFIG_HELPER, self.helper_idx)) self.helpers.append(config_helper) self.helper_idx += 1 self.HelperAdded(obj.name) return config_helper @handle_exceptions def _updateHelper(self, obj): for helper in self.helpers: if helper.obj.name == obj.name and helper.obj.path == obj.path and \ helper.obj.filename == obj.filename: helper.obj = obj helper.Updated(obj.name) @handle_exceptions def removeHelper(self, obj): for helper in self.helpers: if helper.obj == obj: helper.Removed(obj.name) helper.unregister() self.helpers.remove(helper) del helper # access check @dbus_handle_exceptions def accessCheck(self, sender): if self.config._fw._state == "FAILED": raise FirewallError(errors.RUNNING_BUT_FAILED, "Changing permanent configuration is not allowed while " "firewalld is in FAILED state. The permanent " "configuration must be fixed and then firewalld " "restarted. Try `firewall-offline-cmd --check-config`.") if self.config.lockdown_enabled(): if sender is None: log.error("Lockdown not possible, sender not set.") return bus = dbus.SystemBus() context = context_of_sender(bus, sender) if self.config.access_check("context", context): return uid = uid_of_sender(bus, sender) if self.config.access_check("uid", uid): return user = user_of_uid(uid) if self.config.access_check("user", user): return command = command_of_sender(bus, sender) if self.config.access_check("command", command): return raise FirewallError(errors.ACCESS_DENIED, "lockdown is enabled") # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # P R O P E R T I E S @dbus_handle_exceptions def _get_property(self, prop): if prop not in [ "DefaultZone", "MinimalMark", "CleanupOnExit", "CleanupModulesOnExit", "Lockdown", "IPv6_rpfilter", "IndividualCalls", "LogDenied", "AutomaticHelpers", "FirewallBackend", "FlushAllOnReload", "RFC3964_IPv4", "AllowZoneDrifting", "IPv6_rpfilter2", "NftablesTableOwner" ]: raise dbus.exceptions.DBusException( "org.freedesktop.DBus.Error.InvalidArgs: " "Property '%s' does not exist" % prop) value = self.config.get_firewalld_conf().get(prop) if prop == "DefaultZone": if value is None: value = config.FALLBACK_ZONE return dbus.String(value) elif prop == "MinimalMark": if value is None: value = config.FALLBACK_MINIMAL_MARK else: value = int(value) return dbus.Int32(value) elif prop == "CleanupOnExit": if value is None: value = "yes" if config.FALLBACK_CLEANUP_ON_EXIT else "no" return dbus.String(value) elif prop == "CleanupModulesOnExit": if value is None: value = "yes" if config.FALLBACK_CLEANUP_MODULES_ON_EXIT else "no" return dbus.String(value) elif prop == "Lockdown": if value is None: value = "yes" if config.FALLBACK_LOCKDOWN else "no" return dbus.String(value) elif prop == "IPv6_rpfilter": if value is None or value != "no": return dbus.String("yes") else: return dbus.String("no") elif prop == "IPv6_rpfilter2": if value is None: value = config.FALLBACK_IPV6_RPFILTER return dbus.String(value) elif prop == "IndividualCalls": if value is None: value = "yes" if config.FALLBACK_INDIVIDUAL_CALLS else "no" return dbus.String(value) elif prop == "LogDenied": if value is None: value = config.FALLBACK_LOG_DENIED return dbus.String(value) elif prop == "AutomaticHelpers": if value is None: value = config.FALLBACK_AUTOMATIC_HELPERS return dbus.String(value) elif prop == "FirewallBackend": if value is None: value = config.FALLBACK_FIREWALL_BACKEND return dbus.String(value) elif prop == "FlushAllOnReload": if value is None: value = "yes" if config.FALLBACK_FLUSH_ALL_ON_RELOAD else "no" return dbus.String(value) elif prop == "RFC3964_IPv4": if value is None: value = "yes" if config.FALLBACK_RFC3964_IPV4 else "no" return dbus.String(value) elif prop == "AllowZoneDrifting": if value is None: value = "yes" if config.FALLBACK_ALLOW_ZONE_DRIFTING else "no" return dbus.String(value) elif prop == "NftablesTableOwner": if value is None: value = "yes" if config.FALLBACK_NFTABLES_TABLE_OWNER else "no" return dbus.String(value) @dbus_handle_exceptions def _get_dbus_property(self, prop): if prop == "DefaultZone": return dbus.String(self._get_property(prop)) elif prop == "MinimalMark": return dbus.Int32(self._get_property(prop)) elif prop == "CleanupOnExit": return dbus.String(self._get_property(prop)) elif prop == "CleanupModulesOnExit": return dbus.String(self._get_property(prop)) elif prop == "Lockdown": return dbus.String(self._get_property(prop)) elif prop == "IPv6_rpfilter": return dbus.String(self._get_property(prop)) elif prop == "IPv6_rpfilter2": return dbus.String(self._get_property(prop)) elif prop == "IndividualCalls": return dbus.String(self._get_property(prop)) elif prop == "LogDenied": return dbus.String(self._get_property(prop)) elif prop == "AutomaticHelpers": return dbus.String(self._get_property(prop)) elif prop == "FirewallBackend": return dbus.String(self._get_property(prop)) elif prop == "FlushAllOnReload": return dbus.String(self._get_property(prop)) elif prop == "RFC3964_IPv4": return dbus.String(self._get_property(prop)) elif prop == "AllowZoneDrifting": return dbus.String(self._get_property(prop)) elif prop == "NftablesTableOwner": return dbus.String(self._get_property(prop)) else: raise dbus.exceptions.DBusException( "org.freedesktop.DBus.Error.InvalidArgs: " "Property '%s' does not exist" % prop) @dbus_service_method(dbus.PROPERTIES_IFACE, in_signature='ss', out_signature='v') @dbus_handle_exceptions def Get(self, interface_name, property_name, sender=None): # pylint: disable=W0613 # get a property interface_name = dbus_to_python(interface_name, str) property_name = dbus_to_python(property_name, str) log.debug1("config.Get('%s', '%s')", interface_name, property_name) if interface_name == config.dbus.DBUS_INTERFACE_CONFIG: return self._get_dbus_property(property_name) elif interface_name in [ config.dbus.DBUS_INTERFACE_CONFIG_DIRECT, config.dbus.DBUS_INTERFACE_CONFIG_POLICIES ]: raise dbus.exceptions.DBusException( "org.freedesktop.DBus.Error.InvalidArgs: " "Property '%s' does not exist" % property_name) else: raise dbus.exceptions.DBusException( "org.freedesktop.DBus.Error.UnknownInterface: " "Interface '%s' does not exist" % interface_name) @dbus_service_method(dbus.PROPERTIES_IFACE, in_signature='s', out_signature='a{sv}') @dbus_handle_exceptions def GetAll(self, interface_name, sender=None): # pylint: disable=W0613 interface_name = dbus_to_python(interface_name, str) log.debug1("config.GetAll('%s')", interface_name) ret = { } if interface_name == config.dbus.DBUS_INTERFACE_CONFIG: for x in [ "DefaultZone", "MinimalMark", "CleanupOnExit", "CleanupModulesOnExit", "Lockdown", "IPv6_rpfilter", "IndividualCalls", "LogDenied", "AutomaticHelpers", "FirewallBackend", "FlushAllOnReload", "RFC3964_IPv4", "AllowZoneDrifting", "IPv6_rpfilter2", "NftablesTableOwner" ]: ret[x] = self._get_property(x) elif interface_name in [ config.dbus.DBUS_INTERFACE_CONFIG_DIRECT, config.dbus.DBUS_INTERFACE_CONFIG_POLICIES ]: pass else: raise dbus.exceptions.DBusException( "org.freedesktop.DBus.Error.UnknownInterface: " "Interface '%s' does not exist" % interface_name) return dbus.Dictionary(ret, signature="sv") @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG) @dbus_service_method(dbus.PROPERTIES_IFACE, in_signature='ssv') @dbus_handle_exceptions def Set(self, interface_name, property_name, new_value, sender=None): interface_name = dbus_to_python(interface_name, str) property_name = dbus_to_python(property_name, str) new_value = dbus_to_python(new_value) log.debug1("config.Set('%s', '%s', '%s')", interface_name, property_name, new_value) self.accessCheck(sender) if interface_name == config.dbus.DBUS_INTERFACE_CONFIG: if property_name in [ "CleanupOnExit", "CleanupModulesOnExit", "Lockdown", "IPv6_rpfilter", "IndividualCalls", "LogDenied", "FirewallBackend", "FlushAllOnReload", "RFC3964_IPv4", "IPv6_rpfilter2", "NftablesTableOwner" ]: if property_name in [ "CleanupOnExit", "CleanupModulesOnExit", "Lockdown", "IPv6_rpfilter", "IndividualCalls", "FlushAllOnReload", "RFC3964_IPv4", "NftablesTableOwner" ]: if new_value.lower() not in [ "yes", "no", "true", "false" ]: raise FirewallError(errors.INVALID_VALUE, "'%s' for %s" % \ (new_value, property_name)) elif property_name == "LogDenied": if new_value not in config.LOG_DENIED_VALUES: raise FirewallError(errors.INVALID_VALUE, "'%s' for %s" % \ (new_value, property_name)) elif property_name == "FirewallBackend": if new_value not in config.FIREWALL_BACKEND_VALUES: raise FirewallError(errors.INVALID_VALUE, "'%s' for %s" % \ (new_value, property_name)) elif property_name == "IPv6_rpfilter2": if new_value not in config.IPV6_RPFILTER_VALUES: raise FirewallError( errors.INVALID_VALUE, "'%s' for %s" % (new_value, property_name), ) else: raise dbus.exceptions.DBusException( "org.freedesktop.DBus.Error.InvalidArgs: " "Property '%s' does not exist" % property_name) self.config.get_firewalld_conf().set(property_name, new_value) self.config.get_firewalld_conf().write() self.PropertiesChanged(interface_name, { property_name: new_value }, [ ]) elif property_name in ["MinimalMark", "AutomaticHelpers", "AllowZoneDrifting"]: # deprecated fields. Ignore setting them. pass else: raise dbus.exceptions.DBusException( "org.freedesktop.DBus.Error.InvalidArgs: " "Property '%s' does not exist" % property_name) elif interface_name in [ config.dbus.DBUS_INTERFACE_CONFIG_DIRECT, config.dbus.DBUS_INTERFACE_CONFIG_POLICIES ]: raise dbus.exceptions.DBusException( "org.freedesktop.DBus.Error.InvalidArgs: " "Property '%s' does not exist" % property_name) else: raise dbus.exceptions.DBusException( "org.freedesktop.DBus.Error.UnknownInterface: " "Interface '%s' does not exist" % interface_name) @dbus.service.signal(dbus.PROPERTIES_IFACE, signature='sa{sv}as') def PropertiesChanged(self, interface_name, changed_properties, invalidated_properties): interface_name = dbus_to_python(interface_name, str) changed_properties = dbus_to_python(changed_properties) invalidated_properties = dbus_to_python(invalidated_properties) log.debug1("config.PropertiesChanged('%s', '%s', '%s')", interface_name, changed_properties, invalidated_properties) @dbus_polkit_require_auth(config.dbus.PK_ACTION_INFO) @dbus_service_method(dbus.INTROSPECTABLE_IFACE, out_signature='s') @dbus_handle_exceptions def Introspect(self, sender=None): # pylint: disable=W0613 log.debug2("config.Introspect()") data = super(FirewallDConfig, self).Introspect(self.path, self.busname.get_bus()) data = dbus_introspection_add_properties( self, data, config.dbus.DBUS_INTERFACE_CONFIG) for interface in [config.dbus.DBUS_INTERFACE_CONFIG_DIRECT]: data = dbus_introspection_add_deprecated( self, data, interface, dbus_service_method_deprecated().deprecated, dbus_service_signal_deprecated().deprecated) return data # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # policies @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_POLICIES, out_signature=LockdownWhitelist.DBUS_SIGNATURE) @dbus_handle_exceptions def getLockdownWhitelist(self, sender=None): # pylint: disable=W0613 log.debug1("config.policies.getLockdownWhitelist()") return self.config.get_policies().lockdown_whitelist.export_config() @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_POLICIES, in_signature=LockdownWhitelist.DBUS_SIGNATURE) @dbus_handle_exceptions def setLockdownWhitelist(self, settings, sender=None): # pylint: disable=W0613 log.debug1("config.policies.setLockdownWhitelist(...)") settings = dbus_to_python(settings) self.config.get_policies().lockdown_whitelist.import_config(settings, {}) self.config.get_policies().lockdown_whitelist.write() self.LockdownWhitelistUpdated() @dbus.service.signal(config.dbus.DBUS_INTERFACE_CONFIG_POLICIES) @dbus_handle_exceptions def LockdownWhitelistUpdated(self): log.debug1("config.policies.LockdownWhitelistUpdated()") # command @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_POLICIES, in_signature='s') @dbus_handle_exceptions def addLockdownWhitelistCommand(self, command, sender=None): command = dbus_to_python(command) log.debug1("config.policies.addLockdownWhitelistCommand('%s')", command) self.accessCheck(sender) settings = list(self.getLockdownWhitelist()) if command in settings[0]: raise FirewallError(errors.ALREADY_ENABLED, command) settings[0].append(command) self.setLockdownWhitelist(settings) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_POLICIES, in_signature='s') @dbus_handle_exceptions def removeLockdownWhitelistCommand(self, command, sender=None): command = dbus_to_python(command) log.debug1("config.policies.removeLockdownWhitelistCommand('%s')", command) self.accessCheck(sender) settings = list(self.getLockdownWhitelist()) if command not in settings[0]: raise FirewallError(errors.NOT_ENABLED, command) settings[0].remove(command) self.setLockdownWhitelist(settings) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_POLICIES, in_signature='s', out_signature='b') @dbus_handle_exceptions def queryLockdownWhitelistCommand(self, command, sender=None): # pylint: disable=W0613 command = dbus_to_python(command) log.debug1("config.policies.queryLockdownWhitelistCommand('%s')", command) return command in self.getLockdownWhitelist()[0] @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_POLICIES, out_signature='as') @dbus_handle_exceptions def getLockdownWhitelistCommands(self, sender=None): # pylint: disable=W0613 log.debug1("config.policies.getLockdownWhitelistCommands()") return self.getLockdownWhitelist()[0] # context @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_POLICIES, in_signature='s') @dbus_handle_exceptions def addLockdownWhitelistContext(self, context, sender=None): context = dbus_to_python(context) log.debug1("config.policies.addLockdownWhitelistContext('%s')", context) self.accessCheck(sender) settings = list(self.getLockdownWhitelist()) if context in settings[1]: raise FirewallError(errors.ALREADY_ENABLED, context) settings[1].append(context) self.setLockdownWhitelist(settings) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_POLICIES, in_signature='s') @dbus_handle_exceptions def removeLockdownWhitelistContext(self, context, sender=None): context = dbus_to_python(context) log.debug1("config.policies.removeLockdownWhitelistContext('%s')", context) self.accessCheck(sender) settings = list(self.getLockdownWhitelist()) if context not in settings[1]: raise FirewallError(errors.NOT_ENABLED, context) settings[1].remove(context) self.setLockdownWhitelist(settings) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_POLICIES, in_signature='s', out_signature='b') @dbus_handle_exceptions def queryLockdownWhitelistContext(self, context, sender=None): # pylint: disable=W0613 context = dbus_to_python(context) log.debug1("config.policies.queryLockdownWhitelistContext('%s')", context) return context in self.getLockdownWhitelist()[1] @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_POLICIES, out_signature='as') @dbus_handle_exceptions def getLockdownWhitelistContexts(self, sender=None): # pylint: disable=W0613 log.debug1("config.policies.getLockdownWhitelistContexts()") return self.getLockdownWhitelist()[1] # user @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_POLICIES, in_signature='s') @dbus_handle_exceptions def addLockdownWhitelistUser(self, user, sender=None): user = dbus_to_python(user) log.debug1("config.policies.addLockdownWhitelistUser('%s')", user) self.accessCheck(sender) settings = list(self.getLockdownWhitelist()) if user in settings[2]: raise FirewallError(errors.ALREADY_ENABLED, user) settings[2].append(user) self.setLockdownWhitelist(settings) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_POLICIES, in_signature='s') @dbus_handle_exceptions def removeLockdownWhitelistUser(self, user, sender=None): user = dbus_to_python(user) log.debug1("config.policies.removeLockdownWhitelistUser('%s')", user) self.accessCheck(sender) settings = list(self.getLockdownWhitelist()) if user not in settings[2]: raise FirewallError(errors.NOT_ENABLED, user) settings[2].remove(user) self.setLockdownWhitelist(settings) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_POLICIES, in_signature='s', out_signature='b') @dbus_handle_exceptions def queryLockdownWhitelistUser(self, user, sender=None): # pylint: disable=W0613 user = dbus_to_python(user) log.debug1("config.policies.queryLockdownWhitelistUser('%s')", user) return user in self.getLockdownWhitelist()[2] @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_POLICIES, out_signature='as') @dbus_handle_exceptions def getLockdownWhitelistUsers(self, sender=None): # pylint: disable=W0613 log.debug1("config.policies.getLockdownWhitelistUsers()") return self.getLockdownWhitelist()[2] # uid @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_POLICIES, in_signature='i') @dbus_handle_exceptions def addLockdownWhitelistUid(self, uid, sender=None): uid = dbus_to_python(uid) log.debug1("config.policies.addLockdownWhitelistUid(%d)", uid) self.accessCheck(sender) settings = list(self.getLockdownWhitelist()) if uid in settings[3]: raise FirewallError(errors.ALREADY_ENABLED, uid) settings[3].append(uid) self.setLockdownWhitelist(settings) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_POLICIES, in_signature='i') @dbus_handle_exceptions def removeLockdownWhitelistUid(self, uid, sender=None): uid = dbus_to_python(uid) log.debug1("config.policies.removeLockdownWhitelistUid(%d)", uid) self.accessCheck(sender) settings = list(self.getLockdownWhitelist()) if uid not in settings[3]: raise FirewallError(errors.NOT_ENABLED, uid) settings[3].remove(uid) self.setLockdownWhitelist(settings) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_POLICIES, in_signature='i', out_signature='b') @dbus_handle_exceptions def queryLockdownWhitelistUid(self, uid, sender=None): # pylint: disable=W0613 uid = dbus_to_python(uid) log.debug1("config.policies.queryLockdownWhitelistUid(%d)", uid) return uid in self.getLockdownWhitelist()[3] @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_POLICIES, out_signature='ai') @dbus_handle_exceptions def getLockdownWhitelistUids(self, sender=None): # pylint: disable=W0613 log.debug1("config.policies.getLockdownWhitelistUids()") return self.getLockdownWhitelist()[3] # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # I P S E T S @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG, out_signature='ao') @dbus_handle_exceptions def listIPSets(self, sender=None): # pylint: disable=W0613 """list ipsets objects paths """ log.debug1("config.listIPSets()") return self.ipsets @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG, out_signature='as') @dbus_handle_exceptions def getIPSetNames(self, sender=None): # pylint: disable=W0613 """get ipset names """ log.debug1("config.getIPSetNames()") ipsets = [ ] for obj in self.ipsets: ipsets.append(obj.obj.name) return sorted(ipsets) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG, in_signature='s', out_signature='o') @dbus_handle_exceptions def getIPSetByName(self, ipset, sender=None): # pylint: disable=W0613 """object path of ipset with given name """ ipset = dbus_to_python(ipset, str) log.debug1("config.getIPSetByName('%s')", ipset) for obj in self.ipsets: if obj.obj.name == ipset: return obj raise FirewallError(errors.INVALID_IPSET, ipset) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG, in_signature='s'+IPSet.DBUS_SIGNATURE, out_signature='o') @dbus_handle_exceptions def addIPSet(self, ipset, settings, sender=None): """add ipset with given name and settings """ ipset = dbus_to_python(ipset, str) settings = dbus_to_python(settings) log.debug1("config.addIPSet('%s')", ipset) self.accessCheck(sender) obj = self.config.new_ipset(ipset, settings) config_ipset = self._addIPSet(obj) return config_ipset @dbus.service.signal(config.dbus.DBUS_INTERFACE_CONFIG, signature='s') @dbus_handle_exceptions def IPSetAdded(self, ipset): ipset = dbus_to_python(ipset, str) log.debug1("config.IPSetAdded('%s')" % (ipset)) # I C M P T Y P E S @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG, out_signature='ao') @dbus_handle_exceptions def listIcmpTypes(self, sender=None): # pylint: disable=W0613 """list icmptypes objects paths """ log.debug1("config.listIcmpTypes()") return self.icmptypes @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG, out_signature='as') @dbus_handle_exceptions def getIcmpTypeNames(self, sender=None): # pylint: disable=W0613 """get icmptype names """ log.debug1("config.getIcmpTypeNames()") icmptypes = [ ] for obj in self.icmptypes: icmptypes.append(obj.obj.name) return sorted(icmptypes) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG, in_signature='s', out_signature='o') @dbus_handle_exceptions def getIcmpTypeByName(self, icmptype, sender=None): # pylint: disable=W0613 """object path of icmptype with given name """ icmptype = dbus_to_python(icmptype, str) log.debug1("config.getIcmpTypeByName('%s')", icmptype) for obj in self.icmptypes: if obj.obj.name == icmptype: return obj raise FirewallError(errors.INVALID_ICMPTYPE, icmptype) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG, in_signature='s'+IcmpType.DBUS_SIGNATURE, out_signature='o') @dbus_handle_exceptions def addIcmpType(self, icmptype, settings, sender=None): """add icmptype with given name and settings """ icmptype = dbus_to_python(icmptype, str) settings = dbus_to_python(settings) log.debug1("config.addIcmpType('%s')", icmptype) self.accessCheck(sender) obj = self.config.new_icmptype(icmptype, settings) config_icmptype = self._addIcmpType(obj) return config_icmptype @dbus.service.signal(config.dbus.DBUS_INTERFACE_CONFIG, signature='s') @dbus_handle_exceptions def IcmpTypeAdded(self, icmptype): log.debug1("config.IcmpTypeAdded('%s')" % (icmptype)) # S E R V I C E S @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG, out_signature='ao') @dbus_handle_exceptions def listServices(self, sender=None): # pylint: disable=W0613 """list services objects paths """ log.debug1("config.listServices()") return self.services @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG, out_signature='as') @dbus_handle_exceptions def getServiceNames(self, sender=None): # pylint: disable=W0613 """get service names """ log.debug1("config.getServiceNames()") services = [ ] for obj in self.services: services.append(obj.obj.name) return sorted(services) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG, in_signature='s', out_signature='o') @dbus_handle_exceptions def getServiceByName(self, service, sender=None): # pylint: disable=W0613 """object path of service with given name """ service = dbus_to_python(service, str) log.debug1("config.getServiceByName('%s')", service) for obj in self.services: if obj.obj.name == service: return obj raise FirewallError(errors.INVALID_SERVICE, service) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG, in_signature='s(sssa(ss)asa{ss}asa(ss))', out_signature='o') @dbus_handle_exceptions def addService(self, service, settings, sender=None): """add service with given name and settings """ service = dbus_to_python(service, str) settings = dbus_to_python(settings) log.debug1("config.addService('%s')", service) self.accessCheck(sender) obj = self.config.new_service(service, settings) config_service = self._addService(obj) return config_service @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG, in_signature='sa{sv}', out_signature='o') @dbus_handle_exceptions def addService2(self, service, settings, sender=None): """add service with given name and settings """ service = dbus_to_python(service, str) settings = dbus_to_python(settings) log.debug1("config.addService2('%s')", service) self.accessCheck(sender) obj = self.config.new_service_dict(service, settings) config_service = self._addService(obj) return config_service @dbus.service.signal(config.dbus.DBUS_INTERFACE_CONFIG, signature='s') @dbus_handle_exceptions def ServiceAdded(self, service): log.debug1("config.ServiceAdded('%s')" % (service)) # Z O N E S @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG, out_signature='ao') @dbus_handle_exceptions def listZones(self, sender=None): # pylint: disable=W0613 """list zones objects paths """ log.debug1("config.listZones()") return self.zones @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG, out_signature='as') @dbus_handle_exceptions def getZoneNames(self, sender=None): # pylint: disable=W0613 """get zone names """ log.debug1("config.getZoneNames()") zones = [ ] for obj in self.zones: zones.append(obj.obj.name) return sorted(zones) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG, in_signature='s', out_signature='o') @dbus_handle_exceptions def getZoneByName(self, zone, sender=None): # pylint: disable=W0613 """object path of zone with given name """ zone = dbus_to_python(zone, str) log.debug1("config.getZoneByName('%s')", zone) for obj in self.zones: if obj.obj.name == zone: return obj raise FirewallError(errors.INVALID_ZONE, zone) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG, in_signature='s', out_signature='s') @dbus_handle_exceptions def getZoneOfInterface(self, iface, sender=None): # pylint: disable=W0613 """name of zone the given interface belongs to """ iface = dbus_to_python(iface, str) log.debug1("config.getZoneOfInterface('%s')", iface) ret = [] for obj in self.zones: if iface in obj.obj.interfaces: ret.append(obj.obj.name) if len(ret) > 1: # Even it shouldn't happen, it's actually possible that # the same interface is in several zone XML files return " ".join(ret) + \ " (ERROR: interface '%s' is in %s zone XML files, can be only in one)" % \ (iface, len(ret)) return ret[0] if ret else "" @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG, in_signature='s', out_signature='s') @dbus_handle_exceptions def getZoneOfSource(self, source, sender=None): # pylint: disable=W0613 """name of zone the given source belongs to """ source = dbus_to_python(source, str) log.debug1("config.getZoneOfSource('%s')", source) ret = [] for obj in self.zones: if source in obj.obj.sources: ret.append(obj.obj.name) if len(ret) > 1: # Even it shouldn't happen, it's actually possible that # the same source is in several zone XML files return " ".join(ret) + \ " (ERROR: source '%s' is in %s zone XML files, can be only in one)" % \ (source, len(ret)) return ret[0] if ret else "" @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG, in_signature="s(sssbsasa(ss)asba(ssss)asasasasa(ss)b)", out_signature='o') @dbus_handle_exceptions def addZone(self, zone, settings, sender=None): """add zone with given name and settings """ zone = dbus_to_python(zone, str) settings = dbus_to_python(settings) log.debug1("config.addZone('%s')", zone) self.accessCheck(sender) if settings[4] == "default": # convert to list, fix target, convert back to tuple _settings = list(settings) _settings[4] = DEFAULT_ZONE_TARGET settings = tuple(_settings) obj = self.config.new_zone(zone, settings) config_zone = self._addZone(obj) return config_zone @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG, in_signature="sa{sv}", out_signature='o') @dbus_handle_exceptions def addZone2(self, zone, settings, sender=None): """add zone with given name and settings """ zone = dbus_to_python(zone, str) settings = dbus_to_python(settings) log.debug1("config.addZone('%s')", zone) self.accessCheck(sender) if "target" in settings and settings["target"] == "default": settings["target"] = DEFAULT_ZONE_TARGET obj = self.config.new_zone_dict(zone, settings) config_zone = self._addZone(obj) return config_zone @dbus.service.signal(config.dbus.DBUS_INTERFACE_CONFIG, signature='s') @dbus_handle_exceptions def ZoneAdded(self, zone): log.debug1("config.ZoneAdded('%s')" % (zone)) # policies @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG, out_signature='ao') @dbus_handle_exceptions def listPolicies(self, sender=None): """list policies objects paths """ log.debug1("config.listPolicies()") return self.policy_objects @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG, out_signature='as') @dbus_handle_exceptions def getPolicyNames(self, sender=None): """get policy names """ log.debug1("config.getPolicyNames()") policies = [ ] for obj in self.policy_objects: policies.append(obj.obj.name) return sorted(policies) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG, in_signature='s', out_signature='o') @dbus_handle_exceptions def getPolicyByName(self, policy, sender=None): """object path of policy with given name """ policy = dbus_to_python(policy, str) log.debug1("config.getPolicyByName('%s')", policy) for obj in self.policy_objects: if obj.obj.name == policy: return obj raise FirewallError(errors.INVALID_POLICY, policy) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG, in_signature="sa{sv}", out_signature='o') @dbus_handle_exceptions def addPolicy(self, policy, settings, sender=None): """add policy with given name and settings """ policy = dbus_to_python(policy, str) settings = dbus_to_python(settings) log.debug1("config.addPolicy('%s')", policy) self.accessCheck(sender) obj = self.config.new_policy_object_dict(policy, settings) config_policy = self._addPolicy(obj) return config_policy @dbus.service.signal(config.dbus.DBUS_INTERFACE_CONFIG, signature='s') @dbus_handle_exceptions def PolicyAdded(self, policy): log.debug1("config.PolicyAdded('%s')" % (policy)) # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # H E L P E R S @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG, out_signature='ao') @dbus_handle_exceptions def listHelpers(self, sender=None): # pylint: disable=W0613 """list helpers objects paths """ log.debug1("config.listHelpers()") return self.helpers @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG, out_signature='as') @dbus_handle_exceptions def getHelperNames(self, sender=None): # pylint: disable=W0613 """get helper names """ log.debug1("config.getHelperNames()") helpers = [ ] for obj in self.helpers: helpers.append(obj.obj.name) return sorted(helpers) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG, in_signature='s', out_signature='o') @dbus_handle_exceptions def getHelperByName(self, helper, sender=None): # pylint: disable=W0613 """object path of helper with given name """ helper = dbus_to_python(helper, str) log.debug1("config.getHelperByName('%s')", helper) for obj in self.helpers: if obj.obj.name == helper: return obj raise FirewallError(errors.INVALID_HELPER, helper) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG, in_signature='s'+Helper.DBUS_SIGNATURE, out_signature='o') @dbus_handle_exceptions def addHelper(self, helper, settings, sender=None): """add helper with given name and settings """ helper = dbus_to_python(helper, str) settings = dbus_to_python(settings) log.debug1("config.addHelper('%s')", helper) self.accessCheck(sender) obj = self.config.new_helper(helper, settings) config_helper = self._addHelper(obj) return config_helper @dbus.service.signal(config.dbus.DBUS_INTERFACE_CONFIG, signature='s') @dbus_handle_exceptions def HelperAdded(self, helper): helper = dbus_to_python(helper, str) log.debug1("config.HelperAdded('%s')" % (helper)) # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # DIRECT @dbus_service_method_deprecated(config.dbus.DBUS_INTERFACE_CONFIG_DIRECT) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_DIRECT, out_signature=Direct.DBUS_SIGNATURE) @dbus_handle_exceptions def getSettings(self, sender=None): # pylint: disable=W0613 # returns list ipv, table, list of chains log.debug1("config.direct.getSettings()") return self.config.get_direct().export_config() @dbus_service_method_deprecated(config.dbus.DBUS_INTERFACE_CONFIG_DIRECT) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_DIRECT, in_signature=Direct.DBUS_SIGNATURE) @dbus_handle_exceptions def update(self, settings, sender=None): # pylint: disable=W0613 # returns list ipv, table, list of chains log.debug1("config.direct.update()") settings = dbus_to_python(settings) self.config.get_direct().import_config(settings, {}) self.config.get_direct().write() self.Updated() @dbus_service_signal_deprecated(config.dbus.DBUS_INTERFACE_CONFIG_DIRECT) @dbus.service.signal(config.dbus.DBUS_INTERFACE_CONFIG_DIRECT) @dbus_handle_exceptions def Updated(self): log.debug1("config.direct.Updated()") # chain @dbus_service_method_deprecated(config.dbus.DBUS_INTERFACE_CONFIG_DIRECT) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_DIRECT, in_signature='sss') @dbus_handle_exceptions def addChain(self, ipv, table, chain, sender=None): ipv = dbus_to_python(ipv) table = dbus_to_python(table) chain = dbus_to_python(chain) log.debug1("config.direct.addChain('%s', '%s', '%s')" % \ (ipv, table, chain)) self.accessCheck(sender) idx = tuple((ipv, table, chain)) settings = list(self.getSettings()) if idx in settings[0]: raise FirewallError(errors.ALREADY_ENABLED, "chain '%s' already is in '%s:%s'" % \ (chain, ipv, table)) settings[0].append(idx) self.update(settings) @dbus_service_method_deprecated(config.dbus.DBUS_INTERFACE_CONFIG_DIRECT) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_DIRECT, in_signature='sss') @dbus_handle_exceptions def removeChain(self, ipv, table, chain, sender=None): ipv = dbus_to_python(ipv) table = dbus_to_python(table) chain = dbus_to_python(chain) log.debug1("config.direct.removeChain('%s', '%s', '%s')" % \ (ipv, table, chain)) self.accessCheck(sender) idx = tuple((ipv, table, chain)) settings = list(self.getSettings()) if idx not in settings[0]: raise FirewallError(errors.NOT_ENABLED, "chain '%s' is not in '%s:%s'" % (chain, ipv, table)) settings[0].remove(idx) self.update(settings) @dbus_service_method_deprecated(config.dbus.DBUS_INTERFACE_CONFIG_DIRECT) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_DIRECT, in_signature='sss', out_signature='b') @dbus_handle_exceptions def queryChain(self, ipv, table, chain, sender=None): # pylint: disable=W0613 ipv = dbus_to_python(ipv) table = dbus_to_python(table) chain = dbus_to_python(chain) log.debug1("config.direct.queryChain('%s', '%s', '%s')" % \ (ipv, table, chain)) idx = tuple((ipv, table, chain)) return idx in self.getSettings()[0] @dbus_service_method_deprecated(config.dbus.DBUS_INTERFACE_CONFIG_DIRECT) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_DIRECT, in_signature='ss', out_signature='as') @dbus_handle_exceptions def getChains(self, ipv, table, sender=None): # pylint: disable=W0613 ipv = dbus_to_python(ipv) table = dbus_to_python(table) log.debug1("config.direct.getChains('%s', '%s')" % (ipv, table)) ret = [ ] for idx in self.getSettings()[0]: if idx[0] == ipv and idx[1] == table: ret.append(idx[2]) return ret @dbus_service_method_deprecated(config.dbus.DBUS_INTERFACE_CONFIG_DIRECT) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_DIRECT, in_signature='', out_signature='a(sss)') @dbus_handle_exceptions def getAllChains(self, sender=None): # pylint: disable=W0613 log.debug1("config.direct.getAllChains()") return self.getSettings()[0] # rule @dbus_service_method_deprecated(config.dbus.DBUS_INTERFACE_CONFIG_DIRECT) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_DIRECT, in_signature='sssias') @dbus_handle_exceptions def addRule(self, ipv, table, chain, priority, args, sender=None): # pylint: disable=R0913 ipv = dbus_to_python(ipv) table = dbus_to_python(table) chain = dbus_to_python(chain) priority = dbus_to_python(priority) args = dbus_to_python(args) log.debug1("config.direct.addRule('%s', '%s', '%s', %d, '%s')" % \ (ipv, table, chain, priority, "','".join(args))) self.accessCheck(sender) idx = (ipv, table, chain, priority, args) settings = list(self.getSettings()) if idx in settings[1]: raise FirewallError(errors.ALREADY_ENABLED, "rule '%s' already is in '%s:%s:%s'" % \ (args, ipv, table, chain)) settings[1].append(idx) self.update(tuple(settings)) @dbus_service_method_deprecated(config.dbus.DBUS_INTERFACE_CONFIG_DIRECT) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_DIRECT, in_signature='sssias') @dbus_handle_exceptions def removeRule(self, ipv, table, chain, priority, args, sender=None): # pylint: disable=R0913 ipv = dbus_to_python(ipv) table = dbus_to_python(table) chain = dbus_to_python(chain) priority = dbus_to_python(priority) args = dbus_to_python(args) log.debug1("config.direct.removeRule('%s', '%s', '%s', %d, '%s')" % \ (ipv, table, chain, priority, "','".join(args))) self.accessCheck(sender) idx = (ipv, table, chain, priority, args) settings = list(self.getSettings()) if idx not in settings[1]: raise FirewallError(errors.NOT_ENABLED, "rule '%s' is not in '%s:%s:%s'" % \ (args, ipv, table, chain)) settings[1].remove(idx) self.update(tuple(settings)) @dbus_service_method_deprecated(config.dbus.DBUS_INTERFACE_CONFIG_DIRECT) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_DIRECT, in_signature='sssias', out_signature='b') @dbus_handle_exceptions def queryRule(self, ipv, table, chain, priority, args, sender=None): # pylint: disable=W0613,R0913 ipv = dbus_to_python(ipv) table = dbus_to_python(table) chain = dbus_to_python(chain) priority = dbus_to_python(priority) args = dbus_to_python(args) log.debug1("config.direct.queryRule('%s', '%s', '%s', %d, '%s')" % \ (ipv, table, chain, priority, "','".join(args))) idx = (ipv, table, chain, priority, args) return idx in self.getSettings()[1] @dbus_service_method_deprecated(config.dbus.DBUS_INTERFACE_CONFIG_DIRECT) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_DIRECT, in_signature='sss') @dbus_handle_exceptions def removeRules(self, ipv, table, chain, sender=None): ipv = dbus_to_python(ipv) table = dbus_to_python(table) chain = dbus_to_python(chain) log.debug1("config.direct.removeRules('%s', '%s', '%s')" % \ (ipv, table, chain, )) self.accessCheck(sender) settings = list(self.getSettings()) for rule in settings[1][:]: if (ipv, table, chain) == (rule[0], rule[1], rule[2]): settings[1].remove(rule) self.update(tuple(settings)) @dbus_service_method_deprecated(config.dbus.DBUS_INTERFACE_CONFIG_DIRECT) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_DIRECT, in_signature='sss', out_signature='a(ias)') @dbus_handle_exceptions def getRules(self, ipv, table, chain, sender=None): # pylint: disable=W0613 ipv = dbus_to_python(ipv) table = dbus_to_python(table) chain = dbus_to_python(chain) log.debug1("config.direct.getRules('%s', '%s', '%s')" % \ (ipv, table, chain)) ret = [ ] for idx in self.getSettings()[1]: if idx[0] == ipv and idx[1] == table and idx[2] == chain: ret.append((idx[3], idx[4])) return ret @dbus_service_method_deprecated(config.dbus.DBUS_INTERFACE_CONFIG_DIRECT) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_DIRECT, in_signature='', out_signature='a(sssias)') @dbus_handle_exceptions def getAllRules(self, sender=None): # pylint: disable=W0613 log.debug1("config.direct.getAllRules()") return self.getSettings()[1] # passthrough @dbus_service_method_deprecated(config.dbus.DBUS_INTERFACE_CONFIG_DIRECT) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_DIRECT, in_signature='sas') @dbus_handle_exceptions def addPassthrough(self, ipv, args, sender=None): ipv = dbus_to_python(ipv) args = dbus_to_python(args) log.debug1("config.direct.addPassthrough('%s', '%s')" % \ (ipv, "','".join(args))) self.accessCheck(sender) idx = (ipv, args) settings = list(self.getSettings()) if idx in settings[2]: raise FirewallError(errors.ALREADY_ENABLED, "passthrough '%s', '%s'" % (ipv, args)) settings[2].append(idx) self.update(settings) @dbus_service_method_deprecated(config.dbus.DBUS_INTERFACE_CONFIG_DIRECT) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_DIRECT, in_signature='sas') @dbus_handle_exceptions def removePassthrough(self, ipv, args, sender=None): ipv = dbus_to_python(ipv) args = dbus_to_python(args) log.debug1("config.direct.removePassthrough('%s', '%s')" % \ (ipv, "','".join(args))) self.accessCheck(sender) idx = (ipv, args) settings = list(self.getSettings()) if idx not in settings[2]: raise FirewallError(errors.NOT_ENABLED, "passthrough '%s', '%s'" % (ipv, args)) settings[2].remove(idx) self.update(settings) @dbus_service_method_deprecated(config.dbus.DBUS_INTERFACE_CONFIG_DIRECT) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_DIRECT, in_signature='sas', out_signature='b') @dbus_handle_exceptions def queryPassthrough(self, ipv, args, sender=None): # pylint: disable=W0613 ipv = dbus_to_python(ipv) args = dbus_to_python(args) log.debug1("config.direct.queryPassthrough('%s', '%s')" % \ (ipv, "','".join(args))) idx = (ipv, args) return idx in self.getSettings()[2] @dbus_service_method_deprecated(config.dbus.DBUS_INTERFACE_CONFIG_DIRECT) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_DIRECT, in_signature='s', out_signature='aas') @dbus_handle_exceptions def getPassthroughs(self, ipv, sender=None): # pylint: disable=W0613 ipv = dbus_to_python(ipv) log.debug1("config.direct.getPassthroughs('%s')" % (ipv)) ret = [ ] for idx in self.getSettings()[2]: if idx[0] == ipv: ret.append(idx[1]) return ret @dbus_service_method_deprecated(config.dbus.DBUS_INTERFACE_CONFIG_DIRECT) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_DIRECT, out_signature='a(sas)') @dbus_handle_exceptions def getAllPassthroughs(self, sender=None): # pylint: disable=W0613 log.debug1("config.direct.getAllPassthroughs()") return self.getSettings()[2] server/firewalld.py 0000644 00000344507 15025011705 0010406 0 ustar 00 # -*- coding: utf-8 -*- # # Copyright (C) 2010-2016 Red Hat, Inc. # # Authors: # Thomas Woerner <twoerner@redhat.com> # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see <http://www.gnu.org/licenses/>. __all__ = [ "FirewallD" ] from gi.repository import GLib import copy import dbus import dbus.service from firewall import config from firewall.core.fw import Firewall from firewall.core.rich import Rich_Rule from firewall.core.logger import log from firewall.client import FirewallClientZoneSettings from firewall.server.dbus import FirewallDBusException, DbusServiceObject from firewall.server.decorators import dbus_handle_exceptions, \ dbus_service_method, \ handle_exceptions, \ dbus_service_method_deprecated, \ dbus_service_signal_deprecated, \ dbus_polkit_require_auth from firewall.server.config import FirewallDConfig from firewall.dbus_utils import dbus_to_python, \ command_of_sender, context_of_sender, uid_of_sender, user_of_uid, \ dbus_introspection_prepare_properties, \ dbus_introspection_add_properties, \ dbus_introspection_add_deprecated from firewall.core.io.functions import check_on_disk_config from firewall.core.io.ipset import IPSet from firewall.core.io.icmptype import IcmpType from firewall.core.io.helper import Helper from firewall.core.fw_nm import nm_get_connection_of_interface, \ nm_set_zone_of_connection from firewall.core.fw_ifcfg import ifcfg_set_zone_of_interface from firewall import errors from firewall.errors import FirewallError ############################################################################ # # class FirewallD # ############################################################################ class FirewallD(DbusServiceObject): """FirewallD main class""" persistent = True """ Make FirewallD persistent. """ default_polkit_auth_required = config.dbus.PK_ACTION_CONFIG """ Use config.dbus.PK_ACTION_CONFIG as a default """ @handle_exceptions def __init__(self, *args, **kwargs): super(FirewallD, self).__init__(*args, **kwargs) self.fw = Firewall() self.busname = args[0] self.path = args[1] self.start() dbus_introspection_prepare_properties(self, config.dbus.DBUS_INTERFACE) self.config = FirewallDConfig(self.fw.config, self.busname, config.dbus.DBUS_PATH_CONFIG) def __del__(self): self.stop() @handle_exceptions def start(self): # tests if iptables and ip6tables are usable using test functions # loads default firewall rules for iptables and ip6tables log.debug1("start()") self._timeouts = { } return self.fw.start() @handle_exceptions def stop(self): # stops firewall: unloads firewall modules, flushes chains and tables, # resets policies log.debug1("stop()") return self.fw.stop() # lockdown functions @dbus_handle_exceptions def accessCheck(self, sender): if self.fw.policies.query_lockdown(): if sender is None: log.error("Lockdown not possible, sender not set.") return bus = dbus.SystemBus() context = context_of_sender(bus, sender) if self.fw.policies.access_check("context", context): return uid = uid_of_sender(bus, sender) if self.fw.policies.access_check("uid", uid): return user = user_of_uid(uid) if self.fw.policies.access_check("user", user): return command = command_of_sender(bus, sender) if self.fw.policies.access_check("command", command): return raise FirewallError(errors.ACCESS_DENIED, "lockdown is enabled") # timeout functions @dbus_handle_exceptions def addTimeout(self, zone, x, tag): if zone not in self._timeouts: self._timeouts[zone] = { } self._timeouts[zone][x] = tag @dbus_handle_exceptions def removeTimeout(self, zone, x): if zone in self._timeouts and x in self._timeouts[zone]: GLib.source_remove(self._timeouts[zone][x]) del self._timeouts[zone][x] @dbus_handle_exceptions def cleanup_timeouts(self): # cleanup timeouts for zone in self._timeouts: for x in self._timeouts[zone]: GLib.source_remove(self._timeouts[zone][x]) self._timeouts[zone].clear() self._timeouts.clear() # property handling @dbus_handle_exceptions def _get_property(self, prop): if prop == "version": return dbus.String(config.VERSION) elif prop == "interface_version": return dbus.String("%d.%d" % (config.dbus.DBUS_INTERFACE_VERSION, config.dbus.DBUS_INTERFACE_REVISION)) elif prop == "state": return dbus.String(self.fw.get_state()) elif prop == "IPv4": return dbus.Boolean(self.fw.is_ipv_enabled("ipv4")) elif prop == "IPv4ICMPTypes": return dbus.Array(self.fw.ipv4_supported_icmp_types, "s") elif prop == "IPv6": return dbus.Boolean(self.fw.is_ipv_enabled("ipv6")) elif prop == "IPv6_rpfilter": return dbus.Boolean(False if self.fw._ipv6_rpfilter == "no" else True) elif prop == "IPv6ICMPTypes": return dbus.Array(self.fw.ipv6_supported_icmp_types, "s") elif prop == "BRIDGE": return dbus.Boolean(self.fw.ebtables_enabled) elif prop == "IPSet": return dbus.Boolean(self.fw.ipset_enabled) elif prop == "IPSetTypes": return dbus.Array(self.fw.ipset_supported_types, "s") elif prop == "nf_conntrack_helper_setting": return dbus.Boolean(False) elif prop == "nf_conntrack_helpers": return dbus.Dictionary({}, "sas") elif prop == "nf_nat_helpers": return dbus.Dictionary({}, "sas") else: raise dbus.exceptions.DBusException( "org.freedesktop.DBus.Error.InvalidArgs: " "Property '%s' does not exist" % prop) @dbus_service_method(dbus.PROPERTIES_IFACE, in_signature='ss', out_signature='v') @dbus_handle_exceptions def Get(self, interface_name, property_name, sender=None): # pylint: disable=W0613 # get a property interface_name = dbus_to_python(interface_name, str) property_name = dbus_to_python(property_name, str) log.debug1("Get('%s', '%s')", interface_name, property_name) if interface_name == config.dbus.DBUS_INTERFACE: return self._get_property(property_name) elif interface_name in [ config.dbus.DBUS_INTERFACE_ZONE, config.dbus.DBUS_INTERFACE_DIRECT, config.dbus.DBUS_INTERFACE_POLICIES, config.dbus.DBUS_INTERFACE_IPSET ]: raise dbus.exceptions.DBusException( "org.freedesktop.DBus.Error.InvalidArgs: " "Property '%s' does not exist" % property_name) else: raise dbus.exceptions.DBusException( "org.freedesktop.DBus.Error.UnknownInterface: " "Interface '%s' does not exist" % interface_name) @dbus_service_method(dbus.PROPERTIES_IFACE, in_signature='s', out_signature='a{sv}') @dbus_handle_exceptions def GetAll(self, interface_name, sender=None): # pylint: disable=W0613 interface_name = dbus_to_python(interface_name, str) log.debug1("GetAll('%s')", interface_name) ret = { } if interface_name == config.dbus.DBUS_INTERFACE: for x in [ "version", "interface_version", "state", "IPv4", "IPv6", "IPv6_rpfilter", "BRIDGE", "IPSet", "IPSetTypes", "nf_conntrack_helper_setting", "nf_conntrack_helpers", "nf_nat_helpers", "IPv4ICMPTypes", "IPv6ICMPTypes" ]: ret[x] = self._get_property(x) elif interface_name in [ config.dbus.DBUS_INTERFACE_ZONE, config.dbus.DBUS_INTERFACE_DIRECT, config.dbus.DBUS_INTERFACE_POLICIES, config.dbus.DBUS_INTERFACE_IPSET ]: pass else: raise dbus.exceptions.DBusException( "org.freedesktop.DBus.Error.UnknownInterface: " "Interface '%s' does not exist" % interface_name) return dbus.Dictionary(ret, signature="sv") @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG) @dbus_service_method(dbus.PROPERTIES_IFACE, in_signature='ssv') @dbus_handle_exceptions def Set(self, interface_name, property_name, new_value, sender=None): interface_name = dbus_to_python(interface_name, str) property_name = dbus_to_python(property_name, str) new_value = dbus_to_python(new_value) log.debug1("Set('%s', '%s', '%s')", interface_name, property_name, new_value) self.accessCheck(sender) if interface_name == config.dbus.DBUS_INTERFACE: if property_name in [ "version", "interface_version", "state", "IPv4", "IPv6", "IPv6_rpfilter", "BRIDGE", "IPSet", "IPSetTypes", "nf_conntrack_helper_setting", "nf_conntrack_helpers", "nf_nat_helpers", "IPv4ICMPTypes", "IPv6ICMPTypes" ]: raise dbus.exceptions.DBusException( "org.freedesktop.DBus.Error.PropertyReadOnly: " "Property '%s' is read-only" % property_name) else: raise dbus.exceptions.DBusException( "org.freedesktop.DBus.Error.InvalidArgs: " "Property '%s' does not exist" % property_name) elif interface_name in [ config.dbus.DBUS_INTERFACE_ZONE, config.dbus.DBUS_INTERFACE_DIRECT, config.dbus.DBUS_INTERFACE_POLICIES, config.dbus.DBUS_INTERFACE_IPSET ]: raise dbus.exceptions.DBusException( "org.freedesktop.DBus.Error.InvalidArgs: " "Property '%s' does not exist" % property_name) else: raise dbus.exceptions.DBusException( "org.freedesktop.DBus.Error.UnknownInterface: " "Interface '%s' does not exist" % interface_name) @dbus.service.signal(dbus.PROPERTIES_IFACE, signature='sa{sv}as') def PropertiesChanged(self, interface_name, changed_properties, invalidated_properties): interface_name = dbus_to_python(interface_name, str) changed_properties = dbus_to_python(changed_properties) invalidated_properties = dbus_to_python(invalidated_properties) log.debug1("PropertiesChanged('%s', '%s', '%s')", interface_name, changed_properties, invalidated_properties) @dbus_polkit_require_auth(config.dbus.PK_ACTION_INFO) @dbus_service_method(dbus.INTROSPECTABLE_IFACE, out_signature='s') @dbus_handle_exceptions def Introspect(self, sender=None): # pylint: disable=W0613 log.debug2("Introspect()") data = super(FirewallD, self).Introspect(self.path, self.busname.get_bus()) data = dbus_introspection_add_properties(self, data, config.dbus.DBUS_INTERFACE) for interface in [config.dbus.DBUS_INTERFACE_DIRECT]: data = dbus_introspection_add_deprecated(self, data, interface, dbus_service_method_deprecated().deprecated, dbus_service_signal_deprecated().deprecated) return data # reload @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG) @dbus_service_method(config.dbus.DBUS_INTERFACE, in_signature='', out_signature='') @dbus_handle_exceptions def reload(self, sender=None): # pylint: disable=W0613 """Reload the firewall rules. """ log.debug1("reload()") self.fw.reload() self.config.reload() self.Reloaded() # complete_reload @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG) @dbus_service_method(config.dbus.DBUS_INTERFACE, in_signature='', out_signature='') @dbus_handle_exceptions def completeReload(self, sender=None): # pylint: disable=W0613 """Completely reload the firewall. Completely reload the firewall: Stops firewall, unloads modules and starts the firewall again. """ log.debug1("completeReload()") self.fw.reload(True) self.config.reload() self.Reloaded() @dbus.service.signal(config.dbus.DBUS_INTERFACE) @dbus_handle_exceptions def Reloaded(self): log.debug1("Reloaded()") @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG) @dbus_service_method(config.dbus.DBUS_INTERFACE, in_signature='', out_signature= '') def resetToDefaults(self, sender=None): """reset to firewall's builtin defaults. Reloads firewalld to apply changes properly """ log.debug1("firewalld.reset_to_defaults()") self.fw.config.reset_defaults() self.reload() @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG) @dbus_service_method(config.dbus.DBUS_INTERFACE, in_signature='', out_signature='') @dbus_handle_exceptions def checkPermanentConfig(self, sender=None): # pylint: disable=W0613 """Check permanent configuration """ log.debug1("checkPermanentConfig()") check_on_disk_config(self.fw) # runtime to permanent @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG) @dbus_service_method(config.dbus.DBUS_INTERFACE, in_signature='', out_signature='') @dbus_handle_exceptions def runtimeToPermanent(self, sender=None): # pylint: disable=W0613 """Make runtime configuration permanent """ log.debug1("copyRuntimeToPermanent()") if self.fw._state == "FAILED": raise FirewallError(errors.RUNNING_BUT_FAILED, "Saving runtime to permanent is not allowed while " "firewalld is in FAILED state. The permanent " "configuration must be fixed and then firewalld " "restarted. Try `firewall-offline-cmd --check-config`.") error = False # Services or icmptypes can not be modified in runtime, but they can # be removed or modified in permanent environment. Therefore copying # of services and icmptypes to permanent is also needed. # services config_names = self.config.getServiceNames() for name in self.fw.service.get_services(): conf = self.getServiceSettings(name) try: if name in config_names: conf_obj = self.config.getServiceByName(name) if conf_obj.getSettings() != conf: log.debug1("Copying service '%s' settings" % name) conf_obj.update(conf) else: log.debug1("Service '%s' is identical, ignoring." % name) else: log.debug1("Creating service '%s'" % name) self.config.addService(name, conf) except Exception as e: log.warning( "Runtime To Permanent failed on service '%s': %s" % \ (name, e)) error = True # icmptypes config_names = self.config.getIcmpTypeNames() for name in self.fw.icmptype.get_icmptypes(): conf = self.getIcmpTypeSettings(name) try: if name in config_names: conf_obj = self.config.getIcmpTypeByName(name) if conf_obj.getSettings() != conf: log.debug1("Copying icmptype '%s' settings" % name) conf_obj.update(conf) else: log.debug1("IcmpType '%s' is identical, ignoring." % name) else: log.debug1("Creating icmptype '%s'" % name) self.config.addIcmpType(name, conf) except Exception as e: log.warning( "Runtime To Permanent failed on icmptype '%s': %s" % \ (name, e)) error = True # ipsets config_names = self.config.getIPSetNames() for name in self.fw.ipset.get_ipsets(): try: conf = self.getIPSetSettings(name) if name in config_names: conf_obj = self.config.getIPSetByName(name) if conf_obj.getSettings() != conf: log.debug1("Copying ipset '%s' settings" % name) conf_obj.update(conf) else: log.debug1("IPSet '%s' is identical, ignoring." % name) else: log.debug1("Creating ipset '%s'" % name) self.config.addIPSet(name, conf) except Exception as e: log.warning( "Runtime To Permanent failed on ipset '%s': %s" % \ (name, e)) error = True # zones config_names = self.config.getZoneNames() for name in self.fw.zone.get_zones(): conf = self.getZoneSettings2(name) settings = FirewallClientZoneSettings(copy.deepcopy(conf)) changed = False for interface in settings.getInterfaces(): if interface in self.fw._nm_assigned_interfaces: log.debug1("Zone '%s': interface binding for '%s' has been added by NM, ignoring." % (name, interface)) settings.removeInterface(interface) changed = True # For the remaining interfaces, attempt to let NM manage them for interface in settings.getInterfaces(): try: connection = nm_get_connection_of_interface(interface) if connection and nm_set_zone_of_connection(name, connection): settings.removeInterface(interface) changed = True except Exception: pass if changed: conf = settings.getSettingsDict() # For the remaining try to update the ifcfg files for interface in settings.getInterfaces(): ifcfg_set_zone_of_interface(name, interface) try: if name in config_names: conf_obj = self.config.getZoneByName(name) log.debug1("Copying zone '%s' settings" % name) conf_obj.update2(conf) else: log.debug1("Creating zone '%s'" % name) self.config.addZone2(name, conf) except Exception as e: log.warning( "Runtime To Permanent failed on zone '%s': %s" % \ (name, e)) error = True # policies config_names = self.config.getPolicyNames() for name in self.fw.policy.get_policies_not_derived_from_zone(): conf = self.getPolicySettings(name) try: if name in config_names: conf_obj = self.config.getPolicyByName(name) conf_obj.update(conf) else: log.debug1("Creating policy '%s'" % name) self.config.addPolicy(name, conf) except Exception as e: log.warning( "Runtime To Permanent failed on policy '%s': %s" % \ (name, e)) error = True # helpers config_names = self.config.getHelperNames() for name in self.fw.helper.get_helpers(): conf = self.getHelperSettings(name) try: if name in config_names: conf_obj = self.config.getHelperByName(name) if conf_obj.getSettings() != conf: log.debug1("Copying helper '%s' settings" % name) conf_obj.update(conf) else: log.debug1("Helper '%s' is identical, ignoring." % name) else: log.debug1("Creating helper '%s'" % name) self.config.addHelper(name, conf) except Exception as e: log.warning( "Runtime To Permanent failed on helper '%s': %s" % \ (name, e)) error = True # direct # rt_config = self.fw.direct.get_config() conf = ( self.fw.direct.get_all_chains(), self.fw.direct.get_all_rules(), self.fw.direct.get_all_passthroughs() ) try: if self.config.getSettings() != conf: log.debug1("Copying direct configuration") self.config.update(conf) else: log.debug1("Direct configuration is identical, ignoring.") except Exception as e: log.warning( "Runtime To Permanent failed on direct configuration: %s" % e) error = True # policies conf = self.fw.policies.lockdown_whitelist.export_config() try: if self.config.getSettings() != conf: log.debug1("Copying policies configuration") self.config.setLockdownWhitelist(conf) else: log.debug1("Policies configuration is identical, ignoring.") except Exception as e: log.warning( "Runtime To Permanent failed on policies configuration: %s" % \ e) error = True if error: raise FirewallError(errors.RT_TO_PERM_FAILED) # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # POLICIES # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # lockdown @dbus_polkit_require_auth(config.dbus.PK_ACTION_POLICIES) @dbus_service_method(config.dbus.DBUS_INTERFACE_POLICIES, in_signature='', out_signature='') @dbus_handle_exceptions def enableLockdown(self, sender=None): """Enable lockdown policies """ log.debug1("policies.enableLockdown()") self.accessCheck(sender) self.fw.policies.enable_lockdown() self.LockdownEnabled() @dbus_polkit_require_auth(config.dbus.PK_ACTION_POLICIES) @dbus_service_method(config.dbus.DBUS_INTERFACE_POLICIES, in_signature='', out_signature='') @dbus_handle_exceptions def disableLockdown(self, sender=None): """Disable lockdown policies """ log.debug1("policies.disableLockdown()") self.accessCheck(sender) self.fw.policies.disable_lockdown() self.LockdownDisabled() @dbus_polkit_require_auth(config.dbus.PK_ACTION_POLICIES_INFO) @dbus_service_method(config.dbus.DBUS_INTERFACE_POLICIES, in_signature='', out_signature='b') @dbus_handle_exceptions def queryLockdown(self, sender=None): # pylint: disable=W0613 """Returns True if lockdown is enabled """ log.debug1("policies.queryLockdown()") # no access check here return self.fw.policies.query_lockdown() @dbus.service.signal(config.dbus.DBUS_INTERFACE_POLICIES, signature='') @dbus_handle_exceptions def LockdownEnabled(self): log.debug1("LockdownEnabled()") @dbus.service.signal(config.dbus.DBUS_INTERFACE_POLICIES, signature='') @dbus_handle_exceptions def LockdownDisabled(self): log.debug1("LockdownDisabled()") # lockdown whitelist # command @dbus_polkit_require_auth(config.dbus.PK_ACTION_POLICIES) @dbus_service_method(config.dbus.DBUS_INTERFACE_POLICIES, in_signature='s', out_signature='') @dbus_handle_exceptions def addLockdownWhitelistCommand(self, command, sender=None): """Add lockdown command """ command = dbus_to_python(command, str) log.debug1("policies.addLockdownWhitelistCommand('%s')" % command) self.accessCheck(sender) self.fw.policies.lockdown_whitelist.add_command(command) self.LockdownWhitelistCommandAdded(command) @dbus_polkit_require_auth(config.dbus.PK_ACTION_POLICIES) @dbus_service_method(config.dbus.DBUS_INTERFACE_POLICIES, in_signature='s', out_signature='') @dbus_handle_exceptions def removeLockdownWhitelistCommand(self, command, sender=None): """Remove lockdown command """ command = dbus_to_python(command, str) log.debug1("policies.removeLockdownWhitelistCommand('%s')" % command) self.accessCheck(sender) self.fw.policies.lockdown_whitelist.remove_command(command) self.LockdownWhitelistCommandRemoved(command) @dbus_polkit_require_auth(config.dbus.PK_ACTION_POLICIES_INFO) @dbus_service_method(config.dbus.DBUS_INTERFACE_POLICIES, in_signature='s', out_signature='b') @dbus_handle_exceptions def queryLockdownWhitelistCommand(self, command, sender=None): # pylint: disable=W0613 """Query lockdown command """ command = dbus_to_python(command, str) log.debug1("policies.queryLockdownWhitelistCommand('%s')" % command) # no access check here return self.fw.policies.lockdown_whitelist.has_command(command) @dbus_polkit_require_auth(config.dbus.PK_ACTION_POLICIES_INFO) @dbus_service_method(config.dbus.DBUS_INTERFACE_POLICIES, in_signature='', out_signature='as') @dbus_handle_exceptions def getLockdownWhitelistCommands(self, sender=None): # pylint: disable=W0613 """Add lockdown command """ log.debug1("policies.getLockdownWhitelistCommands()") # no access check here return self.fw.policies.lockdown_whitelist.get_commands() @dbus.service.signal(config.dbus.DBUS_INTERFACE_POLICIES, signature='s') @dbus_handle_exceptions def LockdownWhitelistCommandAdded(self, command): log.debug1("LockdownWhitelistCommandAdded('%s')" % command) @dbus.service.signal(config.dbus.DBUS_INTERFACE_POLICIES, signature='s') @dbus_handle_exceptions def LockdownWhitelistCommandRemoved(self, command): log.debug1("LockdownWhitelistCommandRemoved('%s')" % command) # uid @dbus_polkit_require_auth(config.dbus.PK_ACTION_POLICIES) @dbus_service_method(config.dbus.DBUS_INTERFACE_POLICIES, in_signature='i', out_signature='') @dbus_handle_exceptions def addLockdownWhitelistUid(self, uid, sender=None): """Add lockdown uid """ uid = dbus_to_python(uid, int) log.debug1("policies.addLockdownWhitelistUid('%s')" % uid) self.accessCheck(sender) self.fw.policies.lockdown_whitelist.add_uid(uid) self.LockdownWhitelistUidAdded(uid) @dbus_polkit_require_auth(config.dbus.PK_ACTION_POLICIES) @dbus_service_method(config.dbus.DBUS_INTERFACE_POLICIES, in_signature='i', out_signature='') @dbus_handle_exceptions def removeLockdownWhitelistUid(self, uid, sender=None): """Remove lockdown uid """ uid = dbus_to_python(uid, int) log.debug1("policies.removeLockdownWhitelistUid('%s')" % uid) self.accessCheck(sender) self.fw.policies.lockdown_whitelist.remove_uid(uid) self.LockdownWhitelistUidRemoved(uid) @dbus_polkit_require_auth(config.dbus.PK_ACTION_POLICIES_INFO) @dbus_service_method(config.dbus.DBUS_INTERFACE_POLICIES, in_signature='i', out_signature='b') @dbus_handle_exceptions def queryLockdownWhitelistUid(self, uid, sender=None): # pylint: disable=W0613 """Query lockdown uid """ uid = dbus_to_python(uid, int) log.debug1("policies.queryLockdownWhitelistUid('%s')" % uid) # no access check here return self.fw.policies.lockdown_whitelist.has_uid(uid) @dbus_polkit_require_auth(config.dbus.PK_ACTION_POLICIES_INFO) @dbus_service_method(config.dbus.DBUS_INTERFACE_POLICIES, in_signature='', out_signature='ai') @dbus_handle_exceptions def getLockdownWhitelistUids(self, sender=None): # pylint: disable=W0613 """Add lockdown uid """ log.debug1("policies.getLockdownWhitelistUids()") # no access check here return self.fw.policies.lockdown_whitelist.get_uids() @dbus.service.signal(config.dbus.DBUS_INTERFACE_POLICIES, signature='i') @dbus_handle_exceptions def LockdownWhitelistUidAdded(self, uid): log.debug1("LockdownWhitelistUidAdded(%d)" % uid) @dbus.service.signal(config.dbus.DBUS_INTERFACE_POLICIES, signature='i') @dbus_handle_exceptions def LockdownWhitelistUidRemoved(self, uid): log.debug1("LockdownWhitelistUidRemoved(%d)" % uid) # user @dbus_polkit_require_auth(config.dbus.PK_ACTION_POLICIES) @dbus_service_method(config.dbus.DBUS_INTERFACE_POLICIES, in_signature='s', out_signature='') @dbus_handle_exceptions def addLockdownWhitelistUser(self, user, sender=None): """Add lockdown user """ user = dbus_to_python(user, str) log.debug1("policies.addLockdownWhitelistUser('%s')" % user) self.accessCheck(sender) self.fw.policies.lockdown_whitelist.add_user(user) self.LockdownWhitelistUserAdded(user) @dbus_polkit_require_auth(config.dbus.PK_ACTION_POLICIES) @dbus_service_method(config.dbus.DBUS_INTERFACE_POLICIES, in_signature='s', out_signature='') @dbus_handle_exceptions def removeLockdownWhitelistUser(self, user, sender=None): """Remove lockdown user """ user = dbus_to_python(user, str) log.debug1("policies.removeLockdownWhitelistUser('%s')" % user) self.accessCheck(sender) self.fw.policies.lockdown_whitelist.remove_user(user) self.LockdownWhitelistUserRemoved(user) @dbus_polkit_require_auth(config.dbus.PK_ACTION_POLICIES_INFO) @dbus_service_method(config.dbus.DBUS_INTERFACE_POLICIES, in_signature='s', out_signature='b') @dbus_handle_exceptions def queryLockdownWhitelistUser(self, user, sender=None): # pylint: disable=W0613 """Query lockdown user """ user = dbus_to_python(user, str) log.debug1("policies.queryLockdownWhitelistUser('%s')" % user) # no access check here return self.fw.policies.lockdown_whitelist.has_user(user) @dbus_polkit_require_auth(config.dbus.PK_ACTION_POLICIES_INFO) @dbus_service_method(config.dbus.DBUS_INTERFACE_POLICIES, in_signature='', out_signature='as') @dbus_handle_exceptions def getLockdownWhitelistUsers(self, sender=None): # pylint: disable=W0613 """Add lockdown user """ log.debug1("policies.getLockdownWhitelistUsers()") # no access check here return self.fw.policies.lockdown_whitelist.get_users() @dbus.service.signal(config.dbus.DBUS_INTERFACE_POLICIES, signature='s') @dbus_handle_exceptions def LockdownWhitelistUserAdded(self, user): log.debug1("LockdownWhitelistUserAdded('%s')" % user) @dbus.service.signal(config.dbus.DBUS_INTERFACE_POLICIES, signature='s') @dbus_handle_exceptions def LockdownWhitelistUserRemoved(self, user): log.debug1("LockdownWhitelistUserRemoved('%s')" % user) # context @dbus_polkit_require_auth(config.dbus.PK_ACTION_POLICIES) @dbus_service_method(config.dbus.DBUS_INTERFACE_POLICIES, in_signature='s', out_signature='') @dbus_handle_exceptions def addLockdownWhitelistContext(self, context, sender=None): """Add lockdown context """ context = dbus_to_python(context, str) log.debug1("policies.addLockdownWhitelistContext('%s')" % context) self.accessCheck(sender) self.fw.policies.lockdown_whitelist.add_context(context) self.LockdownWhitelistContextAdded(context) @dbus_polkit_require_auth(config.dbus.PK_ACTION_POLICIES) @dbus_service_method(config.dbus.DBUS_INTERFACE_POLICIES, in_signature='s', out_signature='') @dbus_handle_exceptions def removeLockdownWhitelistContext(self, context, sender=None): """Remove lockdown context """ context = dbus_to_python(context, str) log.debug1("policies.removeLockdownWhitelistContext('%s')" % context) self.accessCheck(sender) self.fw.policies.lockdown_whitelist.remove_context(context) self.LockdownWhitelistContextRemoved(context) @dbus_polkit_require_auth(config.dbus.PK_ACTION_POLICIES_INFO) @dbus_service_method(config.dbus.DBUS_INTERFACE_POLICIES, in_signature='s', out_signature='b') @dbus_handle_exceptions def queryLockdownWhitelistContext(self, context, sender=None): # pylint: disable=W0613 """Query lockdown context """ context = dbus_to_python(context, str) log.debug1("policies.queryLockdownWhitelistContext('%s')" % context) # no access check here return self.fw.policies.lockdown_whitelist.has_context(context) @dbus_polkit_require_auth(config.dbus.PK_ACTION_POLICIES_INFO) @dbus_service_method(config.dbus.DBUS_INTERFACE_POLICIES, in_signature='', out_signature='as') @dbus_handle_exceptions def getLockdownWhitelistContexts(self, sender=None): # pylint: disable=W0613 """Add lockdown context """ log.debug1("policies.getLockdownWhitelistContexts()") # no access check here return self.fw.policies.lockdown_whitelist.get_contexts() @dbus.service.signal(config.dbus.DBUS_INTERFACE_POLICIES, signature='s') @dbus_handle_exceptions def LockdownWhitelistContextAdded(self, context): log.debug1("LockdownWhitelistContextAdded('%s')" % context) @dbus.service.signal(config.dbus.DBUS_INTERFACE_POLICIES, signature='s') @dbus_handle_exceptions def LockdownWhitelistContextRemoved(self, context): log.debug1("LockdownWhitelistContextRemoved('%s')" % context) # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # PANIC @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG) @dbus_service_method(config.dbus.DBUS_INTERFACE, in_signature='', out_signature='') @dbus_handle_exceptions def enablePanicMode(self, sender=None): """Enable panic mode. All ingoing and outgoing connections and packets will be blocked. """ log.debug1("enablePanicMode()") self.accessCheck(sender) self.fw.enable_panic_mode() self.PanicModeEnabled() @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG) @dbus_service_method(config.dbus.DBUS_INTERFACE, in_signature='', out_signature='') @dbus_handle_exceptions def disablePanicMode(self, sender=None): """Disable panic mode. Enables normal mode: Allowed ingoing and outgoing connections will not be blocked anymore """ log.debug1("disablePanicMode()") self.accessCheck(sender) self.fw.disable_panic_mode() self.PanicModeDisabled() @dbus_polkit_require_auth(config.dbus.PK_ACTION_INFO) @dbus_service_method(config.dbus.DBUS_INTERFACE, in_signature='', out_signature='b') @dbus_handle_exceptions def queryPanicMode(self, sender=None): # pylint: disable=W0613 # returns True if in panic mode log.debug1("queryPanicMode()") return self.fw.query_panic_mode() @dbus.service.signal(config.dbus.DBUS_INTERFACE, signature='') @dbus_handle_exceptions def PanicModeEnabled(self): log.debug1("PanicModeEnabled()") @dbus.service.signal(config.dbus.DBUS_INTERFACE, signature='') @dbus_handle_exceptions def PanicModeDisabled(self): log.debug1("PanicModeDisabled()") # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # list functions @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG_INFO) @dbus_service_method(config.dbus.DBUS_INTERFACE, in_signature='s', out_signature="(sssbsasa(ss)asba(ssss)asasasasa(ss)b)") @dbus_handle_exceptions def getZoneSettings(self, zone, sender=None): # pylint: disable=W0613 # returns zone settings for zone zone = dbus_to_python(zone, str) log.debug1("getZoneSettings(%s)", zone) return self.fw.zone.get_config_with_settings(zone) @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG_INFO) @dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='s', out_signature="a{sv}") @dbus_handle_exceptions def getZoneSettings2(self, zone, sender=None): zone = dbus_to_python(zone, str) log.debug1("getZoneSettings2(%s)", zone) return self.fw.zone.get_config_with_settings_dict(zone) @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG_INFO) @dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='sa{sv}') @dbus_handle_exceptions def setZoneSettings2(self, zone, settings, sender=None): zone = dbus_to_python(zone, str) log.debug1("setZoneSettings2(%s)", zone) self.accessCheck(sender) self.fw.zone.set_config_with_settings_dict(zone, dbus_to_python(settings), sender) self.ZoneUpdated(zone, settings) @dbus.service.signal(config.dbus.DBUS_INTERFACE_ZONE, signature='sa{sv}') @dbus_handle_exceptions def ZoneUpdated(self, zone, settings): log.debug1("zone.ZoneUpdated('%s', '%s')" % (zone, settings)) @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG_INFO) @dbus_service_method(config.dbus.DBUS_INTERFACE_POLICY, in_signature='s', out_signature="a{sv}") @dbus_handle_exceptions def getPolicySettings(self, policy, sender=None): policy = dbus_to_python(policy, str) log.debug1("policy.getPolicySettings(%s)", policy) return self.fw.policy.get_config_with_settings_dict(policy) @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG_INFO) @dbus_service_method(config.dbus.DBUS_INTERFACE_POLICY, in_signature='sa{sv}') @dbus_handle_exceptions def setPolicySettings(self, policy, settings, sender=None): policy = dbus_to_python(policy, str) log.debug1("policy.setPolicySettings(%s)", policy) self.accessCheck(sender) self.fw.policy.set_config_with_settings_dict(policy, dbus_to_python(settings), sender) self.PolicyUpdated(policy, settings) @dbus.service.signal(config.dbus.DBUS_INTERFACE_POLICY, signature='sa{sv}') @dbus_handle_exceptions def PolicyUpdated(self, policy, settings): log.debug1("policy.PolicyUpdated('%s', '%s')" % (policy, settings)) @dbus_polkit_require_auth(config.dbus.PK_ACTION_INFO) @dbus_service_method(config.dbus.DBUS_INTERFACE, in_signature='', out_signature='as') @dbus_handle_exceptions def listServices(self, sender=None): # pylint: disable=W0613 # returns the list of services # TODO: should be renamed to getServices() # because is called by firewall-cmd --get-services log.debug1("listServices()") return self.fw.service.get_services() @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG_INFO) @dbus_service_method(config.dbus.DBUS_INTERFACE, in_signature='s', out_signature='(sssa(ss)asa{ss}asa(ss))') @dbus_handle_exceptions def getServiceSettings(self, service, sender=None): # pylint: disable=W0613 # returns service settings for service service = dbus_to_python(service, str) log.debug1("getServiceSettings(%s)", service) obj = self.fw.service.get_service(service) conf_dict = obj.export_config_dict() conf_list = [] for i in range(8): # tuple based dbus API has 8 elements if obj.IMPORT_EXPORT_STRUCTURE[i][0] not in conf_dict: # old API needs the empty elements as well. Grab it from the # object otherwise we don't know the type. conf_list.append(copy.deepcopy(getattr(obj, obj.IMPORT_EXPORT_STRUCTURE[i][0]))) else: conf_list.append(conf_dict[obj.IMPORT_EXPORT_STRUCTURE[i][0]]) return tuple(conf_list) @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG_INFO) @dbus_service_method(config.dbus.DBUS_INTERFACE, in_signature='s', out_signature='a{sv}') @dbus_handle_exceptions def getServiceSettings2(self, service, sender=None): # pylint: disable=W0613 service = dbus_to_python(service, str) log.debug1("getServiceSettings2(%s)", service) obj = self.fw.service.get_service(service) return obj.export_config_dict() @dbus_polkit_require_auth(config.dbus.PK_ACTION_INFO) @dbus_service_method(config.dbus.DBUS_INTERFACE, in_signature='', out_signature='as') @dbus_handle_exceptions def listIcmpTypes(self, sender=None): # pylint: disable=W0613 # returns the list of services # TODO: should be renamed to getIcmptypes() # because is called by firewall-cmd --get-icmptypes log.debug1("listIcmpTypes()") return self.fw.icmptype.get_icmptypes() @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG_INFO) @dbus_service_method(config.dbus.DBUS_INTERFACE, in_signature='s', out_signature=IcmpType.DBUS_SIGNATURE) @dbus_handle_exceptions def getIcmpTypeSettings(self, icmptype, sender=None): # pylint: disable=W0613 # returns icmptype settings for icmptype icmptype = dbus_to_python(icmptype, str) log.debug1("getIcmpTypeSettings(%s)", icmptype) return self.fw.icmptype.get_icmptype(icmptype).export_config() # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # LOG DENIED @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG_INFO) @dbus_service_method(config.dbus.DBUS_INTERFACE, in_signature='', out_signature='s') @dbus_handle_exceptions def getLogDenied(self, sender=None): # pylint: disable=W0613 # returns the log denied value log.debug1("getLogDenied()") return self.fw.get_log_denied() @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG) @dbus_service_method(config.dbus.DBUS_INTERFACE, in_signature='s', out_signature='') @dbus_handle_exceptions def setLogDenied(self, value, sender=None): # set the log denied value value = dbus_to_python(value, str) log.debug1("setLogDenied('%s')" % value) self.accessCheck(sender) self.fw.set_log_denied(value) self.LogDeniedChanged(value) # must reload the firewall as well self.fw.reload() self.config.reload() self.Reloaded() @dbus.service.signal(config.dbus.DBUS_INTERFACE, signature='s') @dbus_handle_exceptions def LogDeniedChanged(self, value): log.debug1("LogDeniedChanged('%s')" % (value)) # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # AUTOMATIC HELPER ASSIGNMENT @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG_INFO) @dbus_service_method(config.dbus.DBUS_INTERFACE, in_signature='', out_signature='s') @dbus_handle_exceptions def getAutomaticHelpers(self, sender=None): # pylint: disable=W0613 # returns the automatic helpers value log.debug1("getAutomaticHelpers()") # NOTE: This feature was removed and is now a noop. We retain the dbus # call to keep API. return "no" @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG) @dbus_service_method(config.dbus.DBUS_INTERFACE, in_signature='s', out_signature='') @dbus_handle_exceptions def setAutomaticHelpers(self, value, sender=None): # set the automatic helpers value value = dbus_to_python(value, str) log.debug1("setAutomaticHelpers('%s')" % value) self.accessCheck(sender) # NOTE: This feature was removed and is now a noop. We retain the dbus # call to keep API. @dbus.service.signal(config.dbus.DBUS_INTERFACE, signature='s') @dbus_handle_exceptions def AutomaticHelpersChanged(self, value): log.debug1("AutomaticHelpersChanged('%s')" % (value)) # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # DEFAULT ZONE @dbus_polkit_require_auth(config.dbus.PK_ACTION_INFO) @dbus_service_method(config.dbus.DBUS_INTERFACE, in_signature='', out_signature='s') @dbus_handle_exceptions def getDefaultZone(self, sender=None): # pylint: disable=W0613 # returns the system default zone log.debug1("getDefaultZone()") return self.fw.get_default_zone() @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG) @dbus_service_method(config.dbus.DBUS_INTERFACE, in_signature='s', out_signature='') @dbus_handle_exceptions def setDefaultZone(self, zone, sender=None): # set the system default zone zone = dbus_to_python(zone, str) log.debug1("setDefaultZone('%s')" % zone) self.accessCheck(sender) self.fw.set_default_zone(zone) self.DefaultZoneChanged(zone) @dbus.service.signal(config.dbus.DBUS_INTERFACE, signature='s') @dbus_handle_exceptions def DefaultZoneChanged(self, zone): log.debug1("DefaultZoneChanged('%s')" % (zone)) # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # POLICY INTERFACE # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # POLICIES @dbus_polkit_require_auth(config.dbus.PK_ACTION_INFO) @dbus_service_method(config.dbus.DBUS_INTERFACE_POLICY, in_signature='', out_signature='as') @dbus_handle_exceptions def getPolicies(self, sender=None): log.debug1("policy.getPolicies()") return self.fw.policy.get_policies_not_derived_from_zone() @dbus_polkit_require_auth(config.dbus.PK_ACTION_INFO) @dbus_service_method(config.dbus.DBUS_INTERFACE_POLICY, in_signature='', out_signature='a{sa{sas}}') @dbus_handle_exceptions def getActivePolicies(self, sender=None): log.debug1("policy.getActivePolicies()") policies = { } for policy in self.fw.policy.get_active_policies_not_derived_from_zone(): policies[policy] = { } policies[policy]["ingress_zones"] = self.fw.policy.list_ingress_zones(policy) policies[policy]["egress_zones"] = self.fw.policy.list_egress_zones(policy) return policies # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # ZONE INTERFACE # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # ZONES @dbus_polkit_require_auth(config.dbus.PK_ACTION_INFO) # TODO: shouldn't this be in DBUS_INTERFACE instead of DBUS_INTERFACE_ZONE ? @dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='', out_signature='as') @dbus_handle_exceptions def getZones(self, sender=None): # pylint: disable=W0613 # returns the list of zones log.debug1("zone.getZones()") return self.fw.zone.get_zones() @dbus_polkit_require_auth(config.dbus.PK_ACTION_INFO) @dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='', out_signature='a{sa{sas}}') @dbus_handle_exceptions def getActiveZones(self, sender=None): # pylint: disable=W0613 # returns the list of active zones log.debug1("zone.getActiveZones()") zones = { } for zone in self.fw.zone.get_zones(): interfaces = self.fw.zone.list_interfaces(zone) sources = self.fw.zone.list_sources(zone) if len(interfaces) + len(sources) > 0: zones[zone] = { } if len(interfaces) > 0: zones[zone]["interfaces"] = interfaces if len(sources) > 0: zones[zone]["sources"] = sources return zones @dbus_polkit_require_auth(config.dbus.PK_ACTION_INFO) @dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='s', out_signature='s') @dbus_handle_exceptions def getZoneOfInterface(self, interface, sender=None): # pylint: disable=W0613 """Return the zone an interface belongs to. :Parameters: `interface` : str Name of the interface :Returns: str. The name of the zone. """ interface = dbus_to_python(interface, str) log.debug1("zone.getZoneOfInterface('%s')" % interface) zone = self.fw.zone.get_zone_of_interface(interface) if zone: return zone return "" @dbus_polkit_require_auth(config.dbus.PK_ACTION_INFO) @dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='s', out_signature='s') @dbus_handle_exceptions def getZoneOfSource(self, source, sender=None): # pylint: disable=W0613 #Return the zone an source belongs to. source = dbus_to_python(source, str) log.debug1("zone.getZoneOfSource('%s')" % source) zone = self.fw.zone.get_zone_of_source(source) if zone: return zone return "" @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG_INFO) @dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='s', out_signature='b') @dbus_handle_exceptions def isImmutable(self, zone, sender=None): # pylint: disable=W0613 # no immutable zones anymore return False # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # INTERFACES @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG) @dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='ss', out_signature='s') @dbus_handle_exceptions def addInterface(self, zone, interface, sender=None): """Add an interface to a zone. If zone is empty, use default zone. """ zone = dbus_to_python(zone, str) interface = dbus_to_python(interface, str) log.debug1("zone.addInterface('%s', '%s')" % (zone, interface)) self.accessCheck(sender) _zone = self.fw.zone.add_interface(zone, interface, sender) self.InterfaceAdded(_zone, interface) return _zone @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG) @dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='ss', out_signature='s') @dbus_handle_exceptions def changeZone(self, zone, interface, sender=None): """Change a zone an interface is part of. If zone is empty, use default zone. This function is deprecated, use changeZoneOfInterface instead """ zone = dbus_to_python(zone, str) interface = dbus_to_python(interface, str) return self.changeZoneOfInterface(zone, interface, sender) @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG) @dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='ss', out_signature='s') @dbus_handle_exceptions def changeZoneOfInterface(self, zone, interface, sender=None): """Change a zone an interface is part of. If zone is empty, use default zone. """ zone = dbus_to_python(zone, str) interface = dbus_to_python(interface, str) log.debug1("zone.changeZoneOfInterface('%s', '%s')" % (zone, interface)) self.accessCheck(sender) _zone = self.fw.zone.change_zone_of_interface(zone, interface, sender) self.ZoneOfInterfaceChanged(_zone, interface) return _zone @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG) @dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='ss', out_signature='s') @dbus_handle_exceptions def removeInterface(self, zone, interface, sender=None): """Remove interface from a zone. If zone is empty, remove from zone the interface belongs to. """ zone = dbus_to_python(zone, str) interface = dbus_to_python(interface, str) log.debug1("zone.removeInterface('%s', '%s')" % (zone, interface)) self.accessCheck(sender) _zone = self.fw.zone.remove_interface(zone, interface) self.InterfaceRemoved(_zone, interface) return _zone @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG_INFO) @dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='ss', out_signature='b') @dbus_handle_exceptions def queryInterface(self, zone, interface, sender=None): # pylint: disable=W0613 """Return true if an interface is in a zone. If zone is empty, use default zone. """ zone = dbus_to_python(zone, str) interface = dbus_to_python(interface, str) log.debug1("zone.queryInterface('%s', '%s')" % (zone, interface)) return self.fw.zone.query_interface(zone, interface) @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG_INFO) @dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='s', out_signature='as') @dbus_handle_exceptions def getInterfaces(self, zone, sender=None): # pylint: disable=W0613 """Return the list of interfaces of a zone. If zone is empty, use default zone. """ # TODO: should be renamed to listInterfaces() # because is called by firewall-cmd --zone --list-interfaces zone = dbus_to_python(zone, str) log.debug1("zone.getInterfaces('%s')" % (zone)) return self.fw.zone.list_interfaces(zone) @dbus.service.signal(config.dbus.DBUS_INTERFACE_ZONE, signature='ss') @dbus_handle_exceptions def InterfaceAdded(self, zone, interface): log.debug1("zone.InterfaceAdded('%s', '%s')" % (zone, interface)) @dbus.service.signal(config.dbus.DBUS_INTERFACE_ZONE, signature='ss') @dbus_handle_exceptions def ZoneChanged(self, zone, interface): """ This signal is deprecated. """ log.debug1("zone.ZoneChanged('%s', '%s')" % (zone, interface)) @dbus.service.signal(config.dbus.DBUS_INTERFACE_ZONE, signature='ss') @dbus_handle_exceptions def ZoneOfInterfaceChanged(self, zone, interface): log.debug1("zone.ZoneOfInterfaceChanged('%s', '%s')" % (zone, interface)) self.ZoneChanged(zone, interface) @dbus.service.signal(config.dbus.DBUS_INTERFACE_ZONE, signature='ss') @dbus_handle_exceptions def InterfaceRemoved(self, zone, interface): log.debug1("zone.InterfaceRemoved('%s', '%s')" % (zone, interface)) # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # SOURCES @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG) @dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='ss', out_signature='s') @dbus_handle_exceptions def addSource(self, zone, source, sender=None): """Add a source to a zone. If zone is empty, use default zone. """ zone = dbus_to_python(zone, str) source = dbus_to_python(source, str) log.debug1("zone.addSource('%s', '%s')" % (zone, source)) self.accessCheck(sender) _zone = self.fw.zone.add_source(zone, source, sender) self.SourceAdded(_zone, source) return _zone @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG) @dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='ss', out_signature='s') @dbus_handle_exceptions def changeZoneOfSource(self, zone, source, sender=None): """Change a zone an source is part of. If zone is empty, use default zone. """ zone = dbus_to_python(zone, str) source = dbus_to_python(source, str) log.debug1("zone.changeZoneOfSource('%s', '%s')" % (zone, source)) self.accessCheck(sender) _zone = self.fw.zone.change_zone_of_source(zone, source, sender) self.ZoneOfSourceChanged(_zone, source) return _zone @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG) @dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='ss', out_signature='s') @dbus_handle_exceptions def removeSource(self, zone, source, sender=None): """Remove source from a zone. If zone is empty, remove from zone the source belongs to. """ zone = dbus_to_python(zone, str) source = dbus_to_python(source, str) log.debug1("zone.removeSource('%s', '%s')" % (zone, source)) self.accessCheck(sender) _zone = self.fw.zone.remove_source(zone, source) self.SourceRemoved(_zone, source) return _zone @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG_INFO) @dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='ss', out_signature='b') @dbus_handle_exceptions def querySource(self, zone, source, sender=None): # pylint: disable=W0613 """Return true if an source is in a zone. If zone is empty, use default zone. """ zone = dbus_to_python(zone, str) source = dbus_to_python(source, str) log.debug1("zone.querySource('%s', '%s')" % (zone, source)) return self.fw.zone.query_source(zone, source) @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG_INFO) @dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='s', out_signature='as') @dbus_handle_exceptions def getSources(self, zone, sender=None): # pylint: disable=W0613 """Return the list of sources of a zone. If zone is empty, use default zone. """ # TODO: should be renamed to listSources() # because is called by firewall-cmd --zone --list-sources zone = dbus_to_python(zone, str) log.debug1("zone.getSources('%s')" % (zone)) return self.fw.zone.list_sources(zone) @dbus.service.signal(config.dbus.DBUS_INTERFACE_ZONE, signature='ss') @dbus_handle_exceptions def SourceAdded(self, zone, source): log.debug1("zone.SourceAdded('%s', '%s')" % (zone, source)) @dbus.service.signal(config.dbus.DBUS_INTERFACE_ZONE, signature='ss') @dbus_handle_exceptions def ZoneOfSourceChanged(self, zone, source): log.debug1("zone.ZoneOfSourceChanged('%s', '%s')" % (zone, source)) @dbus.service.signal(config.dbus.DBUS_INTERFACE_ZONE, signature='ss') @dbus_handle_exceptions def SourceRemoved(self, zone, source): log.debug1("zone.SourceRemoved('%s', '%s')" % (zone, source)) # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # RICH RULES @dbus_handle_exceptions def disableTimedRichRule(self, zone, rule): log.debug1("zone.disableTimedRichRule('%s', '%s')" % (zone, rule)) del self._timeouts[zone][rule] obj = Rich_Rule(rule_str=rule) self.fw.zone.remove_rule(zone, obj) self.RichRuleRemoved(zone, rule) @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG) @dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='ssi', out_signature='s') @dbus_handle_exceptions def addRichRule(self, zone, rule, timeout, sender=None): # pylint: disable=W0613 zone = dbus_to_python(zone, str) rule = dbus_to_python(rule, str) timeout = dbus_to_python(timeout, int) log.debug1("zone.addRichRule('%s', '%s')" % (zone, rule)) obj = Rich_Rule(rule_str=rule) _zone = self.fw.zone.add_rule(zone, obj, timeout) if timeout > 0: tag = GLib.timeout_add_seconds(timeout, self.disableTimedRichRule, _zone, rule) self.addTimeout(_zone, rule, tag) self.RichRuleAdded(_zone, rule, timeout) return _zone @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG) @dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='ss', out_signature='s') @dbus_handle_exceptions def removeRichRule(self, zone, rule, sender=None): # pylint: disable=W0613 zone = dbus_to_python(zone, str) rule = dbus_to_python(rule, str) log.debug1("zone.removeRichRule('%s', '%s')" % (zone, rule)) obj = Rich_Rule(rule_str=rule) _zone = self.fw.zone.remove_rule(zone, obj) self.removeTimeout(_zone, rule) self.RichRuleRemoved(_zone, rule) return _zone @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG_INFO) @dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='ss', out_signature='b') @dbus_handle_exceptions def queryRichRule(self, zone, rule, sender=None): # pylint: disable=W0613 zone = dbus_to_python(zone, str) rule = dbus_to_python(rule, str) log.debug1("zone.queryRichRule('%s', '%s')" % (zone, rule)) obj = Rich_Rule(rule_str=rule) return self.fw.zone.query_rule(zone, obj) @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG_INFO) @dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='s', out_signature='as') @dbus_handle_exceptions def getRichRules(self, zone, sender=None): # pylint: disable=W0613 # returns the list of enabled rich rules for zone # TODO: should be renamed to listRichRules() # because is called by firewall-cmd --zone --list-rich-rules zone = dbus_to_python(zone, str) log.debug1("zone.getRichRules('%s')" % (zone)) return self.fw.zone.list_rules(zone) @dbus.service.signal(config.dbus.DBUS_INTERFACE_ZONE, signature='ssi') @dbus_handle_exceptions def RichRuleAdded(self, zone, rule, timeout): log.debug1("zone.RichRuleAdded('%s', '%s', %d)" % (zone, rule, timeout)) @dbus.service.signal(config.dbus.DBUS_INTERFACE_ZONE, signature='ss') @dbus_handle_exceptions def RichRuleRemoved(self, zone, rule): log.debug1("zone.RichRuleRemoved('%s', '%s')" % (zone, rule)) # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # SERVICES @dbus_handle_exceptions def disableTimedService(self, zone, service): log.debug1("zone.disableTimedService('%s', '%s')" % (zone, service)) del self._timeouts[zone][service] self.fw.zone.remove_service(zone, service) self.ServiceRemoved(zone, service) @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG) @dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='ssi', out_signature='s') @dbus_handle_exceptions def addService(self, zone, service, timeout, sender=None): # enables service <service> if not enabled already for zone zone = dbus_to_python(zone, str) service = dbus_to_python(service, str) timeout = dbus_to_python(timeout, int) log.debug1("zone.addService('%s', '%s', %d)" % (zone, service, timeout)) self.accessCheck(sender) _zone = self.fw.zone.add_service(zone, service, timeout, sender) if timeout > 0: tag = GLib.timeout_add_seconds(timeout, self.disableTimedService, _zone, service) self.addTimeout(_zone, service, tag) self.ServiceAdded(_zone, service, timeout) return _zone @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG) @dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='ss', out_signature='s') @dbus_handle_exceptions def removeService(self, zone, service, sender=None): # disables service for zone zone = dbus_to_python(zone, str) service = dbus_to_python(service, str) log.debug1("zone.removeService('%s', '%s')" % (zone, service)) self.accessCheck(sender) _zone = self.fw.zone.remove_service(zone, service) self.removeTimeout(_zone, service) self.ServiceRemoved(_zone, service) return _zone @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG_INFO) @dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='ss', out_signature='b') @dbus_handle_exceptions def queryService(self, zone, service, sender=None): # pylint: disable=W0613 # returns true if a service is enabled for zone zone = dbus_to_python(zone, str) service = dbus_to_python(service, str) log.debug1("zone.queryService('%s', '%s')" % (zone, service)) return self.fw.zone.query_service(zone, service) @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG_INFO) @dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='s', out_signature='as') @dbus_handle_exceptions def getServices(self, zone, sender=None): # pylint: disable=W0613 # returns the list of enabled services for zone # TODO: should be renamed to listServices() # because is called by firewall-cmd --zone --list-services zone = dbus_to_python(zone, str) log.debug1("zone.getServices('%s')" % (zone)) return self.fw.zone.list_services(zone) @dbus.service.signal(config.dbus.DBUS_INTERFACE_ZONE, signature='ssi') @dbus_handle_exceptions def ServiceAdded(self, zone, service, timeout): log.debug1("zone.ServiceAdded('%s', '%s', %d)" % \ (zone, service, timeout)) @dbus.service.signal(config.dbus.DBUS_INTERFACE_ZONE, signature='ss') @dbus_handle_exceptions def ServiceRemoved(self, zone, service): log.debug1("zone.ServiceRemoved('%s', '%s')" % (zone, service)) # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # PORTS @dbus_handle_exceptions def disableTimedPort(self, zone, port, protocol): log.debug1("zone.disableTimedPort('%s', '%s', '%s')" % \ (zone, port, protocol)) del self._timeouts[zone][(port, protocol)] self.fw.zone.remove_port(zone, port, protocol) self.PortRemoved(zone, port, protocol) @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG) @dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='sssi', out_signature='s') @dbus_handle_exceptions def addPort(self, zone, port, protocol, timeout, sender=None): # pylint: disable=R0913 # adds port <port> <protocol> if not enabled already to zone zone = dbus_to_python(zone, str) port = dbus_to_python(port, str) protocol = dbus_to_python(protocol, str) timeout = dbus_to_python(timeout, int) log.debug1("zone.addPort('%s', '%s', '%s')" % \ (zone, port, protocol)) self.accessCheck(sender) _zone = self.fw.zone.add_port(zone, port, protocol, timeout, sender) if timeout > 0: tag = GLib.timeout_add_seconds(timeout, self.disableTimedPort, _zone, port, protocol) self.addTimeout(_zone, (port, protocol), tag) self.PortAdded(_zone, port, protocol, timeout) return _zone @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG) @dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='sss', out_signature='s') @dbus_handle_exceptions def removePort(self, zone, port, protocol, sender=None): # pylint: disable=R0913 # removes port<port> <protocol> if enabled from zone zone = dbus_to_python(zone, str) port = dbus_to_python(port, str) protocol = dbus_to_python(protocol, str) log.debug1("zone.removePort('%s', '%s', '%s')" % \ (zone, port, protocol)) self.accessCheck(sender) _zone= self.fw.zone.remove_port(zone, port, protocol) self.removeTimeout(_zone, (port, protocol)) self.PortRemoved(_zone, port, protocol) return _zone @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG_INFO) @dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='sss', out_signature='b') @dbus_handle_exceptions def queryPort(self, zone, port, protocol, sender=None): # pylint: disable=W0613, R0913 # returns true if a port is enabled for zone zone = dbus_to_python(zone, str) port = dbus_to_python(port, str) protocol = dbus_to_python(protocol, str) log.debug1("zone.queryPort('%s', '%s', '%s')" % (zone, port, protocol)) return self.fw.zone.query_port(zone, port, protocol) @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG_INFO) @dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='s', out_signature='aas') @dbus_handle_exceptions def getPorts(self, zone, sender=None): # pylint: disable=W0613 # returns the list of enabled ports # TODO: should be renamed to listPorts() # because is called by firewall-cmd --zone --list-ports zone = dbus_to_python(zone, str) log.debug1("zone.getPorts('%s')" % (zone)) return self.fw.zone.list_ports(zone) @dbus.service.signal(config.dbus.DBUS_INTERFACE_ZONE, signature='sssi') @dbus_handle_exceptions def PortAdded(self, zone, port, protocol, timeout=0): log.debug1("zone.PortAdded('%s', '%s', '%s', %d)" % \ (zone, port, protocol, timeout)) @dbus.service.signal(config.dbus.DBUS_INTERFACE_ZONE, signature='sss') @dbus_handle_exceptions def PortRemoved(self, zone, port, protocol): log.debug1("zone.PortRemoved('%s', '%s', '%s')" % \ (zone, port, protocol)) # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # PROTOCOLS @dbus_handle_exceptions def disableTimedProtocol(self, zone, protocol): log.debug1("zone.disableTimedProtocol('%s', '%s')" % (zone, protocol)) del self._timeouts[zone][(protocol)] self.fw.zone.remove_protocol(zone, protocol) self.ProtocolRemoved(zone, protocol) @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG) @dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='ssi', out_signature='s') @dbus_handle_exceptions def addProtocol(self, zone, protocol, timeout, sender=None): # adds protocol <protocol> if not enabled already to zone zone = dbus_to_python(zone, str) protocol = dbus_to_python(protocol, str) timeout = dbus_to_python(timeout, int) log.debug1("zone.enableProtocol('%s', '%s')" % (zone, protocol)) self.accessCheck(sender) _zone = self.fw.zone.add_protocol(zone, protocol, timeout, sender) if timeout > 0: tag = GLib.timeout_add_seconds(timeout, self.disableTimedProtocol, _zone, protocol) self.addTimeout(_zone, protocol, tag) self.ProtocolAdded(_zone, protocol, timeout) return _zone @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG) @dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='ss', out_signature='s') @dbus_handle_exceptions def removeProtocol(self, zone, protocol, sender=None): # removes protocol<protocol> if enabled from zone zone = dbus_to_python(zone, str) protocol = dbus_to_python(protocol, str) log.debug1("zone.removeProtocol('%s', '%s')" % (zone, protocol)) self.accessCheck(sender) _zone= self.fw.zone.remove_protocol(zone, protocol) self.removeTimeout(_zone, protocol) self.ProtocolRemoved(_zone, protocol) return _zone @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG_INFO) @dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='ss', out_signature='b') @dbus_handle_exceptions def queryProtocol(self, zone, protocol, sender=None): # pylint: disable=W0613 # returns true if a protocol is enabled for zone zone = dbus_to_python(zone, str) protocol = dbus_to_python(protocol, str) log.debug1("zone.queryProtocol('%s', '%s')" % (zone, protocol)) return self.fw.zone.query_protocol(zone, protocol) @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG_INFO) @dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='s', out_signature='as') @dbus_handle_exceptions def getProtocols(self, zone, sender=None): # pylint: disable=W0613 # returns the list of enabled protocols # TODO: should be renamed to listProtocols() # because is called by firewall-cmd --zone --list-protocols zone = dbus_to_python(zone, str) log.debug1("zone.getProtocols('%s')" % (zone)) return self.fw.zone.list_protocols(zone) @dbus.service.signal(config.dbus.DBUS_INTERFACE_ZONE, signature='ssi') @dbus_handle_exceptions def ProtocolAdded(self, zone, protocol, timeout=0): log.debug1("zone.ProtocolAdded('%s', '%s', %d)" % \ (zone, protocol, timeout)) @dbus.service.signal(config.dbus.DBUS_INTERFACE_ZONE, signature='ss') @dbus_handle_exceptions def ProtocolRemoved(self, zone, protocol): log.debug1("zone.ProtocolRemoved('%s', '%s')" % (zone, protocol)) # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # SOURCE PORTS @dbus_handle_exceptions def disableTimedSourcePort(self, zone, port, protocol): log.debug1("zone.disableTimedSourcePort('%s', '%s', '%s')" % \ (zone, port, protocol)) del self._timeouts[zone][("sport", port, protocol)] self.fw.zone.remove_source_port(zone, port, protocol) self.SourcePortRemoved(zone, port, protocol) @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG) @dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='sssi', out_signature='s') @dbus_handle_exceptions def addSourcePort(self, zone, port, protocol, timeout, sender=None): # pylint: disable=R0913 # adds source port <port> <protocol> if not enabled already to zone zone = dbus_to_python(zone, str) port = dbus_to_python(port, str) protocol = dbus_to_python(protocol, str) timeout = dbus_to_python(timeout, int) log.debug1("zone.addSourcePort('%s', '%s', '%s')" % (zone, port, protocol)) self.accessCheck(sender) _zone = self.fw.zone.add_source_port(zone, port, protocol, timeout, sender) if timeout > 0: tag = GLib.timeout_add_seconds(timeout, self.disableTimedSourcePort, _zone, port, protocol) self.addTimeout(_zone, ("sport", port, protocol), tag) self.SourcePortAdded(_zone, port, protocol, timeout) return _zone @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG) @dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='sss', out_signature='s') @dbus_handle_exceptions def removeSourcePort(self, zone, port, protocol, sender=None): # pylint: disable=R0913 # removes source port<port> <protocol> if enabled from zone zone = dbus_to_python(zone, str) port = dbus_to_python(port, str) protocol = dbus_to_python(protocol, str) log.debug1("zone.removeSourcePort('%s', '%s', '%s')" % (zone, port, protocol)) self.accessCheck(sender) _zone= self.fw.zone.remove_source_port(zone, port, protocol) self.removeTimeout(_zone, ("sport", port, protocol)) self.SourcePortRemoved(_zone, port, protocol) return _zone @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG_INFO) @dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='sss', out_signature='b') @dbus_handle_exceptions def querySourcePort(self, zone, port, protocol, sender=None): # pylint: disable=W0613, R0913 # returns true if a source port is enabled for zone zone = dbus_to_python(zone, str) port = dbus_to_python(port, str) protocol = dbus_to_python(protocol, str) log.debug1("zone.querySourcePort('%s', '%s', '%s')" % (zone, port, protocol)) return self.fw.zone.query_source_port(zone, port, protocol) @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG_INFO) @dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='s', out_signature='aas') @dbus_handle_exceptions def getSourcePorts(self, zone, sender=None): # pylint: disable=W0613 # returns the list of enabled source ports # TODO: should be renamed to listSourcePorts() # because is called by firewall-cmd --zone --list-source-ports zone = dbus_to_python(zone, str) log.debug1("zone.getSourcePorts('%s')" % (zone)) return self.fw.zone.list_source_ports(zone) @dbus.service.signal(config.dbus.DBUS_INTERFACE_ZONE, signature='sssi') @dbus_handle_exceptions def SourcePortAdded(self, zone, port, protocol, timeout=0): log.debug1("zone.SourcePortAdded('%s', '%s', '%s', %d)" % \ (zone, port, protocol, timeout)) @dbus.service.signal(config.dbus.DBUS_INTERFACE_ZONE, signature='sss') @dbus_handle_exceptions def SourcePortRemoved(self, zone, port, protocol): log.debug1("zone.SourcePortRemoved('%s', '%s', '%s')" % (zone, port, protocol)) # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # MASQUERADE @dbus_handle_exceptions def disableTimedMasquerade(self, zone): del self._timeouts[zone]["masquerade"] self.fw.zone.remove_masquerade(zone) self.MasqueradeRemoved(zone) @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG) @dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='si', out_signature='s') @dbus_handle_exceptions def addMasquerade(self, zone, timeout, sender=None): # adds masquerade if not added already zone = dbus_to_python(zone, str) timeout = dbus_to_python(timeout, int) log.debug1("zone.addMasquerade('%s')" % (zone)) self.accessCheck(sender) _zone = self.fw.zone.add_masquerade(zone, timeout, sender) if timeout > 0: tag = GLib.timeout_add_seconds(timeout, self.disableTimedMasquerade, _zone) self.addTimeout(_zone, "masquerade", tag) self.MasqueradeAdded(_zone, timeout) return _zone @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG) @dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='s', out_signature='s') @dbus_handle_exceptions def removeMasquerade(self, zone, sender=None): # removes masquerade zone = dbus_to_python(zone, str) log.debug1("zone.removeMasquerade('%s')" % (zone)) self.accessCheck(sender) _zone = self.fw.zone.remove_masquerade(zone) self.removeTimeout(_zone, "masquerade") self.MasqueradeRemoved(_zone) return _zone @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG_INFO) @dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='s', out_signature='b') @dbus_handle_exceptions def queryMasquerade(self, zone, sender=None): # pylint: disable=W0613 # returns true if a masquerade is added zone = dbus_to_python(zone, str) log.debug1("zone.queryMasquerade('%s')" % (zone)) return self.fw.zone.query_masquerade(zone) @dbus.service.signal(config.dbus.DBUS_INTERFACE_ZONE, signature='si') @dbus_handle_exceptions def MasqueradeAdded(self, zone, timeout=0): log.debug1("zone.MasqueradeAdded('%s', %d)" % (zone, timeout)) @dbus.service.signal(config.dbus.DBUS_INTERFACE_ZONE, signature='s') @dbus_handle_exceptions def MasqueradeRemoved(self, zone): log.debug1("zone.MasqueradeRemoved('%s')" % (zone)) # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # FORWARD PORT @dbus_handle_exceptions def disable_forward_port(self, zone, port, protocol, toport, toaddr): # pylint: disable=R0913 del self._timeouts[zone][(port, protocol, toport, toaddr)] self.fw.zone.remove_forward_port(zone, port, protocol, toport, toaddr) self.ForwardPortRemoved(zone, port, protocol, toport, toaddr) @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG) @dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='sssssi', out_signature='s') @dbus_handle_exceptions def addForwardPort(self, zone, port, protocol, toport, toaddr, timeout, sender=None): # pylint: disable=R0913 # add forward port if not enabled already for zone zone = dbus_to_python(zone, str) port = dbus_to_python(port, str) protocol = dbus_to_python(protocol, str) toport = dbus_to_python(toport, str) toaddr = dbus_to_python(toaddr, str) timeout = dbus_to_python(timeout, int) log.debug1("zone.addForwardPort('%s', '%s', '%s', '%s', '%s')" % \ (zone, port, protocol, toport, toaddr)) self.accessCheck(sender) _zone = self.fw.zone.add_forward_port(zone, port, protocol, toport, toaddr, timeout, sender) if timeout > 0: tag = GLib.timeout_add_seconds(timeout, self.disable_forward_port, _zone, port, protocol, toport, toaddr) self.addTimeout(_zone, (port, protocol, toport, toaddr), tag) self.ForwardPortAdded(_zone, port, protocol, toport, toaddr, timeout) return _zone @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG) @dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='sssss', out_signature='s') @dbus_handle_exceptions def removeForwardPort(self, zone, port, protocol, toport, toaddr, sender=None): # pylint: disable=R0913 # remove forward port from zone zone = dbus_to_python(zone, str) port = dbus_to_python(port, str) protocol = dbus_to_python(protocol, str) toport = dbus_to_python(toport, str) toaddr = dbus_to_python(toaddr, str) log.debug1("zone.removeForwardPort('%s', '%s', '%s', '%s', '%s')" % \ (zone, port, protocol, toport, toaddr)) self.accessCheck(sender) _zone = self.fw.zone.remove_forward_port(zone, port, protocol, toport, toaddr) self.removeTimeout(_zone, (port, protocol, toport, toaddr)) self.ForwardPortRemoved(_zone, port, protocol, toport, toaddr) return _zone @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG_INFO) @dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='sssss', out_signature='b') @dbus_handle_exceptions def queryForwardPort(self, zone, port, protocol, toport, toaddr, sender=None): # pylint: disable=W0613, R0913 # returns true if a forward port is enabled for zone zone = dbus_to_python(zone, str) port = dbus_to_python(port, str) protocol = dbus_to_python(protocol, str) toport = dbus_to_python(toport, str) toaddr = dbus_to_python(toaddr, str) log.debug1("zone.queryForwardPort('%s', '%s', '%s', '%s', '%s')" % \ (zone, port, protocol, toport, toaddr)) return self.fw.zone.query_forward_port(zone, port, protocol, toport, toaddr) @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG_INFO) @dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='s', out_signature='aas') @dbus_handle_exceptions def getForwardPorts(self, zone, sender=None): # pylint: disable=W0613 # returns the list of enabled ports for zone # TODO: should be renamed to listForwardPorts() # because is called by firewall-cmd --zone --list-forward-ports zone = dbus_to_python(zone, str) log.debug1("zone.getForwardPorts('%s')" % (zone)) return self.fw.zone.list_forward_ports(zone) @dbus.service.signal(config.dbus.DBUS_INTERFACE_ZONE, signature='sssssi') @dbus_handle_exceptions def ForwardPortAdded(self, zone, port, protocol, toport, toaddr, timeout=0): # pylint: disable=R0913 log.debug1("zone.ForwardPortAdded('%s', '%s', '%s', '%s', '%s', %d)" % \ (zone, port, protocol, toport, toaddr, timeout)) @dbus.service.signal(config.dbus.DBUS_INTERFACE_ZONE, signature='sssss') @dbus_handle_exceptions def ForwardPortRemoved(self, zone, port, protocol, toport, toaddr): # pylint: disable=R0913 log.debug1("zone.ForwardPortRemoved('%s', '%s', '%s', '%s', '%s')" % \ (zone, port, protocol, toport, toaddr)) # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # ICMP BLOCK @dbus_handle_exceptions def disableTimedIcmpBlock(self, zone, icmp, sender): # pylint: disable=W0613 log.debug1("zone.disableTimedIcmpBlock('%s', '%s')" % (zone, icmp)) del self._timeouts[zone][icmp] self.fw.zone.remove_icmp_block(zone, icmp) self.IcmpBlockRemoved(zone, icmp) @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG) @dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='ssi', out_signature='s') @dbus_handle_exceptions def addIcmpBlock(self, zone, icmp, timeout, sender=None): # add icmpblock <icmp> if not enabled already for zone zone = dbus_to_python(zone, str) icmp = dbus_to_python(icmp, str) timeout = dbus_to_python(timeout, int) log.debug1("zone.enableIcmpBlock('%s', '%s')" % (zone, icmp)) self.accessCheck(sender) _zone = self.fw.zone.add_icmp_block(zone, icmp, timeout, sender) if timeout > 0: tag = GLib.timeout_add_seconds(timeout, self.disableTimedIcmpBlock, _zone, icmp, sender) self.addTimeout(_zone, icmp, tag) self.IcmpBlockAdded(_zone, icmp, timeout) return _zone @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG) @dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='ss', out_signature='s') @dbus_handle_exceptions def removeIcmpBlock(self, zone, icmp, sender=None): # removes icmpBlock from zone zone = dbus_to_python(zone, str) icmp = dbus_to_python(icmp, str) log.debug1("zone.removeIcmpBlock('%s', '%s')" % (zone, icmp)) self.accessCheck(sender) _zone = self.fw.zone.remove_icmp_block(zone, icmp) self.removeTimeout(_zone, icmp) self.IcmpBlockRemoved(_zone, icmp) return _zone @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG_INFO) @dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='ss', out_signature='b') @dbus_handle_exceptions def queryIcmpBlock(self, zone, icmp, sender=None): # pylint: disable=W0613 # returns true if a icmp is enabled for zone zone = dbus_to_python(zone, str) icmp = dbus_to_python(icmp, str) log.debug1("zone.queryIcmpBlock('%s', '%s')" % (zone, icmp)) return self.fw.zone.query_icmp_block(zone, icmp) @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG_INFO) @dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='s', out_signature='as') @dbus_handle_exceptions def getIcmpBlocks(self, zone, sender=None): # pylint: disable=W0613 # returns the list of enabled icmpblocks # TODO: should be renamed to listIcmpBlocks() # because is called by firewall-cmd --zone --list-icmp-blocks zone = dbus_to_python(zone, str) log.debug1("zone.getIcmpBlocks('%s')" % (zone)) return self.fw.zone.list_icmp_blocks(zone) @dbus.service.signal(config.dbus.DBUS_INTERFACE_ZONE, signature='ssi') @dbus_handle_exceptions def IcmpBlockAdded(self, zone, icmp, timeout=0): log.debug1("zone.IcmpBlockAdded('%s', '%s', %d)" % \ (zone, icmp, timeout)) @dbus.service.signal(config.dbus.DBUS_INTERFACE_ZONE, signature='ss') @dbus_handle_exceptions def IcmpBlockRemoved(self, zone, icmp): log.debug1("zone.IcmpBlockRemoved('%s', '%s')" % (zone, icmp)) # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # ICMP BLOCK INVERSION @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG) @dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='s', out_signature='s') @dbus_handle_exceptions def addIcmpBlockInversion(self, zone, sender=None): # adds icmpBlockInversion if not added already zone = dbus_to_python(zone, str) log.debug1("zone.addIcmpBlockInversion('%s')" % (zone)) self.accessCheck(sender) _zone = self.fw.zone.add_icmp_block_inversion(zone, sender) self.IcmpBlockInversionAdded(_zone) return _zone @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG) @dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='s', out_signature='s') @dbus_handle_exceptions def removeIcmpBlockInversion(self, zone, sender=None): # removes icmpBlockInversion zone = dbus_to_python(zone, str) log.debug1("zone.removeIcmpBlockInversion('%s')" % (zone)) self.accessCheck(sender) _zone = self.fw.zone.remove_icmp_block_inversion(zone) self.IcmpBlockInversionRemoved(_zone) return _zone @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG_INFO) @dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='s', out_signature='b') @dbus_handle_exceptions def queryIcmpBlockInversion(self, zone, sender=None): # pylint: disable=W0613 # returns true if a icmpBlockInversion is added zone = dbus_to_python(zone, str) log.debug1("zone.queryIcmpBlockInversion('%s')" % (zone)) return self.fw.zone.query_icmp_block_inversion(zone) @dbus.service.signal(config.dbus.DBUS_INTERFACE_ZONE, signature='s') @dbus_handle_exceptions def IcmpBlockInversionAdded(self, zone): log.debug1("zone.IcmpBlockInversionAdded('%s')" % (zone)) @dbus.service.signal(config.dbus.DBUS_INTERFACE_ZONE, signature='s') @dbus_handle_exceptions def IcmpBlockInversionRemoved(self, zone): log.debug1("zone.IcmpBlockInversionRemoved('%s')" % (zone)) # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # DIRECT INTERFACE # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # DIRECT CHAIN @dbus_polkit_require_auth(config.dbus.PK_ACTION_DIRECT) @dbus_service_method_deprecated(config.dbus.DBUS_INTERFACE_DIRECT) @dbus_service_method(config.dbus.DBUS_INTERFACE_DIRECT, in_signature='sss', out_signature='') @dbus_handle_exceptions def addChain(self, ipv, table, chain, sender=None): # inserts direct chain ipv = dbus_to_python(ipv, str) table = dbus_to_python(table, str) chain = dbus_to_python(chain, str) log.debug1("direct.addChain('%s', '%s', '%s')" % (ipv, table, chain)) self.accessCheck(sender) self.fw.direct.add_chain(ipv, table, chain) self.ChainAdded(ipv, table, chain) @dbus_polkit_require_auth(config.dbus.PK_ACTION_DIRECT) @dbus_service_method_deprecated(config.dbus.DBUS_INTERFACE_DIRECT) @dbus_service_method(config.dbus.DBUS_INTERFACE_DIRECT, in_signature='sss', out_signature='') @dbus_handle_exceptions def removeChain(self, ipv, table, chain, sender=None): # removes direct chain ipv = dbus_to_python(ipv, str) table = dbus_to_python(table, str) chain = dbus_to_python(chain, str) log.debug1("direct.removeChain('%s', '%s', '%s')" % (ipv, table, chain)) self.accessCheck(sender) self.fw.direct.remove_chain(ipv, table, chain) self.ChainRemoved(ipv, table, chain) @dbus_polkit_require_auth(config.dbus.PK_ACTION_DIRECT_INFO) @dbus_service_method_deprecated(config.dbus.DBUS_INTERFACE_DIRECT) @dbus_service_method(config.dbus.DBUS_INTERFACE_DIRECT, in_signature='sss', out_signature='b') @dbus_handle_exceptions def queryChain(self, ipv, table, chain, sender=None): # pylint: disable=W0613 # returns true if a chain is enabled ipv = dbus_to_python(ipv, str) table = dbus_to_python(table, str) chain = dbus_to_python(chain, str) log.debug1("direct.queryChain('%s', '%s', '%s')" % (ipv, table, chain)) return self.fw.direct.query_chain(ipv, table, chain) @dbus_polkit_require_auth(config.dbus.PK_ACTION_DIRECT_INFO) @dbus_service_method_deprecated(config.dbus.DBUS_INTERFACE_DIRECT) @dbus_service_method(config.dbus.DBUS_INTERFACE_DIRECT, in_signature='ss', out_signature='as') @dbus_handle_exceptions def getChains(self, ipv, table, sender=None): # pylint: disable=W0613 # returns list of added chains ipv = dbus_to_python(ipv, str) table = dbus_to_python(table, str) log.debug1("direct.getChains('%s', '%s')" % (ipv, table)) return self.fw.direct.get_chains(ipv, table) @dbus_polkit_require_auth(config.dbus.PK_ACTION_DIRECT_INFO) @dbus_service_method_deprecated(config.dbus.DBUS_INTERFACE_DIRECT) @dbus_service_method(config.dbus.DBUS_INTERFACE_DIRECT, in_signature='', out_signature='a(sss)') @dbus_handle_exceptions def getAllChains(self, sender=None): # pylint: disable=W0613 # returns list of added chains log.debug1("direct.getAllChains()") return self.fw.direct.get_all_chains() @dbus_service_signal_deprecated(config.dbus.DBUS_INTERFACE_DIRECT) @dbus.service.signal(config.dbus.DBUS_INTERFACE_DIRECT, signature='sss') @dbus_handle_exceptions def ChainAdded(self, ipv, table, chain): log.debug1("direct.ChainAdded('%s', '%s', '%s')" % (ipv, table, chain)) @dbus_service_signal_deprecated(config.dbus.DBUS_INTERFACE_DIRECT) @dbus.service.signal(config.dbus.DBUS_INTERFACE_DIRECT, signature='sss') @dbus_handle_exceptions def ChainRemoved(self, ipv, table, chain): log.debug1("direct.ChainRemoved('%s', '%s', '%s')" % (ipv, table, chain)) # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # DIRECT RULE @dbus_polkit_require_auth(config.dbus.PK_ACTION_DIRECT) @dbus_service_method_deprecated(config.dbus.DBUS_INTERFACE_DIRECT) @dbus_service_method(config.dbus.DBUS_INTERFACE_DIRECT, in_signature='sssias', out_signature='') @dbus_handle_exceptions def addRule(self, ipv, table, chain, priority, args, sender=None): # pylint: disable=R0913 # inserts direct rule ipv = dbus_to_python(ipv, str) table = dbus_to_python(table, str) chain = dbus_to_python(chain, str) priority = dbus_to_python(priority, int) args = tuple( dbus_to_python(i, str) for i in args ) log.debug1("direct.addRule('%s', '%s', '%s', %d, '%s')" % \ (ipv, table, chain, priority, "','".join(args))) self.accessCheck(sender) self.fw.direct.add_rule(ipv, table, chain, priority, args) self.RuleAdded(ipv, table, chain, priority, args) @dbus_polkit_require_auth(config.dbus.PK_ACTION_DIRECT) @dbus_service_method_deprecated(config.dbus.DBUS_INTERFACE_DIRECT) @dbus_service_method(config.dbus.DBUS_INTERFACE_DIRECT, in_signature='sssias', out_signature='') @dbus_handle_exceptions def removeRule(self, ipv, table, chain, priority, args, sender=None): # pylint: disable=R0913 # removes direct rule ipv = dbus_to_python(ipv, str) table = dbus_to_python(table, str) chain = dbus_to_python(chain, str) priority = dbus_to_python(priority, int) args = tuple( dbus_to_python(i, str) for i in args ) log.debug1("direct.removeRule('%s', '%s', '%s', %d, '%s')" % \ (ipv, table, chain, priority, "','".join(args))) self.accessCheck(sender) self.fw.direct.remove_rule(ipv, table, chain, priority, args) self.RuleRemoved(ipv, table, chain, priority, args) @dbus_polkit_require_auth(config.dbus.PK_ACTION_DIRECT) @dbus_service_method_deprecated(config.dbus.DBUS_INTERFACE_DIRECT) @dbus_service_method(config.dbus.DBUS_INTERFACE_DIRECT, in_signature='sss', out_signature='') @dbus_handle_exceptions def removeRules(self, ipv, table, chain, sender=None): # removes direct rule ipv = dbus_to_python(ipv, str) table = dbus_to_python(table, str) chain = dbus_to_python(chain, str) log.debug1("direct.removeRules('%s', '%s', '%s')" % (ipv, table, chain)) self.accessCheck(sender) for (priority, args) in self.fw.direct.get_rules(ipv, table, chain): self.fw.direct.remove_rule(ipv, table, chain, priority, args) self.RuleRemoved(ipv, table, chain, priority, args) @dbus_polkit_require_auth(config.dbus.PK_ACTION_DIRECT_INFO) @dbus_service_method_deprecated(config.dbus.DBUS_INTERFACE_DIRECT) @dbus_service_method(config.dbus.DBUS_INTERFACE_DIRECT, in_signature='sssias', out_signature='b') @dbus_handle_exceptions def queryRule(self, ipv, table, chain, priority, args, sender=None): # pylint: disable=W0613, R0913 # returns true if a rule is enabled ipv = dbus_to_python(ipv, str) table = dbus_to_python(table, str) chain = dbus_to_python(chain, str) priority = dbus_to_python(priority, int) args = tuple( dbus_to_python(i, str) for i in args ) log.debug1("direct.queryRule('%s', '%s', '%s', %d, '%s')" % \ (ipv, table, chain, priority, "','".join(args))) return self.fw.direct.query_rule(ipv, table, chain, priority, args) @dbus_polkit_require_auth(config.dbus.PK_ACTION_DIRECT_INFO) @dbus_service_method_deprecated(config.dbus.DBUS_INTERFACE_DIRECT) @dbus_service_method(config.dbus.DBUS_INTERFACE_DIRECT, in_signature='sss', out_signature='a(ias)') @dbus_handle_exceptions def getRules(self, ipv, table, chain, sender=None): # pylint: disable=W0613 # returns list of added rules ipv = dbus_to_python(ipv, str) table = dbus_to_python(table, str) chain = dbus_to_python(chain, str) log.debug1("direct.getRules('%s', '%s', '%s')" % (ipv, table, chain)) return self.fw.direct.get_rules(ipv, table, chain) @dbus_polkit_require_auth(config.dbus.PK_ACTION_DIRECT_INFO) @dbus_service_method_deprecated(config.dbus.DBUS_INTERFACE_DIRECT) @dbus_service_method(config.dbus.DBUS_INTERFACE_DIRECT, in_signature='', out_signature='a(sssias)') @dbus_handle_exceptions def getAllRules(self, sender=None): # pylint: disable=W0613 # returns list of added rules log.debug1("direct.getAllRules()") return self.fw.direct.get_all_rules() @dbus_service_signal_deprecated(config.dbus.DBUS_INTERFACE_DIRECT) @dbus.service.signal(config.dbus.DBUS_INTERFACE_DIRECT, signature='sssias') @dbus_handle_exceptions def RuleAdded(self, ipv, table, chain, priority, args): # pylint: disable=R0913 log.debug1("direct.RuleAdded('%s', '%s', '%s', %d, '%s')" % \ (ipv, table, chain, priority, "','".join(args))) @dbus_service_signal_deprecated(config.dbus.DBUS_INTERFACE_DIRECT) @dbus.service.signal(config.dbus.DBUS_INTERFACE_DIRECT, signature='sssias') @dbus_handle_exceptions def RuleRemoved(self, ipv, table, chain, priority, args): # pylint: disable=R0913 log.debug1("direct.RuleRemoved('%s', '%s', '%s', %d, '%s')" % \ (ipv, table, chain, priority, "','".join(args))) # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # DIRECT PASSTHROUGH (untracked) @dbus_polkit_require_auth(config.dbus.PK_ACTION_DIRECT) @dbus_service_method_deprecated(config.dbus.DBUS_INTERFACE_DIRECT) @dbus_service_method(config.dbus.DBUS_INTERFACE_DIRECT, in_signature='sas', out_signature='s') @dbus_handle_exceptions def passthrough(self, ipv, args, sender=None): # inserts direct rule ipv = dbus_to_python(ipv, str) args = tuple( dbus_to_python(i, str) for i in args ) log.debug1("direct.passthrough('%s', '%s')" % (ipv, "','".join(args))) self.accessCheck(sender) try: return self.fw.direct.passthrough(ipv, args) except FirewallError as error: if ipv in ["ipv4", "ipv6"]: query_args = set(["-C", "--check", "-L", "--list"]) else: query_args = set(["-L", "--list"]) msg = str(error) if error.code == errors.COMMAND_FAILED: if len(set(args) & query_args) <= 0: log.warning(msg) raise FirewallDBusException(msg) raise # DIRECT PASSTHROUGH (tracked) @dbus_polkit_require_auth(config.dbus.PK_ACTION_DIRECT) @dbus_service_method_deprecated(config.dbus.DBUS_INTERFACE_DIRECT) @dbus_service_method(config.dbus.DBUS_INTERFACE_DIRECT, in_signature='sas', out_signature='') @dbus_handle_exceptions def addPassthrough(self, ipv, args, sender=None): # inserts direct passthrough ipv = dbus_to_python(ipv) args = tuple( dbus_to_python(i) for i in args ) log.debug1("direct.addPassthrough('%s', '%s')" % \ (ipv, "','".join(args))) self.accessCheck(sender) self.fw.direct.add_passthrough(ipv, args) self.PassthroughAdded(ipv, args) @dbus_polkit_require_auth(config.dbus.PK_ACTION_DIRECT) @dbus_service_method_deprecated(config.dbus.DBUS_INTERFACE_DIRECT) @dbus_service_method(config.dbus.DBUS_INTERFACE_DIRECT, in_signature='sas', out_signature='') @dbus_handle_exceptions def removePassthrough(self, ipv, args, sender=None): # removes direct passthrough ipv = dbus_to_python(ipv) args = tuple( dbus_to_python(i) for i in args ) log.debug1("direct.removePassthrough('%s', '%s')" % \ (ipv, "','".join(args))) self.accessCheck(sender) self.fw.direct.remove_passthrough(ipv, args) self.PassthroughRemoved(ipv, args) @dbus_polkit_require_auth(config.dbus.PK_ACTION_DIRECT_INFO) @dbus_service_method_deprecated(config.dbus.DBUS_INTERFACE_DIRECT) @dbus_service_method(config.dbus.DBUS_INTERFACE_DIRECT, in_signature='sas', out_signature='b') @dbus_handle_exceptions def queryPassthrough(self, ipv, args, sender=None): # pylint: disable=W0613 # returns true if a passthrough is enabled ipv = dbus_to_python(ipv) args = tuple( dbus_to_python(i) for i in args ) log.debug1("direct.queryPassthrough('%s', '%s')" % \ (ipv, "','".join(args))) return self.fw.direct.query_passthrough(ipv, args) @dbus_polkit_require_auth(config.dbus.PK_ACTION_DIRECT_INFO) @dbus_service_method_deprecated(config.dbus.DBUS_INTERFACE_DIRECT) @dbus_service_method(config.dbus.DBUS_INTERFACE_DIRECT, in_signature='', out_signature='a(sas)') @dbus_handle_exceptions def getAllPassthroughs(self, sender=None): # pylint: disable=W0613 # returns list of all added passthroughs log.debug1("direct.getAllPassthroughs()") return self.fw.direct.get_all_passthroughs() @dbus_polkit_require_auth(config.dbus.PK_ACTION_DIRECT) @dbus_service_method_deprecated(config.dbus.DBUS_INTERFACE_DIRECT) @dbus_service_method(config.dbus.DBUS_INTERFACE_DIRECT, in_signature='', out_signature='') @dbus_handle_exceptions def removeAllPassthroughs(self, sender=None): # pylint: disable=W0613 # remove all passhroughs log.debug1("direct.removeAllPassthroughs()") # remove in reverse order to avoid removing non-empty chains for passthrough in reversed(self.getAllPassthroughs()): self.removePassthrough(*passthrough) @dbus_polkit_require_auth(config.dbus.PK_ACTION_DIRECT_INFO) @dbus_service_method_deprecated(config.dbus.DBUS_INTERFACE_DIRECT) @dbus_service_method(config.dbus.DBUS_INTERFACE_DIRECT, in_signature='s', out_signature='aas') @dbus_handle_exceptions def getPassthroughs(self, ipv, sender=None): # pylint: disable=W0613 # returns list of all added passthroughs with ipv ipv = dbus_to_python(ipv) log.debug1("direct.getPassthroughs('%s')", ipv) return self.fw.direct.get_passthroughs(ipv) @dbus_service_signal_deprecated(config.dbus.DBUS_INTERFACE_DIRECT) @dbus.service.signal(config.dbus.DBUS_INTERFACE_DIRECT, signature='sas') @dbus_handle_exceptions def PassthroughAdded(self, ipv, args): log.debug1("direct.PassthroughAdded('%s', '%s')" % \ (ipv, "','".join(args))) @dbus_service_signal_deprecated(config.dbus.DBUS_INTERFACE_DIRECT) @dbus.service.signal(config.dbus.DBUS_INTERFACE_DIRECT, signature='sas') @dbus_handle_exceptions def PassthroughRemoved(self, ipv, args): log.debug1("direct.PassthroughRemoved('%s', '%s')" % \ (ipv, "','".join(args))) # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # @dbus_polkit_require_auth(config.dbus.PK_ACTION_ALL) @dbus_service_method(config.dbus.DBUS_INTERFACE, in_signature='', out_signature='') @dbus_handle_exceptions def authorizeAll(self, sender=None): # pylint: disable=W0613 """ PK_ACTION_ALL implies all other actions, i.e. once a subject is authorized for PK_ACTION_ALL it's also authorized for any other action. Use-case is GUI (RHBZ#994729). """ pass # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # IPSETS # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # @dbus_polkit_require_auth(config.dbus.PK_ACTION_INFO) @dbus_service_method(config.dbus.DBUS_INTERFACE_IPSET, in_signature='s', out_signature='b') @dbus_handle_exceptions def queryIPSet(self, ipset, sender=None): # pylint: disable=W0613 # returns true if a set with the name exists ipset = dbus_to_python(ipset) log.debug1("ipset.queryIPSet('%s')" % (ipset)) return self.fw.ipset.query_ipset(ipset) @dbus_polkit_require_auth(config.dbus.PK_ACTION_INFO) @dbus_service_method(config.dbus.DBUS_INTERFACE_IPSET, in_signature='', out_signature='as') @dbus_handle_exceptions def getIPSets(self, sender=None): # pylint: disable=W0613 # returns list of added sets log.debug1("ipsets.getIPSets()") return self.fw.ipset.get_ipsets() @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG_INFO) @dbus_service_method(config.dbus.DBUS_INTERFACE_IPSET, in_signature='s', out_signature=IPSet.DBUS_SIGNATURE) @dbus_handle_exceptions def getIPSetSettings(self, ipset, sender=None): # pylint: disable=W0613 # returns ipset settings for ipset ipset = dbus_to_python(ipset, str) log.debug1("getIPSetSettings(%s)", ipset) return self.fw.ipset.get_ipset(ipset).export_config() # set entries # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG) @dbus_service_method(config.dbus.DBUS_INTERFACE_IPSET, in_signature='ss', out_signature='') @dbus_handle_exceptions def addEntry(self, ipset, entry, sender=None): # adds ipset entry ipset = dbus_to_python(ipset) entry = dbus_to_python(entry) log.debug1("ipset.addEntry('%s', '%s')" % (ipset, entry)) self.accessCheck(sender) self.fw.ipset.add_entry(ipset, entry) self.EntryAdded(ipset, entry) @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG) @dbus_service_method(config.dbus.DBUS_INTERFACE_IPSET, in_signature='ss', out_signature='') @dbus_handle_exceptions def removeEntry(self, ipset, entry, sender=None): # removes ipset entry ipset = dbus_to_python(ipset) entry = dbus_to_python(entry) log.debug1("ipset.removeEntry('%s', '%s')" % (ipset, entry)) self.accessCheck(sender) self.fw.ipset.remove_entry(ipset, entry) self.EntryRemoved(ipset, entry) @dbus_polkit_require_auth(config.dbus.PK_ACTION_INFO) @dbus_service_method(config.dbus.DBUS_INTERFACE_IPSET, in_signature='ss', out_signature='b') @dbus_handle_exceptions def queryEntry(self, ipset, entry, sender=None): # pylint: disable=W0613 # returns true if the entry exists in the ipset ipset = dbus_to_python(ipset) entry = dbus_to_python(entry) log.debug1("ipset.queryEntry('%s', '%s')" % (ipset, entry)) return self.fw.ipset.query_entry(ipset, entry) @dbus_polkit_require_auth(config.dbus.PK_ACTION_INFO) @dbus_service_method(config.dbus.DBUS_INTERFACE_IPSET, in_signature='s', out_signature='as') @dbus_handle_exceptions def getEntries(self, ipset, sender=None): # pylint: disable=W0613 # returns list of added entries for the ipset ipset = dbus_to_python(ipset) log.debug1("ipset.getEntries('%s')" % ipset) return self.fw.ipset.get_entries(ipset) @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG) @dbus_service_method(config.dbus.DBUS_INTERFACE_IPSET, in_signature='sas') @dbus_handle_exceptions def setEntries(self, ipset, entries, sender=None): # pylint: disable=W0613 # returns list of added entries for the ipset ipset = dbus_to_python(ipset) entries = dbus_to_python(entries, list) log.debug1("ipset.setEntries('%s', '[%s]')", ipset, ",".join(entries)) old_entries = self.fw.ipset.get_entries(ipset) self.fw.ipset.set_entries(ipset, entries) old_entries_set = set(old_entries) entries_set = set(entries) for entry in entries_set - old_entries_set: self.EntryAdded(ipset, entry) for entry in old_entries_set - entries_set: self.EntryRemoved(ipset, entry) @dbus.service.signal(config.dbus.DBUS_INTERFACE_IPSET, signature='ss') @dbus_handle_exceptions def EntryAdded(self, ipset, entry): ipset = dbus_to_python(ipset) entry = dbus_to_python(entry) log.debug1("ipset.EntryAdded('%s', '%s')" % (ipset, entry)) @dbus.service.signal(config.dbus.DBUS_INTERFACE_IPSET, signature='ss') @dbus_handle_exceptions def EntryRemoved(self, ipset, entry): ipset = dbus_to_python(ipset) entry = dbus_to_python(entry) log.debug1("ipset.EntryRemoved('%s', '%s')" % (ipset, entry)) # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # HELPERS # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # @dbus_polkit_require_auth(config.dbus.PK_ACTION_INFO) @dbus_service_method(config.dbus.DBUS_INTERFACE, in_signature='', out_signature='as') @dbus_handle_exceptions def getHelpers(self, sender=None): # pylint: disable=W0613 # returns list of added sets log.debug1("helpers.getHelpers()") return self.fw.helper.get_helpers() @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG_INFO) @dbus_service_method(config.dbus.DBUS_INTERFACE, in_signature='s', out_signature=Helper.DBUS_SIGNATURE) @dbus_handle_exceptions def getHelperSettings(self, helper, sender=None): # pylint: disable=W0613 # returns helper settings for helper helper = dbus_to_python(helper, str) log.debug1("getHelperSettings(%s)", helper) return self.fw.helper.get_helper(helper).export_config() server/__init__.py 0000644 00000000000 15025011705 0010145 0 ustar 00 server/server.py 0000644 00000007131 15025011705 0007730 0 ustar 00 # -*- coding: utf-8 -*- # # Copyright (C) 2010-2016 Red Hat, Inc. # # Authors: # Thomas Woerner <twoerner@redhat.com> # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see <http://www.gnu.org/licenses/>. # # signal handling and run_server derived from setroubleshoot # Copyright (C) 2006,2007,2008,2009 Red Hat, Inc. # Authors: # John Dennis <jdennis@redhat.com> # Thomas Liu <tliu@redhat.com> # Dan Walsh <dwalsh@redhat.com> __all__ = [ "run_server" ] import signal from gi.repository import GLib import dbus import dbus.service import dbus.mainloop.glib from firewall import config from firewall.core.logger import log from firewall.server.firewalld import FirewallD ############################################################################ # # signal handlers # ############################################################################ def sighup(service): service.reload() return True def sigterm(mainloop): mainloop.quit() ############################################################################ # # run_server function # ############################################################################ def run_server(debug_gc=False): """ Main function for firewall server. Handles D-Bus and GLib mainloop. """ service = None if debug_gc: from pprint import pformat import gc gc.enable() gc.set_debug(gc.DEBUG_LEAK) gc_timeout = 10 def gc_collect(): gc.collect() if len(gc.garbage) > 0: print("\n>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>" ">>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>\n") print("GARBAGE OBJECTS (%d):\n" % len(gc.garbage)) for x in gc.garbage: print(type(x), "\n ",) print(pformat(x)) print("\n<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<" "<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<\n") GLib.timeout_add_seconds(gc_timeout, gc_collect) try: dbus.mainloop.glib.DBusGMainLoop(set_as_default=True) bus = dbus.SystemBus() name = dbus.service.BusName(config.dbus.DBUS_INTERFACE, bus=bus) service = FirewallD(name, config.dbus.DBUS_PATH) mainloop = GLib.MainLoop() if debug_gc: GLib.timeout_add_seconds(gc_timeout, gc_collect) # use unix_signal_add if available, else unix_signal_add_full if hasattr(GLib, 'unix_signal_add'): unix_signal_add = GLib.unix_signal_add else: unix_signal_add = GLib.unix_signal_add_full unix_signal_add(GLib.PRIORITY_HIGH, signal.SIGHUP, sighup, service) unix_signal_add(GLib.PRIORITY_HIGH, signal.SIGTERM, sigterm, mainloop) mainloop.run() except KeyboardInterrupt: log.debug1("Stopping..") except SystemExit: log.error("Raising SystemExit in run_server") except Exception as e: log.error("Exception %s: %s", e.__class__.__name__, str(e)) if service: service.stop() dbus_utils.py 0000644 00000022276 15025011705 0007300 0 ustar 00 # -*- coding: utf-8 -*- # # Copyright (C) 2011-2016 Red Hat, Inc. # # Authors: # Thomas Woerner <twoerner@redhat.com> # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see <http://www.gnu.org/licenses/>. # __all__ = [ "command_of_pid", "pid_of_sender", "uid_of_sender", "user_of_uid", "context_of_sender", "command_of_sender", "user_of_sender", "dbus_to_python", "dbus_signature", "dbus_introspection_prepare_properties", "dbus_introspection_add_properties" ] import dbus import pwd from xml.dom import minidom from firewall.core.logger import log def command_of_pid(pid): """ Get command for pid from /proc """ try: with open("/proc/%d/cmdline" % pid, "r") as f: cmd = f.readlines()[0].replace('\0', " ").strip() except Exception: return None return cmd def pid_of_sender(bus, sender): """ Get pid from sender string using org.freedesktop.DBus.GetConnectionUnixProcessID """ dbus_obj = bus.get_object('org.freedesktop.DBus', '/org/freedesktop/DBus') dbus_iface = dbus.Interface(dbus_obj, 'org.freedesktop.DBus') try: pid = int(dbus_iface.GetConnectionUnixProcessID(sender)) except ValueError: return None return pid def uid_of_sender(bus, sender): """ Get user id from sender string using org.freedesktop.DBus.GetConnectionUnixUser """ dbus_obj = bus.get_object('org.freedesktop.DBus', '/org/freedesktop/DBus') dbus_iface = dbus.Interface(dbus_obj, 'org.freedesktop.DBus') try: uid = int(dbus_iface.GetConnectionUnixUser(sender)) except ValueError: return None return uid def user_of_uid(uid): """ Get user for uid from pwd """ try: pws = pwd.getpwuid(uid) except Exception: return None return pws[0] def context_of_sender(bus, sender): """ Get SELinux context from sender string using org.freedesktop.DBus.GetConnectionSELinuxSecurityContext """ dbus_obj = bus.get_object('org.freedesktop.DBus', '/org/freedesktop/DBus') dbus_iface = dbus.Interface(dbus_obj, 'org.freedesktop.DBus') try: context = dbus_iface.GetConnectionSELinuxSecurityContext(sender) except Exception: return None return "".join(map(chr, dbus_to_python(context))) def command_of_sender(bus, sender): """ Return command of D-Bus sender """ return command_of_pid(pid_of_sender(bus, sender)) def user_of_sender(bus, sender): return user_of_uid(uid_of_sender(bus, sender)) def dbus_to_python(obj, expected_type=None): if obj is None: python_obj = obj elif isinstance(obj, dbus.Boolean): python_obj = bool(obj) elif isinstance(obj, dbus.String): python_obj = str(obj) elif isinstance(obj, dbus.ObjectPath): python_obj = str(obj) elif isinstance(obj, dbus.Byte) or \ isinstance(obj, dbus.Int16) or \ isinstance(obj, dbus.Int32) or \ isinstance(obj, dbus.Int64) or \ isinstance(obj, dbus.UInt16) or \ isinstance(obj, dbus.UInt32) or \ isinstance(obj, dbus.UInt64): python_obj = int(obj) elif isinstance(obj, dbus.Double): python_obj = float(obj) elif isinstance(obj, dbus.Array): python_obj = [dbus_to_python(x) for x in obj] elif isinstance(obj, dbus.Struct): python_obj = tuple([dbus_to_python(x) for x in obj]) elif isinstance(obj, dbus.Dictionary): python_obj = {dbus_to_python(k): dbus_to_python(v) for k, v in obj.items()} elif isinstance(obj, bool) or \ isinstance(obj, str) or isinstance(obj, bytes) or \ isinstance(obj, int) or isinstance(obj, float) or \ isinstance(obj, list) or isinstance(obj, tuple) or \ isinstance(obj, dict): python_obj = obj else: raise TypeError("Unhandled %s" % repr(obj)) if expected_type is not None: if (expected_type == bool and not isinstance(python_obj, bool)) or \ (expected_type == str and not isinstance(python_obj, str)) or \ (expected_type == int and not isinstance(python_obj, int)) or \ (expected_type == float and not isinstance(python_obj, float)) or \ (expected_type == list and not isinstance(python_obj, list)) or \ (expected_type == tuple and not isinstance(python_obj, tuple)) or \ (expected_type == dict and not isinstance(python_obj, dict)): raise TypeError("%s is %s, expected %s" % (python_obj, type(python_obj), expected_type)) return python_obj def dbus_signature(obj): if isinstance(obj, dbus.Boolean): return 'b' elif isinstance(obj, dbus.String): return 's' elif isinstance(obj, dbus.ObjectPath): return 'o' elif isinstance(obj, dbus.Byte): return 'y' elif isinstance(obj, dbus.Int16): return 'n' elif isinstance(obj, dbus.Int32): return 'i' elif isinstance(obj, dbus.Int64): return 'x' elif isinstance(obj, dbus.UInt16): return 'q' elif isinstance(obj, dbus.UInt32): return 'u' elif isinstance(obj, dbus.UInt64): return 't' elif isinstance(obj, dbus.Double): return 'd' elif isinstance(obj, dbus.Array): if len(obj.signature) > 1: return 'a(%s)' % obj.signature else: return 'a%s' % obj.signature elif isinstance(obj, dbus.Struct): return '(%s)' % obj.signature elif isinstance(obj, dbus.Dictionary): return 'a{%s}' % obj.signature else: raise TypeError("Unhandled %s" % repr(obj)) def dbus_introspection_prepare_properties(obj, interface, access=None): if access is None: access = { } if not hasattr(obj, "_fw_dbus_properties"): setattr(obj, "_fw_dbus_properties", { }) dip = getattr(obj, "_fw_dbus_properties") dip[interface] = { } try: _dict = obj.GetAll(interface) except Exception: _dict = { } for key,value in _dict.items(): dip[interface][key] = { "type": dbus_signature(value) } if key in access: dip[interface][key]["access"] = access[key] else: dip[interface][key]["access"] = "read" def dbus_introspection_add_properties(obj, data, interface): doc = minidom.parseString(data) if hasattr(obj, "_fw_dbus_properties"): for node in doc.getElementsByTagName("interface"): if node.hasAttribute("name") and \ node.getAttribute("name") == interface: dip = { } if getattr(obj, "_fw_dbus_properties"): dip = getattr(obj, "_fw_dbus_properties") if interface in dip: for key,value in dip[interface].items(): prop = doc.createElement("property") prop.setAttribute("name", key) prop.setAttribute("type", value["type"]) prop.setAttribute("access", value["access"]) node.appendChild(prop) log.debug10(doc.toxml()) new_data = doc.toxml() doc.unlink() return new_data def dbus_introspection_add_deprecated(obj, data, interface, deprecated_methods, deprecated_signals): doc = minidom.parseString(data) if interface in deprecated_methods: for node in doc.getElementsByTagName("interface"): if node.hasAttribute("name") and \ node.getAttribute("name") == interface: for method_node in node.getElementsByTagName("method"): if method_node.hasAttribute("name") and \ method_node.getAttribute("name") in deprecated_methods[interface]: annotation = doc.createElement("annotation") annotation.setAttribute("name", "org.freedesktop.DBus.Deprecated") annotation.setAttribute("value", "true") method_node.appendChild(annotation) if interface in deprecated_signals: for node in doc.getElementsByTagName("interface"): if node.hasAttribute("name") and \ node.getAttribute("name") == interface: for signal_node in node.getElementsByTagName("signal"): if signal_node.hasAttribute("name") and \ signal_node.getAttribute("name") in deprecated_signals[interface]: annotation = doc.createElement("annotation") annotation.setAttribute("name", "org.freedesktop.DBus.Deprecated") annotation.setAttribute("value", "true") signal_node.appendChild(annotation) log.debug10(doc.toxml()) data = doc.toxml() doc.unlink() return data core/__pycache__/ipXtables.cpython-39.opt-1.pyc 0000644 00000103742 15025011705 0015232 0 ustar 00 a ���gh� � @ s0 d dl Zd dlZd dlmZ d dlmZ d dlmZm Z m Z m Z m Z m Z mZmZ d dlmZ d dlmZmZmZmZmZ d dlmZmZmZm Z m Z m Z m Z m Z m!Z! d dl"m#Z# d dl$Z$d Z%g d �d d gg d �g d�g d �d�Z&ddd�Z'ddd�Z(dd� Z)dd� Z*dd� Z+G dd � d e,�Z-G d d � d e-�Z.dS ) � N)�runProg)�log)�tempFile�readfile� splitArgs� check_mac�portStr�check_single_address� check_address� normalizeIP6)�config)� FirewallError�INVALID_PASSTHROUGH� INVALID_RULE� UNKNOWN_ERROR� INVALID_ADDR) � Rich_Accept� Rich_Reject� Rich_Drop� Rich_Mark� Rich_NFLog�Rich_Masquerade�Rich_ForwardPort�Rich_IcmpBlock�Rich_Tcp_Mss_Clamp)�DEFAULT_ZONE_TARGET� )�INPUT�OUTPUT�FORWARD� PREROUTINGr )r � POSTROUTINGr r r )r r! r )�security�raw�mangle�nat�filterzicmp-host-prohibitedzicmp6-adm-prohibited��ipv4�ipv6�icmp� ipv6-icmpc C s� ddddddd�}| dd� }|D ]t}z|� |�}W n tyJ Y q"Y n0 |dv r�zt||d � W n tyz Y n0 |�|d � || ||< q"|S ) z Inverse valid rule �-D�--delete�-X�--delete-chain��-A�--append�-I�--insert�-Nz --new-chainN�r3 r4 � )�index� Exception�int�pop)�args� replace_args�ret_args�arg�idx� rA �;/usr/lib/python3.9/site-packages/firewall/core/ipXtables.py�common_reverse_rule: s* � rC c C s� ddddddd�}| dd� }|D ]z}z|� |�}W n tyJ Y q"Y n0 |dv r�zt||d � W n tyz Y n0 |�|d � || ||< | S ttd ��dS ) z Reverse valid passthough rule r, r- r. r/ r0 Nr6 r7 �no '-A', '-I' or '-N' arg)r8 � ValueErrorr: r; r r )r< r= r> �xr@ rA rA rB �common_reverse_passthrough_ s0 � �rG c C sh t | �} t g d��}t| |@ �dkr>ttdt| |@ �d ��t g d��}t| |@ �dkrdttd��dS )zZ Check if passthough rule is valid (only add, insert and new chain rules are allowed) )z-Cz--checkr, r- z-Rz --replace�-Lz--listz-Sz --list-rules�-Fz--flush�-Zz--zeror. r/ �-Pz--policyz-Ez--rename-chainr zarg '%s' is not allowedr0 rD N)�set�lenr r �list)r< Z not_allowedZneededrA rA rB �common_check_passthrough� s �� �rO c @ s� e Zd ZdZd ZdZdd� Zdd� Zdd� Zd d � Z d d � Z d d� Z dd� Z dd� Z dd� Zdd� Zdd� Zdd� Zdd � Zd d � Zd d � Zdjd"d#�Zd$d%� Zd&d'� Zd(d)� Zd*d+� Zdkd,d-�Zd.d/� Zdld1d2�Z d3d4� Z d5d6� Z dmd8d9�Z dnd:d;�Z d<d=� Z!d>d?� Z"d@dA� Z#dBdC� Z$dDdE� Z%dFdG� Z&dHdI� Z'dJdK� Z(dLdM� Z)dNdO� Z*dPdQ� Z+dodRdS�Z,dpdTdU�Z-dqdVdW�Z.drdXdY�Z/dZd[� Z0dsd\d]�Z1dtd^d_�Z2dud`da�Z3dvdbdc�Z4ddde� Z5dfdg� Z6dhdi� Z7d!S )w� ip4tablesr( Tc C sd || _ tj| j | _tjd| j | _| �� | _| �� | _ | � � g | _ i | _ i | _ g | _i | _d S )Nz %s-restore)�_fwr ZCOMMANDS�ipv�_command�_restore_command�_detect_wait_option� wait_option�_detect_restore_wait_option�restore_wait_option� fill_exists�available_tables�rich_rule_priority_counts�policy_priority_counts�zone_source_index_cache� our_chains)�self�fwrA rA rB �__init__� s zip4tables.__init__c C s$ t j�| j�| _t j�| j�| _d S �N)�os�path�existsrS Zcommand_existsrT Zrestore_command_exists�r_ rA rA rB rY � s zip4tables.fill_existsc C s� | j r(| j |vr(| j gdd� |D � }ndd� |D �}t�d| j| jd�|�� t| j|�\}}|dkr�td| jd�|�|f ��|S )Nc S s g | ] }d | �qS ��%srA ��.0�itemrA rA rB � <listcomp>� � z#ip4tables.__run.<locals>.<listcomp>c S s g | ] }d | �qS rg rA ri rA rA rB rl � rm � %s: %s %s� r �'%s %s' failed: %s)rV r �debug2� __class__rS �joinr rE )r_ r< �_args�status�retrA rA rB Z__run� s �zip4tables.__runc C s< z|� |�}W n ty" Y dS 0 ||||d �< dS d S )NF� T)r8 rE )r_ �rule�patternZ replacement�irA rA rB � _rule_replace� s zip4tables._rule_replacec C s |t v o|t | v S rb )�BUILT_IN_CHAINS)r_ rR �table�chainrA rA rB �is_chain_builtin� s �zip4tables.is_chain_builtinc C s2 d|g}|r|� d� n |� d� |� |� |gS )N�-tr5 r. )�append)r_ �addr} r~ rx rA rA rB �build_chain_rules� s zip4tables.build_chain_rulesc C s8 d|g}|r |d|t |�g7 }n |d|g7 }||7 }|S )Nr� r3 r, )�str)r_ r� r} r~ r8 r< rx rA rA rB � build_rule� s zip4tables.build_rulec C s t |�S rb )rC �r_ r< rA rA rB � reverse_rule� s zip4tables.reverse_rulec C s t |� d S rb )rO r� rA rA rB �check_passthrough� s zip4tables.check_passthroughc C s t |�S rb )rG r� rA rA rB �reverse_passthrough� s z ip4tables.reverse_passthroughc C s� d}z|� d�}W n ty$ Y n 0 t|�|d krB||d }d }dD ]B}z|� |�}W n tyn Y qJ0 t|�|d krJ||d }qJ||fS )Nr& r� rw r0 )r8 rE rM )r_ r< r} rz r~ �optrA rA rB � passthrough_parse_table_chain� s z'ip4tables.passthrough_parse_table_chainc C s zH|� d�}|�|� |�|�}d|d kr:||d f}n ||d f}W nF ty� z |� d�}|�|� d }W n ty� Y Y d S 0 Y n0 d}|d d v r�d }|r�|s�||v r�|�|� n\|�r |r�||vr�|�|� |jd d � d � |� |�}nt|�}d|d< |�dd|d � d S )N�%%ZONE_SOURCE%%�-m� � � �%%ZONE_INTERFACE%%Tr �r, r- Fc S s | d S )Nr rA )rF rA rA rB �<lambda>' rm z4ip4tables._run_replace_zone_source.<locals>.<lambda>)�keyr3 r7 �%drw )r8 r; rE �remover� �sortrM �insert)r_ rx r] rz �zoneZ zone_source�rule_addr8 rA rA rB �_run_replace_zone_source s: z"ip4tables._run_replace_zone_sourcec C s z|� |�}W n ty" Y �n�0 d}d}d}|�|� |�|�}t|�tkrZttd��d} dD ]B} z|� | �} W n ty� Y qb0 t|�| d krb|| d } qbdD ]Z} z|� | �}W n ty� Y q�0 t|�|d kr�||d } | d v r�d}| d v r�d}q�| | f} |�s^| |v�s>||| v�s>|| | d k�rHttd ��|| | d8 < n�| |v�rpi || < ||| v�r�d || |< d} t || � � �D ]<}||k�r�|�r� �q�| || | 7 } ||k�r� �qܐq�|| | d7 < d ||< |� |d d| � dS )a Change something like -t filter -I public_IN %%RICH_RULE_PRIORITY%% 123 or -t filter -A public_IN %%RICH_RULE_PRIORITY%% 321 into -t filter -I public_IN 4 or -t filter -I public_IN TF���z%priority must be followed by a numberr& �r� z--tablerw )r1 r2 r3 r4 r, r- r6 r� r z*nonexistent or underflow of priority countr3 r7 r� N) r8 rE r; �typer: r r rM r �sorted�keysr� )r_ rx Zpriority_counts�tokenrz r� r� Zinsert_add_index�priorityr} r� �jr~ r8 �prA rA rB �_set_rule_replace_priority0 sj �� z$ip4tables._set_rule_replace_priorityc C s t � }i }t�| j�}t�| j�}t�| j�}|D �]x}|d d � } | �| dddt| j g� | �| dt | j g� z| � d�} W n t y� Y n80 |dkr�q2|dv r�dd d |g| | | d �< n | � | � | � | |d � | � | |d � | �| |� d} dD ]L} z| � | �} W n t �y" Y q�0 t| �| d kr�| � | � | � | �} q�t| �D ]F\} } tjD ]4}|| v �r`| �d��r�| �d��s`d| | | < �q`�qR|�| g ��| � q2|D ]F} || }|�d| � |D ]} |�d�| �d � �q�|�d� �q�|�� t�|j �}t � d| j | j d|j |j!f � g }| j"�rF|�| j"� |�d� t#| j ||j d�\}}t �$� dk�r�t%|j �}|d u�r�d } |D ]@}t j&d| |f d d d � |�d��s�t j&d d d � | d 7 } �q�t�'|j � |d k�rt d | j d�|�|f ��|| _|| _|| _d S )!N� %%REJECT%%�REJECT� --reject-with�%%ICMP%%� %%LOGTYPE%%�off��unicast� broadcastZ multicastr� �pkttype� --pkt-typerw �%%RICH_RULE_PRIORITY%%�%%POLICY_PRIORITY%%r& r� �"z"%s"z*%s ro � zCOMMIT rn z%s: %d�-n��stdinr7 z%8d: %sr )�nofmt�nlr )r� rp )(r �copy�deepcopyr[ r\ r] r{ �DEFAULT_REJECT_TYPErR �ICMPr8 rE r; r� r� rM � enumerate�stringZ whitespace� startswith�endswith� setdefaultr� �writers �closerc �stat�namer rq rr rT �st_sizerX r ZgetDebugLogLevelr �debug3�unlink)r_ �rules� log_denied� temp_fileZ table_rulesr[ r\ r] Z_rulerx rz r} r� �element�cr� r< ru rv �lines�linerA rA rB � set_rules� s� � � � � �zip4tables.set_rulesc C s� | � |dddt| j g� | � |dt| j g� z|�d�}W n tyP Y n:0 |dkr^dS |dv r�d d d |g|||d �< n |�|� t�| j �}t�| j �}t�| j �}| � ||d � | � ||d� | � ||� | �|�}|| _ || _ || _ |S )Nr� r� r� r� r� r� r r� r� r� r� rw r� r� )r{ r� rR r� r8 rE r; r� r� r[ r\ r] r� r� �_ip4tables__run)r_ rx r� rz r[ r\ r] �outputrA rA rB �set_rule� s0 � zip4tables.set_ruleNc C s� g }|r|gnt �� }|D ]n}|| jv r4|�|� qz,| �d|ddg� | j�|� |�|� W q ty� t�d| j|f � Y q0 q|S )Nr� rH r� zA%s table '%s' does not exist (or not enough permission to check).) r| r� rZ r� r� rE r �debug1rR )r_ r} rv ZtablesrA rA rB �get_available_tables s z ip4tables.get_available_tablesc C s� d}t | jg d��}t�d| j| jd|d |d � |d dkr�d}t | jg d��}t�d| j| jd|d |d � |d dkr�d}t�d | j| j|� |S ) Nr )�-wrH r� �7%s: %s: probe for wait option (%s): ret=%u, output="%s"r� r rw )�-w10rH r� r� � %s: %s will be using %s option.)r rS r r� rr rq )r_ rV rv rA rA rB rU s z ip4tables._detect_wait_optionc C s� t � }|�d� |�� d}dD ]d}t| j|g|jd�}t�d| j| j ||d |d � |d dkr d|d vr d |d vr |} q�q t� d | j| j|� t � |j� |S ) Nz#foor )r� z--wait=2r� r� r rw zinvalid optionzunrecognized optionr� ) r r� r� r rT r� r r� rr rS rq rc r� )r_ r� rV Z test_optionrv rA rA rB rW " s � z%ip4tables._detect_restore_wait_optionc C sN i | _ i | _g | _g }t�� D ]*}| �|�s.q dD ]}|�d||g� q2q |S )N)rI r. rJ r� )r[ r\ r] r| r� r� r� )r_ r� r} �flagrA rA rB �build_flush_rules6 s zip4tables.build_flush_rulesc C s� g }|dkrdn|}t �� D ]t}| �|�s,q |dkr6q t | D ]P}|dkrv|| }|dkrz|�d|d|ddg� d}n|}|�d|d ||g� q>q |S ) NZPANIC�DROPr% r& r� r� r1 �-jrK )r| r� r� r� )r_ �policyZpolicy_detailsr� �_policyr} r~ r� rA rA rB �build_set_policy_rulesE s z ip4tables.build_set_policy_rulesc C s g }d}z"| � d| jdkr dnddg�}W nL tyv } z4| jdkrTt�d| � nt�d| � W Y d }~n d }~0 0 |�� }d }|D ]�}|r�|�� �� }|�� }|D ]<} | � d �r�| � d �r�| d d� } n| } | |vr�|� | � q�| jdkr�|� d��s| jdkr�|� d�r�d}q�|S )zQReturn ICMP types that are supported by the iptables/ip6tables command and kernelr �-pr( r* r+ z--helpziptables error: %szip6tables error: %sNF�(�)rw r� zValid ICMP Types:r) zValid ICMPv6 Types:T) r� rR rE r r� � splitlines�strip�lower�splitr� r� r� ) r_ rR rv r� �exr� Zin_typesr� Zsplitsr� rF rA rA rB �supported_icmp_typesX s< � $ ��z ip4tables.supported_icmp_typesc C s g S rb rA rf rA rA rB �build_default_tablesy s z ip4tables.build_default_tablesr� c C s� i }| � d�rlg |d< t� | jd< td D ]@}|d �d| � |d �d||f � | jd �d| � q*| � d��r@g |d< t� | jd< td D ]�}|d �d| � |d �d||f � | jd �d| � |dkr�dD ]8}|d �d||f � | jd �td ||f g�� q�d D ] }|d �d |||f � �q q�| � d ��rg |d < t� | jd < td D ]�}|d �d| � |d �d||f � | jd �d| � |dk�rhdD ]:}|d �d||f � | jd �td ||f g�� �q�d D ] }|d �d |||f � �q��qh| � d ��rPg |d < t� | jd < td D �] }|d �d| � |d �d||f � | jd �d| � |dv �r�dD ]R}|d �d||f � | jd �td ||f g�� |d �d |||f � �q�nddD ]:}|d �d||f � | jd �td ||f g�� �q�d D ] }|d �d |||f � �q,�qBg |d< t� | jd< |d �d� |d �d� |dk�r�|d �d� |d �d� |d �d� |d �d� | jd �td�� dD ]0}|d �d| � | jd �td| �� �q�d D ]}|d �d| � �q|dk�rB|d �d � |d �d � |d �d � |d �d � |dk�r�|d �d � |d �d!� |d �d"� |d �d#� | jd �td$�� d%D ]0}|d �d&| � | jd �td'| �� �q�d D ]B}|d �d&| � |d �d(| � | jd �td'| �� �q�d)D ]0}|d �d&| � | jd �td'| �� �qD|dk�r�|d �d*� |d �d+� |d g d,�7 < | jd �td-�� d%D ]B}|d �d.| � |d �d/| � | jd �td0| �� �q�d)D ]B}|d �d.| � |d �d/| � | jd �td0| �� �qg }|D ]>}|| � � v�rr�q\|| D ] }|�d1|gt|� � �qz�q\|S )2Nr" z -N %s_directz-A %s -j %s_directz %s_directr# r )� POLICIES_pre�ZONES� POLICIES_postz-N %s_%s�%s_%s)r� z-A %s -j %s_%sr$ r% )r )r� r� r& zB-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED,DNAT -j ACCEPTz-A INPUT -i lo -j ACCEPTr� z^-A INPUT -m conntrack --ctstate INVALID %%LOGTYPE%% -j LOG --log-prefix 'STATE_INVALID_DROP: 'z/-A INPUT -m conntrack --ctstate INVALID -j DROPz-N INPUT_directz-A INPUT -j INPUT_directZ INPUT_directz -N INPUT_%szINPUT_%sz-A INPUT -j INPUT_%sz9-A INPUT %%LOGTYPE%% -j LOG --log-prefix 'FINAL_REJECT: 'z-A INPUT -j %%REJECT%%zD-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED,DNAT -j ACCEPTz-A FORWARD -i lo -j ACCEPTz`-A FORWARD -m conntrack --ctstate INVALID %%LOGTYPE%% -j LOG --log-prefix 'STATE_INVALID_DROP: 'z1-A FORWARD -m conntrack --ctstate INVALID -j DROPz-N FORWARD_directz -A FORWARD -j FORWARD_directZFORWARD_direct)r� z -N FORWARD_%sz FORWARD_%sz-A FORWARD -j FORWARD_%s)r� z;-A FORWARD %%LOGTYPE%% -j LOG --log-prefix 'FINAL_REJECT: 'z-A FORWARD -j %%REJECT%%)z-N OUTPUT_directz>-A OUTPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPTz-A OUTPUT -o lo -j ACCEPTz-A OUTPUT -j OUTPUT_directZ OUTPUT_directz -N OUTPUT_%sz-A OUTPUT -j OUTPUT_%sz OUTPUT_%sr� )r� rL r^ r| r� r� �updater )r_ r� Z default_rulesr~ Zdispatch_suffixZfinal_default_rulesr} rx rA rA rB �build_default_rules} s� " " z ip4tables.build_default_rulesc C sd |dkrddhS |dkr*d| � � v r*dhS |dkrFd| � � v rFddhS |dkr`d| � � v r`dhS i S ) Nr& r r r$ r r% r! r# )r� )r_ r} rA rA rB �get_zone_table_chains� s z ip4tables.get_zone_table_chainsc s� | j j�|���jdk r dnd��dkr4�dkr4dnd} | j j�|�t| �� g } g } |D ]} | �d| g� qX|D ]} | �d | g� qp|D ]8} | j j�| �}|d v r�| � |�s�q�| �| � d | �� q�|D ]J} | j j�| �}|d v r�| � |�s�q�t | �r��d v r�q�| �| � d | �� qƇ �����fdd�}g }| �r|| D ]B}| �r^| D ]}|�|||�� �qDn|�rfn|�||d �� �q6nD|�r�n<| �r�| D ]}|�|d |�� �q�n|�r�n|�|d d �� |S )Nr �pre�postr% r! TF�-i�-or' �-s�r! r r �-dc sV ddd�� }d�|d��f d�j g}| r6|�| � |rD|�|� |�d� g� |S )Nr1 r, �TFr� z%s_POLICIES_%sr� r� )r� �extend)�ingress_fragment�egress_fragment�add_delrx �r� r~ � chain_suffix�enable�p_objr} rA rB � _generate_policy_dispatch_rule* s � zSip4tables.build_policy_ingress_egress_rules.<locals>._generate_policy_dispatch_rule) rQ r� � get_policyr� �policy_base_chain_name�POLICY_CHAIN_PREFIXr� r� � check_source�is_ipv_supported�_rule_addr_fragmentr )r_ r r� r} r~ Zingress_interfacesZegress_interfacesZingress_sourcesZegress_sources�isSNATZingress_fragmentsZegress_fragments� interface�addrrR r r� r� r� rA r� rB �!build_policy_ingress_egress_rules sR z+ip4tables.build_policy_ingress_egress_rulesFc C s� |dkr|dkrdnd}| j jj||t|d�} dddddd�| } d } |r^|s^d d | d g} n,|rpd d | g} ndd | g} |s�| d g7 } | d|| || | g7 } | gS )Nr% r! TF�r r� r� �r r! r r r �-gr3 �%s_ZONESr� r1 r, r� )rQ r� r r ) r_ r r� r� r r} r~ r� r r� r� �actionrx rA rA rB �!build_zone_source_interface_rulesZ s( �� z+ip4tables.build_zone_source_interface_rulesc C s� |� d�rP|dd � }|dkr$d}nd}d�|g| jj�|� �}ddd ||gS t|�rz|dkrjttd ��dd d |�� gS t d |�r�t |�}n,t d |�r�|� d�}t |d �d |d }||gS d S )Nzipset:� r� �dst�src�,r� rL � --match-setz Can't match a destination MAC.�mac� --mac-sourcer) �/r rw ) r� rs rQ �ipsetZ get_dimensionr r r �upperr r r r� )r_ r� �address�invertr� �flags� addr_splitrA rA rB r s s" z ip4tables._rule_addr_fragmentc C s� ddd�| }|dkr"|dkr"dnd}| j jj||t|d�} d d d d d d �| } t|�rd|d v rdg S |d | d|d|g} | �| �| |�� | �d| g� | gS )Nr3 r, r� r% r! TFr r� r� r r� r r� r� r )rQ r� r r r r� r ) r_ r r� r� r r} r~ r� r r� r� rx rA rA rB � build_zone_source_address_rules� s" �� z)ip4tables.build_zone_source_address_rulesc C s� ddd�| }ddd�| }|dkr0|dkr0dnd }| j jj||t|d �}| j j�|�} | j| �t|d | d | d | d| d| g�� g } | �||d|g� | �|d | d|g� | �|d | d|g� | �|d | d|g� | �|d| d|g� | �|d| d|g� | j �r6| �||d|dd|df g� | �||d|dd | g� | �||d|dd | g� | �||d|dd | g� | �||d|dd| g� | �||d|dd| g� | j �r�| �||d|dd|df g� | j jj | j } | j � � dk�rb|dk�rb| t ddfv �r8| �||d|ddddd | g � | d k�rb| �||d|ddddd | g � |dk�r�| t d ddd fv �r�| t fv �r�d} n| } | �||d|d| g� |�s�| �� | S ) Nr5 r. r� r1 r, r% r! TFr z%s_log�%s_denyz%s_prez%s_post�%s_allowr� r� r� r� r� r� r& r� r� r� �LOG� --log-prefixz %s_REJECT: r� z %s_DROP: �ACCEPT)rQ r� r r r r^ r� rL r� Zderived_from_zoneZ _policies�target�get_log_deniedr �reverse) r_ r r� r} r~ Z add_del_chainZ add_del_ruler r� r r� r( �_targetrA rA rB �build_policy_chain_rules� sf � � � � z"ip4tables.build_policy_chain_rulesc C s |rddd|j gS g S )Nr� �limitz--limit)�value)r_ r- rA rA rB � _rule_limit� s zip4tables._rule_limitc C s� t |j�ttttfv rn<|jrJt |j�ttt t fvrTt t dt |j� ��n t t d��|j dkr�t |j�tttfv s�t |j�tt fv r�dS t |j�tfv s�t |j�tt fv r�dS n|j dk r�dS dS d S )N�Unknown action %szNo rule action specified.r �allowZdenyr� r� )r� r� r r r r r r r r r r r r� �r_ � rich_rulerA rA rB �_rich_rule_chain_suffix� s$ �� z!ip4tables._rich_rule_chain_suffixc C s: |j s|jsttd��|jdkr$dS |jdk r2dS dS d S )NzNot log or auditr r r� r� )r �auditr r r� r2 rA rA rB � _rich_rule_chain_suffix_from_log� s z*ip4tables._rich_rule_chain_suffix_from_logc C s |j dkrg S d|j gS )Nr r� )r� r2 rA rA rB � _rich_rule_priority_fragment s z&ip4tables._rich_rule_priority_fragmentc C s" |j s g S | jj�||t�}ddd�| }| �|�}d||d||f g} | | �|�7 } t|j �tkr�| |ddg 7 } |j j r�| d|j j g7 } |j j r�| d d |j j g7 } |j j r�| d |j j g7 } nJ| |dd g 7 } |j j r�| d d |j j g7 } |j j �r | dd |j j g7 } | | � |j j�7 } | S )Nr1 r, r� r� r� r� ZNFLOGz --nflog-groupz--nflog-prefixrh z--nflog-thresholdr% r& z --log-level)r rQ r� r r r6 r7 r� r �group�prefixZ threshold�levelr/ r- ) r_ r� r3 r r} � rule_fragmentr� r� r rx rA rA rB �_rich_rule_log s, zip4tables._rich_rule_logc C s� |j s g S ddd�| }| jj�||t�}| �|�}d||d||f g} | | �|�7 } | |7 } t|j�t krrd} n,t|j�t kr�d} nt|j�t kr�d} nd } | d d d | g7 } | | � |j j �7 } | S ) Nr1 r, r� r� r� ZacceptZrejectZdrop�unknownr� ZAUDITz--type)r5 rQ r� r r r6 r7 r� r r r r r/ r- ) r_ r� r3 r r} r; r� r� r rx Z_typerA rA rB �_rich_rule_audit" s$ zip4tables._rich_rule_auditc C s2 |j s g S ddd�| }| jj�||t�}| �|�}d||f } t|j �tkrXddg} n�t|j �tkr�ddg} |j jr�| d|j jg7 } nnt|j �t kr�dd g} nVt|j �t kr�d }| jj�||t�}d||f } dd d |j j g} nt t d t|j � ��d||| g} | | �|�7 } | || 7 } | | �|j j�7 } | S )Nr1 r, r� r� r� r' r� r� r� r$ �MARKz --set-xmarkr0 r� )r rQ r� r r r4 r� r r r r rL r r r7 r/ r- ) r_ r� r3 r r} r; r� r� r r~ Z rule_actionrx rA rA rB �_rich_rule_action; s6 � zip4tables._rich_rule_actionc C s� |sg S g }|j r�|jr"|�d� td|j �rB|dt|j �g7 }q�td|j �r||j �d�}|dt|d �d |d g7 }q�|d|j g7 }nD|jr�|ddg7 }|jr�|�d� | jj � |jd �}|d |j|g7 }|S ) N�!r) r� r r rw r� rL r r ) r r r� r r r r� r rQ r� �_ipset_match_flags)r_ Z rich_destr; r! r rA rA rB � _rich_rule_destination_fragment] s& " z)ip4tables._rich_rule_destination_fragmentc C s |sg S g }|j r�|jr"|�d� td|j �rB|dt|j �g7 }nHtd|j �r||j �d�}|dt|d �d |d g7 }n|d|j g7 }n�t|d�r�|jr�|ddg7 }|jr�|�d� |d |jg7 }nRt|d ��r|j �r|dd g7 }|jr�|�d� | j j � |j d �}|d |j |g7 }|S )NrA r) r� r r rw r r� r r rL r r ) r r r� r r r r� �hasattrr r rQ r� rB )r_ Z rich_sourcer; r! r rA rA rB �_rich_rule_source_fragmentu s0 " z$ip4tables._rich_rule_source_fragmentc C s� ddd�| }d}| j j�||t�} d|g} |rD| ddt|� g7 } |rT| d|g7 } |rx| | �|j�7 } | | �|j�7 } g } |r�| � | � ||||| �� | � | � ||||| �� | � | � ||||| �� n"| � |d | d |g| d d g � | S ) Nr1 r, r� r& r� �--dportrh r� r$ r� r� r' � rQ r� r r r rC � destinationrE �sourcer� r< r> r@ � r_ r r� �proto�portrH r3 r� r} r� r; r� rA rA rB �build_policy_ports_rules� s, ��z"ip4tables.build_policy_ports_rulesc C s� ddd�| }d}| j j�||t�}d|g} |r<| d|g7 } |r`| | �|j�7 } | | �|j�7 } g } |r�| �| � ||||| �� | �| � ||||| �� | �| � ||||| �� n"| �|d| d|g| d d g � | S ) Nr1 r, r� r& r� r� r$ r� r� r' ) rQ r� r r rC rH rE rI r� r< r> r@ ) r_ r r� �protocolrH r3 r� r} r� r; r� rA rA rB �build_policy_protocol_rules� s( ��z%ip4tables.build_policy_protocol_rulesc C s� d}d}| j j�||t�}ddd�| } g d�} |rl| �|�}| | �|�7 } | | �|j�7 } | | �|j �7 } |dks||d u r�| g d�7 } n| d d d |g7 } d d| d ||f g| gS )Nr1 r& r1 r, r� )r� Ztcpz --tcp-flagszSYN,RSTZSYNZpmtu)r� �TCPMSSz--clamp-mss-to-pmtur� rP z --set-mssr� r� ) rQ r� r r r4 r7 rC rH rE rI ) r_ r r� Ztcp_mss_clamp_valuerH r3 r r} r� r� r; rA rA rB � build_policy_tcp_mss_clamp_rules� s z*ip4tables.build_policy_tcp_mss_clamp_rulesc C s� ddd�| }d}| j j�||t�} d|g} |rD| ddt|� g7 } |rT| d|g7 } |rx| | �|j�7 } | | �|j�7 } g } |r�| � | � ||||| �� | � | � ||||| �� | � | � ||||| �� n"| � |d | d |g| d d g � | S ) Nr1 r, r� r& r� z--sportrh r� r$ r� r� r' rG rJ rA rA rB � build_policy_source_ports_rules� s, ��z)ip4tables.build_policy_source_ports_rulesc C sv d}| j j�||t�} ddd�| } | d| ddd|g} |rP| dd t|� g7 } |r`| d |g7 } | d d d |g7 } | gS )Nr# r1 r, r� r$ r� r� rF rh r� r� ZCTz--helper)rQ r� r r r ) r_ r r� rK rL rH Z helper_nameZmodule_short_namer} r� r� rx rA rA rB � build_policy_helper_ports_rules� s z)ip4tables.build_policy_helper_ports_rulesc C s� ddd�| }| j j�||t�}g } |rH| �dd|d| d|dd g� n6t|�rTg S | �dd|d| g| �d |� dd g � | S ) Nr1 r, r� r� r& r$ r� r� r' r� )rQ r� r r r� r r ) r_ r r� r� r} r rI r� r� r� rA rA rB �build_zone_forward_rules� s � ��z"ip4tables.build_zone_forward_rulesc C s� d}| j jj||tdd�}ddd�| }g }|rj| �|�}|| �|�7 }|| �|j�7 }|| �|j �7 }nd}g } | � dd|d ||f g| g d � � | S ) Nr% Tr r1 r, r� r1 r� r� )rA r� �lor� Z MASQUERADE) rQ r� r r r4 r7 rC rH rE rI r� ) r_ r r� r3 r} r� r� r; r r� rA rA rB � build_policy_masquerade_rules s" ��z'ip4tables.build_policy_masquerade_rulesc C s d}| j j�||t�} ddd�| } d} |rPtd|�rH| dt|� 7 } n| |7 } |rn|dkrn| dt|d � 7 } g } |r�| �|�} | �|�} | | � |j �7 } | | � |j �7 } nd } g }|r�|� | �|||d| �� |� d d| d | | f g| d |dt|�ddd| g � |S )Nr% r1 r, r� r r) z[%s]z:%s�-r1 r� r� r� rF r� ZDNATz--to-destination)rQ r� r r r r r r4 r7 rC rH rE rI r� r< )r_ r r� rL rN ZtoportZtoaddrr3 r} r� r� �tor; r r� rA rA rB � build_policy_forward_port_rules' s8 � ��z)ip4tables.build_policy_forward_port_rulesc C s� d}| j j�||t�}ddd�| }| jdkrFddg}ddd |jg} ndd g}dd d |jg} g } | j j�|�r|d | } d} n d| } d} g } |r�| | �|j�7 } | | � |j �7 } | || 7 } |�rP| � | � ||||| �� | � | � ||||| �� |j�r| � | �||||| �� n:| �|�}| � d||d||f g| �|� | ddg � n`| j �� dk�r�| dk�r�| � || d|g| ddddd| g � | � || d|g| d| g � | S )Nr& r1 r, r� r( r� r* r� z --icmp-typer+ Zicmp6z --icmpv6-typer$ r' r# r� r� r� r� r� r� r% r& �%s_ICMP_BLOCK: )rQ r� r r rR r� �query_icmp_block_inversionrC rH rE rI r� r< r> r r@ r4 r7 r) )r_ r r� Zictr3 r} r� r� rK �matchr� Z final_chainZ final_targetr; r rA rA rB � build_policy_icmp_block_rulesI s\ ��������z'ip4tables.build_policy_icmp_block_rulesc C s� d}| j j�||t�}g }d}| j j�|�r�d}| j �� dkr�|rRd|t|�g}nd|g}|d|dd d d d d d| g }|�|� |d7 }nd}|r�d|t|�g}nd|g}|d|dd d |g }|�|� |S )Nr& � r� r� r3 r, r� r� r� r� r� r% r& rZ rw r' )rQ r� r r r[ r) r� r� ) r_ r r� r} r� r� Zrule_idxZ ibi_targetrx rA rA rB �'build_policy_icmp_block_inversion_rulesz s0 � z1ip4tables.build_policy_icmp_block_inversion_rulesc C sx d}g }|| � |j�7 }|| �|j�7 }g }|�| �|||||�� |�| �|||||�� |�| �|||||�� |S )Nr& )rC rH rE rI r� r< r> r@ )r_ r r� r3 r} r; r� rA rA rB �*build_policy_rich_source_destination_rules� s z4ip4tables.build_policy_rich_source_destination_rulesc C s || j kS rb )rR )r_ rR rA rA rB r � s zip4tables.is_ipv_supported)N)N)r� )F)F)NN)NN)NN)NN)NN)N)N)N)8�__name__� __module__� __qualname__rR r� Zpolicies_supportedra rY r� r{ r r� r� r� r� r� r� r� r� r� r� r� rU rW r� r� r� r� r� r� r r r r" r, r/ r4 r6 r7 r< r> r@ rC rE rM rO rQ rR rS rT rV rY r] r_ r` r rA rA rA rB rP � sr &Pa# ! N � 9 " � � " 1"rP c @ s& e Zd ZdZd Zddd�Zdd� ZdS ) � ip6tablesr) Fc C s~ g }g d�}| j jdkr"|dg7 }|�g d�| ddg � |dkr^|�g d�| g d� � |�g d �� |�g d �� |S ) N)r� Zrpfilterz--invertz --validmarkZloosez--loose)r3 r r� r$ r� r� r� )r� r% r& zrpfilter_DROP: ) r3 r r� r$ r� r+ z$--icmpv6-type=neighbour-solicitationr� r' ) r3 r r� r$ r� r+ z"--icmpv6-type=router-advertisementr� r' )rQ Z_ipv6_rpfilterr� )r_ r� r� Zrpfilter_fragmentrA rA rB �build_rpfilter_rules� s$ �� ��z ip6tables.build_rpfilter_rulesc C s� g d�}d}| j d �|� g }|�ddd|g� |D ]L}|�ddd|d|dd d d g � | jjd v r6|�ddd|d|dd ddg � q6|�dddddd|g� |�dddd| j�� dkr�dndd|g� |S )N) z ::0.0.0.0/96z::ffff:0.0.0.0/96z2002:0000::/24z2002:0a00::/24z2002:7f00::/24z2002:ac10::/28z2002:c0a8::/32z2002:a9fe::/32z2002:e000::/19Z RFC3964_IPv4r& r� r5 r3 r� r� r� r� z addr-unreach)r� �allr% r& zRFC3964_IPv4_REJECT: r �4r r� �6�5)r^ r� r� rQ Z _log_deniedr) )r_ Z daddr_listZ chain_namer� ZdaddrrA rA rB �build_rfc3964_ipv4_rules� s. � �� �z"ip6tables.build_rfc3964_ipv4_rulesN)F)ra rb rc rR r� re rj rA rA rA rB rd � s rd )/Zos.pathrc r� Zfirewall.core.progr Zfirewall.core.loggerr Zfirewall.functionsr r r r r r r r Zfirewallr Zfirewall.errorsr r r r r Zfirewall.core.richr r r r r r r r r Zfirewall.core.baser r� r r| r� r� rC rG rO �objectrP rd rA rA rA rB �<module> sJ ( , � ��%* core/__pycache__/ipset.cpython-39.pyc 0000644 00000021160 15025011705 0013455 0 ustar 00 a ���gq2 � @ s� d Z g d�ZddlZddlZddlmZ ddlmZ ddl m Z ddl m Z ddl mZmZ dd lmZ d Zg d �Zd d d dd�Zdddd�ZG dd� de�Zdd� Zdd� Zdd� Zd d � Zd d � Z dS ) zThe ipset command wrapper)�ipset�check_ipset_name� remove_default_create_options� N)�errors)� FirewallError)�runProg)�log)�tempFile�readfile)�COMMANDS� ) zhash:ipz hash:ip,portzhash:ip,port,ipzhash:ip,port,netz hash:ip,markzhash:netz hash:net,netz hash:net,portzhash:net,port,netzhash:net,ifacezhash:macz inet|inet6�valuez value in secs)�family�hashsize�maxelem�timeoutZinetZ1024Z65536)r r r c @ s� e Zd ZdZdd� Zdd� Zdd� Zdd � Zd d � Zd'd d�Z dd� Z dd� Z dd� Z d(dd�Z d)dd�Zdd� Zd*dd �Zd+d d �Zd d � Zd!d"� Zd#d$� Zd%d&� Zd S ),r zipset command wrapper classc C s t d | _d| _d S )Nr )r �_command�name��self� r �7/usr/lib/python3.9/site-packages/firewall/core/ipset.py�__init__K s zipset.__init__c C s^ dd� |D �}t �d| j| jd�|�� t| j|�\}}|dkrZtd| jd�|�|f ��|S )zCall ipset with argsc S s g | ] }d | �qS )�%sr )�.0�itemr r r � <listcomp>R � z ipset.__run.<locals>.<listcomp>z %s: %s %s� r �'%s %s' failed: %s)r �debug2� __class__r �joinr � ValueError)r �args�_args�status�retr r r Z__runO s �z ipset.__runc C s t |�tkr ttjd| ��dS )zCheck ipset namez ipset name '%s' is not validN)�len�IPSET_MAXNAMELENr r Z INVALID_NAME)r r r r r � check_nameZ s �zipset.check_namec C s� g }d}z| � dg�}W n2 tyJ } zt�d| � W Y d}~n d}~0 0 |�� }d}|D ]L}|r�|�� �dd�}|d |vr�|d tv r�|�|d � |� d�r\d }q\|S ) z?Return types that are supported by the ipset command and kernel� z--helpzipset error: %sNF� r zSupported set types:T) � _ipset__runr# r Zdebug1� splitlines�strip�split� IPSET_TYPES�append� startswith)r r' �output�ex�linesZin_types�line�splitsr r r �set_supported_types` s $ zipset.set_supported_typesc C s( t |�tks|tvr$ttjd| ��dS )zCheck ipset typez!ipset type name '%s' is not validN)r( r) r1 r r Z INVALID_TYPE)r � type_namer r r � check_typeu s �zipset.check_typeNc C s` | � |� | �|� d||g}t|t�rV|�� D ]$\}}|�|� |dkr0|�|� q0| �|�S )z+Create an ipset with name, type and options�creater+ )r* r; � isinstance�dict�itemsr2 r- )r �set_namer: �optionsr$ �key�valr r r � set_create{ s zipset.set_createc C s | � |� | �d|g�S )NZdestroy)r* r- )r r@ r r r � set_destroy� s zipset.set_destroyc C s d||g}| � |�S )N�add�r- �r r@ �entryr$ r r r �set_add� s z ipset.set_addc C s d||g}| � |�S )N�delrG rH r r r � set_delete� s zipset.set_deletec C s, d||g}|r"|� dd�|� � | �|�S )N�testr r )r2 r" r- )r r@ rI rA r$ r r r rM � s z ipset.testc C s2 dg}|r|� |� |r"|�|� | �|��d�S )N�list� )r2 �extendr- r0 )r r@ rA r$ r r r �set_list� s zipset.set_listc C s4 | j dgd�}i }d }}i }|D �] }t|�dk r6q"dd� |�dd�D �}t|�dkr\q"q"|d d krr|d }q"|d d kr�|d }q"|d d kr"|d �� }d } | t|�k �r|| } | d v r�t|�| kr�| d7 } || || < nt�d|� i S | d7 } q�|�r |�r |t|�f||< d }}|�� q"|S )z" Get active ipsets (only headers) z-terse)rA N� c S s g | ] }|� � �qS r )r/ �r �xr r r r � r z.ipset.set_get_active_terse.<locals>.<listcomp>�:r, r �Name�TypeZHeader)r r r r �netmaskz&Malformed ipset list -terse output: %s)rQ r( r0 r �errorr �clear) r r6 r' �_nameZ_type�_optionsr7 Zpairr8 �i�optr r r �set_get_active_terse� sF � � zipset.set_get_active_tersec C s dg}|r|� |� | �|�S )N�save�r2 r- �r r@ r$ r r r r` � s z ipset.savec C s� | � |� | �|� t� }d|v r*d| }d||dg}|rh|�� D ]$\}} |�|� | dkrB|�| � qB|�dd�|� � |�d| � |D ]F} d| v r�d| } |r�|�d|| d�|�f � q�|�d || f � q�|�� t� |j �} t � d | j | jd |j | jf � d g}t| j||j d �\} } t �� dk�r�zt|j � W n t�yV Y nR0 d}t|j �D ]@}t jd||f ddd� |�d��s�t jddd� |d7 }�qft�|j � | dk�r�td| jd�|�| f ��| S )Nr z'%s'r< z-existr+ z%s z flush %s z add %s %s %s z add %s %s z%s: %s restore %sz%s: %dZrestore)�stdinr, rR z%8d: %sr )�nofmt�nlrO )rd r )r* r; r r? r2 �writer" �close�os�statr r r r! r �st_sizer ZgetDebugLogLevelr � ExceptionZdebug3�endswith�unlinkr# )r r@ r: �entriesZcreate_optionsZ entry_optionsZ temp_filer$ rB rC rI ri r& r' r] r7 r r r � set_restore� s^ � �� �zipset.set_restorec C s dg}|r|� |� | �|�S )N�flushra rb r r r � set_flush s zipset.set_flushc C s | � d||g�S )N�renamerG )r Z old_set_nameZ new_set_namer r r rr s z ipset.renamec C s | � d||g�S )N�swaprG )r Z set_name_1Z set_name_2r r r rs s z ipset.swapc C s | � dg�S )N�versionrG r r r r rt s z ipset.version)N)N)NN)N)NN)�__name__� __module__� __qualname__�__doc__r r- r* r9 r; rD rE rJ rL rM rQ r_ r` ro rq rr rs rt r r r r r H s( ' � 8r c C s t | �tkrdS dS )z"Return true if ipset name is validFT)r( r) )r r r r r s r c C s4 | � � }tD ]"}||v r t| || kr ||= q |S )z( Return only non default create options )�copy� IPSET_DEFAULT_CREATE_OPTIONS)rA r\ r^ r r r r s �r c C sb g }| � d�D ]H}z&|�d� |�ttj|dd��� W q tyT |�|� Y q0 qd�|�S )z! Normalize IP addresses in entry �,�/F��strict)r0 �indexr2 �str� ipaddress� ip_networkr# r" )rI Z_entryZ_partr r r �normalize_ipset_entry& s r� c C st t | �d��dkrdS ztj| dd�}W n ty< Y dS 0 |D ],}|�tj|dd��rBttjd� | |���qBdS )z: Check if entry overlaps any entry in the list of entries r{ rR NFr} z,Entry '{}' overlaps with existing entry '{}') r( r0 r� r� r# �overlapsr r � INVALID_ENTRY�format)rI rn Z entry_network�itrr r r � check_entry_overlaps_existing2 s r� c C sz zdd� | D �} W n t y& Y dS 0 t| �dkr8dS | �� | �d�}| D ]&}|�|�rpttjd�||���|}qNdS )z> Check if any entry overlaps any entry in the list of entries c S s g | ]}t j|d d��qS )Fr} )r� r� rS r r r r E r z1check_for_overlapping_entries.<locals>.<listcomp>Nr z Entry '{}' overlaps entry '{}') r# r( �sort�popr� r r r� r� )rn Z prev_networkZcurrent_networkr r r � check_for_overlapping_entriesB s 2 r� ) rx �__all__Zos.pathrh r� Zfirewallr Zfirewall.errorsr Zfirewall.core.progr Zfirewall.core.loggerr Zfirewall.functionsr r Zfirewall.configr r) r1 ZIPSET_CREATE_OPTIONSrz �objectr r r r� r� r� r r r r �<module> s6 � � P core/__pycache__/prog.cpython-39.opt-1.pyc 0000644 00000001352 15025011705 0014240 0 ustar 00 a ���g� � @ s d dl Z dgZddd�ZdS )� N�runProgc C s� |d u r g }| g| }d }|rTt |d�� }|�� �� }W d � n1 sJ0 Y ddi}z tj|tjtjtjd|d�}W n ty� Y dS 0 |�|�\}} |� dd�}|j |fS ) N�r�LANG�CT)�stdin�stderr�stdoutZ close_fds�env)� � zutf-8�replace) �open�read�encode� subprocess�Popen�PIPEZSTDOUT�OSErrorZ communicate�decode� returncode) �prog�argvr �argsZ input_stringZhandler Zprocess�outputZ err_output� r �6/usr/lib/python3.9/site-packages/firewall/core/prog.pyr s& * � )NN)r �__all__r r r r r �<module> s core/__pycache__/fw_policies.cpython-39.pyc 0000644 00000004527 15025011705 0014644 0 ustar 00 a ���g� � @ sV d gZ ddlmZ ddlmZ ddlmZ ddlmZ ddlm Z G dd � d e �Z dS ) �FirewallPolicies� )�config)�log)�LockdownWhitelist)�errors)� FirewallErrorc @ sD e Zd Zdd� Zdd� Zdd� Zdd� Zd d � Zd d � Zd d� Z dS )r c C s d| _ ttj�| _d S �NF)� _lockdownr r ZLOCKDOWN_WHITELIST�lockdown_whitelist��self� r �=/usr/lib/python3.9/site-packages/firewall/core/fw_policies.py�__init__ s zFirewallPolicies.__init__c C s d| j | j| jf S )Nz %s(%r, %r))� __class__r r r r r r �__repr__# s �zFirewallPolicies.__repr__c C s d| _ | j�� d S r )r r �cleanupr r r r r ' s zFirewallPolicies.cleanupc C s� |dkr2t �d| � | j�|�r�t �d� dS n�|dkrdt �d| � | j�|�r�t �d� dS nb|dkr�t �d | � | j�|�r�t �d � dS n0|d kr�t �d | � | j�|�r�t �d � dS dS )N�contextz#Doing access check for context "%s"zcontext matches.T�uidz Doing access check for uid %dz uid matches.�userz Doing access check for user "%s"z user matches.Zcommandz#Doing access check for command "%s"zcommand matches.F)r Zdebug2r Z match_contextZdebug3Z match_uidZ match_userZ match_command)r �key�valuer r r � access_check- s* z FirewallPolicies.access_checkc C s | j rttjd��d| _ d S )Nzenable_lockdown()T)r r r ZALREADY_ENABLEDr r r r �enable_lockdownD s z FirewallPolicies.enable_lockdownc C s | j sttjd��d| _ d S )Nzdisable_lockdown()F)r r r Z NOT_ENABLEDr r r r �disable_lockdownI s z!FirewallPolicies.disable_lockdownc C s | j S )N)r r r r r �query_lockdownN s z FirewallPolicies.query_lockdownN) �__name__� __module__� __qualname__r r r r r r r r r r r r s N) �__all__Zfirewallr Zfirewall.core.loggerr Z#firewall.core.io.lockdown_whitelistr r Zfirewall.errorsr �objectr r r r r �<module> s core/__pycache__/fw_service.cpython-39.pyc 0000644 00000003274 15025011705 0014473 0 ustar 00 a ���gg � @ s2 d gZ ddlmZ ddlmZ G dd � d e�ZdS )�FirewallService� )�errors)� FirewallErrorc @ sL e Zd Zdd� Zdd� Zdd� Zdd� Zd d � Zd d � Zd d� Z dd� Z dS )r c C s || _ i | _d S �N)Z_fw� _services)�self�fw� r �</usr/lib/python3.9/site-packages/firewall/core/fw_service.py�__init__ s zFirewallService.__init__c C s d| j | jf S )Nz%s(%r))� __class__r �r r r r �__repr__ s zFirewallService.__repr__c C s | j �� d S r )r �clearr r r r �cleanup# s zFirewallService.cleanupc C s t | j�� �S r )�sortedr �keysr r r r � get_services( s z FirewallService.get_servicesc C s || j vrttj|��d S r )r r r ZINVALID_SERVICE�r Zservicer r r � check_service+ s z FirewallService.check_servicec C s | � |� | j| S r �r r r r r r � get_service/ s zFirewallService.get_servicec C s || j |j< d S r )r �name)r �objr r r � add_service3 s zFirewallService.add_servicec C s | � |� | j|= d S r r r r r r �remove_service6 s z FirewallService.remove_serviceN) �__name__� __module__� __qualname__r r r r r r r r r r r r r s N)�__all__Zfirewallr Zfirewall.errorsr �objectr r r r r �<module> s core/__pycache__/fw_helper.cpython-39.pyc 0000644 00000004010 15025011705 0014277 0 ustar 00 a ���g) � @ s6 d Z dgZddlmZ ddlmZ G dd� de�ZdS )zhelper backend�FirewallHelper� )�errors)� FirewallErrorc @ s\ e Zd Zdd� Zdd� Zdd� Zdd� Zd d � Zd d � Zd d� Z dd� Z dd� Z dd� Z dS )r c C s || _ i | _d S �N)Z_fw�_helpers)�self�fw� r �;/usr/lib/python3.9/site-packages/firewall/core/fw_helper.py�__init__ s zFirewallHelper.__init__c C s d| j | jf S )Nz%s(%r))� __class__r �r r r r �__repr__" s zFirewallHelper.__repr__c C s | j �� d S r )r �clearr r r r �cleanup' s zFirewallHelper.cleanupc C s || � � vrttj|��d S r )� get_helpersr r �INVALID_HELPER�r �namer r r � check_helper* s zFirewallHelper.check_helperc C s || � � v S r )r r r r r � query_helper. s zFirewallHelper.query_helperc C s t | j�� �S r )�sortedr �keysr r r r r 1 s zFirewallHelper.get_helpersc C s t | j�dkS )Nr )�lenr r r r r � has_helpers4 s zFirewallHelper.has_helpersc C s | � |� | j| S r )r r r r r r � get_helper7 s zFirewallHelper.get_helperc C s || j |j< d S r )r r )r �objr r r � add_helper; s zFirewallHelper.add_helperc C s" || j vrttj|��| j |= d S r )r r r r r r r r � remove_helper> s z FirewallHelper.remove_helperN) �__name__� __module__� __qualname__r r r r r r r r r r r r r r r s N)�__doc__�__all__Zfirewallr Zfirewall.errorsr �objectr r r r r �<module> s core/__pycache__/fw.cpython-39.pyc 0000644 00000105333 15025011705 0012752 0 ustar 00 a ���gs� � @ s� d gZ ddlZddlZddlZddlZddlZddlmZmZ ddl m Z ddl m Z ddl m Z ddl mZ ddl mZ dd l mZ dd l mZ dd lmZ dd lmZ dd lmZ ddlmZ ddlmZ ddl m Z ddl m Z ddl m!Z! ddl"m#Z# ddl$m%Z% ddl&m'Z'm(Z( ddl)m*Z* ddl+m,Z, ddl-m.Z. ddl/m0Z0 ddl1m2Z2 ddl3m4Z4 dd l5m6Z6m7Z7 dd l8m9Z9 dd l:m;Z; dd l<m=Z= dd l>m?Z? dd!l@mAZA dd"lBmCZC dd#l mDZD dd$lEmFZF G d%d � d eG�ZHdS )&�Firewall� N)�Dict�List)�config)� functions)� ipXtables)�ebtables)�nftables)�ipset)�modules)�FirewallIcmpType)�FirewallService)� FirewallZone)�FirewallDirect)�FirewallConfig)�FirewallPolicies)� FirewallIPSet)�FirewallTransaction)�FirewallHelper)�FirewallPolicy)�nm_get_bus_name�nm_get_interfaces_in_zone)�log)� IO_Object)�firewalld_conf)�Direct)�service_reader)�icmptype_reader)� zone_reader�Zone)� ipset_reader)� IPSET_TYPES)� helper_reader)� policy_reader)�check_on_disk_config)� Rich_Rule)�errors)� FirewallErrorc @ sZ e Zd Zd�dd�Zdd� Zdd� Zdd � Zi feee e f d �d d �Z d d� Z dd� Z dd� Zdd� Zdd� Zdd� Zdd� Zdd � Zd�d d �Zd d � Zd!d"� Zd�d#d$�Zd�d%d&�Zd'd(� Zd)d*� Zd+d,� Zd-d.� Z d/d0� Z d1d2� Z d3d4� Z d�d5d6�Z d7d8� Z!d9d:� Z"d;d<� Z#d=d>� Z$d?d@� Z%dAdB� Z&dCdD� Z'dEdF� Z(dGdH� Z)dIdJ� Z*dKdL� Z+d�dNdO�Z,d�dPdQ�Z-dRdS� Z.d�dTdU�Z/d�dVdW�Z0d�dXdY�Z1d�dZd[�Z2d\d]� Z3d^d_� Z4d`da� Z5dbdc� Z6ddde� Z7dfdg� Z8dhdi� Z9djdk� Z:dldm� Z;dndo� Z<dpdq� Z=drds� Z>dtdu� Z?d�dvdw�Z@dxdy� ZAdzd{� ZBd|d}� ZCd~d� ZDd�d�� ZEd�d�� ZFd�d�� ZGd�d�� ZHd�d�� ZId�d�� ZJdMS )�r Fc C s� t tj�| _|| _|sXt�| �| _t�| �| _ t � � | _ t � � | _ t�| �| _t�� | _t| �| _t| �| _t| �| _t| �| _t| �| _t� | _ t | �| _ t | �| _ t | �| _!| �"� d S �N)#r r �FIREWALLD_CONF�_firewalld_conf�_offliner � ip4tables�ip4tables_backend� ip6tables�ip6tables_backendr �ebtables_backendr � ipset_backendr �nftables_backendr �modules_backendr �icmptyper �servicer �zoner �directr r �policiesr r �helperr �policy�_Firewall__init_vars)�selfZoffline� r= �4/usr/lib/python3.9/site-packages/firewall/core/fw.py�__init__G s& zFirewall.__init__c C sD d| j | j| j| j| j| j| j| j| j| j | j | j | j | j | jf S )Nz:%s(%r, %r, %r, %r, %r, %r, %r, %r, %r, %r, %r, %r, %r, %r))� __class__�ip4tables_enabled�ip6tables_enabled�ebtables_enabled�_state�_panic� _default_zone�_module_refcount�_marks�cleanup_on_exit�cleanup_modules_on_exit�_ipv6_rpfilter� ipset_enabled�_individual_calls� _log_denied�r< r= r= r> �__repr___ s ��zFirewall.__repr__c C s� d| _ d| _tj| _g | _g | _i | _g | _tj | _ tj | _ tj | _tj| _tj| _tj| _tj| _tj| _tj| _tj| _ | j r�d| _ d| _ d| _ d| _!t"| _#d| _$n0d| _ g | _%d| _ g | _&d| _ d| _!t"| _#d| _$d S )NZINITFT)'rD rE r Z FALLBACK_ZONErF �_default_zone_interfacesZ_nm_assigned_interfacesrG rH ZFALLBACK_CLEANUP_ON_EXITrI Z FALLBACK_CLEANUP_MODULES_ON_EXITrJ ZFALLBACK_IPV6_RPFILTERrK ZFALLBACK_INDIVIDUAL_CALLSrM ZFALLBACK_LOG_DENIEDrN ZFALLBACK_FIREWALL_BACKEND�_firewall_backendZ FALLBACK_FLUSH_ALL_ON_RELOAD�_flush_all_on_reloadZFALLBACK_RFC3964_IPV4� _rfc3964_ipv4Z FALLBACK_ALLOW_ZONE_DRIFTINGZ_allow_zone_driftingZ FALLBACK_NFTABLES_TABLE_OWNER�_nftables_table_ownerr+ rA rB rC rL r! �ipset_supported_types�nftables_enabled�ipv4_supported_icmp_types�ipv6_supported_icmp_typesrO r= r= r> Z __init_varsh s@ zFirewall.__init_varsc s� i }� fdd�� j �� D �|d< � fdd�� j�� D �|d< � fdd�� j�� D �|d< � fdd�� j�� D �|d < � fd d�� j� � D �|d < � fd d�� j � � D �|d < i |d< � j � d�|d d< i |d< i |d d< t� j�� ��t� j�� ��D ] }� j�|�|d d |< q�t� j�� ��t� j�� ��D ]�}|� jv�sR|� jv�r6t�� j�|��|d d |< g |d d | _|� jv�r�|d d | j�d� |� jv�r6|d d | j�d� �q6|S )zH Returns a dict of dicts of all runtime config objects. c s i | ]}|� j �|��qS r= )r � get_ipset)�.0�_ipsetrO r= r> � <dictcomp>� � z4Firewall.get_all_io_objects_dict.<locals>.<dictcomp>�ipsetsc s i | ]}|� j �|��qS r= )r9 � get_helper)r[ r9 rO r= r> r] � r^ �helpersc s i | ]}|� j �|��qS r= )r4 � get_icmptype)r[ r4 rO r= r> r] � r^ � icmptypesc s i | ]}|� j �|��qS r= )r5 � get_service)r[ r5 rO r= r> r] � r^ �servicesc s i | ]}|� j �|��qS r= )r6 �get_zone)r[ r6 rO r= r> r] � r^ �zonesc s i | ]}|� j �|��qS r= )r: Z get_policy)r[ r: rO r= r> r] � r^ r8 Zconf�FirewallBackend�runtimeZicmptypes_unsupported�ipv4�ipv6)r � get_ipsetsr9 � get_helpersr4 � get_icmptypesr5 � get_servicesr6 � get_zonesr: Z"get_policies_not_derived_from_zoner* �get�setr � differencerb � intersectionrX rY �copyZ destination�append)r< Z conf_dictr4 r= rO r> �get_all_io_objects_dict� s8 � � � z Firewall.get_all_io_objects_dict)�extra_io_objectsc C sn | � � }|D ] }|| D ]}||| |j< qq g d�}|D ].}|| }|�� D ]\}} | �| �� |� qNq:d S )N)r_ ra rc re rg r8 )rw �name�itemsZcheck_config_dictZexport_config_dict) r< rx Zall_io_objectsZtype_key�obj�orderZ io_obj_typeZio_objsry Zio_objr= r= r> �full_check_config� s zFirewall.full_check_configc C s� | j r$d| j�� vr$t�d� d| _ | jrHd| j�� vrHt�d� d| _| jrld| j�� vrlt�d� d| _| j s�| js�| j s�t t j d��d S )N�filterziptables is not usable.Fzip6tables is not usable.zebtables is not usable.zNo IPv4 and IPv6 firewall.) rA r- �get_available_tablesr �info1rB r/ rC r0 rW r' r& � UNKNOWN_ERRORrO r= r= r> �_start_check_tables� s& � � � �z Firewall._start_check_tablesc C s� z| j �� W n: tyH | jr.t�d� nt�d� g | _d| _Y n0 | j � � | _| j � � | j j s�| j j r|t�d� n"| jr�t�d� n t�d� d| _| jr�| j�d�| _n| jr�| j �� | _ng | _| j� � | jj �s| jj r�t�d� n$| j�r t�d � n t�d � d| _| j�r2| j�d �| _n | j�rH| j�� | _ng | _| j� � | jj �s�| jj �rxt�d � n$| j�r�t�d � n t�d� d| _| j�r�| j�s�| jj�s�t�d� | j�� | j�r�| jj �s�t�d� d S )Nzaipset not usable, disabling ipset usage in firewall. Other set backends (nftables) remain usable.z4ipset not usable, disabling ipset usage in firewall.FzFiptables-restore is missing, using individual calls for IPv4 firewall.zMiptables-restore and iptables are missing, IPv4 direct rules won't be usable.zCiptables-restore and iptables are missing, disabling IPv4 firewall.rj zGip6tables-restore is missing, using individual calls for IPv6 firewall.zOip6tables-restore and ip6tables are missing, IPv6 direct rules won't be usable.zEip6tables-restore and ip6tables are missing, disabling IPv6 firewall.rk zHebtables-restore is missing, using individual calls for bridge firewall.zKebtables-restore and ebtables are missing, eb direct rules won't be usable.zEebtables-restore and ebtables are missing, disabling bridge firewall.zSebtables-restore is not supporting the --noflush option, will therefore not be usedzpConfiguration has NftablesTableOwner=True, but it's not supported by nftables. Table ownership will be disabled.) r1 Zset_list� ValueErrorrW r r� �warningrV rL Zset_supported_typesr- Z fill_exists�restore_command_existsZcommand_existsrA r2 Zsupported_icmp_typesrX r/ rB rY r0 rC rM �restore_noflush_option�debug1Z probe_supportrU Zsupports_table_ownerrO r= r= r> �_start_probe_backends� sn � ���z Firewall._start_probe_backendsc C s� t �dtj� z| j�� W n: tyV } z"t �|� t �d� W Y d }~�n2d }~0 0 | j�d�rr| j�d�| _ | j�d�r�| j�d�}|d ur�|� � dv r�d| _ t �d| j � | j�d�r�| j�d�}|d ur�|� � d v r�d | _ t �d | j � | j�d ��rR| j�d �}|d u�rR|� � d v �rRt �d � z| j �� W n t�yP Y n0 | j�d��r�| j�d�}|d u�r�|� � dv �r�d| _nV|� � dv �r�d| _n@|� � dv �r�d| _n*|� � dv �r�d| _n|� � dv �r�d| _t �d| j� d�� | j�d��r8| j�d�}|d u�r8|� � d v �r8t �d� d | _| j�d ��r�| j�d �}|d u �sj|� � dk�rrd | _n|� � | _t �d | j� | j�d ��r�| j�d �| _t �d | j� | j�d!��r�| j�d!�}|� � dv �r�d| _nd | _t �d"| j� | j�d#��r<| j�d#�}|� � dv �r(d| _nd | _t �d$| j� | j�d%��r�| j�d%�}|� � dv �rld| _nd | _t �d&| j� | j�t�| j�� d S )'Nz"Loading firewalld config file '%s'z0Using fallback firewalld configuration settings.� DefaultZoneZ CleanupOnExit)�noZfalseFz CleanupOnExit is set to '%s'ZCleanupModulesOnExit)�yes�trueTz#CleanupModulesOnExit is set to '%s'ZLockdownzLockdown is enabledZ IPv6_rpfilterr� )r� r� �strictr� )�looser� )� loose-forwardr� )�strict-forwardr� zIPv6_rpfilter is set to '�'ZIndividualCallszIndividualCalls is enabled� LogDeniedZoffzLogDenied is set to '%s'rh z FirewallBackend is set to '%s'ZFlushAllOnReloadz FlushAllOnReload is set to '%s'Z RFC3964_IPv4zRFC3964_IPv4 is set to '%s'ZNftablesTableOwnerz!NftablesTableOwner is set to '%s')r r� r r) r* �read� Exceptionr� rq rF �lowerrI rJ r8 Zenable_lockdownr' rK rM rN rR rS rT rU �set_firewalld_confru �deepcopy)r< �msg�valuer= r= r> �_start_load_firewalld_conf1 s� " � � � � � �z#Firewall._start_load_firewalld_confc C s� t �d� z| jj�� W nX tyr } z@| j�� rJt �d| jjj|� nt �d| jjj|� W Y d }~n d }~0 0 | j � t � | j�� d S )NzLoading lockdown whitelistz*Failed to load lockdown whitelist '%s': %s) r r� r8 Zlockdown_whitelistr� r� Zquery_lockdown�error�filenamer Z set_policiesru r� �r< r� r= r= r> � _start_load_lockdown_whitelist� s � �z'Firewall._start_load_lockdown_whitelistc C sL | � tj� | �tj� | �tj� | �tj� | � tj � | � tj � d S r( ) �_loader_ipsetsr ZFIREWALLD_IPSETS�_loader_icmptypesZFIREWALLD_ICMPTYPES�_loader_helpersZFIREWALLD_HELPERS�_loader_servicesZFIREWALLD_SERVICES� _loader_zonesZFIREWALLD_ZONES�_loader_policiesZFIREWALLD_POLICIESrO r= r= r> �_start_load_stock_config� s z!Firewall._start_load_stock_configc C sL | � tj� | �tj� | �tj� | �tj� | � tj � | � tj � d S r( ) r� r ZETC_FIREWALLD_IPSETSr� ZETC_FIREWALLD_ICMPTYPESr� ZETC_FIREWALLD_HELPERSr� ZETC_FIREWALLD_SERVICESr� ZETC_FIREWALLD_ZONESr� ZETC_FIREWALLD_POLICIESrO r= r= r> �_start_load_user_config� s z Firewall._start_load_user_configc C s� | j �� D ] }| j�t�| j �|��� q | j �� D ] }| j� t�| j � |��� q4| j � � D ] }| j � t�| j �|��� q^| j �� D ] }| j�t�| j �|��� q�| j �� D ] }| j�t�| j �|��� q�| j�t�| j �� �� i }| j �� D ]�}| j �|�}d|j v�r0| j � t�| j �|��� q�t j �!|j �} | |v�r|t"� } | | _ | �#| j � |j | _ d| _$d| _%| || < t&�'d| |j t j(|j)� || �*|� q�|D ]}| j � || � �q�d S )N�/Fz"Combining zone '%s' using '%s%s%s')+r rl r � add_ipsetru r� rZ rn r4 � add_icmptyperb rm r9 � add_helperr` ro r5 � add_servicerd �get_policy_objectsr: Z add_policy�get_policy_objectr7 Zset_permanent_configZ get_directrp rf ry r6 �add_zone�os�path�basenamer � check_name�defaultZforwardr r� �sepr� �combine) r< r\ r4 r9 r5 r: Zcombined_zonesr6 Zz_objZ combined_nameZ combined_zoner= r= r> � _start_copy_config_to_runtime� s\ ������ � �z&Firewall._start_copy_config_to_runtimec C sz t tj�}tj�tj�rjt�dtj � z |�� W n4 t yh } z t� dtj|� W Y d }~n d }~0 0 | j� |� d S )Nz Loading direct rules file '%s'z)Failed to load direct rules file '%s': %s) r r ZFIREWALLD_DIRECTr� r� �existsr r� r� r� r� Z set_direct)r< r{ r� r= r= r> �_start_load_direct_rules� s � �z!Firewall._start_load_direct_rulesc C s t | �}|s| j|d� |r |s4| j�� rF| j�� rF|�d� |�� |rb|rbt�d� | j � � | j |d� |�d� |�� | j�� r�| j�� r�t�d� | j� � t�d� | j |d� t�d� | jj|d� | jjd | j|d� t�d� | jj|d� |�d� |�� d S )N��use_transactionTzUnloading firewall moduleszApplying ipsetszApplying default rule setzApplying used zoneszApplying used policies)r �flushr �backendsZ has_ipsets�execute�clearr r� r3 �unload_firewall_modules�apply_default_tablesZ apply_ipsets�apply_default_rulesr6 Z apply_zones�change_default_zonerF r: Zapply_policies)r< �reload�complete_reload� transactionr= r= r> �_start_apply_objects� s< �� � z Firewall._start_apply_objectsc C s� t | �}| j�� r�t�d� | j�|� z|�d� |�� W nR ty~ } z(t|j d|j rb|j nd ��W Y d }~n d }~0 t y� � Y n0 |�d� |�� d S )Nz2Applying direct chains rules and passthrough rulesTz Direct: %s� ) r r7 Zhas_configurationr r� Z apply_directr� r� r' �coder� r� )r< r� �er= r= r> �_start_apply_direct_rules s 0 z"Firewall._start_apply_direct_rulesc C s� dD ]$}|| j �� vrttjd�|���q| j| j �� vr~d| j �� v rNd}nd| j �� v rbd}nd}t�d| j|� || _nt� d| j� | j s�| � � | � � | j dkr�d }n| j }| �|�s�ttjd �| j ���d S ) N)�blockZdropZtrustedzZone '{}' is not available.ZpublicZexternalr� z+Default zone '%s' is not valid. Using '%s'.zUsing default zone '%s'Ziptablesr, z'Firewall backend '{}' is not available.)r6 rp r' r& � INVALID_ZONE�formatrF r r� r� r+ r} r� rR �is_backend_enabledr� )r< �zr6 Zbackend_to_checkr= r= r> � _start_check5 s4 � ��zFirewall._start_checkc C s� | � � | �� | �| j� | js*| �� | �� | �� | �� | � � | � � | jr\d S t � � dkrpt � � }| j||d� | �� t � � dkr�t � � }t �d|| � d S )Nr �r� r� � z%Flushing and applying took %f seconds)r� r� �_select_firewall_backendrR r+ r� r� r� r� r� r� r ZgetDebugLogLevel�timer� r� Zdebug2)r< r� r� Ztm1Ztm2r= r= r> �_startX s& zFirewall._startc C st | � � | j�� | j�t�| j�� | �| j� | j s@| � � | � � | � � | � � | j rbdS | j||d� dS )z� This is basically _start() with at least the following differences: - built-in defaults for firewalld.conf - no lockdown list - no user config (/etc/firewalld) - no direct rules Nr� )�cleanupr* � set_defaultsr r� ru r� r� rR r+ r� r� r� r� r� )r< r� r� r= r= r> �_start_failsafew s zFirewall._start_failsafec C s� z | � � W n� ty� } z�t�d� z | �� d| _| �d� W nv ty� } z^t�|� t�� t�|� t�d� z | �� W n ty� Y n0 t � t j � W Y d }~n d }~0 0 |�W Y d }~nd }~0 0 d| _| �d� d S )NzLFailed to load user configuration. Falling back to full stock configuration.�FAILED�ACCEPTz�Failed to load full stock configuration. This likely indicates a system level issue, e.g. the firewall backend (nftables, iptables) is broken. All hope is lost. Exiting.�RUNNING) r� r� r r� r� rD � set_policy� exceptionr� �sys�exitr& r� )r< Z original_exZnew_exr= r= r> �start� s* "zFirewall.startc c s: t j�|�sd S tt �|��D ]}|�d�s.q |V q d S )N�.xml)r� r� �isdir�sorted�listdir�endswith)r< r� r� r= r= r> � _loader_config_file_generator� s z&Firewall._loader_config_file_generatorc C s� | � |�D ]v}t�d|tj|� t||�}|j| j�� v r`| j� |j�}t�d|j tj|j � n|j � tj �rtd|_| j�|� q d S )Nz Loading service file '%s%s%s'�Overrides '%s%s%s'T)r� r r� r� r� r ry r ro rd r� r� � startswith� ETC_FIREWALLDr� r� �r< r� r� r{ �orig_objr= r= r> r� � s �zFirewall._loader_servicesc C s� | � |�D ]v}t�d|tj|� t||�}|j| j�� v r`| j� |j�}t�d|j tj|j � n|j � tj �rtd|_| j�|� q d S )NzLoading ipset file '%s%s%s'r� T)r� r r� r� r� r ry r rl rZ r� r� r� r� r� r� r� r= r= r> r� � s �zFirewall._loader_ipsetsc C s� | � |�D ]v}t�d|tj|� t||�}|j| j�� v r`| j� |j�}t�d|j tj|j � n|j � tj �rtd|_| j�|� q d S )Nz Loading helper file '%s%s%s'r� T)r� r r� r� r� r" ry r rm r` r� r� r� r� r� r� r� r= r= r> r� � s �zFirewall._loader_helpersc C s� | � |�D ]v}t�d|tj|� t||�}|j| j�� v r`| j� |j�}t�d|j tj|j � n|j � tj �rtd|_| j�|� q d S )Nz Loading policy file '%s%s%s'r� T)r� r r� r� r� r# ry r r� r� r� r� r� r� r� Zadd_policy_objectr� r= r= r> r� � s �zFirewall._loader_policiesc C s� | � |�D ]v}t�d|tj|� t||�}|j| j�� v r`| j� |j�}t�d|j tj|j � n|j � tj �rtd|_| j�|� q d S )Nz Loading icmptype file '%s%s%s'r� T)r� r r� r� r� r ry r rn rb r� r� r� r� r� r� r� r= r= r> r� � s �zFirewall._loader_icmptypesc C s t j�|�sd S tt �|��D ]�}|�d�sd|�tj�r t j�d||f �r | j d||f dd� q d||f }t � d|� t |||d�}|r�dt j� |�t j� |�dd� f |_|�|j� |j| j�� v r�| j�|j�}t � d |jt j|j� n|j�tj��r d|_| j�|� q d S ) Nr� z%s/%sT)r� zLoading zone file '%s')Z no_check_namer ���r� )r� r� r� r� r� r� r� r r� r� r r� r r� ry r� rp rf r� r� r� r� )r< r� r� r� ry r{ r� r= r= r> r� � s4 � � �zFirewall._loader_zonesc C sp | j �� | j�� | j�� | j�� | j�� | j�� | j�� | j�� | j �� | j �� | � � d S r( ) r4 r� r5 r6 r r9 r r7 r8 r: r* r; rO r= r= r> r� s zFirewall.cleanupc C sN | j sB| jr(| �� | j�� | �d� | jrBt�d� | j� � | � � d S )Nr� z!Unloading firewall kernel modules) r+ rI r� r r� rJ r r� r3 r� r� rO r= r= r> �stop- s z Firewall.stopc C s� d}d}t |�D ]�\}}|r.| j�|�\}}n$| j| dkrBd}n| j�|�\}}|dkrl|d7 }||7 }q|r�| j�|d� | j| d7 < q|| jv r| j| d8 < | j| dkr| j|= q||fS )Nr r� r� )� enumerater3 � load_modulerG Z unload_module� setdefault) r< Z_modules�enableZ num_failedZ error_msgs�i�module�statusr� r= r= r> �handle_modules< s( zFirewall.handle_modulesc C s |dkrd| _ d S )Nr F)rW )r< �backendr= r= r> r� V s z!Firewall._select_firewall_backendc C s4 | � � D ]}|j|kr| S qttjd| ��d S )Nz'%s' backend does not exist)� all_backendsry r' r& r� )r< ry r� r= r= r> �get_backend_by_name\ s �z Firewall.get_backend_by_namec C s\ | j r | jS |dkr | jr | jS |dkr4| jr4| jS |dkrH| jrH| jS tt j d| ��d S �Nrj rk �ebz-'%s' is not a valid backend or is unavailable) rW r2 rA r- rB r/ rC r0 r' r& � INVALID_IPV�r< �ipvr= r= r> �get_backend_by_ipvc s �zFirewall.get_backend_by_ipvc C sP |dkr| j r| jS |dkr(| jr(| jS |dkr<| jr<| jS ttjd| ��d S r� ) rA r- rB r/ rC r0 r' r& r� r� r= r= r> �get_direct_backend_by_ipvo s �z"Firewall.get_direct_backend_by_ipvc C s< |dkr| j S |dkr | jS |dkr*| jS |dkr8| jS dS )Nr, r. r r F)rA rB rC rW )r< ry r= r= r> r� y s zFirewall.is_backend_enabledc C s8 | j r dS |dkr| jS |dkr&| jS |dkr4| jS dS )NTrj rk r� F)rW rA rB rC r� r= r= r> �is_ipv_enabled� s zFirewall.is_ipv_enabledc C sR g }| j r|�| j� n6| jr*|�| j� | jr<|�| j� | jrN|�| j� |S r( ) rW rv r2 rA r- rB r/ rC r0 �r< r� r= r= r> �enabled_backends� s zFirewall.enabled_backendsc C sP g }| j r|�| j� | jr(|�| j� | jr:|�| j� | jrL|�| j� |S r( ) rA rv r- rB r/ rC r0 rW r2 r r= r= r> r� � s zFirewall.all_backendsNc C sJ |d u rt | �}n|}| �� D ]}|�||�� � q |d u rF|�d� d S �NT)r r � add_rulesZbuild_default_tablesr� )r< r� r� r� r= r= r> r� � s z Firewall.apply_default_tablesc C s� |d u rt | �}n|}| �� D ] }|�| j�}|�||� q | �d�r~| �d�}d|�� v r~| jdkr~|� | j�}|�||� | �d�r�| j r�|� � }|�||� |d u r�|� d� d S )Nrk �rawr� T) r r Zbuild_default_rulesrN r r r� r rK Zbuild_rpfilter_rulesrT Zbuild_rfc3964_ipv4_rulesr� )r< r� r� r� �rulesZ ipv6_backendr= r= r> r� � s" z Firewall.apply_default_rulesc C s | j r| j�� sdS dS )NTF)rW r7 Zhas_runtime_configurationrO r= r= r> � may_skip_flush_direct_backends� s z'Firewall.may_skip_flush_direct_backendsc C s\ |d u rt | �}n|}| �� D ]&}|| �� v r0q |�� }|�||� q |d u rX|�d� d S r )r r� r �build_flush_rulesr r� �r< r� r� r� r r= r= r> �flush_direct_backends� s z Firewall.flush_direct_backendsc C sl |d u rt | �}n|}t�d� | �� s4| j|d� | �� D ]}|�� }|�||� q<|d u rh|�d� d S )NzFlushing rule setr� T) r r r� r r r r r r� r r= r= r> r� � s zFirewall.flushc C s< |dv s J �|d u r0|dkr dnd}|||d�}|� ||�S )N)r� �DROP�PANICr� r )ZINPUTZOUTPUTZFORWARD)Zbuild_set_policy_rules)r< r� r: �policy_detailsZdpr= r= r> �_set_policy_build_rules� s �z Firewall._set_policy_build_rulesc C s| |d u rt | �}n|}t�d||dkr8dt�|�� d�nd� | �� D ] }| �|||�}|�||� qF|d u rx|�d� d S )NzSetting policy to '%s'%sr z (ReloadPolicy=�)r� T) r r r� r Z_unparse_reload_policyr r r r� )r< r: r r� r� r� r r= r= r> r� � s �� zFirewall.set_policyc C sB |sdS | � |�}|s&ttjd| ��| �|�s4dS |�|| j�S )Nr� �'%s' is not a valid backend)r� r' r& r� r� �set_rulerN )r< � backend_name�ruler� r= r= r> r s � z Firewall.rulec C s t td |��}| �|�}|s,ttjd| ��| �|�s:d S | jsZ|jrZ|dk�r| j j �st |�D ]�\}}z|� || j � W qb ty� } zjt�t�� � t�|� t|d |� �D ]0}z|� |�|�| j � W q� ty� Y q�0 q�|�W Y d }~qbd }~0 0 qbn|�|| j � d S )Nr r )�listr~ r� r' r& r� r� rM r� r0 r� r� r rN r� r r� � traceback� format_excr� �reversedZ reverse_ruleZ set_rules) r< r r Z_rulesr� r� r r� Zrruler= r= r> r # s8 � ��� zFirewall.rulesc C s | j rttj��d S r( )rE r' r& Z PANIC_MODErO r= r= r> � check_panicC s zFirewall.check_panicc C s" |}|| j �� vr ttj|��|S r( )r: Z get_policiesr' r& ZINVALID_POLICY)r< r: Z_policyr= r= r> � check_policyG s zFirewall.check_policyc C s6 |}|r|dkr| � � }|| j�� vr2ttj|��|S )Nr� )�get_default_zoner6 rp r' r& r� )r< r6 �_zoner= r= r> � check_zoneM s zFirewall.check_zonec C s t �|�sttj|��d S r( )r ZcheckInterfacer' r& ZINVALID_INTERFACE)r< � interfacer= r= r> �check_interfaceU s zFirewall.check_interfacec C s | j �|� d S r( )r5 � check_service)r< r5 r= r= r> r Y s zFirewall.check_servicec C s t �|�sttj|��d S r( )r � check_portr' r& Z INVALID_PORT)r< �portr= r= r> r \ s zFirewall.check_portc C s* |st tj��|dvr&t tjd| ��d S )N)ZtcpZudpZsctpZdccpz''%s' not in {'tcp'|'udp'|'sctp'|'dccp'})r' r& ZMISSING_PROTOCOLZINVALID_PROTOCOL)r< Zprotocolr= r= r> � check_tcpudp` s ��zFirewall.check_tcpudpc C s t �|�sttj|��d S r( )r ZcheckIPr' r& � INVALID_ADDR)r< �ipr= r= r> �check_iph s zFirewall.check_ipc C sP |dkr t �|�sLttj|��n,|dkr@t �|�sLttj|��n ttjd��d S )Nrj rk z'%s' not in {'ipv4'|'ipv6'})r Z checkIPnMaskr' r& r# Z checkIP6nMaskr� )r< r� �sourcer= r= r> � check_addressl s �zFirewall.check_addressc C s | j �|� d S r( )r4 �check_icmptype)r< Zicmpr= r= r> r( w s zFirewall.check_icmptypec C s> t |t�s td|t|�f ��t|�dk r:ttjd| ��d S )Nz%s is %s, expected intr z#timeout '%d' is not positive number)� isinstance�int� TypeError�typer' r& � INVALID_VALUE)r< �timeoutr= r= r> � check_timeoutz s �zFirewall.check_timeoutc C s� t | � | j}| j�� }| j}| j}|s`i }| j�� D ]}| j�|�j ||< q6| j � � }| � � } g } | j� � D ]} | �| j�| �� qn|s�t�| j�d��} | jd| d� | �� | �� d } z| jd|d� W n( ty� } z|} W Y d }~n d }~0 0 |�r8| D ]2}| j�|j��s| j�r|�s| j � |j� �q|�s�| � � }|| k�r�||v�rbi ||< || D ]0}|| j v �rj|| | || |< || |= �qj| j�� D ]B}||v �r�|| D ]}| j� ||� �q�||= n t �!d|� �q�t"|�dk�r t#|�$� �D ]}t �!d|� ||= �q~| D ]�}| j�|j��r�|j%D ]T}z| j�&|j|� W n8 t'�y� } z |j(t)j*k�rz|�W Y d }~n d }~0 0 �q>n| j�+|� | j�,|j� �q$| j �-|� t.� }|�r| j�� d g D ](}t/|�D ]}| jj |||d � �q�q�|| _| j�s | �d � | j�s�|| jk�r�|d k�rd| �0| j1d �D ]}| j1�2|| j3� �qJnT| �0| j4d �D ]}| j4�2|| j3� �qr| j5�r�| �0| j6d �D ]}| j6�2|| j3� �q�| �r�d | _7| �nd| _7d S )NZ ReloadPolicyr )r Tr� zNew zone '%s'.r z(Lost zone '%s', zone interfaces dropped.r� )Zsenderr� r r� r� )8r$ rE r Zomit_native_ipsetrR rS r6 rp rf � interfacesr7 Zget_runtime_configr rl rv rZ r Z_parse_reload_policyr* rq r� r� r� r� r� Z query_ipsetry rL r1 Z set_destroyrQ �change_zone_of_interfacer r� �lenr �keys�entriesZ add_entryr' r� r& �ALREADY_ENABLEDr� Z apply_ipsetZ set_configr r r r2 r rN r- rB r/ rD )r< r� rE Z_omit_native_ipsetZold_firewall_backendZ flush_allZ_zone_interfacesr6 Z_direct_config�_old_dzZ _ipset_objs�_nameZ reload_policyZstart_exceptionr� r{ Z_new_dz�ifaceZ interface_id�entryr� Z nm_bus_namer r r= r= r> r� � s� � � ���zFirewall.reloadc C s | j S r( )rD rO r= r= r> � get_state s zFirewall.get_statec C s\ | j rttjd��z| �d� W n0 tyP } zttj|��W Y d }~n d }~0 0 d| _ d S )Nzpanic mode already enabledr T)rE r' r& r5 r� r� �COMMAND_FAILEDr� r= r= r> �enable_panic_mode s �"zFirewall.enable_panic_modec C s\ | j sttjd��z| �d� W n0 tyP } zttj|��W Y d }~n d }~0 0 d| _ d S )Nzpanic mode is not enabledr� F)rE r' r& Z NOT_ENABLEDr� r� r; r� r= r= r> �disable_panic_mode s �"zFirewall.disable_panic_modec C s | j S r( )rE rO r= r= r> �query_panic_mode* s zFirewall.query_panic_modec C s | j S r( )rN rO r= r= r> �get_log_denied/ s zFirewall.get_log_deniedc C sb |t jvr&ttjd|d�t j�f ��|| �� krR|| _| j� d|� | j� � n ttj |��d S )Nz'%s', choose from '%s'z','r� ) r ZLOG_DENIED_VALUESr' r& r- �joinr? rN r* rr �writeZ ALREADY_SET)r< r� r= r= r> �set_log_denied2 s �� zFirewall.set_log_deniedc C s | j S r( )rF rO r= r= r> r A s zFirewall.get_default_zonec C s� | � |�}|| jkr~| j}|| _| j�d|� | j�� | jrBd S | j�||� | j�|�j D ] }|| j v r^| j� d|� q^n t t j|��d S )Nr� r� )r rF r* rr rA r+ r6 r� rf r0 rQ r1 r' r& ZZONE_ALREADY_SET)r< r6 r r6 r8 r= r= r> �set_default_zoneD s zFirewall.set_default_zonec C sD |� � }|�� D ].\}}|s&t|t�r0|||< q||v r||= q|S r( )ru rz r) �bool)r< Z permanentri Zcombined�keyr� r= r= r> �'combine_runtime_with_permanent_settings[ s z0Firewall.combine_runtime_with_permanent_settingsc C s, dD ]"}||v rdd� || D �||< qi }i }t |�� �t |�� �B D ]�}||v rHt|| t�r�t ||v rt|| ng �}tt || �| �||< t|t || �A |@ �||< qHt|| t�s�t|| t��r|| s�|| r�d||< n || �r"|| �s"d||< qHttjd� t || �|���qH||fS )N)Z rich_rulesZ rules_strc S s g | ]}t t|d ���qS ))�rule_str)�strr% )r[ rG r= r= r> � <listcomp>m r^ z;Firewall.get_added_and_removed_settings.<locals>.<listcomp>TFz Unhandled setting type {} key {}) rr r3 r) r rD r* r' r& ZINVALID_SETTINGr� r, )r< Z old_settingsZ new_settingsZrich_keyZ add_settingsZremove_settingsrE �oldr= r= r> � get_added_and_removed_settingsi s$ z'Firewall.get_added_and_removed_settings)F)FF)FF)FF)F)N)N)N)N)N)NN)F)K�__name__� __module__� __qualname__r? rP r; rw r rH r r r} r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r r r� r� r� r r r� r r� r r r r r r r r r" r% r' r( r/ r� r: r< r= r> r? rB r rC rF rK r= r= r= r> r F s� %* Ud0 .# " )I�__all__r� r� ru r� r �typingr r Zfirewallr r Z firewall.corer r r r r Zfirewall.core.fw_icmptyper Zfirewall.core.fw_servicer Zfirewall.core.fw_zoner Zfirewall.core.fw_directr Zfirewall.core.fw_configr Zfirewall.core.fw_policiesr Zfirewall.core.fw_ipsetr Z firewall.core.fw_transactionr Zfirewall.core.fw_helperr Zfirewall.core.fw_policyr Zfirewall.core.fw_nmr r Zfirewall.core.loggerr Zfirewall.core.io.io_objectr Z firewall.core.io.firewalld_confr Zfirewall.core.io.directr Zfirewall.core.io.servicer Zfirewall.core.io.icmptyper Zfirewall.core.io.zoner r Zfirewall.core.io.ipsetr Zfirewall.core.ipsetr! Zfirewall.core.io.helperr" Zfirewall.core.io.policyr# Zfirewall.core.io.functionsr$ Zfirewall.core.richr% r& Zfirewall.errorsr' �objectr r= r= r= r> �<module> sP core/__pycache__/nftables.cpython-39.pyc 0000644 00000125404 15025011705 0014135 0 ustar 00 a ���gɆ � % @ s� d dl Z d dlZd dlZd dlmZ d dlmZmZmZm Z m Z d dl m Z m Z mZmZmZmZmZ d dlmZmZmZmZmZmZmZmZm Z d dl m Z d dl m Z dZ!e!d d Z"e!d d Z#d Z$d Z%i ddde% fidde% fdde% fdde% fd�dd e% fdd e% fdd e% fdd e% fd�d�Z&dEdd�Z'e'd d d �e'd d �e'd d �e'd d �e'd d d!�e'd d d"�e'd d d �e'd d#d$�e'd d d%�e'd d d$�e'd d&d$�e'd d d'�e'd d#d �e'd d d(�e'd d d �e'd d&�e'd d d)�e'd d d*�e'd d d+�e'd d#�e'd d&d$�e'd d,�e'd d-�e'd d.�e'd d d/�e'd d0�e'd d1�e'd d2�e'd d#d)�e'd d d3�e'd d#d+�e'd d d4�e'd d0d$�e'd d0d �d5�"e'd6d d)�e'd6d&d �e'd6d d+�e'd6d d$�e'd6d �e'd6d �e'd6d �e'd6d d/�e'd6d7�e'd6d8�e'd6d9�e'd6d:�e'd6d;�e'd6d<�e'd6d d �e'd6d=�e'd6d&�e'd6d d!�e'd6d>�e'd6d d(�e'd6d?�e'd6d@�e'd6d0�e'd6d0d$�e'd6d0d �e'd6d&d$�e'd6d&d+�dA�dB�Z(G dCdD� dDe)�Z*dS )F� N)�log)� check_mac� getPortRange� normalizeIP6�check_single_address� check_address)� FirewallError� UNKNOWN_ERROR� INVALID_RULE�INVALID_ICMPTYPE� INVALID_TYPE� INVALID_ENTRY� INVALID_PORT) � Rich_Accept� Rich_Reject� Rich_Drop� Rich_Mark�Rich_Masquerade�Rich_ForwardPort�Rich_IcmpBlock�Rich_Tcp_Mss_Clamp� Rich_NFLog)�DEFAULT_ZONE_TARGET)�NftablesZ firewalld�_Z policy_dropZprobeZpolicy_� � PREROUTING� preroutingij���i����Z postrouting�d �output)r � POSTROUTING�OUTPUT�inputZforward)r �INPUT�FORWARDr! )�raw�mangle�nat�filterc C sH dd| dd�id|d�ig}|d urD|� dd| dd�id|d�i� |S )N�match�payload�type��protocol�field�==��left�op�right�code)�append)r- r+ r4 � fragments� r7 �:/usr/lib/python3.9/site-packages/firewall/core/nftables.py�_icmp_types_fragmentsT s � � r9 �icmp�destination-unreachable� � echo-reply� echo-request� � �redirect� � �parameter-problem� � � � � �router-advertisement�router-solicitation� source-quench� � time-exceeded�timestamp-reply�timestamp-request� � )"�communication-prohibitedr; r= r> zfragmentation-neededzhost-precedence-violation�host-prohibitedz host-redirectz host-unknown�host-unreachablez ip-header-badznetwork-prohibitedznetwork-redirectznetwork-unknownznetwork-unreachablerD �port-unreachablezprecedence-cutoffzprotocol-unreachablerA zrequired-option-missingrJ rK rL zsource-route-failedrN rO rP ztos-host-redirectztos-host-unreachableztos-network-redirectztos-network-unreachable�ttl-zero-during-reassembly�ttl-zero-during-transit�icmpv6�mld-listener-done�mld-listener-query�mld-listener-report�mld2-listener-reportznd-neighbor-advert�nd-neighbor-solicit�packet-too-bigz nd-redirect�nd-router-advertznd-router-solicit)zaddress-unreachablez bad-headerz beyond-scoperS r; r= r> z failed-policyrZ r[ r\ r] zneighbour-advertisementzneighbour-solicitation�no-router_ rD rV rA z reject-routerJ rK rN rW rX zunknown-header-typezunknown-option��ipv4�ipv6c @ sh e Zd Zd ZdZdd� Zdd� Zdd� Zdd � Zd d � Z d d � Z dd� Z dd� Z dd� Z d�dd�Zdd� Zdd� Zdd � Zd d � Zd d � Zd�d!d"�Zd#d$� Zd�d&d'�Zd(d)� Zd*d+� Zd�d-d.�Zd/d0� Zd1d2� Zd3d4� Z d5d6� Z d7d8� Z d9d:� Z d;d<� Z d=d>� Z!d?d@� Z"dAdB� Z#dCdD� Z$dEdF� Z%dGdH� Z&dIdJ� Z'dKdL� Z(dMdN� Z)d�dOdP�Z*dQdR� Z+dSdT� Z,dUdV� Z-dWdX� Z.d�dYdZ�Z/d�d[d\�Z0d�d]d^�Z1d�d_d`�Z2dadb� Z3d�dcdd�Z4d�dedf�Z5d�dgdh�Z6didj� Z7d�dkdl�Z8dmdn� Z9d�dodp�Z:dqdr� Z;dsdt� Z<dudv� Z=dwdx� Z>d�dydz�Z?d�d{d|�Z@d}d~� ZAd�dd��ZBd�d�� ZCd�d�� ZDd�d�� ZEd�d�� ZFd�d�� ZGd�d�� ZHd�d�� ZId�d�d��ZJdS )��nftablesTc C sZ || _ d| _d| _g | _i | _i | _i | _i | _i | _t � | _ | j � d� | j � d� d S )NTF) �_fwZrestore_command_exists�supports_table_ownerZavailable_tables�rule_to_handle�rule_ref_count�rich_rule_priority_counts�policy_priority_counts�zone_source_index_cacher re �set_echo_outputZset_handle_output)�self�fwr7 r7 r8 �__init__� s znftables.__init__c C s z�ddddiidddt dd gd �iigi}| j�|�\}}}|rHtd ��ddddiid ddt d �iigi}| j�d� | j�|�\}}}| j�d� |d d d d }| �dddt d �ii| j�� � d|vs�d |vr�td ��t� d� d| _ W n t� d� d| _ Y n0 d S )Nre �metainfo�json_schema_versionrB �add�table�inet�owner�persist)�family�name�flagsz!nftables probe table owner failed�list�rx ry FTrz �deletez3nftables: probe_support(): owner flag is supported.z7nftables: probe_support(): owner flag is NOT supported.) �TABLE_NAME_PROBEre �json_cmd� ValueErrorrm �set_rulerf �get_log_deniedr �debug2rg )rn �rules�rcr r rz r7 r7 r8 �_probe_support_table_owner� sH ����� �� � z#nftables._probe_support_table_ownerc C s | � � d S �N)r� �rn r7 r7 r8 � probe_support� s znftables.probe_supportc C sx dD ]}||v r qqd|| d v r^|| d d d || d d d f}|| d d= n(d|| d v r�d }|| d d= nd S || d d }|r�|dkr�||v r�||| v r�|| � |� n�|dk�rt||vr�g ||< |�r&||| v�r|| �|� || jd d � d � || �|�}n t|| �}|| }||= |d k�rT||d < n |d8 }||d< ||d d d< d S )N�rs �insertr} �%%ZONE_SOURCE%%�rule�zone�address�%%ZONE_INTERFACE%%rx r} c S s | d S )Nr r7 )�xr7 r7 r8 �<lambda> � z3nftables._run_replace_zone_source.<locals>.<lambda>)�keyr r� rB rs �index)�remover5 �sortr� �len)rn r� rl �verbZ zone_sourcerx r� � _verb_snippetr7 r7 r8 �_run_replace_zone_source� sD � � z!nftables._run_replace_zone_sourcec C sB d|v rdt �|d �iS d|v r4dt �|d �iS ttd��d S )Nr� r} rs zFailed to reverse rule)�copy�deepcopyr r )rn �dictr7 r7 r8 � reverse_rule s znftables.reverse_rulec C s� dD ]}||v r qq||| d v �r�|| d | }|| d |= t |�tkr\ttd��|| d d || d d f}|dkr�||vs�||| vs�|| | dkr�ttd��|| | d 8 < n�||vr�i ||< ||| vr�d|| |< d}t|| �� �D ]J}||k�r"|d k�r" �qP||| | 7 }||k�r|d k�r �qP�q|| | d 7 < || } ||= |dk�r�| |d < n |d 8 }| |d < ||d d d < d S ) Nr� r� z%priority must be followed by a numberrx �chainr} r z*nonexistent or underflow of priority countrB r� rs r� )r+ �intr r r �sorted�keys) rn r� Zpriority_counts�tokenr� �priorityr� r� �pr� r7 r7 r8 �_set_rule_replace_priority sH �� z#nftables._set_rule_replace_priorityc C sb dD ]X}||v rd|| v rt �|| d �}dD ]}||v r2||= q2tj|dd�}| S qd S )Nr� r� )r� �handleZpositionT)Z sort_keys)r� r� �json�dumps)rn r� r� �rule_keyZnon_keyr7 r7 r8 � _get_rule_keyN s znftables._get_rule_keyc C sX g d�}g d�}g }g }t �| j�}t �| j�}t �| j�} | j� � } |D �]�} t| �tkrjtt d| ��|D ]} | | v rn q�qn| | vr�tt d| ��| � | �} | | v �r4t � d| j| | | � | dkr�| | d7 < qJnV| | dkr�| | d8 < qJn6| | dk�r | | d8 < ntt d| | | f ��n| �rL| dk�rLd| | < |�| � t �| �}| �r�ttd || d d ��|| d d < | �||d � | �||d � | �|| � | dk�r�dd |d d d |d d d |d d d | j| d�ii}|�|� qJddddiig| i}t �� dk�rDt �d| jt�|�� | j�|�\}}}|dk�rxtdd|t�|�f ��|| _|| _| | _| | _d}|D ]�} |d7 }| � | �} | �s��q�d| v �r�| j| = | j| = �q�|D ] } | |d | v �r� �q��q�| |d | v�r�q�t |d | | d d k�r2�q�|d | | d d | j| < �q�d S )N)rs r� r} �flush�replace)rs r� r� z#rule must be a dictionary, rule: %sz no valid verb found, rule: %sz %s: prev rule ref cnt %d, %sr} rB z)rule ref count bug: rule_key '%s', cnt %dr� �expr�%%RICH_RULE_PRIORITY%%�%%POLICY_PRIORITY%%rx rt r� )rx rt r� r� re rq rr rG z.%s: calling python-nftables with JSON blob: %sr z '%s' failed: %s JSON blob: %szpython-nftablesr� ) r� r� rj rk rl ri r+ r� r r r r� r r� � __class__r5 r{ r( r� r� rh ZgetDebugLogLevelZdebug3r� r� re r r� �TABLE_NAME_POLICY)rn r� � log_deniedZ _valid_verbsZ_valid_add_verbsZ_deduplicated_rulesZ_executed_rulesrj rk rl ri r� r� r� Z_ruleZ json_blobr� r �errorr� r7 r7 r8 � set_rules\ s� � � & � � znftables.set_rulesc C s | � |g|� dS )N� )r� )rn r� r� r7 r7 r8 r� � s znftables.set_ruleNc C s |r |gS t �� S r� )�IPTABLES_TO_NFT_HOOKr� �rn rt r7 r7 r8 �get_available_tables� s z nftables.get_available_tablesc C sB ddd|d�ii}|t kr<| jjr<| jr<ddg|d d d< |gS )Nrs rt ru r| rv rw rz )� TABLE_NAMErf Z_nftables_table_ownerrg )rn rt r� r7 r7 r8 �_build_add_table_rules� s ���z nftables._build_add_table_rulesc C s | � |�ddd|d�iig S )Nr} rt ru r| )r� r� r7 r7 r8 �_build_delete_table_rules� s �z"nftables._build_delete_table_rulesc C s( i | _ i | _i | _i | _i | _| �t�S r� )rh ri rj rk rl r� r� r� r7 r7 r8 �build_flush_rules� s znftables.build_flush_rulesc C sP ddd�| }|ddt dd|f dd d d iid d ddgid�idd igd�iiS )Nrs r} �TFr� ru �%s_%sr( r) �ctr� �state�in�set� established�relatedr0 �accept�rx rt r� r� )r� )rn �enable�hook�add_delr7 r7 r8 � _build_set_policy_rules_ct_rule� s ���z(nftables._build_set_policy_rules_ct_rulec C s\ g }|dkrZ|� | �t�� dD ]6}|�dddtdd|f d|d t d d d �ii� q n�|d k�r4|� | �t�� dD ]�}|| }|dv s�J �|�� }d|� �}|�dddt|d|dt d d d �ii� |�| �d|�� |dkr�dd i}n"|d k�rd d i}ndddd�i}|�dddt||gd�ii� qxn$|dk�rN|| �t�7 }n tt d��|S ) NZPANIC)r r rs r� ru r� r% r( i���rB �drop)rx rt ry r+ r� �prio�policy�DROP)r# r$ r! )�ACCEPT�REJECTr� Zfilter_r Tr� r� �reject�icmpx�admin-prohibited�r+ r� r� r� znot implemented) �extendr� r� r5 �NFT_HOOK_OFFSET�lowerr� r� r r )rn r� Zpolicy_detailsr� r� Zd_policyZ chain_nameZ expr_fragmentr7 r7 r8 �build_set_policy_rules� sb � � ����� z nftables.build_set_policy_rulesc C s8 t � }|r|gnt�� D ]}|�t| �� � qt|�S r� )r� �ICMP_TYPES_FRAGMENTSr� �updater{ )rn �ipvZ supportedZ_ipvr7 r7 r8 �supported_icmp_types5 s z nftables.supported_icmp_typesc C s | � t�S r� )r� r� r� r7 r7 r8 �build_default_tables? s z nftables.build_default_tables�offc C s" g }t d �� D ]�}|�dddtd| ddt d | d t d | d d �ii� d D ]&}|�dddtd ||f d �ii� qXdD ]6}|�dddtd| ddd ||f iigd�ii� q�qt d �� D �] }|�dddtd| ddt d | d t d | d d �ii� |dv �r|dD ]Z}|�dddtd||f d �ii� |�dddtd| ddd||f iigd�ii� �q q�d D ](}|�dddtd||f d �ii� �q�dD ]8}|�dddtd| ddd||f iigd�ii� �q�q�t d �� D ]F}|�dddtd| ddt d | d t d | d d �ii� �q�|�dddtdd ddd d iid d d d!gid"�id#d igd�ii� |�dddtdd ddd d$iid d%d"�id#d igd�ii� |�dddtdd dd&d d'iid(d)d"�id#d igd�ii� |d*k�rR|�dddtdd ddd d iid d d+gid"�i| �|�d,d-d.iigd�ii� |�dddtdd ddd d iid d d+gid"�id/d igd�ii� d D ](}|�dddtd0d|f d �ii� �q�dD ]8}|�dddtdd ddd0d|f iigd�ii� �q�|d*k�r<|�dddtdd | �|�d,d-d1iigd�ii� |�dddtdd d2d3d4d5�igd�ii� |�dddtdd6 ddd d iid d d d!gid"�id#d igd�ii� |�dddtdd6 ddd d$iid d%d"�id#d igd�ii� |�dddtdd6 dd&d d'iid(d)d"�id#d igd�ii� |d*k�r||�dddtdd6 ddd d iid d d+gid"�i| �|�d,d-d.iigd�ii� |�dddtdd6 ddd d iid d d+gid"�id/d igd�ii� d7D ](}|�dddtd0d6|f d �ii� �q�dD ]Z}|�dddtd0d6|f d �ii� |�dddtdd6 ddd0d6|f iigd�ii� �q�d8D ](}|�dddtd0d6|f d �ii� �qP|d*k�r�|�dddtdd6 | �|�d,d-d1iigd�ii� |�dddtdd6 d2d3d4d5�igd�ii� |�dddtdd9 ddd d iid d d d!gid"�id#d igd�ii� |�dddtd:dd&d d;iid(d)d"�id#d igd�ii� d7D ]Z}|�dddtd0d9|f d �ii� |�dddtdd9 ddd0d9|f iigd�ii� �qbd8D ]Z}|�dddtd0d9|f d �ii� |�dddtdd9 ddd0d9|f iigd�ii� �q�|S )<Nr& rs r� ru z mangle_%sr( �%sr rB )rx rt ry r+ r� r� )� POLICIES_pre�ZONES� POLICIES_postz mangle_%s_%s�rx rt ry )r� r� �jump�targetr� r' znat_%s)r! )r� r� � nat_%s_%sz filter_%sr# r) r� r� r� r� r� r� r� r0 r� �status�dnat�meta�iifnamer/ �lor� Zinvalidr �prefixzSTATE_INVALID_DROP: r� � filter_%s_%szFINAL_REJECT: r� r� r� r� r$ )r� )r� r! � filter_OUTPUT�oifname)r� r� r5 r� �_pkttype_match_fragment)rn r� Z default_rulesr� Zdispatch_suffixr7 r7 r8 �build_default_rulesB s � � � � � � � � � ��� ��� ��� � �� ��� � � �� � ��� ��� ��� � �� ��� � � � � �� � ��� ��� � � � �z nftables.build_default_rulesc C s2 |dkrddgS |dkr dgS |dkr.ddgS g S )Nr( r# r$ r& r r' r r7 r� r7 r7 r8 �get_zone_table_chains s z nftables.get_zone_table_chainsc sJ �j j�|���jdk r dnd��dkr4�dkr4dnd} �j j�|�t| �� g } g } g } g } |D ]V}|t|�d d kr�| �d d d d iid|d t|�d � d d�i� q`| �|� q`|D ]X}|t|�d d k�r | �d d d diid|d t|�d � d d�i� q�| �|� q�| �r>| �d d d d iidd| id�i� | �rf| �d d d diidd| id�i� |�r�|D ]}| ���d|�� �qp|�r�|D ]}| ���d|�� �q�� ������fdd�}g }| �r| D ]:}| �r�| D ]}|�|||�� �q�n|�||d �� �q�n4| �r6| D ]}|�|d |�� �q n|�|d d �� |S )Nr �pre�postr' r TFrB �+r) r� r� r� r/ �*r0 r� r� �saddr�daddrc s� | rT|rTd| d d v rTd|d d v rT| d d d d |d d d d krTd S g }| rf|� | � |rt|� |� |� ddd�� f ii� dtd ���f |d �}|������ �r�d d |iiS d d |iiS d S )Nr* r) r1 r- r� r� r� ru z%s_%s_POLICIES_%sr� rs r� r} )r5 r� r� �_policy_priority_fragment)�ingress_fragment�egress_fragment�expr_fragmentsr� ��_policyr� � chain_suffixr� �p_objrn rt r7 r8 � _generate_policy_dispatch_ruleR s0 ��� � zRnftables.build_policy_ingress_egress_rules.<locals>._generate_policy_dispatch_rule) rf r� � get_policyr� �policy_base_chain_name�POLICY_CHAIN_PREFIXr� r5 �_rule_addr_fragment)rn r� r� rt r� Zingress_interfacesZegress_interfacesZingress_sourcesZegress_sources�isSNATZingress_fragmentsZegress_fragmentsZ$ingress_interfaces_without_wildcardsZ#egress_interfaces_without_wildcardsZingress_interfaceZegress_interface�src�dstr r� r� r� r7 r� r8 �!build_policy_ingress_egress_rules! sf � � � � z*nftables.build_policy_ingress_egress_rulesFc C sN |dkr|dkrdnd}| j jj||t|d�} dddddd�| } |t|�d d krn|d t|�d � d }d } |d kr�| d d|| f iig} n,ddd| iid|d�i| d d|| f iig} |r�|s�d} dtd||f | d�}|�| �� � nP|�rd} dtd||f | d�}n.d} dtd||f | d�}|�s@|�| �� � | d|iigS )Nr' r TF�r r� r� �r r r# r$ r! rB r� r� �gotor� r� r) r� r� r/ r0 r� ru � %s_%s_ZONESr� rs r} r� )rf r� r r r� r� r� �_zone_interface_fragment)rn r� r� r� � interfacert r� r5 r r �opt�actionr� r� r� r7 r7 r8 �!build_zone_source_interface_rules� sZ �� �� � � �z*nftables.build_zone_source_interface_rulesc C s� |dkr|dkrdnd}| j jj||t|d�}ddd�| } d d d d d d �| } d } d td||f | �| |�| dd||f iigd�} | �| �||�� | d| iigS )Nr' r TFr r� r} r� r� r� r r ru r r� r� r� r� )rf r� r r r� r r� �_zone_source_fragment) rn r� r� r� r� rt r� r r r� r r r� r7 r7 r8 � build_zone_source_address_rules� s* �� ��z(nftables.build_zone_source_address_rulesc C sp ddd�| }|dkr"|dkr"dnd}| j jj||t|d�}| j j�|�}g } | �|d d td ||f d �ii� d D ](} | �|d d td||| f d �ii� qt|jr�| �ddd td ||f ddd||df iigd�ii� d D ]<} | �|dd td ||f ddd||| f iigd�ii� q�|j�r^| �ddd td ||f ddd||df iigd�ii� | j jj| j } | j � � dk�r�|dk�r�| t dddfv �r�| } | t dfv �r�d} | �|dd td ||f | � | j � � �ddd || f iigd�ii� |dk�r^| t d dddfv �r^| t ddfv �r,| � � } n | �� d i} | �|dd td ||f | gd�ii� |�sl| �� | S ) Nrs r} r� r' r TFr r� ru r� r� )r� r �deny�allowr� �%s_%s_%sr� r� r� r� r� r� r� r( r� z %%REJECT%%r� r r� zfilter_%s_%s: r� )rf r� r r r r5 r� Zderived_from_zoneZ _policiesr� r� r r� �_reject_fragmentr� �reverse)rn r� r� rt r� r� r r r r� r r� Z log_suffix�target_fragmentr7 r7 r8 �build_policy_chain_rules� sx � � � � � �� � � z!nftables.build_policy_chain_rulesc C s< |dkr i S |dv r,ddddiid|d�iS t td |��d S ) N�all)�unicast� broadcastZ multicastr) r� r� �pkttyper/ r0 zInvalid pkttype "%s"�r r )rn r! r7 r7 r8 r� s �z nftables._pkttype_match_fragmentc C s dddd�idddd�idddd�idddd�idddd�idddd�idddd�idddd�idddd�idddd�iddd d�iddd d�iddd d�iddd d�idd d d�iddd d�iddd d�iddd d�iddd d�idddd�idddd�idddiidddiid�}|| S )Nr� r: rT r� znet-prohibitedr� rY znet-unreachablerU rV r� zprot-unreachablezaddr-unreachablera r+ z tcp reset)zicmp-host-prohibitedz host-prohibzicmp-net-prohibitedz net-prohibzicmp-admin-prohibitedz admin-prohibzicmp6-adm-prohibitedzadm-prohibitedzicmp-net-unreachablez net-unreachzicmp-host-unreachablez host-unreachzicmp-port-unreachablezicmp6-port-unreachablez port-unreachzicmp-proto-unreachablez proto-unreachzicmp6-addr-unreachable� addr-unreachzicmp6-no-routera z tcp-resetztcp-rstr7 )rn Z reject_typeZfragsr7 r7 r8 �_reject_types_fragment s2 � z nftables._reject_types_fragmentc C s dddd�iS )Nr� r� r� r� r7 r� r7 r7 r8 r 9 s �znftables._reject_fragmentc C s ddddiiddddgid �iS ) Nr) r� r� �l4protor/ r� r: rY r0 r7 r� r7 r7 r8 �_icmp_match_fragment= s �z nftables._icmp_match_fragmentc C sn |si S ddddd�}z|j �d�}W n tyB ttd��Y n0 dt|j d |� �||j |d d �iS ) N�secondZminuteZhourZday)�s�m�h�d�/zExpected '/' in limit�limitr rB )ZrateZper)�valuer� r� r r r� )rn r- Z rich_to_nft�ir7 r7 r8 �_rich_rule_limit_fragmentB s � �z"nftables._rich_rule_limit_fragmentc C s� t |j�ttttfv rn<|jrJt |j�ttt t fvrTt t dt |j� ��n t t d��|j dkr�t |j�tttfv s�t |j�tt fv r�dS t |j�tfv s�t |j�tt fv r�dS n|j dk r�dS dS d S )N�Unknown action %szNo rule action specified.r r r r� r� )r+ �elementr r r r r r r r r r r r� �rn � rich_ruler7 r7 r8 �_rich_rule_chain_suffixU s$ �� z nftables._rich_rule_chain_suffixc C s: |j s|jsttd��|jdkr$dS |jdk r2dS dS d S )NzNot log or auditr r r� r� )r �auditr r r� r3 r7 r7 r8 � _rich_rule_chain_suffix_from_logk s z)nftables._rich_rule_chain_suffix_from_logc C s dd iS )Nr� r7 r� r7 r7 r8 r v s z!nftables._zone_interface_fragmentc C sN t d|�rt|�}n,td|�r@|�d�}t|d �d |d }d||d�iS )Nrd r, r rB r� )r� r� )r r r �split)rn r� r� Z addr_splitr7 r7 r8 r y s z nftables._zone_source_fragmentc C s d|j iS )Nr� �r� )rn r� r7 r7 r8 r� � s z"nftables._policy_priority_fragmentc C s |r|j dkri S d|j iS )Nr r� r9 r3 r7 r7 r8 � _rich_rule_priority_fragment� s z%nftables._rich_rule_priority_fragmentc C s |j s i S | jj�||t�}ddd�| }| �|�}i } t|j �tkr||j jrZt |j j�nd| d< |j j r�t |j j �| d< n,|j j r�d|j j kr�dn|j j } d | | d < |j j r�d |j j | d < d t d |||f || �|j j�d| ig d�} | �| �|�� |d| iiS )Nrs r} r� r �groupzqueue-thresholdZwarning�warnr� �levelr� ru r r r� r� )r rf r� r r r7 r+ r r; r� Z thresholdr= r� r� r0 r- r� r: ) rn r� r4 r� rt r� r r� r Z log_optionsr= r� r7 r7 r8 �_rich_rule_log� s4 ���znftables._rich_rule_logc C s� |j s i S | jj�||t�}ddd�| }| �|�}dtd|||f || �|j j�dddiig d �} | � | � |�� |d | iiS ) Nrs r} r� ru r r r= r6 r� r� ) r6 rf r� r r r7 r� r0 r- r� r: ) rn r� r4 r� rt r� r r� r r� r7 r7 r8 �_rich_rule_audit� s ���znftables._rich_rule_auditc C s� |j s i S | jj�||t�}ddd�| }| �|�}d|||f } t|j �tkr\dd i} �n t|j �tkr�|j jr�| � |j j�} ndd i} n�t|j �t kr�dd i} n�t|j �t k�rHd}| jj�||t�}d|||f } |j j � d �} t| �d k�r,dd d d iiddd d d ii| d gi| d gid�i} ndd d d ii| d d�i} nttdt|j � ��dt| || �|j j�| g d�} | �| �|�� |d| iiS )Nrs r} r� r r� r� r� r& r, rB r� r� �mark�^�&r �r� r. r1 ru r� r� )r rf r� r r r5 r+ r r r$ r r r� r8 r� r r r� r0 r- r� r: ) rn r� r4 r� rt r� r r� r r� Z rule_actionr. r� r7 r7 r8 �_rich_rule_action� sL "� � ���znftables._rich_rule_actionc C s� |� d�r0| �|td�d � d|kr(dnd|�S t|�r>d}n�td|�rNd}nvtd|�r�d}tj|dd�}d |jj |j d �i}nDtd |�r�d }t |�}n,d }|� d �}d t |d �t |d �d �i}dd||d�i|r�dnd|d�iS d S )N�ipset:r� TF�etherrc �ip)�strictr� ��addrr� rd �ip6r, r rB r) r* r, �!=r/ r0 )� startswith�_set_match_fragmentr� r r r � ipaddress� IPv4Network�network_address� compressed� prefixlenr r8 r� )rn Z addr_fieldr� �invertrx Znormalized_addressZaddr_lenr7 r7 r8 r � s, & � �z nftables._rule_addr_fragmentc C s6 |si S |dvr t td| ��ddddiid|d�iS ) Nrb zInvalid familyr) r� r� �nfprotor/ r0 r" )rn Z rich_familyr7 r7 r8 �_rich_rule_family_fragment� s � �z#nftables._rich_rule_family_fragmentc C s8 |si S |j r|j }n|jr&d|j }| jd||jd�S )NrE r� �rT )rJ �ipsetr rT )rn Z rich_destr� r7 r7 r8 � _rich_rule_destination_fragment s z(nftables._rich_rule_destination_fragmentc C sZ |si S |j r|j }n2t|d�r.|jr.|j}nt|d�rH|jrHd|j }| jd||jd�S )N�macrX rE r� rW )rJ �hasattrrZ rX r rT )rn Z rich_sourcer� r7 r7 r8 �_rich_rule_source_fragment s z#nftables._rich_rule_source_fragmentc C sP t |�}t|t�r$|dk r$tt��n(t|�dkr8|d S d|d |d giS d S )Nr rB �range)r � isinstancer� r r r� )rn �portr] r7 r7 r8 �_port_fragment! s znftables._port_fragmentc C s& ddd�| }d}| j j�||t�} g } |r>| �| �|j�� |rT| �| �d|�� |r|| �| �|j �� | �| � |j �� | �dd|dd �id | � |�d �i� g } |r�| �| � ||||| �� | �| �||||| �� | �| �||||| �� n.| �|d d td|| f | dd ig d�ii� | S )Nrs r} r� r( r� r) r* �dportr, r/ r0 r� ru � %s_%s_allowr� r� �rf r� r r r5 rV rx r rY � destinationr\ �sourcer` r> r? rD r� � rn r� r� �protor_ rd r4 r� rt r r� r� r7 r7 r8 �build_policy_ports_rules* s8 �� � z!nftables.build_policy_ports_rulesc C s ddd�| }d}| j j�||t�}g } |r>| �| �|j�� |rT| �| �d|�� |r|| �| �|j �� | �| � |j �� | �dddd iid |d �i� g } |r�| �| � ||||| �� | �| � ||||| �� | �| �||||| �� n.| �|d d td||f | dd ig d�ii� | S )Nrs r} r� r( r� r) r� r� r% r/ r0 r� ru rb r� r� )rf r� r r r5 rV rx r rY rd r\ re r> r? rD r� ) rn r� r� r- rd r4 r� rt r r� r� r7 r7 r8 �build_policy_protocol_rulesJ s4 � � z$nftables.build_policy_protocol_rulesc C s� d}d}| j j�||t�}ddd�| } g } |r^| �| �|j�� | �| �|j�� | � |�}| �dddd d d �id d �i� |dks�|d u r�| �ddddd�idddiid�i� n | �ddddd�i|d�i� | ddt d||f | d�iigS ) Nr r( rs r} r� r) r� r* �tcprz r, Zsyn)r2 r1 r3 Zpmtur& z tcp optionZmaxseg�size)ry r. Zrtr� ZmturC r� ru r� r� ) rf r� r r r5 rY rd r\ re r5 r� ) rn r� r� Ztcp_mss_clamp_valuerd r4 r rt r r� r� r7 r7 r8 � build_policy_tcp_mss_clamp_rulesi s2 � � � �z)nftables.build_policy_tcp_mss_clamp_rulesc C s& ddd�| }d}| j j�||t�} g } |r>| �| �|j�� |rT| �| �d|�� |r|| �| �|j �� | �| � |j �� | �dd|dd �id | � |�d �i� g } |r�| �| � ||||| �� | �| �||||| �� | �| �||||| �� n.| �|d d td|| f | dd ig d�ii� | S )Nrs r} r� r( r� r) r* �sportr, r/ r0 r� ru rb r� r� rc rf r7 r7 r8 � build_policy_source_ports_rules� s8 �� � z(nftables.build_policy_source_ports_rulesc C s� d}| j j�||t�} ddd�| } g } |rR| �dddtd||f ||d�ii� g } |rl| �| �d |�� | �d d |d d �id| �|�d�i� | �dd||f i� | �| ddtd| | d�ii� | S )Nr( rs r} r� z ct helperru z helper-%s-%s)rx rt ry r+ r- r� r) r* ra r, r/ r0 r� �filter_%s_allowr� )rf r� r r r5 r� r r` ) rn r� r� rg r_ rd Z helper_nameZmodule_short_namert r r� r� r� r7 r7 r8 � build_policy_helper_ports_rules� s6 � �� � z(nftables.build_policy_helper_ports_rulesc C s� ddd�| }| j j�||t�}g } |rv|t|�d dkrT|d t|�d � d }ddd d iid |d �id d ig} n| �d|�d d ig} dtd| | d�} | �|d| ii� | S )Nrs r} r� rB r� r� r) r� r� r� r/ r0 r� r� ru ro r� r� )rf r� r r r� r r� r5 ) rn r� r� r� rt r re r� r r� r� r� r7 r7 r8 �build_zone_forward_rules� s( ���z!nftables.build_zone_forward_rulesc C s� ddd�| }g }g }|r\|� | �|j�� |� | �|j�� |� | �|j�� | �|�}n"|� ddddiidd d �i� d }d }| jj j ||t d d�} dt d| |f |ddddiiddd �idd ig d�} | � | �|�� |� |d| ii� |S )Nrs r} r� r) r� r� rU r/ rc r0 r r' Tr ru r� r� rL r� Z masquerader� r� )r5 rV rx rY rd r\ re r5 rf r� r r r� r� r: ) rn r� r� r4 r� r� r� r rt r r� r7 r7 r8 � build_policy_masquerade_rules� s< � ����z&nftables.build_policy_masquerade_rulesc C sp d}| j j�||t�} ddd�| } g } |rn| �| �|j�� | �| �|j�� | �| � |j �� | � |�} n8d} |r�t d|�r�d} | �ddd d iid | d �i� d } | �dd|dd�id | � |�d �i� |�r$t d|�r�t|�}|�r|dk�r| �d|| � |�d�i� n| �dd|ii� n| �dd| � |�ii� dtd| | f | d�}|�| �|�� | d|iigS )Nr' rs r} r� rc rd r) r� r� rU r/ r0 r r* ra r, r� r� )rJ r_ rJ rA r_ ru r� r� r� )rf r� r r r5 rV rx rY rd r\ re r5 r r` r r� r� r: )rn r� r� r_ r- ZtoportZtoaddrr4 rt r r� r� r rU r� r7 r7 r8 � build_policy_forward_port_rules� sJ � �� �z(nftables.build_policy_forward_port_rulesc C s2 |t | v rt | | S ttd|| j|f ��d S )Nz)ICMP type '%s' not supported by %s for %s)r� r r ry )rn r� Z icmp_typer7 r7 r8 � _icmp_types_to_nft_fragments( s �z%nftables._icmp_types_to_nft_fragmentsc C s: d}| j j�||t�}ddd�| }|r6|jr6|j}n<|jrjg }d|jv rT|�d� d|jv rr|�d� nddg}g } |D �]�} | j j�|�r�d||f } dd i} nd ||f } | �� } g } |r�| �| � |j �� | �| � |j�� | �| � |j �� | �| �| |j�� |�r�| �| �||||| �� | �| �||||| �� |j�rb| �| �||||| �� nN| �|�}d td |||f | | �� g d �}|�| �|�� | �|d |ii� qz| j �� dk�r| j j�|��s| �|d d t| | | �| j �� �ddd||f iig d �ii� | �|d d t| | | g d �ii� qz| S )Nr( rs r} r� rc rd rb r� z %s_%s_denyru r r� r� r� r r� �%s_%s_ICMP_BLOCK: )rf r� r r �ipvsrd r5 �query_icmp_block_inversionr rV rx rY r\ re r� rt ry r> r? r rD r5 r� r� r: r� r� )rn r� r� Zictr4 rt r r� rv r� r� Z final_chainr r� r r� r7 r7 r8 � build_policy_icmp_block_rules/ sl � ��� �z&nftables.build_policy_icmp_block_rulesc C s� d}| j j�||t�}g }ddd�| }| j j�|�r@| �� }ndd i}|�|ddtd||f d | �� |gd �ii� | j � � d kr�| j j�|�r�|�|ddtd||f d | �� | � | j � � �d d d||f iigd �ii� |S )Nr( rs r} r� r� r� ru r� rF �rx rt r� r� r� r� r r� ru ) rf r� r r rw r r5 r� r& r� r� )rn r� r� rt r r� r� r r7 r7 r8 �'build_policy_icmp_block_inversion_rulesk s4 �� �� z0nftables.build_policy_icmp_block_inversion_rulesc C s$ g }d}| j jdkr ddg}n<| j jdkr8ddg}d}n"| j jdkrRg d�}d}ng d�}d d d d iid dd�id d|dd�id dd�ig}|dkr�|�dddii� |�dd i� |�dddt||d �ii� | j jd v�r |�dddt|d d d d d!�id d"d#d$gid�id%d igd �ii� |S )&NZfilter_PREROUTINGZlooser� r@ � loose-forward�filter_FORWARD�strict-forward)r� r@ Ziifr) r� r� rU r/ rd r0 ZfibZoif)rz �resultFr� r r� zrpfilter_DROP: r� r� r� ru r� �r{ r} r* rY r+ r, r� r` r^ r� )rf �_ipv6_rpfilterr5 r� )rn r� r� Zrpfilter_chainZ fib_flagsr� r7 r7 r8 �build_rpfilter_rules� sX ���� � � ��� z nftables.build_rpfilter_rulesc C s� g d�}dd� |D �}ddddd�id d |id �ig}| j jd v rT|�d ddii� |�| �d�� g }|�dddtdd|d�ii� d}| j �� dkr�|d7 }| j jdv r�|d7 }|�dddtd||d�ii� |S )N) z ::0.0.0.0/96z::ffff:0.0.0.0/96z2002:0000::/24z2002:0a00::/24z2002:7f00::/24z2002:ac10::/28z2002:c0a8::/32z2002:a9fe::/32z2002:e000::/19c S s2 g | ]*}d |� d�d t|� d�d �d�i�qS )r� r, r rB rI )r8 r� )�.0r� r7 r7 r8 � <listcomp>� r� z5nftables.build_rfc3964_ipv4_rules.<locals>.<listcomp>r) r* rK r� r, r/ r� r0 )r r r r� zRFC3964_IPv4_REJECT: r# rs r� ru r� rB ry rG r� r r| )rf Z _log_deniedr5 r$ r� r� r� )rn Z daddr_setr� r� Z forward_indexr7 r7 r8 �build_rfc3964_ipv4_rules� s< �� � � z!nftables.build_rfc3964_ipv4_rulesc C s� d}g }|� | �|j�� |� | �|j�� |� | �|j�� g }|� | �|||||�� |� | �|||||�� |� | � |||||�� |S )Nr( ) r5 rV rx rY rd r\ re r> r? rD )rn r� r� r4 rt r� r� r7 r7 r8 �*build_policy_rich_source_destination_rules� s z3nftables.build_policy_rich_source_destination_rulesc C s |dv r dS dS )N)rc rd ZebTFr7 )rn r� r7 r7 r8 �is_ipv_supported� s znftables.is_ipv_supportedc C s� ddd�}|| || ddg|| dd|| g|| dd|| g|| dg|| || || g|| ddg|| dd|| g|| dgdd � }||v r�|| S t td | ��d S ) NZ ipv4_addrZ ipv6_addrrb Z inet_protoZ inet_servicer@ ZifnameZ ether_addr) zhash:ipz hash:ip,portzhash:ip,port,ipzhash:ip,port,netz hash:ip,markzhash:netz hash:net,netz hash:net,portzhash:net,port,netzhash:net,iface�hash:macz!ipset type name '%s' is not valid)r r )rn r� r+ Zipv_addr�typesr7 r7 r8 �_set_type_list� s( � ��znftables._set_type_listc C s� |r d|v r |d dkr d}nd}dt || �||�d�}|�d�d �d �D ]}|d v rLd g|d < qhqL|r�d |v r�t|d �|d < d|v r�t|d �|d< dd|iigS )Nrx �inet6rd rc ru )rx rt ry r+ �:rB �,)rG �netr_ �intervalrz �timeoutZmaxelemrk rs r� )r� r� r8 r� )rn ry r+ �optionsr� Zset_dict�tr7 r7 r8 �build_set_create_rules s$ � z nftables.build_set_create_rulesc C s$ | � |||�}| �|| j�� � d S r� )r� r� rf r� )rn ry r+ r� r� r7 r7 r8 � set_create$ s znftables.set_createc C s* dddt |d�ii}| �|| j�� � d S )Nr} r� ru r� )r� r� rf r� )rn ry r� r7 r7 r8 � set_destroy( s � znftables.set_destroyc C s | j j�|�j�d�d �d�}g }|D ]�}|dkrd|�dddii� |�dd |rVd nd d �i� q(|d v r�|�d| �|�|r�dndd �i� q(|dkr�|�dd|r�dndii� q(|dkr�|�dddii� q(ttd| ��q(dt |�dkr�d|in|d |�rdndd| d�iS ) Nr� rB r� r_ r� r� r% r* �thra rm r, )rG r� rZ r� r� Zifacer� r� r@ z-Unsupported ipset type for match fragment: %sr) �concatr rL r/ �@r0 ) rf rX � get_ipsetr+ r8 r5 �_set_get_familyr r r� )rn ry Z match_destrT � type_formatr6 �formatr7 r7 r8 rN . s* � � �z nftables._set_match_fragmentc C s8 | j j�|�}|j�d�d �d�}|�d�}t|�t|�krHttd��g }t|�D �]�\}}|dk�r z|| � d�} W n$ t y� |� d� || } Y n,0 |� || d | � � || | d d � } z| � d�} W n t y� |� | � Y n(0 |� d| d | � | | d d � gi� qT|d v �r d|| v �rP|� d|| �d�i� n�z|| � d �} W nJ t �y� || } d |j v �r�|j d d k�r�t | �} |� | � Y n^0 || d | � } d |j v �r�|j d d k�r�t | �} |� d | t|| | d d � �d�i� qT|� || � qTt|�dk�r4d|igS |S )Nr� rB r� z+Number of values does not match ipset type.r_ rj �-r] )rG r� r, rx r� r� rI r� )rf rX r� r+ r8 r� r r � enumerater� r� r5 r� r r� ) rn ry �entry�objr� Z entry_tokens�fragmentr/ r� r� Zport_strrJ r7 r7 r8 �_set_entry_fragmentE sP � ( � z nftables._set_entry_fragmentc C s0 g }| � ||�}|�dddt||d�ii� |S )Nrs r2 ru �rx rt ry �elem)r� r5 r� )rn ry r� r� r2 r7 r7 r8 �build_set_add_rulesy s � z nftables.build_set_add_rulesc C s" | � ||�}| �|| j�� � d S r� )r� r� rf r� )rn ry r� r� r7 r7 r8 �set_add� s znftables.set_addc C s8 | � ||�}dddt||d�ii}| �|| j�� � d S )Nr} r2 ru r� )r� r� r� rf r� )rn ry r� r2 r� r7 r7 r8 � set_delete� s � znftables.set_deletec C s dddt |d�iigS )Nr� r� ru r� )r� )rn ry r7 r7 r8 �build_set_flush_rules� s �z nftables.build_set_flush_rulesc C s | � |�}| �|| j�� � d S r� )r� r� rf r� )rn ry r� r7 r7 r8 � set_flush� s znftables.set_flushc C sJ | j j�|�}|jdkr d}n(|jrBd|jv rB|jd dkrBd}nd}|S )Nr� rF rx r� rK rG )rf rX r� r+ r� )rn ry rX rx r7 r7 r8 r� � s �znftables._set_get_familyc C s� g }|� | �|||�� |� | �|�� d}|D ]D}|� | �||�� |d7 }|dkr0| �|| j�� � |�� d}q0| �|| j�� � d S )Nr rB i� )r� r� r� r� r� rf r� �clear) rn Zset_name� type_name�entriesZcreate_optionsZ entry_optionsr� �chunkr� r7 r7 r8 � set_restore� s znftables.set_restore)N)N)r� )F)F)NN)NN)NN)NN)NN)N)N)N)F)N)N)F)NN)K�__name__� __module__� __qualname__ry Zpolicies_supportedrp r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r r r r r� r$ r r& r0 r5 r7 r r r� r: r> r? rD r rV rY r\ r` rh ri rl rn rp rq rr rs rt rx rz r� r� r� r� r� r� r� r� rN r� r� r� r� r� r� r� r� r7 r7 r7 r8 re � s� 0,.e C V c � 2B + � � ! ! � + < +( 4 �re )N)+r� r� rO Zfirewall.core.loggerr Zfirewall.functionsr r r r r Zfirewall.errorsr r r r r r r Zfirewall.core.richr r r r r r r r r Zfirewall.core.baser Znftables.nftablesr r� r� r~ r r� r� r9 r� �objectre r7 r7 r7 r8 �<module> s� $, � � �� �& ��E core/__pycache__/fw_nm.cpython-39.pyc 0000644 00000012051 15025011705 0013436 0 ustar 00 a ���g � @ s d Z g d�ZddlZddlmZ ze�dd� W n eyF dZY n60 zddlmZ d ZW n e eej fyz dZY n0 da dd l m Z dd lmZ dd lmZ ddlZd d� Zdd� Zdd� Zdd� Zdd� Zdd� Zdd� Zdd � Zd d � Zd d � Z d!d"� Z d#d$� Z dS )%z(Functions for NetworkManager interaction)�check_nm_imported�nm_is_imported�nm_get_zone_of_connection�nm_set_zone_of_connection�nm_get_connections� nm_get_connection_of_interface�nm_get_bus_name�nm_get_dbus_interface� N)�GLib�NMz1.0F)r T)�errors)� FirewallError)�logc C s t sttjd��dS )zNCheck function to raise a MISSING_IMPORT error if the import of NM failed zgi.repository.NM = 1.0N)� _nm_importedr r ZMISSING_IMPORT� r r �7/usr/lib/python3.9/site-packages/firewall/core/fw_nm.pyr 0 s r c C s t S )znReturns true if NM has been properly imported @return True if import was successful, False otherwirse )r r r r r r 6 s r c C s t stj�d�a t S )z�Returns the NM client object or None if the import of NM failed @return NM.Client instance if import was successful, None otherwise N)� _nm_clientr ZClient�newr r r r � nm_get_client< s r c C s� t � t� �| �}|du r dS |�� }|du r2dS z"|�� tjjtjjB @ rRW dS W n t yt |� � rpY dS Y n0 |� � }|du r�d}|S )z�Get zone of connection from NM @param connection name @return zone string setting of connection, empty string if not set, None if connection is unknown N� ) r r �get_connection_by_uuid�get_setting_connection� get_flagsr �SettingsConnectionFlags� NM_GENERATED� NM_VOLATILE�AttributeError� get_unsavedZget_zone)� connection�con� setting_con�zoner r r r E s& � r c C sV t � t� �|�}|du r dS |�� }|du r2dS | dkr>d} |�d| � |�dd�S )zSet the zone for a connection @param zone name @param connection name @return True if zone was set, else False NFr r! T)r r r r Z set_propertyZcommit_changes)r! r r r r r r r c s r c C sv | � � |� � t� t� �� }|D ]L}|�� r2q$|�� }|�� }|�� }|||< |D ]}|�� }|rV|| |< qVq$dS )znGet active connections from NM @param connections return dict @param connections_name return dict N) �clearr r �get_active_connections�get_vpnZget_id�get_uuid� get_devices� get_ip_iface) Z connectionsZconnections_nameZactive_connections� active_con�nameZuuidZdevices�dev�ip_ifacer r r r x s r c C s� t � g } t� �� D ]z}|�� r"qz(|�� }|�� tjjtjj B @ rHW qW n t yh |� � rdY qY n0 |� � D ]}|� � }|rr| �|� qrq| S )zGGet active interfaces from NM @returns list of interface names )r r r# r$ �get_connectionr r r r r r r r& r' �append)Zactive_interfacesr( r r* r+ r r r �nm_get_interfaces� s& � r. c C s2 g }t � D ]"}t|�}| t|�kr |�|� q |S )N)r. r r r- )r! Z interfaces� interfaceZconnr r r �nm_get_interfaces_in_zone� s r0 c C s< t � t� �� D ]&}|�� }|du r&q|| kr| S qdS )zzGet device from NM which has the given IP interface @param interface name @returns NM.Device instance or None N)r r r& r' )r/ �devicer+ r r r �nm_get_device_by_ip_iface� s r2 c C sz t � t| �}|du rdS |�� }|du r.dS z"|�� }|�� tjj@ rNW dS W n typ |� � rlY dS Y n0 |� � S )z�Get connection from NM that is using the interface @param interface name @returns connection that is using interface or None N) r r2 Zget_active_connectionr, r r r r r r r% )r/ r1 r( r r r r r � s r c C sR t sd S z(t�� } | �tjtj�}|j}~~ |W S tyL t � d� Y n0 d S )Nz(Failed to get bus name of NetworkManager) r �dbusZ SystemBusZ get_objectr �DBUS_INTERFACEZ DBUS_PATHZbus_name� Exceptionr Zdebug2)Zbus�objr) r r r r � s r c C s t sdS tjS )Nr )r r r4 r r r r r � s r ) �__doc__�__all__ZgiZ gi.repositoryr Zrequire_version� ValueErrorr r � ImportError�Errorr Zfirewallr Zfirewall.errorsr Zfirewall.core.loggerr r3 r r r r r r r. r0 r2 r r r r r r r �<module> s: core/__pycache__/fw_icmptype.cpython-39.opt-1.pyc 0000644 00000004262 15025011705 0015622 0 ustar 00 a ���g� � @ s> d gZ ddlmZ ddlmZ ddlmZ G dd � d e�ZdS )�FirewallIcmpType� )�log)�errors)� FirewallErrorc @ sL e Zd Zdd� Zdd� Zdd� Zdd� Zd d � Zd d � Zd d� Z dd� Z dS )r c C s || _ i | _d S �N)�_fw� _icmptypes)�self�fw� r �=/usr/lib/python3.9/site-packages/firewall/core/fw_icmptype.py�__init__ s zFirewallIcmpType.__init__c C s d| j | jf S )Nz%s(%r))� __class__r �r r r r �__repr__! s zFirewallIcmpType.__repr__c C s | j �� d S r )r �clearr r r r �cleanup$ s zFirewallIcmpType.cleanupc C s t | j�� �S r )�sortedr �keysr r r r � get_icmptypes) s z FirewallIcmpType.get_icmptypesc C s || j vrttj|��d S r )r r r ZINVALID_ICMPTYPE�r Zicmptyper r r �check_icmptype, s z FirewallIcmpType.check_icmptypec C s | � |� | j| S r �r r r r r r � get_icmptype0 s z FirewallIcmpType.get_icmptypec C s� |j }t|�dkrddg}|D ]r}|dkrF| jjs<| jjs<q | jj}n(|dkrj| jjs`| jjs`q | jj}ng }|j� � |vr t � d|j|f � q || j |j< d S )Nr Zipv4Zipv6z5ICMP type '%s' is not supported by the kernel for %s.) Z destination�lenr Zip4tables_enabledZnftables_enabledZipv4_supported_icmp_typesZip6tables_enabledZipv6_supported_icmp_types�name�lowerr Zinfo1r )r �objZ orig_ipvsZipvZsupported_icmpsr r r � add_icmptype4 s z FirewallIcmpType.add_icmptypec C s | � |� | j|= d S r r r r r r �remove_icmptypeG s z FirewallIcmpType.remove_icmptypeN) �__name__� __module__� __qualname__r r r r r r r r r r r r r s N) �__all__Zfirewall.core.loggerr Zfirewallr Zfirewall.errorsr �objectr r r r r �<module> s core/__pycache__/ipset.cpython-39.opt-1.pyc 0000644 00000021160 15025011705 0014414 0 ustar 00 a ���gq2 � @ s� d Z g d�ZddlZddlZddlmZ ddlmZ ddl m Z ddl m Z ddl mZmZ dd lmZ d Zg d �Zd d d dd�Zdddd�ZG dd� de�Zdd� Zdd� Zdd� Zd d � Zd d � Z dS ) zThe ipset command wrapper)�ipset�check_ipset_name� remove_default_create_options� N)�errors)� FirewallError)�runProg)�log)�tempFile�readfile)�COMMANDS� ) zhash:ipz hash:ip,portzhash:ip,port,ipzhash:ip,port,netz hash:ip,markzhash:netz hash:net,netz hash:net,portzhash:net,port,netzhash:net,ifacezhash:macz inet|inet6�valuez value in secs)�family�hashsize�maxelem�timeoutZinetZ1024Z65536)r r r c @ s� e Zd ZdZdd� Zdd� Zdd� Zdd � Zd d � Zd'd d�Z dd� Z dd� Z dd� Z d(dd�Z d)dd�Zdd� Zd*dd �Zd+d d �Zd d � Zd!d"� Zd#d$� Zd%d&� Zd S ),r zipset command wrapper classc C s t d | _d| _d S )Nr )r �_command�name��self� r �7/usr/lib/python3.9/site-packages/firewall/core/ipset.py�__init__K s zipset.__init__c C s^ dd� |D �}t �d| j| jd�|�� t| j|�\}}|dkrZtd| jd�|�|f ��|S )zCall ipset with argsc S s g | ] }d | �qS )�%sr )�.0�itemr r r � <listcomp>R � z ipset.__run.<locals>.<listcomp>z %s: %s %s� r �'%s %s' failed: %s)r �debug2� __class__r �joinr � ValueError)r �args�_args�status�retr r r Z__runO s �z ipset.__runc C s t |�tkr ttjd| ��dS )zCheck ipset namez ipset name '%s' is not validN)�len�IPSET_MAXNAMELENr r Z INVALID_NAME)r r r r r � check_nameZ s �zipset.check_namec C s� g }d}z| � dg�}W n2 tyJ } zt�d| � W Y d}~n d}~0 0 |�� }d}|D ]L}|r�|�� �dd�}|d |vr�|d tv r�|�|d � |� d�r\d }q\|S ) z?Return types that are supported by the ipset command and kernel� z--helpzipset error: %sNF� r zSupported set types:T) � _ipset__runr# r Zdebug1� splitlines�strip�split� IPSET_TYPES�append� startswith)r r' �output�ex�linesZin_types�line�splitsr r r �set_supported_types` s $ zipset.set_supported_typesc C s( t |�tks|tvr$ttjd| ��dS )zCheck ipset typez!ipset type name '%s' is not validN)r( r) r1 r r Z INVALID_TYPE)r � type_namer r r � check_typeu s �zipset.check_typeNc C s` | � |� | �|� d||g}t|t�rV|�� D ]$\}}|�|� |dkr0|�|� q0| �|�S )z+Create an ipset with name, type and options�creater+ )r* r; � isinstance�dict�itemsr2 r- )r �set_namer: �optionsr$ �key�valr r r � set_create{ s zipset.set_createc C s | � |� | �d|g�S )NZdestroy)r* r- )r r@ r r r � set_destroy� s zipset.set_destroyc C s d||g}| � |�S )N�add�r- �r r@ �entryr$ r r r �set_add� s z ipset.set_addc C s d||g}| � |�S )N�delrG rH r r r � set_delete� s zipset.set_deletec C s, d||g}|r"|� dd�|� � | �|�S )N�testr r )r2 r" r- )r r@ rI rA r$ r r r rM � s z ipset.testc C s2 dg}|r|� |� |r"|�|� | �|��d�S )N�list� )r2 �extendr- r0 )r r@ rA r$ r r r �set_list� s zipset.set_listc C s4 | j dgd�}i }d }}i }|D �] }t|�dk r6q"dd� |�dd�D �}t|�dkr\q"q"|d d krr|d }q"|d d kr�|d }q"|d d kr"|d �� }d } | t|�k �r|| } | d v r�t|�| kr�| d7 } || || < nt�d|� i S | d7 } q�|�r |�r |t|�f||< d }}|�� q"|S )z" Get active ipsets (only headers) z-terse)rA N� c S s g | ] }|� � �qS r )r/ �r �xr r r r � r z.ipset.set_get_active_terse.<locals>.<listcomp>�:r, r �Name�TypeZHeader)r r r r �netmaskz&Malformed ipset list -terse output: %s)rQ r( r0 r �errorr �clear) r r6 r' �_nameZ_type�_optionsr7 Zpairr8 �i�optr r r �set_get_active_terse� sF � � zipset.set_get_active_tersec C s dg}|r|� |� | �|�S )N�save�r2 r- �r r@ r$ r r r r` � s z ipset.savec C s� | � |� | �|� t� }d|v r*d| }d||dg}|rh|�� D ]$\}} |�|� | dkrB|�| � qB|�dd�|� � |�d| � |D ]F} d| v r�d| } |r�|�d|| d�|�f � q�|�d || f � q�|�� t� |j �} t � d | j | jd |j | jf � d g}t| j||j d �\} } t �� dk�r�zt|j � W n t�yV Y nR0 d}t|j �D ]@}t jd||f ddd� |�d��s�t jddd� |d7 }�qft�|j � | dk�r�td| jd�|�| f ��| S )Nr z'%s'r< z-existr+ z%s z flush %s z add %s %s %s z add %s %s z%s: %s restore %sz%s: %dZrestore)�stdinr, rR z%8d: %sr )�nofmt�nlrO )rd r )r* r; r r? r2 �writer" �close�os�statr r r r! r �st_sizer ZgetDebugLogLevelr � ExceptionZdebug3�endswith�unlinkr# )r r@ r: �entriesZcreate_optionsZ entry_optionsZ temp_filer$ rB rC rI ri r& r' r] r7 r r r � set_restore� s^ � �� �zipset.set_restorec C s dg}|r|� |� | �|�S )N�flushra rb r r r � set_flush s zipset.set_flushc C s | � d||g�S )N�renamerG )r Z old_set_nameZ new_set_namer r r rr s z ipset.renamec C s | � d||g�S )N�swaprG )r Z set_name_1Z set_name_2r r r rs s z ipset.swapc C s | � dg�S )N�versionrG r r r r rt s z ipset.version)N)N)NN)N)NN)�__name__� __module__� __qualname__�__doc__r r- r* r9 r; rD rE rJ rL rM rQ r_ r` ro rq rr rs rt r r r r r H s( ' � 8r c C s t | �tkrdS dS )z"Return true if ipset name is validFT)r( r) )r r r r r s r c C s4 | � � }tD ]"}||v r t| || kr ||= q |S )z( Return only non default create options )�copy� IPSET_DEFAULT_CREATE_OPTIONS)rA r\ r^ r r r r s �r c C sb g }| � d�D ]H}z&|�d� |�ttj|dd��� W q tyT |�|� Y q0 qd�|�S )z! Normalize IP addresses in entry �,�/F��strict)r0 �indexr2 �str� ipaddress� ip_networkr# r" )rI Z_entryZ_partr r r �normalize_ipset_entry& s r� c C st t | �d��dkrdS ztj| dd�}W n ty< Y dS 0 |D ],}|�tj|dd��rBttjd� | |���qBdS )z: Check if entry overlaps any entry in the list of entries r{ rR NFr} z,Entry '{}' overlaps with existing entry '{}') r( r0 r� r� r# �overlapsr r � INVALID_ENTRY�format)rI rn Z entry_network�itrr r r � check_entry_overlaps_existing2 s r� c C sz zdd� | D �} W n t y& Y dS 0 t| �dkr8dS | �� | �d�}| D ]&}|�|�rpttjd�||���|}qNdS )z> Check if any entry overlaps any entry in the list of entries c S s g | ]}t j|d d��qS )Fr} )r� r� rS r r r r E r z1check_for_overlapping_entries.<locals>.<listcomp>Nr z Entry '{}' overlaps entry '{}') r# r( �sort�popr� r r r� r� )rn Z prev_networkZcurrent_networkr r r � check_for_overlapping_entriesB s 2 r� ) rx �__all__Zos.pathrh r� Zfirewallr Zfirewall.errorsr Zfirewall.core.progr Zfirewall.core.loggerr Zfirewall.functionsr r Zfirewall.configr r) r1 ZIPSET_CREATE_OPTIONSrz �objectr r r r� r� r� r r r r �<module> s6 � � P core/__pycache__/ebtables.cpython-39.opt-1.pyc 0000644 00000016342 15025011705 0015057 0 ustar 00 a ���g�$ � @ s d gZ ddlZddlmZ ddlmZ ddlmZm Z m Z ddl m Z ddl mZ ddlmZmZ ddlZd gg d �g d �d �Zi Zi Zi Ze�� D ]pZg ee< e� ee< ee D ]PZee �d e � ee �deef � ee �de � ee � de � q�q�G dd � d e �Z dS )�ebtables� N)�runProg)�log)�tempFile�readfile� splitArgs)�COMMANDS)� ipXtables�� FirewallError� INVALID_IPVZBROUTING)Z PREROUTINGZ POSTROUTING�OUTPUT)ZINPUTr ZFORWARD)ZbrouteZnat�filterz -N %s_directz-I %s 1 -j %s_directz-I %s_direct 1 -j RETURNz %s_directc @ s� e Zd ZdZd ZdZdd� Zdd� Zdd� Zd d � Z d d � Z d d� Z dd� Z dd� Z dd� Zdd� Zdd� Zdd� Zdd � Zd d � Zd/d d!�Zd"d#� Zd$d%� Zd&d'� Zd(d)� Zd0d+d,�Zd-d.� Zd S )1r ZebFc C sB t | j | _t d| j | _| �� | _| �� | _| �� g | _ d S )Nz %s-restore) r �ipv�_command�_restore_command� _detect_restore_noflush_optionZrestore_noflush_option�_detect_concurrent_option�concurrent_option� fill_exists�available_tables��self� r �:/usr/lib/python3.9/site-packages/firewall/core/ebtables.py�__init__9 s zebtables.__init__c C s$ t j�| j�| _t j�| j�| _d S �N)�os�path�existsr Zcommand_existsr Zrestore_command_existsr r r r r A s zebtables.fill_existsc C s( d}t | jddg�}|d dkr$d}|S )N� z --concurrent�-Lr )r r )r r �retr r r r E s z"ebtables._detect_concurrent_optionc C s. g }z| � |d� W n ty( Y dS 0 dS )N�offFT)� set_rules� ValueError)r �rulesr r r r O s z'ebtables._detect_restore_noflush_optionc C s� g }| j r | j |vr |�| j � |dd� |D �7 }t�d| j| jd�|�� t| j|�\}}|dkr~td| jd�|�|f ��|S )Nc S s g | ] }d | �qS )z%sr )�.0�itemr r r � <listcomp>^ � z"ebtables.__run.<locals>.<listcomp>� %s: %s %s� r �'%s %s' failed: %s) r �appendr �debug2� __class__r �joinr r% )r �args�_args�statusr" r r r Z__runY s �zebtables.__runc C s$ dD ]}||v rt td| ��qd S )N)z %%REJECT%%z%%ICMP%%z %%LOGTYPE%%z'%s' invalid for ebtablesr )r �rule�strr r r �_rule_validatef s �zebtables._rule_validatec C s |t v o|t | v S r )�BUILT_IN_CHAINS)r r �table�chainr r r �is_chain_builtinl s �zebtables.is_chain_builtinc C sJ g }|r4|� d|d|g� |� d|d|dddg� n|� d|d|g� |S )N�-tz-N�-I�1z-jZRETURN�-X)r. )r �addr9 r: r& r r r �build_chain_rulesp s zebtables.build_chain_rulesc C s8 d|g}|r |d|t |�g7 }n |d|g7 }||7 }|S )Nr< r= z-D)r6 )r r@ r9 r: �indexr2 r5 r r r � build_rule{ s zebtables.build_rulec C s t �|�S r )r Zcommon_reverse_rule�r r2 r r r � reverse_rule� s zebtables.reverse_rulec C s t �|� d S r )r Zcommon_check_passthroughrD r r r �check_passthrough� s zebtables.check_passthroughc C s t �|�S r )r Zcommon_reverse_passthroughrD r r r �reverse_passthrough� s z ebtables.reverse_passthroughc C s t � }d}i }|D ]�}|d d � }| �|� dD ]J}z|�|�} W n tyT Y q00 t|�| d kr0|�| � |�| �}q0t|�D ]<\} } tjD ],} | | v r�| � d�r�| � d�s�d| || < q�q�|� |g �� |� q|D ]4}|� d| � || D ]}|� d�|�d � q�q�|�� t�|j�} t�d | j| jd |j| jf � g } | � d � t| j| |jd �\}}t�� d k�r�t|j�}|d u�r�d} |D ]@}tjd| |f ddd� |� d��s�tjddd� | d7 } �q�t� |j� |dk�rtd| jd�| �|f ��d S )Nr )r< z--table� �"z"%s"z*%s r, � r+ z%s: %dz --noflush)�stdin� z%8d: %sr )�nofmt�nlr )rM r- ) r r7 rB r% �len�pop� enumerate�stringZ whitespace� startswith�endswith� setdefaultr. �writer1 �closer �stat�namer r/ r0 r �st_sizer ZgetDebugLogLevelr Zdebug3�unlink)r r& � log_deniedZ temp_filer9 Z table_rulesZ_ruler5 �opt�i�element�crX r2 r4 r" �lines�liner r r r$ � sb � � � �zebtables.set_rulesc C s | � |� | �|�S r )r7 �_ebtables__run)r r5 r\ r r r �set_rule� s zebtables.set_ruleNc C s� g }|r|gnt �� }|D ]f}|| jv r4|�|� qz*| �d|dg� | j�|� |�|� W q ty~ t�d| � Y q0 q|S )Nr< r! z#ebtables table '%s' does not exist.)r8 �keysr r. rc r% r Zdebug1)r r9 r" Ztablesr r r �get_available_tables� s z ebtables.get_available_tablesc C s i S r r )r r9 r r r �get_zone_table_chains� s z ebtables.get_zone_table_chainsc C s> g }t �� D ],}|| �� vr q dD ]}|�d||g� q"q |S )N)z-Fr? z-Zr< �r8 re rf r. )r r& r9 �flagr r r �build_flush_rules� s zebtables.build_flush_rulesc C sV g }|dkrdn|}t �� D ]4}|| �� vr.q t | D ]}|�d|d||g� q6q |S )NZPANICZDROPr< z-Prh )r ZpolicyZpolicy_detailsr& Z_policyr9 r: r r r �build_set_policy_rules� s z ebtables.build_set_policy_rulesc C s g S r r r r r r �build_default_tables� s z ebtables.build_default_tablesr# c C s� g }t D ]�}|| �� vrqt | d d � }|dkrH|tv rH|�t| � d|g}|D ]2}t|�tkrt|�|| � qT|�|t|� � qTq|S )Nr# r< )� DEFAULT_RULESrf � LOG_RULES�extend�type�listr. r )r r\ Z default_rulesr9 Z_default_rules�prefixr5 r r r �build_default_rules� s z ebtables.build_default_rulesc C s || j kS r )r )r r r r r �is_ipv_supported s zebtables.is_ipv_supported)N)r# )�__name__� __module__� __qualname__r rY Zpolicies_supportedr r r r rc r7 r; rA rC rE rF rG r$ rd rf rg rj rk rl rs rt r r r r r 4 s0 @ ) �__all__Zos.pathr Zfirewall.core.progr Zfirewall.core.loggerr Zfirewall.functionsr r r Zfirewall.configr Z firewall.corer Zfirewall.errorsr r rR r8 rm rn Z OUR_CHAINSre r9 �setr: r. r@ �objectr r r r r �<module> s0 � core/__pycache__/helper.cpython-39.pyc 0000644 00000000322 15025011705 0013605 0 ustar 00 a ���g$ � @ s d Z dZdS )zThe helper maxnamelen� N)�__doc__ZHELPER_MAXNAMELEN� r r �8/usr/lib/python3.9/site-packages/firewall/core/helper.py�<module> s core/__pycache__/fw_service.cpython-39.opt-1.pyc 0000644 00000003274 15025011705 0015432 0 ustar 00 a ���gg � @ s2 d gZ ddlmZ ddlmZ G dd � d e�ZdS )�FirewallService� )�errors)� FirewallErrorc @ sL e Zd Zdd� Zdd� Zdd� Zdd� Zd d � Zd d � Zd d� Z dd� Z dS )r c C s || _ i | _d S �N)Z_fw� _services)�self�fw� r �</usr/lib/python3.9/site-packages/firewall/core/fw_service.py�__init__ s zFirewallService.__init__c C s d| j | jf S )Nz%s(%r))� __class__r �r r r r �__repr__ s zFirewallService.__repr__c C s | j �� d S r )r �clearr r r r �cleanup# s zFirewallService.cleanupc C s t | j�� �S r )�sortedr �keysr r r r � get_services( s z FirewallService.get_servicesc C s || j vrttj|��d S r )r r r ZINVALID_SERVICE�r Zservicer r r � check_service+ s z FirewallService.check_servicec C s | � |� | j| S r �r r r r r r � get_service/ s zFirewallService.get_servicec C s || j |j< d S r )r �name)r �objr r r � add_service3 s zFirewallService.add_servicec C s | � |� | j|= d S r r r r r r �remove_service6 s z FirewallService.remove_serviceN) �__name__� __module__� __qualname__r r r r r r r r r r r r r s N)�__all__Zfirewallr Zfirewall.errorsr �objectr r r r r �<module> s core/__pycache__/fw_direct.cpython-39.opt-1.pyc 0000644 00000031640 15025011705 0015242 0 ustar 00 a ���g�Y � @ sn d gZ ddlmZ ddlmZ ddlmZ ddlmZ ddlm Z ddl m Z ddl m Z G d d � d e�Zd S ) �FirewallDirect� )�LastUpdatedOrderedDict)� ipXtables)�ebtables)�FirewallTransaction)�log)�errors)� FirewallErrorc @ sL e Zd Zdd� Zdd� Zdd� Zdd� Zd d � Zd d � Zd d� Z dd� Z dNdd�Z dd� Z dd� Z dOdd�Zdd� Zd d � Zd d � Zd d!� ZdPd"d#�ZdQd$d%�Zd&d'� Zd(d)� Zd*d+� ZdRd,d-�ZdSd.d/�Zd0d1� Zd2d3� Zd4d5� Z d6d7� Z d8d9� Z d:d;� Z dTd<d=�Z dUd>d?�Z!d@dA� Z"dBdC� Z#dDdE� Z$dFdG� Z%dHdI� Z&dJdK� Z'dLdM� Z(dS )Vr c C s || _ | �� d S �N)�_fw�_FirewallDirect__init_vars)�self�fw� r �;/usr/lib/python3.9/site-packages/firewall/core/fw_direct.py�__init__' s zFirewallDirect.__init__c C s d| j | j| j| jf S )Nz%s(%r, %r, %r))� __class__�_chains�_rules�_rule_priority_positions�r r r r �__repr__+ s �zFirewallDirect.__repr__c C s" i | _ i | _i | _i | _d | _d S r )r r r � _passthroughs�_objr r r r Z __init_vars/ s zFirewallDirect.__init_varsc C s | � � d S r )r r r r r �cleanup6 s zFirewallDirect.cleanupc C s t | j�S r )r r r r r r �new_transaction; s z FirewallDirect.new_transactionc C s || _ d S r )r )r �objr r r �set_permanent_config@ s z#FirewallDirect.set_permanent_configc C s* t | j�t | j� t | j� dkr&dS dS )Nr TF)�lenr r r r r r r �has_runtime_configurationC s "z(FirewallDirect.has_runtime_configurationc C sB | � � r dS t| j�� �t| j�� � t| j�� � dkr>dS dS )NTr F)r r r �get_all_chains� get_all_rules�get_all_passthroughsr r r r �has_configurationH s � ��z FirewallDirect.has_configurationNc C sP |d u r| � � }n|}| �| j�� | j�� | j�� f|� |d u rL|�d� d S �NT)r � set_configr r r! r" �execute)r �use_transaction� transactionr r r � apply_directQ s ��zFirewallDirect.apply_directc C s i }i }i }| j D ]>}|\}}| j | D ]&}| j�|||�s(|�|g ��|� q(q| jD ]X}|\}}}| j| D ]>\} } | j�|||| | �sp||vr�t� ||< | || | | f< qpqX| jD ]@}| j| D ]0} | j� || �s�||vr�g ||< || �| � q�q�|||fS r ) r r � query_chain� setdefault�appendr � query_ruler r �query_passthrough) r Zchains�rulesZ passthroughs�table_id�ipv�table�chain�chain_id�priority�argsr r r �get_runtime_configb s, z!FirewallDirect.get_runtime_configc C s | j | j| jfS r )r r r r r r r � get_config� s zFirewallDirect.get_configc C s� |d u r| � � }n|}|\}}}|D ]r}|\}} || D ]\} | �|| | �s8z| j|| | |d� W q8 ty� } zt�t| �� W Y d } ~ q8d } ~ 0 0 q8q$|D ]�} | \}} } || D ]j\} }| �|| | | |�s�z| j|| | | ||d� W q� t�y } zt�t| �� W Y d } ~ q�d } ~ 0 0 q�q�|D ]n}|| D ]^}| � ||��s0z| j |||d� W n4 t�y� } zt�t| �� W Y d } ~ n d } ~ 0 0 �q0�q$|d u �r�|� d� d S )N)r' T) r r* � add_chainr r Zwarning�strr- �add_ruler. �add_passthroughr& )r Zconfr' r( r r r r0 r1 r2 r3 �errorr4 r5 r6 r r r r% � sF � ( � ( � , zFirewallDirect.set_configc C s( g d�}||vr$t tjd||f ��d S )N)�ipv4�ipv6Zeb�'%s' not in '%s')r r Z INVALID_IPV)r r1 Zipvsr r r � _check_ipv� s �zFirewallDirect._check_ipvc C sF | � |� |dv r tj�� ntj�� }||vrBttjd||f ��d S )N�r> r? r@ )rA r �BUILT_IN_CHAINS�keysr r r Z INVALID_TABLE)r r1 r2 Ztablesr r r �_check_ipv_table� s � �z FirewallDirect._check_ipv_tablec C s� |dv r4t j| }| jjr i }qH| j�|�j| }ntj| }tj| }||v r`tt j d| ��||v rxtt j d| ��|dv r�| jj � |�d ur�tt j d| ��d S )NrB z chain '%s' is built-in chainzchain '%s' is reservedzChain '%s' is reserved)r rC r �nftables_enabled�get_direct_backend_by_ipv� our_chainsr Z OUR_CHAINSr r Z BUILTIN_CHAIN�zoneZzone_from_chainZ INVALID_CHAIN)r r1 r2 r3 Zbuilt_in_chainsrH r r r �_check_builtin_chain� s( ���z#FirewallDirect._check_builtin_chainc C sH |r| j �|g ��|� n*| j | �|� t| j | �dkrD| j |= d S �Nr )r r+ r, �remover )r r0 r3 �addr r r �_register_chain� s z FirewallDirect._register_chainc C s� |d u r| � � }n|}| j�� r.|�| jj� | jjrZ| jj�� rZ|�| jjj| jj g� | � d||||� |d u r~|� d� d S r$ ) r r � may_skip_flush_direct_backends�add_pre�flush_direct_backends� ipset_enabled�ipset�omit_native_ipset� apply_ipsets� ipset_backend�_chainr& �r r1 r2 r3 r' r( r r r r9 � s zFirewallDirect.add_chainc C s> |d u r| � � }n|}| �d||||� |d u r:|�d� d S �NFT)r rW r& rX r r r � remove_chain� s zFirewallDirect.remove_chainc C s: | � ||� | �|||� ||f}|| jv o8|| j| v S r )rE rJ r )r r1 r2 r3 r0 r r r r* � s �zFirewallDirect.query_chainc C s, | � ||� ||f}|| jv r(| j| S g S r )rE r )r r1 r2 r0 r r r � get_chains� s zFirewallDirect.get_chainsc C s< g }| j D ],}|\}}| j | D ]}|�|||f� q q |S r )r r, )r �r�keyr1 r2 r3 r r r r s z FirewallDirect.get_all_chainsc C s� |d u r| � � }n|}| j�� r.|�| jj� | jjrZ| jj�� rZ|�| jjj| jj g� | � d||||||� |d u r�|� d� d S r$ ) r r rO rP rQ rR rS rT rU rV �_ruler& �r r1 r2 r3 r5 r6 r' r( r r r r; s zFirewallDirect.add_rulec C sB |d u r| � � }n|}| �d||||||� |d u r>|�d� d S rY )r r^ r& r_ r r r � remove_rule s zFirewallDirect.remove_rulec C s2 | � ||� |||f}|| jv o0||f| j| v S r )rE r )r r1 r2 r3 r5 r6 r4 r r r r- ) s �zFirewallDirect.query_rulec C s6 | � ||� |||f}|| jv r2t| j| �� �S g S r )rE r �listrD )r r1 r2 r3 r4 r r r � get_rules/ s zFirewallDirect.get_rulesc C sJ g }| j D ]:}|\}}}| j | D ] \}}|�||||t|�f� q"q |S r )r r, ra )r r\ r] r1 r2 r3 r5 r6 r r r r! 6 s z FirewallDirect.get_all_rulesc C s� |rr|| j vrt� | j |< || j | |< || jvr<i | j|< || j| v rb| j| | |7 < q�|| j| |< n<| j | |= t| j | �dkr�| j |= | j| | |8 < d S rK )r r r r )r �rule_idr4 r5 �enable�countr r r �_register_rule> s z FirewallDirect._register_rulec C sZ z| j �| j �|�j|�W S tyT } z"t�|� ttj |��W Y d }~n d }~0 0 d S r ) r �rulerG �name� Exceptionr Zdebug2r r ZCOMMAND_FAILED)r r1 r6 �msgr r r � passthroughR s zFirewallDirect.passthroughc C sX |r*|| j vrg | j |< | j | �|� n*| j | �|� t| j | �dkrT| j |= d S rK )r r, rL r )r r1 r6 rd r r r �_register_passthroughZ s z$FirewallDirect._register_passthroughc C s� |d u r| � � }n|}| j�� r.|�| jj� | jjrZ| jj�� rZ|�| jjj| jj g� | � d|t |�|� |d u r�|� d� d S r$ ) r r rO rP rQ rR rS rT rU rV � _passthroughra r& �r r1 r6 r' r( r r r r< d s z FirewallDirect.add_passthroughc C s@ |d u r| � � }n|}| �d|t|�|� |d u r<|�d� d S rY )r rm ra r& rn r r r �remove_passthroughu s z!FirewallDirect.remove_passthroughc C s || j v ot|�| j | v S r )r �tuple)r r1 r6 r r r r. � s �z FirewallDirect.query_passthroughc C s6 g }| j D ]&}| j | D ]}|�|t|�f� qq |S r �r r, ra )r r\ r1 r6 r r r r" � s z#FirewallDirect.get_all_passthroughsc C s0 g }|| j v r,| j | D ]}|�t|�� q|S r rq )r r1 r\ r6 r r r �get_passthroughs� s z FirewallDirect.get_passthroughsc C s� g }|D ]�}d}|D ]�}z|� |�}W n ty8 Y q0 t|�|krd||d v rd}||d �d�}|D ]&} |dd� } | | |d < |�| � qpq|s|�|� q|S )z5Split values combined with commas for options in optsF�,� TN)�index� ValueErrorr �splitr, ) r r/ ZoptsZ out_rulesrg Z processed�opt�i�items�itemr^ r r r � split_value� s$ zFirewallDirect.split_valuec C s | � ||� | jjs0|dv r0| jj�||||� |}| j�|�} | jjs`| �|||�r`d| }n:| jjr�|dd � dkr�| �|||d d� �r�|d d� }|||f} ||f} |r�| | jv r�| | j| v r�tt j d||||f ��n@| | jvs�| | j| v�rtt j d||||f ��| j| | }d} d} | | j v �r�t | j | �� �}d}|t|�k �r�||| k�r�| | j | || 7 } |d7 }�qLt|�g}| �|d d g�}| �|d d g�}|D ]4}|�| | �|||| t|��� | d7 } | d7 } �q�| �| | ||| � |�| j| | || | � d S ) NrB z %s_directi����Z_directz"rule '%s' already is in '%s:%s:%s'z rule '%s' is not in '%s:%s:%s'rt r z-sz--sourcez-dz --destination)rE r rF rI �create_zone_base_by_chainrG Zis_chain_builtinr r r �ALREADY_ENABLED� NOT_ENABLEDr �sortedrD r ra r| r; Z build_rulerp rf �add_fail)r rd r1 r2 r3 r5 r6 r( rW �backendr4 rc ru re Z positions�jZ args_list�_argsr r r r^ � sp �� � � � �� � ��( �zFirewallDirect._rulec C s� | � ||� | �|||� ||f}|rV|| jv r�|| j| v r�ttjd|||f ��n.|| jvsn|| j| vr�ttjd|||f ��| j�|�}|� ||� |||�� | � |||� |� | j ||| � d S )Nz chain '%s' already is in '%s:%s'z chain '%s' is not in '%s:%s') rE rJ r r r r~ r r rG Z add_rulesZbuild_chain_rulesrN r� )r rM r1 r2 r3 r( r0 r� r r r rW s0 ��� ��� zFirewallDirect._chainc C s� | � |� t|�}|rD|| jv rp|| j| v rpttjd||f ��n,|| jvs\|| j| vrpttjd||f ��| j�|�}|r�|� |� |dv r�|� |�\}}|r�|r�| jj � |||� |} n |� |�} |�|| � | �|||� |�| j||| � d S )Nzpassthrough '%s', '%s'rB )rA rp r r r r~ r r rG Zcheck_passthroughZ passthrough_parse_table_chainrI r} Zreverse_passthroughr; rl r� ) r rd r1 r6 r( Z tuple_argsr� r2 r3 r� r r r rm 0 s: � � � � �zFirewallDirect._passthrough)N)N)N)N)N)N)N)N))�__name__� __module__� __qualname__r r r r r r r r# r) r7 r8 r% rA rE rJ rN r9 rZ r* r[ r r; r` r- rb r! rf rk rl r< ro r. r" rr r| r^ rW rm r r r r r & sN ' � jN)�__all__Zfirewall.fw_typesr Z firewall.corer r Z firewall.core.fw_transactionr Zfirewall.core.loggerr Zfirewallr Zfirewall.errorsr �objectr r r r r �<module> s core/__pycache__/fw_helper.cpython-39.opt-1.pyc 0000644 00000004010 15025011705 0015236 0 ustar 00 a ���g) � @ s6 d Z dgZddlmZ ddlmZ G dd� de�ZdS )zhelper backend�FirewallHelper� )�errors)� FirewallErrorc @ s\ e Zd Zdd� Zdd� Zdd� Zdd� Zd d � Zd d � Zd d� Z dd� Z dd� Z dd� Z dS )r c C s || _ i | _d S �N)Z_fw�_helpers)�self�fw� r �;/usr/lib/python3.9/site-packages/firewall/core/fw_helper.py�__init__ s zFirewallHelper.__init__c C s d| j | jf S )Nz%s(%r))� __class__r �r r r r �__repr__" s zFirewallHelper.__repr__c C s | j �� d S r )r �clearr r r r �cleanup' s zFirewallHelper.cleanupc C s || � � vrttj|��d S r )� get_helpersr r �INVALID_HELPER�r �namer r r � check_helper* s zFirewallHelper.check_helperc C s || � � v S r )r r r r r � query_helper. s zFirewallHelper.query_helperc C s t | j�� �S r )�sortedr �keysr r r r r 1 s zFirewallHelper.get_helpersc C s t | j�dkS )Nr )�lenr r r r r � has_helpers4 s zFirewallHelper.has_helpersc C s | � |� | j| S r )r r r r r r � get_helper7 s zFirewallHelper.get_helperc C s || j |j< d S r )r r )r �objr r r � add_helper; s zFirewallHelper.add_helperc C s" || j vrttj|��| j |= d S r )r r r r r r r r � remove_helper> s z FirewallHelper.remove_helperN) �__name__� __module__� __qualname__r r r r r r r r r r r r r r r s N)�__doc__�__all__Zfirewallr Zfirewall.errorsr �objectr r r r r �<module> s core/__pycache__/fw_policies.cpython-39.opt-1.pyc 0000644 00000004527 15025011705 0015603 0 ustar 00 a ���g� � @ sV d gZ ddlmZ ddlmZ ddlmZ ddlmZ ddlm Z G dd � d e �Z dS ) �FirewallPolicies� )�config)�log)�LockdownWhitelist)�errors)� FirewallErrorc @ sD e Zd Zdd� Zdd� Zdd� Zdd� Zd d � Zd d � Zd d� Z dS )r c C s d| _ ttj�| _d S �NF)� _lockdownr r ZLOCKDOWN_WHITELIST�lockdown_whitelist��self� r �=/usr/lib/python3.9/site-packages/firewall/core/fw_policies.py�__init__ s zFirewallPolicies.__init__c C s d| j | j| jf S )Nz %s(%r, %r))� __class__r r r r r r �__repr__# s �zFirewallPolicies.__repr__c C s d| _ | j�� d S r )r r �cleanupr r r r r ' s zFirewallPolicies.cleanupc C s� |dkr2t �d| � | j�|�r�t �d� dS n�|dkrdt �d| � | j�|�r�t �d� dS nb|dkr�t �d | � | j�|�r�t �d � dS n0|d kr�t �d | � | j�|�r�t �d � dS dS )N�contextz#Doing access check for context "%s"zcontext matches.T�uidz Doing access check for uid %dz uid matches.�userz Doing access check for user "%s"z user matches.Zcommandz#Doing access check for command "%s"zcommand matches.F)r Zdebug2r Z match_contextZdebug3Z match_uidZ match_userZ match_command)r �key�valuer r r � access_check- s* z FirewallPolicies.access_checkc C s | j rttjd��d| _ d S )Nzenable_lockdown()T)r r r ZALREADY_ENABLEDr r r r �enable_lockdownD s z FirewallPolicies.enable_lockdownc C s | j sttjd��d| _ d S )Nzdisable_lockdown()F)r r r Z NOT_ENABLEDr r r r �disable_lockdownI s z!FirewallPolicies.disable_lockdownc C s | j S )N)r r r r r �query_lockdownN s z FirewallPolicies.query_lockdownN) �__name__� __module__� __qualname__r r r r r r r r r r r r s N) �__all__Zfirewallr Zfirewall.core.loggerr Z#firewall.core.io.lockdown_whitelistr r Zfirewall.errorsr �objectr r r r r �<module> s core/__pycache__/fw_icmptype.cpython-39.pyc 0000644 00000004262 15025011705 0014663 0 ustar 00 a ���g� � @ s> d gZ ddlmZ ddlmZ ddlmZ G dd � d e�ZdS )�FirewallIcmpType� )�log)�errors)� FirewallErrorc @ sL e Zd Zdd� Zdd� Zdd� Zdd� Zd d � Zd d � Zd d� Z dd� Z dS )r c C s || _ i | _d S �N)�_fw� _icmptypes)�self�fw� r �=/usr/lib/python3.9/site-packages/firewall/core/fw_icmptype.py�__init__ s zFirewallIcmpType.__init__c C s d| j | jf S )Nz%s(%r))� __class__r �r r r r �__repr__! s zFirewallIcmpType.__repr__c C s | j �� d S r )r �clearr r r r �cleanup$ s zFirewallIcmpType.cleanupc C s t | j�� �S r )�sortedr �keysr r r r � get_icmptypes) s z FirewallIcmpType.get_icmptypesc C s || j vrttj|��d S r )r r r ZINVALID_ICMPTYPE�r Zicmptyper r r �check_icmptype, s z FirewallIcmpType.check_icmptypec C s | � |� | j| S r �r r r r r r � get_icmptype0 s z FirewallIcmpType.get_icmptypec C s� |j }t|�dkrddg}|D ]r}|dkrF| jjs<| jjs<q | jj}n(|dkrj| jjs`| jjs`q | jj}ng }|j� � |vr t � d|j|f � q || j |j< d S )Nr Zipv4Zipv6z5ICMP type '%s' is not supported by the kernel for %s.) Z destination�lenr Zip4tables_enabledZnftables_enabledZipv4_supported_icmp_typesZip6tables_enabledZipv6_supported_icmp_types�name�lowerr Zinfo1r )r �objZ orig_ipvsZipvZsupported_icmpsr r r � add_icmptype4 s z FirewallIcmpType.add_icmptypec C s | � |� | j|= d S r r r r r r �remove_icmptypeG s z FirewallIcmpType.remove_icmptypeN) �__name__� __module__� __qualname__r r r r r r r r r r r r r s N) �__all__Zfirewall.core.loggerr Zfirewallr Zfirewall.errorsr �objectr r r r r �<module> s core/__pycache__/base.cpython-39.pyc 0000644 00000002135 15025011705 0013244 0 ustar 00 a ���g � @ sT d Z dZdZdZdddedgZg d�Zd d d d d d�Zg d�g d�d�Zg d�ZdS )zBase firewall settingsz{chain}_{zone}�CONTINUE����ACCEPTz %%REJECT%%�DROP�default)r ZREJECTr r ZPREZPOST�INZFWDZOUT)Z PREROUTINGZ POSTROUTINGZINPUTZFORWARDZOUTPUT)zicmp-host-prohibitedz host-prohibzicmp-net-unreachablez net-unreachzicmp-host-unreachablez host-unreachzicmp-port-unreachable� port-unreachzicmp-proto-unreachablez proto-unreachzicmp-net-prohibitedz net-prohib� tcp-resetztcp-rstzicmp-admin-prohibitedz admin-prohib) zicmp6-adm-prohibitedzadm-prohibitedzicmp6-no-routezno-routezicmp6-addr-unreachablez addr-unreachzicmp6-port-unreachabler r )Zipv4Zipv6)zhash:ipz hash:ip,portz hash:ip,markzhash:netz hash:net,portzhash:net,ifacezhash:macN) �__doc__ZDEFAULT_ZONE_TARGETZDEFAULT_POLICY_TARGETZDEFAULT_POLICY_PRIORITYZ ZONE_TARGETSZPOLICY_TARGETSZ SHORTCUTSZ REJECT_TYPESZSOURCE_IPSET_TYPES� r r �6/usr/lib/python3.9/site-packages/firewall/core/base.py�<module> s" �� � core/__pycache__/fw_transaction.cpython-39.pyc 0000644 00000011172 15025011705 0015354 0 ustar 00 a ���g� � @ sJ d Z dgZddlZddlmZ ddlmZ ddlmZ G dd� de �Z dS )z!Transaction classes for firewalld�FirewallTransaction� N)�log)�errors)� FirewallErrorc @ s� e Zd Zdd� Zdd� Zdd� Zdd� Zd d � Zd d � Zd d� Z dd� Z dd� Z dd� Z dd� Z dd� Zdd� Zdd � Zd d � Zd d � Zd!d"� Zd#S )$r c C s( || _ i | _g | _g | _g | _g | _d S �N)�fw�rules� pre_funcs� post_funcs� fail_funcs�modules)�selfr � r �@/usr/lib/python3.9/site-packages/firewall/core/fw_transaction.py�__init__! s z FirewallTransaction.__init__c C s2 | j �� | jd d �= | jd d �= | jd d �= d S r )r �clearr r r )r r r r r ) s zFirewallTransaction.clearc C s | j �|jg ��|� d S r )r � setdefault�name�append�r �backend�ruler r r �add_rule/ s z FirewallTransaction.add_rulec C s |D ]}| � ||� qd S r )r )r r r r r r r � add_rules2 s z FirewallTransaction.add_rulesc C s |j | jv o|| j|j v S r )r r r r r r � query_rule6 s z FirewallTransaction.query_rulec C s2 |j | jv r.|| j|j v r.| j|j �|� d S r )r r �remover r r r � remove_rule9 s z FirewallTransaction.remove_rulec G s | j �||f� d S r )r r �r �func�argsr r r �add_pre= s zFirewallTransaction.add_prec G s | j �||f� d S r )r r r r r r �add_post@ s z FirewallTransaction.add_postc G s | j �||f� d S r )r r r r r r �add_failC s z FirewallTransaction.add_failc C s || j vr| j �|� d S r )r r �r �moduler r r � add_moduleF s z FirewallTransaction.add_modulec C s || j v r| j �|� d S r )r r r# r r r � remove_moduleJ s z!FirewallTransaction.remove_modulec C s |D ]}| � |� qd S r )r% �r r r$ r r r � add_modulesN s z FirewallTransaction.add_modulesc C s |D ]}| � |� qd S r )r& r' r r r �remove_modulesR s z"FirewallTransaction.remove_modulesc C s� t �dt| �|df � i }|sb| jD ]8}t| j| �D ]$}|�|g ��| j�|�� |�� q8q&n$| jD ] }|�|g �� | j| � qh|| j fS )Nz%s.prepare(%s, %s)z...) r �debug4�typer �reversedr r r �get_backend_by_name� reverse_rule�extendr )r �enabler � backend_namer r r r �prepareV s � zFirewallTransaction.preparec C s t �dt| �|f � | �|�\}}| �� d}d}g }|D ]j}z| j�||| � W nD ty� } z,d}|}t �t � � � t � |� W Y d }~q<d }~0 0 |� |� q<|s�| j� ||�} | r�| \} }| r�t �|� |�r�i } |D ]:}g | |< t|| �D ] } | | � | j�|��| �� q�q�| D ]\}z| j�|| | � W n> t�yz } z$t �t � � � t � |� W Y d }~n d }~0 0 �q"| jD ]`\} }z | |� W nH t�y� } z.t �t � � � t � d| ||f � W Y d }~n d }~0 0 �q�ttj|��| �� d S )Nz%s.execute(%s)F� Tz#Calling fail func %s(%s) failed: %s)r r* r+ r2 �prer r � ExceptionZdebug1� traceback� format_exc�errorr Zhandle_modulesr, r- r. r r r ZCOMMAND_FAILED�post)r r0 r r r8 ZerrorMsgZdoner1 �msgZ module_return�statusZ undo_rulesr r r r r r �executef sZ �$ � zFirewallTransaction.executec C s. t �dt| � � | jD ]\}}||� qd S )Nz%s.pre())r r* r+ r r r r r r4 � s zFirewallTransaction.prec C s. t �dt| � � | jD ]\}}||� qd S )Nz %s.post())r r* r+ r r r r r r9 � s zFirewallTransaction.postN)�__name__� __module__� __qualname__r r r r r r r r! r" r% r& r( r) r2 r< r4 r9 r r r r r s" @) �__doc__�__all__r6 Zfirewall.core.loggerr Zfirewallr Zfirewall.errorsr �objectr r r r r �<module> s core/__pycache__/fw_zone.cpython-39.pyc 0000644 00000073477 15025011705 0014022 0 ustar 00 a ���gߩ � @ s� d dl Z d dlmZmZmZ d dlmZ d dlmZ d dl m Z d dl m Z m Z mZmZmZmZmZmZmZmZmZ d dlmZ d dlmZmZm Z d d l m Z d d l m Z G d d � d e!�Z"dS ) � N)� SHORTCUTS�DEFAULT_ZONE_TARGET�SOURCE_IPSET_TYPES)�FirewallTransaction)�Policy)�log) �Rich_ForwardPort�Rich_IcmpBlock� Rich_IcmpType� Rich_Mark�Rich_Masquerade� Rich_Port� Rich_Protocol� Rich_Rule� Rich_Service�Rich_SourcePort�Rich_Tcp_Mss_Clamp)�nm_get_bus_name)� checkIPnMask� checkIP6nMask� check_mac)�errors)� FirewallErrorc @ s& e Zd ZdZdd� Zdd� Zdd� Zdd � Zd d � Zd d � Z dd� Z dd� Z dd� Z dd� Z dd� Zdd� Zdd� Zd�d d �Zd d � Zd!d"� Zd#d$� Zd�d%d&�Zd'd(� Zd�d)d*�Zd�d+d,�Zd-d.� Zd/d0� Zd1d2� Zd3d4� Z d5d6� Z d�d8d9�Z d:d;� Z d�d<d=�Z d�d>d?�Z!d�d@dA�Z"dBdC� Z#dDdE� Z$dFdG� Z%d�dIdJ�Z&d�dKdL�Z'd�dMdN�Z(dOdP� Z)d�dQdR�Z*d�dSdT�Z+dUdV� Z,dWdX� Z-dYdZ� Z.d�d[d\�Z/d]d^� Z0d_d`� Z1dadb� Z2dcdd� Z3dedf� Z4dgdh� Z5d�didj�Z6dkdl� Z7dmdn� Z8dodp� Z9d�dqdr�Z:dsdt� Z;dudv� Z<dwdx� Z=d�dydz�Z>d{d|� Z?d}d~� Z@dd�� ZAd�d�� ZBd�d�d��ZCd�d�� ZDd�d�� ZEd�d�� ZFd�d�d��ZGd�d�� ZHd�d�� ZId�d�� ZJd�d�d��ZKd�d�� ZLd�d�� ZMd�d�d��ZNd�d�d��ZOd�d�d��ZPd�d�� ZQd�d�d��ZRd�d�� ZSd�d�� ZTd�d�� ZUd�d�d��ZVd�d�� ZWd�d�� ZXd�d�� ZYd�d�� ZZd�d�d��Z[d�d�� Z\d�d�d��Z]d�d�� Z^d�d�� Z_d S )�� FirewallZoner c C s || _ i | _i | _d S �N)�_fw�_zones�_zone_policies)�self�fw� r �9/usr/lib/python3.9/site-packages/firewall/core/fw_zone.py�__init__0 s zFirewallZone.__init__c C s d| j | jf S )Nz%s(%r))� __class__r �r r r r! �__repr__5 s zFirewallZone.__repr__c C s | j �� | j�� d S r )r �clearr r$ r r r! �cleanup8 s zFirewallZone.cleanupc C s t | j�}|�| jj� |S r )r r Zadd_pre�full_check_config)r �tr r r! �new_transaction< s z FirewallZone.new_transactionc C s dj ||d�S )Nzzone_{fromZone}_{toZone})�fromZone�toZone)�format)r r+ r, r r r! �policy_name_from_zonesA s z#FirewallZone.policy_name_from_zonesc C s t | j�� �S r )�sortedr �keysr$ r r r! � get_zonesF s zFirewallZone.get_zonesc C s4 g }| � � D ]"}| �|�s$| �|�r |�|� q |S r )r1 �list_interfaces� list_sources�append)r Z active_zones�zoner r r! �get_active_zonesI s z FirewallZone.get_active_zonesc C s2 | � |�}| jD ] }|| j| jv r| S qd S r )�_FirewallZone__interface_idr � interfaces)r � interface� interface_idr5 r r r! �get_zone_of_interfaceP s z"FirewallZone.get_zone_of_interfacec C s2 | � |�}| jD ] }|| j| jv r| S qd S r )�_FirewallZone__source_idr �sources)r �source� source_idr5 r r r! �get_zone_of_sourceX s z FirewallZone.get_zone_of_sourcec C s | j �|�}| j| S r )r � check_zoner )r r5 �zr r r! �get_zone` s zFirewallZone.get_zonec C sH t � }|j|_| �||�|_| j|_|j|_|g|_|g|_dD �] }||jkrz|dkrz|dv rzt ||t � t ||��� q@|dkr�||jkr�|dv r�t ||t � t ||��� q@||jkr�|dkr�|dv r�t ||t � t ||��� q@|dv r@g |_ g |_|j D ]D}| �||�}t|d�}|| �|j|�v r�|j �|� |j�|� q�q@|S ) N) �services�ports� masquerade� forward_ports� source_ports� icmp_blocks�icmp_block_inversion� rules_str� protocols�HOST)rD rE rH rI rJ rL �ANY)rF )rG )rK ��rule_str)r �nameZderived_from_zoner. �ZONE_POLICY_PRIORITY�priority�targetZ ingress_zonesZ egress_zones�setattr�copy�deepcopy�getattrrK �rulesr �_rich_rule_to_policiesr4 ) r �z_objr+ r, �p_objZsettingrP Zcurrent_policy�ruler r r! �policy_obj_from_zone_objd s8 �� z%FirewallZone.policy_obj_from_zone_objc C sr || j |j< g | j|j< |jdfd|jf|jdffD ]8\}}| �|||�}| jj�|� | j|j �|j� q4d S )NrM rN )r rQ r r^ r �policyZ add_policyr4 )r �objr+ r, r\ r r r! �add_zone� s � zFirewallZone.add_zonec C s. | j | }|jr| �|� | j |= | j|= d S r )r �applied�unapply_zone_settingsr )r r5 r` r r r! � remove_zone� s zFirewallZone.remove_zoneNc C sR | � � D ]D}| j| }t|j�dks2t|j�dkrt�d|� | j||d� qd S )Nr zApplying zone '%s'��use_transaction)r1 r �lenr8 r= r �debug1�apply_zone_settings)r rf r5 r[ r r r! � apply_zones� s zFirewallZone.apply_zonesc C s | j | }||_d S r )r rb )r r5 rb r` r r r! �set_zone_applied� s z FirewallZone.set_zone_appliedc C s� d|vr d S |� d�}t|�dk r&d S d }tD ]}|d t| kr.|}q.|d ur�|d | �� vrdd S t|�dks�t|�dkr�|d dv r�|d |fS d S )N�_� r � � )Zprer ZdenyZallowZpost)�splitrg r r1 )r �chainZsplits�_chain�xr r r! �zone_from_chain� s& � � z FirewallZone.zone_from_chainc C st | � |�}|d u rd S |\}}|dv r0|}d}n4|dv rB|}d}n"|dv rTd}|}nttjd| ��| �||�|fS )N)Z PREROUTINGZFORWARDrN )ZINPUTrM )Z POSTROUTINGz&chain '%s' can't be mapped to a policy)rt r r Z INVALID_CHAINr. )r rq rs r5 rr r+ r, r r r! �policy_from_chain� s z FirewallZone.policy_from_chainc C sj |dv rf| � |�}|d urf| � |�\}}|d u r:| �� }n|}| jj�|d|||� |d u rf|�d� d S )N)�ipv4�ipv6T)ru r* r r_ Zgen_chain_rules�execute) r �ipv�tablerq rf rs r_ rr � transactionr r r! �create_zone_base_by_chain� s �z&FirewallZone.create_zone_base_by_chainc C s� dD ]�}t | �|�|�}t|t�r(|g}|D ]j}|dkrJ| �||||� q,|dkrp| �|�}| �|||||� q,|dkr|q,q,|dkr�q,t�d|||� q,q|r�| � |||� d S )N)r8 r= �forwardrJ r8 r= rJ r} z3Zone '%s': Unknown setting '%s:%s', unable to apply) rX rC � isinstance�bool� _interface� check_source�_sourcer Zwarning�_icmp_block_inversion)r �enabler5 r{ �keyZ args_list�argsry r r r! �_zone_settings� s& �zFirewallZone._zone_settingsc C s� | j �|�}| j| }|jr d S d|_|d u r8| �� }n|}| j| D ]$}t�d||� | j jj ||d� qF| � d||� |d u r�|� d� d S )NTz+Applying policy (%s) derived from zone '%s're ) r rA r rb r* r r rh r_ �apply_policy_settingsr� rx �r r5 rf �_zoner` r{ r_ r r r! ri s z FirewallZone.apply_zone_settingsc C s| | j �|�}| j| }|js d S |d u r2| �� }n|}| j| D ]}| j jj||d� q@| �d||� |d u rx|� d� d S )Nre FT) r rA r rb r* r r_ �unapply_policy_settingsr� rx r� r r r! rc s z"FirewallZone.unapply_zone_settingsc C sz | � |�}| �|�}g }td�D ]P}|j| d |vrX|�t�t||j| d ��� q |�||j| d � q t|�S )�H :return: exported config updated with runtime settings � r ) rC � get_config_with_settings_dict�rangeZIMPORT_EXPORT_STRUCTUREr4 rV rW rX �tuple)r r5 r` Z conf_dictZ conf_list�ir r r! �get_config_with_settings1 s "z%FirewallZone.get_config_with_settingsc C s� | � |��� }|d tkr"d|d< | �|�| �|�| �|�| �|�| �|�| �|�| � |�| � |�| � |�| � |�| � |�| �|�d� }| j�||�S )r� rT �default� rD rE rI rF rG r8 r= rK rL rH rJ r} )rC Zexport_config_dictr � list_services� list_ports�list_icmp_blocks�query_masquerade�list_forward_portsr2 r3 � list_rules�list_protocols�list_source_ports�query_icmp_block_inversion� query_forwardr Z'combine_runtime_with_permanent_settings)r r5 Z permanentZruntimer r r! r� A s" � z*FirewallZone.get_config_with_settings_dictc s, d � fdd� }� fdd�}� j � jf� j� jf� j� jf� j� jf� j� j f� j � j f� j � j f||f� j� jf� j� jf� j� jf� j� jfd� }� �|�}t�|�}|�|� j�� � � j�d|gi� � � |�} � j� | |�\} } | D ]n} t | | t ��rJ| | D ]>} t | t ��r2|| d |g| �R � n|| d || � �qq�|| d |� q�| D ]�} t | | t ��r�| | D ]n} | d v �r�|| d || |d � nFt | t ��r�|| d |g| �R d|d �� n|| d || d|d � �q|n6| d v �r|| d ||d � n|| d |d|d � �q`d S )Nr c s � j | t|d�d|d� d S )NrO r ��timeout�sender)�add_ruler )r5 rP r� r� r$ r r! �add_rule_wrapperY s zDFirewallZone.set_config_with_settings_dict.<locals>.add_rule_wrapperc s � � | t|d�� d S )NrO )� remove_ruler )r5 rP r$ r r! �remove_rule_wrapper[ s zGFirewallZone.set_config_with_settings_dict.<locals>.remove_rule_wrapperr� Zzonesrn )r8 r= )r� r� )rJ )r N)!� add_service�remove_service�add_port� remove_port�add_icmp_block�remove_icmp_block�add_masquerade�remove_masquerade�add_forward_port�remove_forward_port� add_interface�remove_interface� add_source� remove_source� add_protocol�remove_protocol�add_source_port�remove_source_port�add_icmp_block_inversion�remove_icmp_block_inversion� add_forward�remove_forwardrC rV Zimport_config_dictr Zget_all_io_objects_dictr( r� Z get_added_and_removed_settingsr~ �listr� )r r5 Zsettingsr� r� r� Z setting_to_fnZold_objZ check_objZ old_settingsZ add_settingsZremove_settingsr� r� r r$ r! � set_config_with_settings_dictW sN � " z*FirewallZone.set_config_with_settings_dictc C s | j �|� d S r )r �check_interface�r r9 r r r! r� � s z FirewallZone.check_interfacec C s | � |� |S r )r� r� r r r! Z__interface_id� s zFirewallZone.__interface_idTc C s | j �� | j �|�}| j| }| �|�}||jv rHttjd||f ��| � |�} | d urnttj d|| f ��t � d||f � |d u r�| � � } n|} |js�|r�| j|| d� | �| j|d� |r�| �d||| � | �||||� | �| j||� |d u �r| �d� |S )N�'%s' already bound to '%s'z&Setting zone of interface '%s' to '%s're FT)r � check_panicrA r r7 r8 r r �ZONE_ALREADY_SETr; � ZONE_CONFLICTr rh r* rb ri �add_failrk r� �!_FirewallZone__register_interface�#_FirewallZone__unregister_interfacerx ) r r5 r9 r� rf � allow_applyr� �_objr: �zoir{ r r r! r� � sJ �� ��� � � zFirewallZone.add_interfacec C sB |j �|� |r|dkr&| jj�|� |t� kr>| jj�|� d S )N� )r8 r4 r �_default_zone_interfacesr �_nm_assigned_interfaces)r r� r: r5 r� r r r! Z__register_interface� s z!FirewallZone.__register_interfacec C sR | j �� | �|�}| j �|�}||kr,|S |d ur@| �||� | �|||�}|S r )r r� r; rA r� r� )r r5 r9 r� � _old_zone� _new_zoner� r r r! �change_zone_of_interface� s z%FirewallZone.change_zone_of_interfacec C sz | j �� |d u r | �� }n|}| �||� | jd|d|dd� |d urd|dkrd| jd|d|dd� |d u rv|�d� d S )NT�+)r4 r� F)r r� r* ri r� rx )r Zold_zoneZnew_zonerf r{ r r r! �change_default_zone� s z FirewallZone.change_default_zonec C s� | j �� | �|�}|d u r,ttjd| ��|dkr8|n | j �|�}||krbttjd|||f ��|d u rt| �� }n|}| j | }| � |�}|� | j ||� | � d|||� |d u r�|�d� |S )N�'%s' is not in any zoner� z"remove_interface(%s, %s): zoi='%s'FT)r r� r; r r ZUNKNOWN_INTERFACErA r� r* r r7 �add_postr� r� rx ) r r5 r9 rf r� r� r{ r� r: r r r! r� � s. ��� z FirewallZone.remove_interfacec C sN ||j v r|j �|� || jjv r0| jj�|� || jjv rJ| jj�|� d S r )r8 �remover r� r� )r r� r: r r r! Z__unregister_interface s z#FirewallZone.__unregister_interfacec C s | � |�| �|�jv S r )r7 rC r8 )r r5 r9 r r r! �query_interface s z FirewallZone.query_interfacec C s | � |�jS r )rC r8 �r r5 r r r! r2 s z FirewallZone.list_interfacesFc C sx t |�r dS t|�rdS t|�r$dS |�d�rh| �|dd � � |rV| �|dd � � | �|dd � �S ttj |��d S )Nrv rw r� zipset:� ) r r r � startswith� _check_ipset_type_for_source�_check_ipset_applied� _ipset_familyr r Z INVALID_ADDR�r r> rb r r r! r� s zFirewallZone.check_sourcec C s | j ||d� |S )N�rb )r� r� r r r! Z __source_id( s zFirewallZone.__source_idc C s | j �� | j �|�}| j| }t|�r0|�� }| j||d�}| j||d�} | |jv rjt t j d||f ��| � |�d ur�t t j d| ��|d u r�| �� } n|} |js�|r�| j|| d� | �| j|d� |r�| �d||| | � | �|| ||� | �| j|| � |d u �r| �d� |S )Nr� r� z '%s' already bound to a zonere FT)r r� rA r r �upperr� r< r= r r r� r@ r� r* rb ri r� rk r� � _FirewallZone__register_source� _FirewallZone__unregister_sourcerx ) r r5 r> r� rf r� r� r� ry r? r{ r r r! r� , s< �� � zFirewallZone.add_sourcec C s |j �|� d S r )r= r4 )r r� r? r5 r� r r r! Z__register_sourceT s z FirewallZone.__register_sourcec C sb | j �� | �|�}| j �|�}||kr,|S t|�r<|�� }|d urP| �||� | �|||�}|S r )r r� r@ rA r r� r� r� )r r5 r> r� r� r� r� r r r! �change_zone_of_sourceW s z"FirewallZone.change_zone_of_sourcec C s� | j �� t|�r|�� }| �|�}|d u r<ttjd| ��|dkrH|n | j �|�}||krrttj d|||f ��|d u r�| � � }n|}| j | }| � |�}| � |�} |�| j|| � | �d||| |� |d u r�|�d� |S )Nr� r� z remove_source(%s, %s): zos='%s'FT)r r� r r� r@ r r ZUNKNOWN_SOURCErA r� r* r r� r< r� r� r� rx ) r r5 r> rf Zzosr� r{ r� ry r? r r r! r� i s4 ��� zFirewallZone.remove_sourcec C s ||j v r|j �|� d S r )r= r� )r r� r? r r r! Z__unregister_source� s z FirewallZone.__unregister_sourcec C s& t |�r|�� }| �|�| �|�jv S r )r r� r< rC r= )r r5 r> r r r! � query_source� s zFirewallZone.query_sourcec C s | � |�jS r )rC r= r� r r r! r3 � s zFirewallZone.list_sourcesc sp � j �� D ]�}|jsq � j| D ]>}� j j�|�D ]*\}} |�|||||| |�} |�|| � q2q � �|d�}� � |�j r |dvr |j |||d|d�} |�|| � q � j j� � D ]�}|� j j� |�vr�|� j j�|�vr�q�|� j j�� v �rR� j j�|�j�rR|�s*t� �|��dk�r*� j jj||d� n&� j j�d||� |�� fdd �|� q�|r�|�� fd d �|� q�d S ) NrN )r� �*�filter�r9 rn re Fc s | � j j�� v o � j j�d| �S �NT�r r_ �)get_active_policies_not_derived_from_zoneZ!_ingress_egress_zones_transaction��pr$ r r! �<lambda>� s z)FirewallZone._interface.<locals>.<lambda>c s | � j j�� v o � j j�| �S r �r r_ r� r� r� r$ r r! r� � s )r �enabled_backends�policies_supportedr r_ �#_get_table_chains_for_zone_dispatchZ!build_zone_source_interface_rules� add_rulesr. rC r} �build_zone_forward_rules�"get_policies_not_derived_from_zone�list_ingress_zones�list_egress_zonesr� � get_policyrb rg r2 r� �_ingress_egress_zonesr� ) r r� r5 r9 r{ r4 �backendr_ rz rq rY r r$ r! r� � s: � �$��zFirewallZone._interfacec C s$ | � |�dkrd S | jjj|dd�S )Nzhash:macFr� )� _ipset_typer �ipsetZ get_family�r rQ r r r! r� � s zFirewallZone._ipset_familyc C s | j jj|dd�S )NFr� )r r� Zget_typer� r r r! r� � s zFirewallZone._ipset_typec C s d� |g| jj�|� �S )N�,)�joinr r� Z get_dimension)r rQ �flagr r r! �_ipset_match_flags� s z FirewallZone._ipset_match_flagsc C s | j j�|�S r )r r� Z check_appliedr� r r r! r� � s z!FirewallZone._check_ipset_appliedc C s* | � |�}|tvr&ttjd||f ��d S )Nz.ipset '%s' with type '%s' not usable as source)r� r r r Z INVALID_IPSET)r rQ Z_typer r r! r� � s ��z)FirewallZone._check_ipset_type_for_sourcec sx |r� j �|�gn� j �� D ]�}|js(q � j| D ]<}� j j�|�D ](\}} |�|||||| �} |�|| � qDq2� � |d�}� � |�j r |j |||d|d�} |�|| � q � j j� � D ]�}|� j j�|�vr�|� j j�|�vr�q�|� j j�� v �rZ� j j�|�j�rZ|�s2t� �|��dk�r2� j jj||d� n&� j j�d||� |�� fdd�|� q�|r�|�� fd d�|� q�d S ) NrN r� �r> rn re Fc s | � j j�� v o � j j�d| �S r� r� r� r$ r r! r� � s z&FirewallZone._source.<locals>.<lambda>c s | � j j�� v o � j j�| �S r r� r� r$ r r! r� � s )r �get_backend_by_ipvr� r� r r_ r� Z build_zone_source_address_rulesr� r. rC r} r� r� r� r� r� r� rb rg r3 r� r� r� ) r r� r5 ry r> r{ r� r_ rz rq rY r r$ r! r� � s: � �$��zFirewallZone._sourcec C s0 | j �|�}| �|d�}| j j�||||� |S �NrM )r rA r. r_ r� )r r5 �servicer� r� �p_namer r r! r� � s zFirewallZone.add_servicec C s, | j �|�}| �|d�}| j j�||� |S r )r rA r. r_ r� �r r5 r r r r r! r� s zFirewallZone.remove_servicec C s( | j �|�}| �|d�}| j j�||�S r )r rA r. r_ � query_servicer r r r! r s zFirewallZone.query_servicec C s& | j �|�}| �|d�}| j j�|�S r )r rA r. r_ r� �r r5 r r r r! r� s zFirewallZone.list_servicesc C s2 | j �|�}| �|d�}| j j�|||||� |S r )r rA r. r_ r� )r r5 �port�protocolr� r� r r r r! r� s zFirewallZone.add_portc C s. | j �|�}| �|d�}| j j�|||� |S r )r rA r. r_ r� �r r5 r r r r r r! r� s zFirewallZone.remove_portc C s* | j �|�}| �|d�}| j j�|||�S r )r rA r. r_ � query_portr r r r! r s zFirewallZone.query_portc C s& | j �|�}| �|d�}| j j�|�S r )r rA r. r_ r� r r r r! r� % s zFirewallZone.list_portsc C s2 | j �|�}| �|d�}| j j�|||||� |S r )r rA r. r_ r� )r r5 � source_portr r� r� r r r r! r� * s z FirewallZone.add_source_portc C s. | j �|�}| �|d�}| j j�|||� |S r )r rA r. r_ r� �r r5 r r r r r r! r� 0 s z FirewallZone.remove_source_portc C s* | j �|�}| �|d�}| j j�|||�S r )r rA r. r_ �query_source_portr r r r! r 6 s z FirewallZone.query_source_portc C s& | j �|�}| �|d�}| j j�|�S r )r rA r. r_ r� r r r r! r� ; s z FirewallZone.list_source_portsc C s� | j �|�}t|j�tkr(| �|d�gS t|j�ttt t t t fv rP| �|d�gS t|j�t fv rn| �|d�gS t|j�tfv r�| �d|�gS t|j�tfv r�| �|d�gS |jd u r�| �|d�gS ttjdt|j� ��d S )NrN rM z Rich rule type (%s) not handled.)r rA �type�actionr r. �elementr r r r r r r r r r r Z INVALID_RULE)r r5 r] r r r! rZ @ s � z#FirewallZone._rich_rule_to_policiesc C s* | � ||�D ]}| jj�||||� q |S r )rZ r r_ r� )r r5 r] r� r� r r r r! r� R s zFirewallZone.add_rulec C s& | � ||�D ]}| jj�||� q |S r )rZ r r_ r� )r r5 r] r r r r! r� W s zFirewallZone.remove_rulec C s. d}| � ||�D ]}|o&| jj�||�}q|S r� )rZ r r_ � query_rule)r r5 r] �retr r r r! r \ s zFirewallZone.query_rulec C sZ | j �|�}t� }| �|d�| �|d�| �d|�fD ] }|�t| j j�|��� q4t|�S )NrN rM )r rA �setr. �updater_ r� r� )r r5 r r r r r! r� b s �zFirewallZone.list_rulesc C s0 | j �|�}| �|d�}| j j�||||� |S r )r rA r. r_ r� )r r5 r r� r� r r r r! r� k s zFirewallZone.add_protocolc C s, | j �|�}| �|d�}| j j�||� |S r )r rA r. r_ r� �r r5 r r r r r! r� q s z FirewallZone.remove_protocolc C s( | j �|�}| �|d�}| j j�||�S r )r rA r. r_ �query_protocolr r r r! r w s zFirewallZone.query_protocolc C s& | j �|�}| �|d�}| j j�|�S r )r rA r. r_ r� r r r r! r� | s zFirewallZone.list_protocolsc C s. | j �|�}| �d|�}| j j�|||� |S �NrN )r rA r. r_ r� )r r5 r� r� r r r r! r� � s zFirewallZone.add_masqueradec C s* | j �|�}| �d|�}| j j�|� |S r )r rA r. r_ r� r r r r! r� � s z FirewallZone.remove_masqueradec C s& | j �|�}| �d|�}| j j�|�S r )r rA r. r_ r� r r r r! r� � s z FirewallZone.query_masqueradec C s6 | j �|�}| �|d�}| j j�|||||||� |S r )r rA r. r_ r� ) r r5 r r �toport�toaddrr� r� r r r r! r� � s �z FirewallZone.add_forward_portc C s2 | j �|�}| �|d�}| j j�|||||� |S r )r rA r. r_ r� �r r5 r r r r r r r r! r� � s z FirewallZone.remove_forward_portc C s. | j �|�}| �|d�}| j j�|||||�S r )r rA r. r_ �query_forward_portr r r r! r � s �z FirewallZone.query_forward_portc C s& | j �|�}| �|d�}| j j�|�S r )r rA r. r_ r� r r r r! r� � s z FirewallZone.list_forward_portsc C s0 | j �|�}| �|d�}| j j�||||� |S r )r rA r. r_ r� )r r5 �icmpr� r� r r r r! r� � s zFirewallZone.add_icmp_blockc C s, | j �|�}| �|d�}| j j�||� |S r )r rA r. r_ r� )r r5 r r r r r! r� � s z FirewallZone.remove_icmp_blockc C s( | j �|�}| �|d�}| j j�||�S r )r rA r. r_ �query_icmp_block)r r5 r � p_name_hostr r r! r � s z FirewallZone.query_icmp_blockc C s. | j �|�}| �|d�}tt| j j�|���S r )r rA r. r/ r r_ r� �r r5 r r r r! r� � s z FirewallZone.list_icmp_blocksc C s, | j �|�}| �|d�}| j j�||� |S r )r rA r. r_ r� )r r5 r� r r r r! r� � s z%FirewallZone.add_icmp_block_inversionc C s. | j �|�}| �|d�}| j j�|||� d S r )r rA r. r_ r� )r r� r5 r{ r r r r! r� � s z"FirewallZone._icmp_block_inversionc C s* | j �|�}| �|d�}| j j�|� |S r )r rA r. r_ r� r r r r! r� � s z(FirewallZone.remove_icmp_block_inversionc C s& | j �|�}| �|d�}| j j�|�S r )r rA r. r_ r� r r r r! r� � s z'FirewallZone.query_icmp_block_inversionc C s� | � |d�}| j| jD ]<}| j�� D ],}|js2q&|j|||d|d�}|�||� q&q| j| jD ]X}| � |�} | r�| j� | �gn| j�� D ],}|js�q�|j|||d|d�}|�||� q�qbd S )NrN r� r� r� ) r. r r8 r r� r� r� r� r= r� r ) r r� r5 r{ r r9 r� rY r> ry r r r! �_forward� s zFirewallZone._forwardc C s� | j �|�}| j �|� | j �� | j| }|jrBttjd| ��|d u rT| � � }n|}|j rl| � d||� | � |||� |� | j|� |d u r�|�d� |S )Nz forward already enabled in '%s'T)r rA Z check_timeoutr� r r} r r ZALREADY_ENABLEDr* rb r � _FirewallZone__register_forwardr� �!_FirewallZone__unregister_forwardrx )r r5 r� r� rf r� r� r{ r r r! r� � s$ � zFirewallZone.add_forwardc C s d|_ d S r� �r} )r r� r� r� r r r! Z__register_forward s z FirewallZone.__register_forwardc C s� | j �|�}| j �� | j| }|js6ttjd| ��|d u rH| �� }n|}|j r`| � d||� |� | j |� |d u r�|� d� |S )Nzforward not enabled in '%s'FT)r rA r� r r} r r Z NOT_ENABLEDr* rb r r� r" rx )r r5 rf r� r� r{ r r r! r� s � zFirewallZone.remove_forwardc C s d|_ d S )NFr# )r r� r r r! Z__unregister_forward% s z!FirewallZone.__unregister_forwardc C s | � |�jS r )rC r} r� r r r! r� ( s zFirewallZone.query_forward)N)N)N)N)NNT)N)N)N)F)F)NNT)N)N)F)r N)r N)r N)r N)r N)r N)NNr N)NN)NN)r N)N)r NN)N)`�__name__� __module__� __qualname__rR r" r% r' r* r. r1 r6 r; r@ rC r^ ra rd rj rk rt ru r| r� ri rc r� r� r� r� r7 r� r� r� r� r� r� r� r2 r� r< r� r� r� r� r� r� r3 r� r� r� r� r� r� r� r� r� r r� r� r� r r� r� r� r r� rZ r� r� r r� r� r� r r� r� r� r� r� r� r r� r� r� r r� r� r� r� r� r r� r! r� r" r� r r r r! r - s� * � > � + � � ( � ,( � � � � r )#rV Zfirewall.core.baser r r Z firewall.core.fw_transactionr Zfirewall.core.io.policyr Zfirewall.core.loggerr Zfirewall.core.richr r r r r r r r r r r Zfirewall.core.fw_nmr Zfirewall.functionsr r r Zfirewallr Zfirewall.errorsr �objectr r r r r! �<module> s 4 core/__pycache__/rich.cpython-39.pyc 0000644 00000051466 15025011705 0013272 0 ustar 00 a ���gK� � @ s� g d �Z ddlmZ ddlmZ ddlmZ ddlmZ ddlm Z G dd� de �Z G d d � d e �Z G d d � d e �Z G d d� de �ZG dd� de�ZG dd� de �ZG dd� de �ZG dd� de �ZG dd� de �ZG dd� de �ZG dd � d e �ZG d d � d e �ZG d d � d e �ZG d!d"� d"e �ZG d#d$� d$e �ZG d%d&� d&e �ZG d'd(� d(e�ZG d)d*� d*e �Z G d+d,� d,e �Z G d-d.� d.e �Z d/S )0)� Rich_Source�Rich_Destination� Rich_Service� Rich_Port� Rich_Protocol�Rich_Masquerade�Rich_IcmpBlock� Rich_IcmpType�Rich_SourcePort�Rich_ForwardPort�Rich_Log� Rich_NFLog� Rich_Accept� Rich_Reject� Rich_Drop� Rich_Mark� Rich_Audit� Rich_Limit� Rich_Rule�Rich_Tcp_Mss_Clamp� )� functions)�check_ipset_name)� REJECT_TYPES)�errors)� FirewallErrorc @ s e Zd Zddd�Zdd� ZdS )r Fc C s� || _ | j dkrd | _ || _| jdks0| jd u r8d | _n| jd urN| j�� | _|| _| jdkrdd | _|| _| j d u r�| jd u r�| jd u r�ttjd��d S )N� �no address, mac and ipset)�addr�mac�upper�ipset�invertr r � INVALID_RULE)�selfr r r r! � r$ �6/usr/lib/python3.9/site-packages/firewall/core/rich.py�__init__$ s �zRich_Source.__init__c C sj d| j r dnd }| jd ur*|d| j S | jd urB|d| j S | jd urZ|d| j S ttjd��d S )Nz source%s � NOTr � address="%s"zmac="%s"� ipset="%s"r )r! r r r r r r" �r# �retr$ r$ r% �__str__5 s �zRich_Source.__str__N)F��__name__� __module__� __qualname__r& r, r$ r$ r$ r% r # s r c @ s e Zd Zddd�Zdd� ZdS )r Fc C sV || _ | j dkrd | _ || _| jdkr,d | _|| _| j d u rR| jd u rRttjd��d S )Nr �no address and ipset)r r r! r r r" )r# r r r! r$ r$ r% r& A s �zRich_Destination.__init__c C sR d| j r dnd }| jd ur*|d| j S | jd urB|d| j S ttjd��d S )Nzdestination%s r' r r( r) r1 )r! r r r r r" r* r$ r$ r% r, M s �zRich_Destination.__str__N)Fr- r$ r$ r$ r% r @ s r c @ s e Zd Zdd� Zdd� ZdS )r c C s || _ d S �N��name�r# r4 r$ r$ r% r& W s zRich_Service.__init__c C s d| j S )Nzservice name="%s"r3 �r# r$ r$ r% r, Z s zRich_Service.__str__Nr- r$ r$ r$ r% r V s r c @ s e Zd Zdd� Zdd� ZdS )r c C s || _ || _d S r2 ��port�protocol)r# r8 r9 r$ r$ r% r& ^ s zRich_Port.__init__c C s d| j | jf S )Nz port port="%s" protocol="%s"r7 r6 r$ r$ r% r, b s zRich_Port.__str__Nr- r$ r$ r$ r% r ] s r c @ s e Zd Zdd� ZdS )r c C s d| j | jf S )Nz#source-port port="%s" protocol="%s"r7 r6 r$ r$ r% r, f s �zRich_SourcePort.__str__N�r. r/ r0 r, r$ r$ r$ r% r e s r c @ s e Zd Zdd� Zdd� ZdS )r c C s || _ d S r2 ��value�r# r< r$ r$ r% r& k s zRich_Protocol.__init__c C s d| j S )Nzprotocol value="%s"r; r6 r$ r$ r% r, n s zRich_Protocol.__str__Nr- r$ r$ r$ r% r j s r c @ s e Zd Zdd� Zdd� ZdS )r c C s d S r2 r$ r6 r$ r$ r% r& r s zRich_Masquerade.__init__c C s dS )N� masquerader$ r6 r$ r$ r% r, u s zRich_Masquerade.__str__Nr- r$ r$ r$ r% r q s r c @ s e Zd Zdd� Zdd� ZdS )r c C s || _ d S r2 r3 r5 r$ r$ r% r& y s zRich_IcmpBlock.__init__c C s d| j S )Nzicmp-block name="%s"r3 r6 r$ r$ r% r, | s zRich_IcmpBlock.__str__Nr- r$ r$ r$ r% r x s r c @ s e Zd Zdd� Zdd� ZdS )r c C s || _ d S r2 r3 r5 r$ r$ r% r& � s zRich_IcmpType.__init__c C s d| j S )Nzicmp-type name="%s"r3 r6 r$ r$ r% r, � s zRich_IcmpType.__str__Nr- r$ r$ r$ r% r s r c @ s e Zd Zdd� Zdd� ZdS )r c C s || _ d S r2 r; r= r$ r$ r% r& � s zRich_Tcp_Mss_Clamp.__init__c C s | j rd| j S dS d S )Nztcp-mss-clamp value="%s"� tcp-mss-clampr; r6 r$ r$ r% r, � s zRich_Tcp_Mss_Clamp.__str__Nr- r$ r$ r$ r% r � s r c @ s e Zd Zdd� Zdd� ZdS )r c C s< || _ || _|| _|| _| jd u r(d| _| jd u r8d| _d S �Nr �r8 r9 �to_port� to_address)r# r8 r9 rB rC r$ r$ r% r& � s zRich_ForwardPort.__init__c C s< d| j | j| jdkr d| j nd| jdkr4d| j ndf S )Nz(forward-port port="%s" protocol="%s"%s%sr z to-port="%s"z to-addr="%s"rA r6 r$ r$ r% r, � s ��zRich_ForwardPort.__str__Nr- r$ r$ r$ r% r � s r c @ s& e Zd Zddd�Zdd� Zdd� ZdS ) r Nc C s || _ || _|| _d S r2 ��prefix�level�limit)r# rE rF rG r$ r$ r% r& � s zRich_Log.__init__c C s> d| j rd| j nd| jr$d| j nd| jr6d| j ndf S )Nz log%s%s%s� prefix="%s"r z level="%s"� %srD r6 r$ r$ r% r, � s ��zRich_Log.__str__c C sV | j r t| j �dkr ttjd��| jr>| jdvr>ttj| j��| jd urR| j�� d S )N� �+maximum accepted length of 'prefix' is 127.)ZemergZalertZcrit�errorZwarningZnotice�info�debug) rE �lenr r �INVALID_LOG_PREFIXrF ZINVALID_LOG_LEVELrG �checkr6 r$ r$ r% rQ � s � zRich_Log.check)NNN�r. r/ r0 r& r, rQ r$ r$ r$ r% r � s r c @ s& e Zd Zddd�Zdd� Zdd� ZdS ) r Nc C s || _ || _|| _|| _d S r2 ��grouprE � thresholdrG )r# rT rE Z queue_sizerG r$ r$ r% r& � s zRich_NFLog.__init__c C sP d| j rd| j nd| jr$d| j nd| jr6d| j nd| jrHd| j ndf S )Nz nflog%s%s%s%sz group="%s"r rH z queue-size="%s"rI rS r6 r$ r$ r% r, � s ��zRich_NFLog.__str__c C st | j r t�| j �s ttjd��| jr>t| j�dkr>ttjd��| j r\t�| j �s\ttj d��| j d urp| j � � d S )Nz5nflog 'group' must be an integer between 0 and 65535.rJ rK z:nflog 'queue-size' must be an integer between 0 and 65535.) rT r Z checkUINT16r r ZINVALID_NFLOG_GROUPrE rO rP rU ZINVALID_NFLOG_QUEUErG rQ r6 r$ r$ r% rQ � s zRich_NFLog.check)NNNNrR r$ r$ r$ r% r � s r c @ s e Zd Zddd�Zdd� ZdS )r Nc C s || _ d S r2 �rG �r# rG r$ r$ r% r& � s zRich_Audit.__init__c C s d| j rd| j nd S )Nzaudit%srI r rV r6 r$ r$ r% r, � s zRich_Audit.__str__)Nr- r$ r$ r$ r% r � s r c @ s e Zd Zddd�Zdd� ZdS )r Nc C s || _ d S r2 rV rW r$ r$ r% r& � s zRich_Accept.__init__c C s d| j rd| j nd S )Nzaccept%srI r rV r6 r$ r$ r% r, � s zRich_Accept.__str__)Nr- r$ r$ r$ r% r � s r c @ s& e Zd Zddd�Zdd� Zdd� ZdS ) r Nc C s || _ || _d S r2 ��typerG )r# Z_typerG r$ r$ r% r& � s zRich_Reject.__init__c C s, d| j rd| j nd| jr$d| j ndf S )Nz reject%s%sz type="%s"r rI rX r6 r$ r$ r% r, � s �zRich_Reject.__str__c C sT | j rP|sttjd��|dv rP| j t| vrPd�t| �}ttjd| j |f ��d S )Nz9When using reject type you must specify also rule family.�Zipv4Zipv6z, z%Wrong reject type %s. Use one of: %s.)rY r r r" r �join)r# �familyZ valid_typesr$ r$ r% rQ � s �zRich_Reject.check)NNrR r$ r$ r$ r% r � s r c @ s e Zd Zdd� ZdS )r c C s d| j rd| j nd S )Nzdrop%srI r rV r6 r$ r$ r% r, � s zRich_Drop.__str__Nr: r$ r$ r$ r% r � s r c @ s& e Zd Zddd�Zdd� Zdd� ZdS ) r Nc C s || _ || _d S r2 ��setrG )r# Z_setrG r$ r$ r% r& � s zRich_Mark.__init__c C s d| j | jrd| j ndf S )Nz mark set=%s%srI r r] r6 r$ r$ r% r, s �zRich_Mark.__str__c C s� | j d ur| j }n ttjd��d|v rr|�d�}t|�dkrHttj|��t�|d �rdt�|d �s�ttj|��nt�|�s�ttj|��d S )Nz no value set�/� r � )r^ r r Z INVALID_MARK�splitrO r Z checkUINT32)r# �x�splitsr$ r$ r% rQ s � zRich_Mark.check)NrR r$ r$ r$ r% r � s r c @ s, e Zd Zdd� Zdd� Zdd� Zdd� Zd S ) r c C sV || _ d| j v rR| j �d�}t|�dkrR|d dv rRd|d |d d d� f | _ d S )Nr_ r` ra )�secondZminuteZhourZdayz%s/%sr )r< rb rO )r# r< rd r$ r$ r% r& s �zRich_Limit.__init__c C s d }d| j v r| j �d�}|r*t|�dkr8ttj| j ��|\}}z t|�}W n ttj| j ��Y n0 |dk sx|dvr�ttj| j ��d}|dkr�d}n(|dkr�d}n|dkr�d }n |d kr�d }d | | d kr�ttjd| j ��|dk�r|d k�rttjd| j ��d S )Nr_ r` ra )�s�m�h�drf rg �< rh i ri i�Q i' r z %s too fastz %s too slow)r< rb rO r r Z INVALID_LIMIT�int)r# rd ZrateZdurationZmultr$ r$ r% rQ ! s: ��zRich_Limit.checkc C s d| j S )Nzlimit value="%s"r; r6 r$ r$ r% r, C s zRich_Limit.__str__c C s dS r@ r$ r6 r$ r$ r% �commandF s zRich_Limit.commandN)r. r/ r0 r& rQ r, rl r$ r$ r$ r% r s "r c @ s> e Zd ZdZdZddd�Zdd� Zd d � Zd d � Zd d� Z dS )r i ���i� Nr c C sV |d urt |�| _nd | _|| _d | _d | _d | _d | _d | _d | _|rR| � |� d S r2 ) �strr\ �priority�source� destination�element�log�audit�action�_import_from_string)r# r\ �rule_strrn r$ r$ r% r& M s zRich_Rule.__init__c C s� g }t �|�D ]j}d|v rj|�d�}t|�dks@|d r@|d sPttjd| ��|�|d |d d�� q|�d|i� q|�ddi� |S ) z Lexical analysis �=r` r ra z internal error in _lexer(): %s)� attr_name� attr_valuerq �EOL)r Z splitArgsrb rO r r r" �append)r# rv �tokens�r�attrr$ r$ r% �_lexer^ s �zRich_Rule._lexerc C s` |st tjd��t�|�}d| _d | _d | _d | _d | _ d | _ d | _ d | _ | � |�}|rv|d �d�dkrvt tjd��i }g }d}|| �d�dkr�|dgk� sT|| �d�}|| �d�}|| �d�}|r�|dvr�t tjd | ��n�|d v �r�|d k�r| j�rt tjd ��n�|d k�r2| j�r2t tjd��n�|dv �r\| j �r\t tjd|| j f ��nh|dv �r|| j �r|t tjd��nH|dk�r�| j �r�t tjd��n(|dv �r�| j �r�t tjd|| j f ��nt tjd| ��t|�dk�r�|t|�d nd} | dk�r�|�sT|�rT|dk�r&t tjd��n,|d k�r>t tjd ��nt tjd ||f ��n*d|v�rtt tjd ||f ��n |�d� �n�| dk�r6|dk�r�|d v�r�t tjd!| ��|| _nz|d k�r�zt|�| _W n$ t�y� t tjd"| ��Y n0 n:|�r(|d#k�rd$} n d%||f } t tj| ��n |�|� �n| d k�r�|d&v �rT|||< nV|d'v �rhd(|d)< nBt|�d*�|�d+�|�d,�|�d)d-��| _|�� |�� |d }�n�| d k�r |d.v �r�|||< nN|d'v �r�d(|d)< n:t|�d*�|�d,�|�d)d-��| _|�� |�� |d }�n,| d#k�rV|d/k�rFt|�| _ |�� n t tjd0���n�| d1k�r�|d/k�rt|||< n(t|�d/��| _ |�� |�� |d }�n�| d2k�r�|d3k�r�t|�| _ |�� n t tjd4���nr| d5k�r*|d6v �r�|||< n0t|�d5�|�d#��| _ |�� |�� |d }�n | d7k�rb|d3k�rRt |�| _ |�� n t tjd8���n�| d9k�r�|d3k�r�t |�| _ |�� n t tjd:���n�| d;k�r�t � | _ |�� |�� |d }�n�| d<k�r*|d=v �r�|||< n@t |�d5�|�d#�|�d>�|�d?��| _ |�� |�� |d }�n | d@k�r||d6v �rH|||< n0t |�d5�|�d#��| _ |�� |�� |d }�n�| dAk�r�|dBv �r�|||< nN|dCk�r�|�dC� n8t!|�dD�|�dE�|�dC��| _ |�� |�� |d }�n^| dFk�rd|dGv �r |||< nV|dCk�r |�dC� n@t"|�dH�|�dD�|�dI�|�dC��| _ |�� |�� |d }�n�| dk�r�|dCk�r�|�dC� n(t#|�dC��| _ |�� |�� |d }�n�| dJk�r�|dCk�r�|�dC� n(t$|�dC��| _ |�� |�� |d }�nN| dKk�rH|dCk�r |�dC� n(t%|�dC��| _ |�� |�� |d }�n| dLk�r�|dMk�rf|||< nF|dCk�r||�dC� n0t&|�dM�|�dC��| _ |�� |�� |d }n�| dNk� r|dOk�r�|||< nF|dCk�r�|�dC� n0t'|�dO�|�dC��| _ |�� |�� |d }n6| dCk� rJ|d/k� r>t(|�|dC< |�� n t tjdP��|d }q�| �)� d S )QNz empty ruler rq rz �rulerx ry )rn r\ �addressr r r! r< r8 r9 �to-port�to-addrr4 rT rE rF � queue-sizerY r^ zbad attribute '%s')r� ro rp r9 �servicer8 � icmp-block� icmp-typer> � forward-port� source-portrr �nflogrs �accept�drop�reject�markrG �not�NOTrz r? ro z more than one 'source' elementrp z#more than one 'destination' element)r9 r� r8 r� r� r> r� r� zFmore than one element. There cannot be both '%s' and '%s' in one rule.)rr r� z more than one logging elementrs z more than one 'audit' element)r� r� r� r� zOmore than one 'action' element. There cannot be both '%s' and '%s' in one rule.zunknown element %sra r r\ z0'family' outside of rule. Use 'rule family=...'.rn z4'priority' outside of rule. Use 'rule priority=...'.z:'%s' outside of any element. Use 'rule <element> %s= ...'.z,'%s' outside of rule. Use 'rule ... %s ...'.rZ zH'family' attribute cannot have '%s' value. Use 'ipv4' or 'ipv6' instead.z(invalid 'priority' attribute value '%s'.r9 zdwrong 'protocol' usage. Use either 'rule protocol value=...' or 'rule [forward-]port protocol=...'.zDattribute '%s' outside of any element. Use 'rule <element> %s= ...'.)r� r r r! )r� r� Tr! r� r r F)r� r r! r< zinvalid 'protocol' elementr? r� r4 zinvalid 'service' elementr8 r7 r� z invalid 'icmp-block' elementr� zinvalid 'icmp-type' elementr> r� )r8 r9 r� r� r� r� r� rr )rE rF rG rE rF r� )rT rE r� rT r� r� r� r� rY r� r^ zinvalid 'limit' element)*r r r" r ZstripNonPrintableCharactersrn r\ ro rp rq rr rs rt r �getrO r{ rk � ValueError�INVALID_PRIORITYr �pop�clearr r r r r r r r r r r r r r r r r r rQ ) r# rv r| �attrsZ in_elements�indexrq rx ry Z in_element�err_msgr$ r$ r% ru o s� �" * " ( ( � z Rich_Rule._import_from_stringc C s� | j d ur"| j dvr"ttj| j ��| j d u rn| jd urB| jjd usL| jd urVttj��t| j �t krnttj��| j | j k s�| j | j kr�ttjd| j | j f ��| j d u �r| jd u s�| jd u�r| j dk�r| jd u r�ttjd��| jd u �r| jd u �r| j dk�rttjd��t| j �tt ttfv�rZ| jd u �rZ| jd u �rZ| jd u �rZttjd��| jd u�rt| jjd u�r�| j d u �r�ttj��| jjd u�r�ttjd��| jjd u�r�ttjd��t�| j | jj��stttjt| jj���n�| jjd u�r6| jjd u�rttjd ��t� | jj��stttj t| jj���n>| jjd u�rht | jj��stttj t| jj���n ttjd ��| jd u�r&| jjd u�r�| j d u �r�ttj��| jjd u�r�ttj d��t�| j | jj��s&ttjt| jj���n>| jjd u�rt | jj��s&ttj t| jj���n ttjd ��t| j �t!k�rn| j j"d u �sVt#| j j"�d k �r�ttj$t| j j"����nRt| j �t%k�r�t�&| j j'��s�ttj(| j j'��| j j)d v�r�ttj*| j j)���n t| j �t+k�r�t�,| j j-��s�ttj*| j j-���n�t| j �tk�rF| jd u�r ttjd��| jd u�r�| jjd u�r�ttjd���nzt| j �tk�r�| j j"d u �svt#| j j"�d k �r�ttj.t| j j"���| j�r�ttjd���n t| j �t/k�r�| j j"d u �s�t#| j j"�d k �r�ttj.t| j j"����n�t| j �t k�r�t�&| j j'��sttj(| j j'��| j j)d v�r8ttj*| j j)��| j j0dk�rd| j j1dk�rdttj(| j j0��| j j0dk�r�t�&| j j0��s�ttj(| j j0��| j j1dk�r�t�2| j | j j1��s�ttj| j j1��| j d u �r�ttj��| jd u�r�ttjd��n�t| j �t3k�rDt�&| j j'��s$ttj(| j j'��| j j)d v�r�ttj*| j j)��n|t| j �tk�r�| jd u�rrttjd| j ��| j j-�r�t�4| j j-��s�ttj| j j-��n"| j d u�r�ttjdt| j � ��| jd u�r�| j�5� | jd u�r$t| j�t6t7t8fv�r ttj9t| j���| jj:d u�r$| jj:�5� | jd u�r�t| j�t7k�rP| j�5| j � nt| j�t;k�rj| j�5� | jj:d u�r�| jj:�5� d S )NrZ z/'priority' attribute must be between %d and %d.r zno element, no actionz%no element, no source, no destinationzno action, no log, no auditzaddress and maczaddress and ipsetz mac and ipsetzinvalid sourcezinvalid destinationra )ZtcpZudpZsctpZdccpzmasquerade and actionzmasquerade and mac sourcezicmp-block and actionr zforward-port and actionz+tcp-mss-clamp and %s are mutually exclusivezUnknown element %s)<r\ r r ZINVALID_FAMILYro r rp ZMISSING_FAMILYrY rq r rn � priority_min� priority_maxr� rr rt r" r r r rs r r r Z check_addressZ INVALID_ADDRrm Z check_macZ INVALID_MACr Z INVALID_IPSETZINVALID_DESTINATIONr r4 rO ZINVALID_SERVICEr Z check_portr8 Z INVALID_PORTr9 ZINVALID_PROTOCOLr Z checkProtocolr< ZINVALID_ICMPTYPEr rB rC Zcheck_single_addressr ZcheckTcpMssClamprQ r r r ZINVALID_AUDIT_TYPErG r r6 r$ r$ r% rQ f s � � ��� $ �� ��� � zRich_Rule.checkc C s� d}| j r|d| j 7 }| jr,|d| j 7 }| jr@|d| j 7 }| jrT|d| j 7 }| jrh|d| j 7 }| jr||d| j 7 }| jr�|d| j 7 }| jr�|d| j 7 }|S )Nr� z priority="%d"z family="%s"rI )rn r\ ro rp rq rr rs rt r* r$ r$ r% r, s$ zRich_Rule.__str__)NNr ) r. r/ r0 r� r� r& r ru rQ r, r$ r$ r$ r% r I s x 0r N) �__all__Zfirewallr Zfirewall.core.ipsetr Zfirewall.core.baser r Zfirewall.errorsr �objectr r r r r r r r r r r r r r r r r r r r r$ r$ r$ r% �<module> s2 1 core/__pycache__/base.cpython-39.opt-1.pyc 0000644 00000002135 15025011705 0014203 0 ustar 00 a ���g � @ sT d Z dZdZdZdddedgZg d�Zd d d d d d�Zg d�g d�d�Zg d�ZdS )zBase firewall settingsz{chain}_{zone}�CONTINUE����ACCEPTz %%REJECT%%�DROP�default)r ZREJECTr r ZPREZPOST�INZFWDZOUT)Z PREROUTINGZ POSTROUTINGZINPUTZFORWARDZOUTPUT)zicmp-host-prohibitedz host-prohibzicmp-net-unreachablez net-unreachzicmp-host-unreachablez host-unreachzicmp-port-unreachable� port-unreachzicmp-proto-unreachablez proto-unreachzicmp-net-prohibitedz net-prohib� tcp-resetztcp-rstzicmp-admin-prohibitedz admin-prohib) zicmp6-adm-prohibitedzadm-prohibitedzicmp6-no-routezno-routezicmp6-addr-unreachablez addr-unreachzicmp6-port-unreachabler r )Zipv4Zipv6)zhash:ipz hash:ip,portz hash:ip,markzhash:netz hash:net,portzhash:net,ifacezhash:macN) �__doc__ZDEFAULT_ZONE_TARGETZDEFAULT_POLICY_TARGETZDEFAULT_POLICY_PRIORITYZ ZONE_TARGETSZPOLICY_TARGETSZ SHORTCUTSZ REJECT_TYPESZSOURCE_IPSET_TYPES� r r �6/usr/lib/python3.9/site-packages/firewall/core/base.py�<module> s" �� � core/__pycache__/rich.cpython-39.opt-1.pyc 0000644 00000051466 15025011705 0014231 0 ustar 00 a ���gK� � @ s� g d �Z ddlmZ ddlmZ ddlmZ ddlmZ ddlm Z G dd� de �Z G d d � d e �Z G d d � d e �Z G d d� de �ZG dd� de�ZG dd� de �ZG dd� de �ZG dd� de �ZG dd� de �ZG dd� de �ZG dd � d e �ZG d d � d e �ZG d d � d e �ZG d!d"� d"e �ZG d#d$� d$e �ZG d%d&� d&e �ZG d'd(� d(e�ZG d)d*� d*e �Z G d+d,� d,e �Z G d-d.� d.e �Z d/S )0)� Rich_Source�Rich_Destination� Rich_Service� Rich_Port� Rich_Protocol�Rich_Masquerade�Rich_IcmpBlock� Rich_IcmpType�Rich_SourcePort�Rich_ForwardPort�Rich_Log� Rich_NFLog� Rich_Accept� Rich_Reject� Rich_Drop� Rich_Mark� Rich_Audit� Rich_Limit� Rich_Rule�Rich_Tcp_Mss_Clamp� )� functions)�check_ipset_name)� REJECT_TYPES)�errors)� FirewallErrorc @ s e Zd Zddd�Zdd� ZdS )r Fc C s� || _ | j dkrd | _ || _| jdks0| jd u r8d | _n| jd urN| j�� | _|| _| jdkrdd | _|| _| j d u r�| jd u r�| jd u r�ttjd��d S )N� �no address, mac and ipset)�addr�mac�upper�ipset�invertr r � INVALID_RULE)�selfr r r r! � r$ �6/usr/lib/python3.9/site-packages/firewall/core/rich.py�__init__$ s �zRich_Source.__init__c C sj d| j r dnd }| jd ur*|d| j S | jd urB|d| j S | jd urZ|d| j S ttjd��d S )Nz source%s � NOTr � address="%s"zmac="%s"� ipset="%s"r )r! r r r r r r" �r# �retr$ r$ r% �__str__5 s �zRich_Source.__str__N)F��__name__� __module__� __qualname__r& r, r$ r$ r$ r% r # s r c @ s e Zd Zddd�Zdd� ZdS )r Fc C sV || _ | j dkrd | _ || _| jdkr,d | _|| _| j d u rR| jd u rRttjd��d S )Nr �no address and ipset)r r r! r r r" )r# r r r! r$ r$ r% r& A s �zRich_Destination.__init__c C sR d| j r dnd }| jd ur*|d| j S | jd urB|d| j S ttjd��d S )Nzdestination%s r' r r( r) r1 )r! r r r r r" r* r$ r$ r% r, M s �zRich_Destination.__str__N)Fr- r$ r$ r$ r% r @ s r c @ s e Zd Zdd� Zdd� ZdS )r c C s || _ d S �N��name�r# r4 r$ r$ r% r& W s zRich_Service.__init__c C s d| j S )Nzservice name="%s"r3 �r# r$ r$ r% r, Z s zRich_Service.__str__Nr- r$ r$ r$ r% r V s r c @ s e Zd Zdd� Zdd� ZdS )r c C s || _ || _d S r2 ��port�protocol)r# r8 r9 r$ r$ r% r& ^ s zRich_Port.__init__c C s d| j | jf S )Nz port port="%s" protocol="%s"r7 r6 r$ r$ r% r, b s zRich_Port.__str__Nr- r$ r$ r$ r% r ] s r c @ s e Zd Zdd� ZdS )r c C s d| j | jf S )Nz#source-port port="%s" protocol="%s"r7 r6 r$ r$ r% r, f s �zRich_SourcePort.__str__N�r. r/ r0 r, r$ r$ r$ r% r e s r c @ s e Zd Zdd� Zdd� ZdS )r c C s || _ d S r2 ��value�r# r< r$ r$ r% r& k s zRich_Protocol.__init__c C s d| j S )Nzprotocol value="%s"r; r6 r$ r$ r% r, n s zRich_Protocol.__str__Nr- r$ r$ r$ r% r j s r c @ s e Zd Zdd� Zdd� ZdS )r c C s d S r2 r$ r6 r$ r$ r% r& r s zRich_Masquerade.__init__c C s dS )N� masquerader$ r6 r$ r$ r% r, u s zRich_Masquerade.__str__Nr- r$ r$ r$ r% r q s r c @ s e Zd Zdd� Zdd� ZdS )r c C s || _ d S r2 r3 r5 r$ r$ r% r& y s zRich_IcmpBlock.__init__c C s d| j S )Nzicmp-block name="%s"r3 r6 r$ r$ r% r, | s zRich_IcmpBlock.__str__Nr- r$ r$ r$ r% r x s r c @ s e Zd Zdd� Zdd� ZdS )r c C s || _ d S r2 r3 r5 r$ r$ r% r& � s zRich_IcmpType.__init__c C s d| j S )Nzicmp-type name="%s"r3 r6 r$ r$ r% r, � s zRich_IcmpType.__str__Nr- r$ r$ r$ r% r s r c @ s e Zd Zdd� Zdd� ZdS )r c C s || _ d S r2 r; r= r$ r$ r% r& � s zRich_Tcp_Mss_Clamp.__init__c C s | j rd| j S dS d S )Nztcp-mss-clamp value="%s"� tcp-mss-clampr; r6 r$ r$ r% r, � s zRich_Tcp_Mss_Clamp.__str__Nr- r$ r$ r$ r% r � s r c @ s e Zd Zdd� Zdd� ZdS )r c C s< || _ || _|| _|| _| jd u r(d| _| jd u r8d| _d S �Nr �r8 r9 �to_port� to_address)r# r8 r9 rB rC r$ r$ r% r& � s zRich_ForwardPort.__init__c C s< d| j | j| jdkr d| j nd| jdkr4d| j ndf S )Nz(forward-port port="%s" protocol="%s"%s%sr z to-port="%s"z to-addr="%s"rA r6 r$ r$ r% r, � s ��zRich_ForwardPort.__str__Nr- r$ r$ r$ r% r � s r c @ s& e Zd Zddd�Zdd� Zdd� ZdS ) r Nc C s || _ || _|| _d S r2 ��prefix�level�limit)r# rE rF rG r$ r$ r% r& � s zRich_Log.__init__c C s> d| j rd| j nd| jr$d| j nd| jr6d| j ndf S )Nz log%s%s%s� prefix="%s"r z level="%s"� %srD r6 r$ r$ r% r, � s ��zRich_Log.__str__c C sV | j r t| j �dkr ttjd��| jr>| jdvr>ttj| j��| jd urR| j�� d S )N� �+maximum accepted length of 'prefix' is 127.)ZemergZalertZcrit�errorZwarningZnotice�info�debug) rE �lenr r �INVALID_LOG_PREFIXrF ZINVALID_LOG_LEVELrG �checkr6 r$ r$ r% rQ � s � zRich_Log.check)NNN�r. r/ r0 r& r, rQ r$ r$ r$ r% r � s r c @ s& e Zd Zddd�Zdd� Zdd� ZdS ) r Nc C s || _ || _|| _|| _d S r2 ��grouprE � thresholdrG )r# rT rE Z queue_sizerG r$ r$ r% r& � s zRich_NFLog.__init__c C sP d| j rd| j nd| jr$d| j nd| jr6d| j nd| jrHd| j ndf S )Nz nflog%s%s%s%sz group="%s"r rH z queue-size="%s"rI rS r6 r$ r$ r% r, � s ��zRich_NFLog.__str__c C st | j r t�| j �s ttjd��| jr>t| j�dkr>ttjd��| j r\t�| j �s\ttj d��| j d urp| j � � d S )Nz5nflog 'group' must be an integer between 0 and 65535.rJ rK z:nflog 'queue-size' must be an integer between 0 and 65535.) rT r Z checkUINT16r r ZINVALID_NFLOG_GROUPrE rO rP rU ZINVALID_NFLOG_QUEUErG rQ r6 r$ r$ r% rQ � s zRich_NFLog.check)NNNNrR r$ r$ r$ r% r � s r c @ s e Zd Zddd�Zdd� ZdS )r Nc C s || _ d S r2 �rG �r# rG r$ r$ r% r& � s zRich_Audit.__init__c C s d| j rd| j nd S )Nzaudit%srI r rV r6 r$ r$ r% r, � s zRich_Audit.__str__)Nr- r$ r$ r$ r% r � s r c @ s e Zd Zddd�Zdd� ZdS )r Nc C s || _ d S r2 rV rW r$ r$ r% r& � s zRich_Accept.__init__c C s d| j rd| j nd S )Nzaccept%srI r rV r6 r$ r$ r% r, � s zRich_Accept.__str__)Nr- r$ r$ r$ r% r � s r c @ s& e Zd Zddd�Zdd� Zdd� ZdS ) r Nc C s || _ || _d S r2 ��typerG )r# Z_typerG r$ r$ r% r& � s zRich_Reject.__init__c C s, d| j rd| j nd| jr$d| j ndf S )Nz reject%s%sz type="%s"r rI rX r6 r$ r$ r% r, � s �zRich_Reject.__str__c C sT | j rP|sttjd��|dv rP| j t| vrPd�t| �}ttjd| j |f ��d S )Nz9When using reject type you must specify also rule family.�Zipv4Zipv6z, z%Wrong reject type %s. Use one of: %s.)rY r r r" r �join)r# �familyZ valid_typesr$ r$ r% rQ � s �zRich_Reject.check)NNrR r$ r$ r$ r% r � s r c @ s e Zd Zdd� ZdS )r c C s d| j rd| j nd S )Nzdrop%srI r rV r6 r$ r$ r% r, � s zRich_Drop.__str__Nr: r$ r$ r$ r% r � s r c @ s& e Zd Zddd�Zdd� Zdd� ZdS ) r Nc C s || _ || _d S r2 ��setrG )r# Z_setrG r$ r$ r% r& � s zRich_Mark.__init__c C s d| j | jrd| j ndf S )Nz mark set=%s%srI r r] r6 r$ r$ r% r, s �zRich_Mark.__str__c C s� | j d ur| j }n ttjd��d|v rr|�d�}t|�dkrHttj|��t�|d �rdt�|d �s�ttj|��nt�|�s�ttj|��d S )Nz no value set�/� r � )r^ r r Z INVALID_MARK�splitrO r Z checkUINT32)r# �x�splitsr$ r$ r% rQ s � zRich_Mark.check)NrR r$ r$ r$ r% r � s r c @ s, e Zd Zdd� Zdd� Zdd� Zdd� Zd S ) r c C sV || _ d| j v rR| j �d�}t|�dkrR|d dv rRd|d |d d d� f | _ d S )Nr_ r` ra )�secondZminuteZhourZdayz%s/%sr )r< rb rO )r# r< rd r$ r$ r% r& s �zRich_Limit.__init__c C s d }d| j v r| j �d�}|r*t|�dkr8ttj| j ��|\}}z t|�}W n ttj| j ��Y n0 |dk sx|dvr�ttj| j ��d}|dkr�d}n(|dkr�d}n|dkr�d }n |d kr�d }d | | d kr�ttjd| j ��|dk�r|d k�rttjd| j ��d S )Nr_ r` ra )�s�m�h�drf rg �< rh i ri i�Q i' r z %s too fastz %s too slow)r< rb rO r r Z INVALID_LIMIT�int)r# rd ZrateZdurationZmultr$ r$ r% rQ ! s: ��zRich_Limit.checkc C s d| j S )Nzlimit value="%s"r; r6 r$ r$ r% r, C s zRich_Limit.__str__c C s dS r@ r$ r6 r$ r$ r% �commandF s zRich_Limit.commandN)r. r/ r0 r& rQ r, rl r$ r$ r$ r% r s "r c @ s> e Zd ZdZdZddd�Zdd� Zd d � Zd d � Zd d� Z dS )r i ���i� Nr c C sV |d urt |�| _nd | _|| _d | _d | _d | _d | _d | _d | _|rR| � |� d S r2 ) �strr\ �priority�source� destination�element�log�audit�action�_import_from_string)r# r\ �rule_strrn r$ r$ r% r& M s zRich_Rule.__init__c C s� g }t �|�D ]j}d|v rj|�d�}t|�dks@|d r@|d sPttjd| ��|�|d |d d�� q|�d|i� q|�ddi� |S ) z Lexical analysis �=r` r ra z internal error in _lexer(): %s)� attr_name� attr_valuerq �EOL)r Z splitArgsrb rO r r r" �append)r# rv �tokens�r�attrr$ r$ r% �_lexer^ s �zRich_Rule._lexerc C s` |st tjd��t�|�}d| _d | _d | _d | _d | _ d | _ d | _ d | _ | � |�}|rv|d �d�dkrvt tjd��i }g }d}|| �d�dkr�|dgk� sT|| �d�}|| �d�}|| �d�}|r�|dvr�t tjd | ��n�|d v �r�|d k�r| j�rt tjd ��n�|d k�r2| j�r2t tjd��n�|dv �r\| j �r\t tjd|| j f ��nh|dv �r|| j �r|t tjd��nH|dk�r�| j �r�t tjd��n(|dv �r�| j �r�t tjd|| j f ��nt tjd| ��t|�dk�r�|t|�d nd} | dk�r�|�sT|�rT|dk�r&t tjd��n,|d k�r>t tjd ��nt tjd ||f ��n*d|v�rtt tjd ||f ��n |�d� �n�| dk�r6|dk�r�|d v�r�t tjd!| ��|| _nz|d k�r�zt|�| _W n$ t�y� t tjd"| ��Y n0 n:|�r(|d#k�rd$} n d%||f } t tj| ��n |�|� �n| d k�r�|d&v �rT|||< nV|d'v �rhd(|d)< nBt|�d*�|�d+�|�d,�|�d)d-��| _|�� |�� |d }�n�| d k�r |d.v �r�|||< nN|d'v �r�d(|d)< n:t|�d*�|�d,�|�d)d-��| _|�� |�� |d }�n,| d#k�rV|d/k�rFt|�| _ |�� n t tjd0���n�| d1k�r�|d/k�rt|||< n(t|�d/��| _ |�� |�� |d }�n�| d2k�r�|d3k�r�t|�| _ |�� n t tjd4���nr| d5k�r*|d6v �r�|||< n0t|�d5�|�d#��| _ |�� |�� |d }�n | d7k�rb|d3k�rRt |�| _ |�� n t tjd8���n�| d9k�r�|d3k�r�t |�| _ |�� n t tjd:���n�| d;k�r�t � | _ |�� |�� |d }�n�| d<k�r*|d=v �r�|||< n@t |�d5�|�d#�|�d>�|�d?��| _ |�� |�� |d }�n | d@k�r||d6v �rH|||< n0t |�d5�|�d#��| _ |�� |�� |d }�n�| dAk�r�|dBv �r�|||< nN|dCk�r�|�dC� n8t!|�dD�|�dE�|�dC��| _ |�� |�� |d }�n^| dFk�rd|dGv �r |||< nV|dCk�r |�dC� n@t"|�dH�|�dD�|�dI�|�dC��| _ |�� |�� |d }�n�| dk�r�|dCk�r�|�dC� n(t#|�dC��| _ |�� |�� |d }�n�| dJk�r�|dCk�r�|�dC� n(t$|�dC��| _ |�� |�� |d }�nN| dKk�rH|dCk�r |�dC� n(t%|�dC��| _ |�� |�� |d }�n| dLk�r�|dMk�rf|||< nF|dCk�r||�dC� n0t&|�dM�|�dC��| _ |�� |�� |d }n�| dNk� r|dOk�r�|||< nF|dCk�r�|�dC� n0t'|�dO�|�dC��| _ |�� |�� |d }n6| dCk� rJ|d/k� r>t(|�|dC< |�� n t tjdP��|d }q�| �)� d S )QNz empty ruler rq rz �rulerx ry )rn r\ �addressr r r! r< r8 r9 �to-port�to-addrr4 rT rE rF � queue-sizerY r^ zbad attribute '%s')r� ro rp r9 �servicer8 � icmp-block� icmp-typer> � forward-port� source-portrr �nflogrs �accept�drop�reject�markrG �not�NOTrz r? ro z more than one 'source' elementrp z#more than one 'destination' element)r9 r� r8 r� r� r> r� r� zFmore than one element. There cannot be both '%s' and '%s' in one rule.)rr r� z more than one logging elementrs z more than one 'audit' element)r� r� r� r� zOmore than one 'action' element. There cannot be both '%s' and '%s' in one rule.zunknown element %sra r r\ z0'family' outside of rule. Use 'rule family=...'.rn z4'priority' outside of rule. Use 'rule priority=...'.z:'%s' outside of any element. Use 'rule <element> %s= ...'.z,'%s' outside of rule. Use 'rule ... %s ...'.rZ zH'family' attribute cannot have '%s' value. Use 'ipv4' or 'ipv6' instead.z(invalid 'priority' attribute value '%s'.r9 zdwrong 'protocol' usage. Use either 'rule protocol value=...' or 'rule [forward-]port protocol=...'.zDattribute '%s' outside of any element. Use 'rule <element> %s= ...'.)r� r r r! )r� r� Tr! r� r r F)r� r r! r< zinvalid 'protocol' elementr? r� r4 zinvalid 'service' elementr8 r7 r� z invalid 'icmp-block' elementr� zinvalid 'icmp-type' elementr> r� )r8 r9 r� r� r� r� r� rr )rE rF rG rE rF r� )rT rE r� rT r� r� r� r� rY r� r^ zinvalid 'limit' element)*r r r" r ZstripNonPrintableCharactersrn r\ ro rp rq rr rs rt r �getrO r{ rk � ValueError�INVALID_PRIORITYr �pop�clearr r r r r r r r r r r r r r r r r r rQ ) r# rv r| �attrsZ in_elements�indexrq rx ry Z in_element�err_msgr$ r$ r% ru o s� �" * " ( ( � z Rich_Rule._import_from_stringc C s� | j d ur"| j dvr"ttj| j ��| j d u rn| jd urB| jjd usL| jd urVttj��t| j �t krnttj��| j | j k s�| j | j kr�ttjd| j | j f ��| j d u �r| jd u s�| jd u�r| j dk�r| jd u r�ttjd��| jd u �r| jd u �r| j dk�rttjd��t| j �tt ttfv�rZ| jd u �rZ| jd u �rZ| jd u �rZttjd��| jd u�rt| jjd u�r�| j d u �r�ttj��| jjd u�r�ttjd��| jjd u�r�ttjd��t�| j | jj��stttjt| jj���n�| jjd u�r6| jjd u�rttjd ��t� | jj��stttj t| jj���n>| jjd u�rht | jj��stttj t| jj���n ttjd ��| jd u�r&| jjd u�r�| j d u �r�ttj��| jjd u�r�ttj d��t�| j | jj��s&ttjt| jj���n>| jjd u�rt | jj��s&ttj t| jj���n ttjd ��t| j �t!k�rn| j j"d u �sVt#| j j"�d k �r�ttj$t| j j"����nRt| j �t%k�r�t�&| j j'��s�ttj(| j j'��| j j)d v�r�ttj*| j j)���n t| j �t+k�r�t�,| j j-��s�ttj*| j j-���n�t| j �tk�rF| jd u�r ttjd��| jd u�r�| jjd u�r�ttjd���nzt| j �tk�r�| j j"d u �svt#| j j"�d k �r�ttj.t| j j"���| j�r�ttjd���n t| j �t/k�r�| j j"d u �s�t#| j j"�d k �r�ttj.t| j j"����n�t| j �t k�r�t�&| j j'��sttj(| j j'��| j j)d v�r8ttj*| j j)��| j j0dk�rd| j j1dk�rdttj(| j j0��| j j0dk�r�t�&| j j0��s�ttj(| j j0��| j j1dk�r�t�2| j | j j1��s�ttj| j j1��| j d u �r�ttj��| jd u�r�ttjd��n�t| j �t3k�rDt�&| j j'��s$ttj(| j j'��| j j)d v�r�ttj*| j j)��n|t| j �tk�r�| jd u�rrttjd| j ��| j j-�r�t�4| j j-��s�ttj| j j-��n"| j d u�r�ttjdt| j � ��| jd u�r�| j�5� | jd u�r$t| j�t6t7t8fv�r ttj9t| j���| jj:d u�r$| jj:�5� | jd u�r�t| j�t7k�rP| j�5| j � nt| j�t;k�rj| j�5� | jj:d u�r�| jj:�5� d S )NrZ z/'priority' attribute must be between %d and %d.r zno element, no actionz%no element, no source, no destinationzno action, no log, no auditzaddress and maczaddress and ipsetz mac and ipsetzinvalid sourcezinvalid destinationra )ZtcpZudpZsctpZdccpzmasquerade and actionzmasquerade and mac sourcezicmp-block and actionr zforward-port and actionz+tcp-mss-clamp and %s are mutually exclusivezUnknown element %s)<r\ r r ZINVALID_FAMILYro r rp ZMISSING_FAMILYrY rq r rn � priority_min� priority_maxr� rr rt r" r r r rs r r r Z check_addressZ INVALID_ADDRrm Z check_macZ INVALID_MACr Z INVALID_IPSETZINVALID_DESTINATIONr r4 rO ZINVALID_SERVICEr Z check_portr8 Z INVALID_PORTr9 ZINVALID_PROTOCOLr Z checkProtocolr< ZINVALID_ICMPTYPEr rB rC Zcheck_single_addressr ZcheckTcpMssClamprQ r r r ZINVALID_AUDIT_TYPErG r r6 r$ r$ r% rQ f s � � ��� $ �� ��� � zRich_Rule.checkc C s� d}| j r|d| j 7 }| jr,|d| j 7 }| jr@|d| j 7 }| jrT|d| j 7 }| jrh|d| j 7 }| jr||d| j 7 }| jr�|d| j 7 }| jr�|d| j 7 }|S )Nr� z priority="%d"z family="%s"rI )rn r\ ro rp rq rr rs rt r* r$ r$ r% r, s$ zRich_Rule.__str__)NNr ) r. r/ r0 r� r� r& r ru rQ r, r$ r$ r$ r% r I s x 0r N) �__all__Zfirewallr Zfirewall.core.ipsetr Zfirewall.core.baser r Zfirewall.errorsr �objectr r r r r r r r r r r r r r r r r r r r r$ r$ r$ r% �<module> s2 1 core/__pycache__/__init__.cpython-39.pyc 0000644 00000000225 15025011705 0014067 0 ustar 00 a ���g � @ s d S )N� r r r �:/usr/lib/python3.9/site-packages/firewall/core/__init__.py�<module> � core/__pycache__/logger.cpython-39.pyc 0000644 00000054466 15025011705 0013627 0 ustar 00 a ���g?y � @ s� g d �Z ddlZddlZddlZddlZddlZddlZddlZddlZddl Z ddl Z G dd� de �Z G dd� de �Z G dd� de �ZG d d � d e �ZG d d � d e �ZG d d� de �Ze� ZdS ))� LogTarget�FileLog�Logger�log� Nc @ s2 e Zd ZdZdd� Zd dd�Zdd� Zd d � Zd S ) r z% Abstract class for logging targets. c C s d | _ d S �N)�fd��self� r �8/usr/lib/python3.9/site-packages/firewall/core/logger.py�__init__( s zLogTarget.__init__r c C s t d��d S )Nz%LogTarget.write is an abstract method��NotImplementedError�r �data�level�logger�is_debugr r r �write+ s zLogTarget.writec C s t d��d S )Nz%LogTarget.flush is an abstract methodr r r r r �flush. s zLogTarget.flushc C s t d��d S )Nz%LogTarget.close is an abstract methodr r r r r �close1 s zLogTarget.closeN)r )�__name__� __module__� __qualname__�__doc__r r r r r r r r r & s r c @ s. e Zd Zdd� Zd dd�Zdd� Zdd � Zd S ) � _StdoutLogc C s t �| � tj| _d S r )r r �sys�stdoutr r r r r r 8 s z_StdoutLog.__init__r c C s | j �|� | �� d S r )r r r r r r r r < s z_StdoutLog.writec C s | � � d S r )r r r r r r A s z_StdoutLog.closec C s | j �� d S r �r r r r r r r D s z_StdoutLog.flushN)r �r r r r r r r r r r r r 7 s r c @ s e Zd Zdd� ZdS )� _StderrLogc C s t �| � tj| _d S r )r r r �stderrr r r r r r K s z_StderrLog.__init__N)r r r r r r r r r J s r c @ s. e Zd Zdd� Zd dd�Zdd� Zdd � Zd S ) � _SyslogLogc C s. t �| � t�tj�tjd �tj tj � d S )Nr ) r r �syslogZopenlog�os�path�basenamer �argvZLOG_PIDZ LOG_DAEMONr r r r r S s �z_SyslogLog.__init__r c C s� d }|rt j}nF||jkr"t j}n4||jkr4t j}n"||jkrFt j}n||jkrVt j }|� d�rt|d t |�d � }t |�dkr�|d u r�t � |� n t � ||� d S )N� � r ) r# Z LOG_DEBUG�INFO1ZLOG_INFO�WARNINGZ LOG_WARNING�ERRORZLOG_ERR�FATALZLOG_CRIT�endswith�len)r r r r r �priorityr r r r a s" z_SyslogLog.writec C s t �� d S r )r# Zcloselogr r r r r w s z_SyslogLog.closec C s d S r r r r r r r z s z_SyslogLog.flushN)r r r r r r r" R s r" c @ s< e Zd ZdZddd�Zdd� Zddd �Zd d � Zd d � ZdS )r z< FileLog class. File will be opened on the first write. �wc C s t �| � || _|| _d S r )r r �filename�mode)r r2 r3 r r r r � s zFileLog.__init__c C sv | j r d S tjtjB }| j�d�r,|tjO }t�| j|d�| _ t� | j d� t� | j | j�| _ t � | j t j t j � d S )N�ai� )r r$ �O_CREAT�O_WRONLYr3 � startswith�O_APPEND�openr2 �fchmod�fdopen�fcntlZF_SETFDZ FD_CLOEXEC)r �flagsr r r r9 � s z FileLog.openr c C s( | j s| �� | j �|� | j �� d S r )r r9 r r r r r r r � s z FileLog.writec C s | j s d S | j �� d | _ d S r )r r r r r r r � s z FileLog.closec C s | j s d S | j �� d S r r r r r r r � s z FileLog.flushN)r1 )r ) r r r r r r9 r r r r r r r r s r c @ s� e Zd ZdZdZdZdZdZdZdZ e � Z e � Z e� Zd\d d �Zd d � Zd]dd�Zd^dd�Zd_dd�Zd`dd�Zdd� Zdd� Zdd � Zd d � Zd d � Zd!d"� Zed#fd$d%�Z ed#fd&d'�Z ed#fd(d)�Z ed#fd*d+�Z ed#fd,d-�Z ed#fd.d/�Z!d0d1� Z"d2d3� Z#d4d5� Z$d6d7� Z%d8d9� Z&d:d;� Z'd<d=� Z(d>d?� Z)d@dA� Z*dBdC� Z+dDdE� Z,dadFdG�Z-dHdI� Z.dbdJdK�Z/ed#dfdLdM�Z0ed#dfdNdO�Z1ed#dfdPdQ�Z2dcdRdS�Z3dTdU� Z4dVdW� Z5dXdY� Z6dddZd[�Z7d#S )er aL Format string: %(class)s Calling class the function belongs to, else empty %(date)s Date using Logger.date_format, see time module %(domain)s Full Domain: %(module)s.%(class)s.%(function)s %(file)s Filename of the module %(function)s Function name, empty in __main__ %(label)s Label according to log function call from Logger.label %(level)d Internal logging level %(line)d Line number in module %(module)s Module name %(message)s Log message Standard levels: FATAL Fatal error messages ERROR Error messages WARNING Warning messages INFOx, x in [1..5] Information DEBUGy, y in [1..10] Debug messages NO_INFO No info output NO_DEBUG No debug output INFO_MAX Maximum info level DEBUG_MAX Maximum debug level x and y depend on info_max and debug_max from Logger class initialization. See __init__ function. Default logging targets: stdout Logs to stdout stderr Logs to stderr syslog Logs to syslog Additional arguments for logging functions (fatal, error, warning, info and debug): nl Disable newline at the end with nl=0, default is nl=1. fmt Format string for this logging entry, overloads global format string. Example: fmt="%(file)s:%(line)d %(message)s" nofmt Only output message with nofmt=1. The nofmt argument wins over the fmt argument. Example: from logger import log log.setInfoLogLevel(log.INFO1) log.setDebugLogLevel(log.DEBUG1) for i in range(1, log.INFO_MAX+1): log.setInfoLogLabel(i, "INFO%d: " % i) log.setFormat("%(date)s %(module)s:%(line)d [%(domain)s] %(label)s: " "%(level)d %(message)s") log.setDateFormat("%Y-%m-%d %H:%M:%S") fl = FileLog("/tmp/log", "a") log.addInfoLogging("*", fl) log.addDebugLogging("*", fl) log.addInfoLogging("*", log.syslog, fmt="%(label)s%(message)s") log.debug3("debug3") log.debug2("debug2") log.debug1("debug1") log.info2("info2") log.info1("info1") log.warning("warning\n", nl=0) log.error("error\n", nl=0) log.fatal("fatal") log.info(log.INFO1, "nofmt info", nofmt=1) ���������������r � � c C s� i | _ i | _d| _d| _i | _i | _i | _i | _i | _i | _ |dk rPt d| ��|dk rdt d| ��| j | _ || _ d| _|| _| �| jd� | �| jd� | �| jd� | �| j d� td| j d �D ]:}t| d | |� | �|d� t| d | d d � | |�� q�td| jd �D ]@}t| d | |� | �|d| � t| d| dd � | |�� �q| �| j� | �| j� | �d� | �d� | � d| j | j| j| j g� | � d| j dd� t| j| j d �D �� | � d| j dd� td| jd �D �� dS )z Logger class initialization � r) z Logger: info_max %d is too lowr z Logger: debug_max %d is too lowz FATAL ERROR: zERROR: z WARNING: zINFO%dzinfo%dc s � �fdd�S )Nc s � j �| g|�R i |��S r )�info��message�args�kwargs�r �xr r �<lambda> s �3Logger.__init__.<locals>.<lambda>.<locals>.<lambda>r rK r rK r rM s z!Logger.__init__.<locals>.<lambda>zDEBUG%dz DEBUG%d: zdebug%dc s � �fdd�S )Nc s � j �| g|�R i |��S r )�debugrG rK r r rM ) s rN r rK r rK r rM ( s z%(label)s%(message)sz%d %b %Y %H:%M:%S�*c S s g | ]}|�qS r r ��.0�ir r r � <listcomp>4 � z#Logger.__init__.<locals>.<listcomp>c S s g | ]}|�qS r r rQ r r r rT 6 rU N) �_level� _debug_level�_format� _date_format�_label� _debug_label�_logging�_debug_logging�_domains�_debug_domains� ValueErrorr+ �NO_INFO�INFO_MAX�NO_DEBUG� DEBUG_MAX�setInfoLogLabelr- � TRACEBACKr, �range�setattr�setDebugLogLabel�setInfoLogLevelr* �setDebugLogLevel� setFormat� setDateFormat�setInfoLoggingr! r �setDebugLogging)r Zinfo_maxZ debug_maxrV r r r r � sf �� �� � � �zLogger.__init__c C sF t | j| jd �D ].}|| jvr"q| j| D ]\}}}|�� q,qdS )z Close all logging targets r) N)rg r- rd r\ r )r r �dummy�targetr r r r 8 s z Logger.closerP c C s$ | � |� || jv r | j| S | jS )z Get info log level. )� _checkDomainrV �NOTHING�r �domainr r r �getInfoLogLevel@ s zLogger.getInfoLogLevelc C s8 | � |� || jk r| j}|| jkr*| j}|| j|< dS )z% Set log level [NOTHING .. INFO_MAX] N)rr rs rb rV �r r ru r r r rj G s zLogger.setInfoLogLevelc C s* | � |� || jv r$| j| | j S | jS )z Get debug log level. )rr rW rc rt r r r �getDebugLogLevelP s zLogger.getDebugLogLevelc C s: | � |� |dk rd}|| jkr&| j}|| j | j|< dS )z- Set debug log level [NO_DEBUG .. DEBUG_MAX] r N)rr rd rc rW rw r r r rk W s zLogger.setDebugLogLevelc C s | j S r �rX r r r r � getFormat` s zLogger.getFormatc C s || _ d S r ry �r rX r r r rl c s zLogger.setFormatc C s | j S r �rY r r r r � getDateFormatf s zLogger.getDateFormatc C s || _ d S r r| r{ r r r rm i s zLogger.setDateFormatc C s6 | � |�}|D ]"}| j|| j| jd� || j|< qdS )�U Set log label for level. Level can be a single level or an array of levels. �� min_level� max_levelN)� _getLevels�_checkLogLevelr- rb rZ �r r �label�levelsr r r re l s �zLogger.setInfoLogLabelc C s: | j |dd�}|D ]"}| j|| j| jd� || j|< qdS )r~ r) �r r N)r� r� r* rd r[ r� r r r ri u s �zLogger.setDebugLogLabelNc C s | j ||||dd� dS )z� Set info log target for domain and level. Level can be a single level or an array of levels. Use level ALL to set for all levels. If no format is specified, the default format will be used. r r� N�� _setLogging�r ru rq r �fmtr r r rn ~ s zLogger.setInfoLoggingc C s | j ||||dd� dS )z� Set debug log target for domain and level. Level can be a single level or an array of levels. Use level ALL to set for all levels. If no format is specified, the default format will be used. r) r� Nr� r� r r r ro � s zLogger.setDebugLoggingc C s | j ||||dd� dS )z� Add info log target for domain and level. Level can be a single level or an array of levels. Use level ALL to set for all levels. If no format is specified, the default format will be used. r r� N�� _addLoggingr� r r r �addInfoLogging� s zLogger.addInfoLoggingc C s | j ||||dd� dS )z� Add debg log target for domain and level. Level can be a single level or an array of levels. Use level ALL to set for all levels. If no format is specified, the default format will be used. r) r� Nr� r� r r r �addDebugLogging� s zLogger.addDebugLoggingc C s | j ||||dd� dS )z� Delete info log target for domain and level. Level can be a single level or an array of levels. Use level ALL to set for all levels. If no format is specified, the default format will be used. r r� N�� _delLoggingr� r r r �delInfoLogging� s zLogger.delInfoLoggingc C s | j ||||dd� dS )z� Delete debug log target for domain and level. Level can be a single level or an array of levels. Use level ALL to set for all levels. If no format is specified, the default format will be used. r) r� Nr� r� r r r �delDebugLogging� s zLogger.delDebugLoggingc C s | j |dd�S )zN Is there currently any info logging for this log level (and domain)? r r� ��_isLoggingHere�r r r r r �isInfoLoggingHere� s zLogger.isInfoLoggingHerec C s | j |dd�S )zO Is there currently any debug logging for this log level (and domain)? r) r� r� r� r r r �isDebugLoggingHere� s zLogger.isDebugLoggingHerec O s2 | � |� d|d< | j| j|g|�R i |�� dS )z Fatal error log. r r N)� _checkKWargs�_logr- �r rX rI rJ r r r �fatal� s z Logger.fatalc O s2 | � |� d|d< | j| j|g|�R i |�� dS )z Error log. r r N)r� r� r, r� r r r �error� s z Logger.errorc O s2 | � |� d|d< | j| j|g|�R i |�� dS )z Warning log. r r N)r� r� r+ r� r r r �warning� s zLogger.warningc O sH | j |d| jd� | �|� d|d< | j|| j |g|�R i |�� dS )z� Information log using info level [1..info_max]. There are additional infox functions according to info_max from __init__r) r r r N)r� rb r� r� ra �r r rX rI rJ r r r rF � s z Logger.infoc O sB | j |d| jd� | �|� d|d< | j||g|�R i |�� dS )z� Debug log using debug level [1..debug_max]. There are additional debugx functions according to debug_max from __init__r) r r N)r� rd r� r� r� r r r rO � s z Logger.debugc C s | j | jt�� g i d� d S )N)rI rJ )r� rf � traceback� format_excr r r r � exception� s zLogger.exceptionc C s& ||k s||kr"t d|||f ��d S )Nz*Level %d out of range, should be [%d..%d].�r` )r r r� r� r r r r� � s �zLogger._checkLogLevelc C s. |sd S |� � D ]}|dvrtd| ��qd S )N)�nlr� �nofmtz0Key '%s' is not allowed as argument for logging.)�keysr` )r rJ �keyr r r r� � s zLogger._checkKWargsc C s |r |dkrt d| ��d S )NrE zDomain '%s' is not valid.r� rt r r r rr � s zLogger._checkDomainc C s� || j krbt|t�s t|t�r$|}n|g}|D ]0}|rJ| j|d| jd� q.| j|| j| jd� q.n6|r�dd� t| j | j�D �}ndd� t| j| j�D �}|S )z Generate log level array. r) r c S s g | ]}|�qS r r rQ r r r rT � rU z%Logger._getLevels.<locals>.<listcomp>c S s g | ]}|�qS r r rQ r r r rT � rU ) �ALL� isinstance�list�tupler� rd r- rb rg ZDEBUG1)r r r r� r r r r� � s � � zLogger._getLevelsc C sJ t |t�st |t�r|}n|g}|D ] }t|jt�s$td|jj ��q$|S )z Generate target array. z '%s' is no valid logging target.)r� r� r� � issubclass� __class__r r` r )r rq �targets�_targetr r r � _getTargets� s �zLogger._getTargetsc C s� |r | j }| j}d| jd f}n | j}| j}| j| jd f}t|�dkrP|�� t |d |d �D ]<}||vrpqb|| D ]$\}}}||vrx|� |g �� |� qxqbdS )z% Generate dict with domain by level. r) r N) r_ r] rd r^ r\ r- rb r/ �clearrg � setdefault�append)r r r^ r\ Z_ranger ru rp r r r � _genDomains s zLogger._genDomainsc C sd | � |� | �||�}| �|�}|r,| j}n| j}|D ] }|D ]}|||fg||< q>q6| �|� d S r )rr r� r� r] r\ r� � r ru rq r r� r r� r� r\ r r r r� s zLogger._setLoggingc C sl | � |� | �||�}| �|�}|r,| j}n| j}|D ]&}|D ] }|�|g ��|||f� q>q6| �|� d S r )rr r� r� r] r\ r� r� r� r� r r r r� - s zLogger._addLoggingc C s� | � |� | �||�}| �|�}|r,| j}n| j}|D ]x} |D ]n}| |vrLq>|||f|| v r�|| �|||f� t|| �dkr�|| = q>|| jkr>td| ||j j |f ��q>q6| � |� d S )Nr zENo matching logging for level %d, domain %s, target %s and format %s.) rr r� r� r] r\ �remover/ r� r` r� r r� ) r ru rq r r� r r� r� r\ rV r r r r� < s( � zLogger._delLoggingc C sr | � ||�}|sdS |d d }|r,| j}n| j}|| D ]2\}}}|dksf|�|�sft�|d |�r: dS q:dS )NFru �.rP T)�_genDictr] r\ r7 �fnmatch� fnmatchcase)r r r �_dict� point_domainr\ ru rp r r r r� U s ��zLogger._isLoggingHerec C s� |j jdkrD|j jd }||jv rD|j| }| �|j|j �}|rD|S t�|j �}|j }|j|j v r�t |j |j d�r�|j |j j |kr�dS |j � � D ]J\}}t |tj�r�t ||j�r�t||j�}t |tj�r�|j |kr�| S q�dS )z7 Function to get calling class. Returns class or None. r Z func_codeN)�f_code� co_argcount� co_varnames�f_locals� _getClass2r� �inspectZ getmodule�co_name�__dict__�hasattr�__code__�itemsr� �typesZ ClassType�getattr� FunctionType) r �frameZselfnameZ_self�obj�module�coderp �valuer r r � _getClassi s, � zLogger._getClassc C sV |j �� D ]"}t|tj�r |j|kr | S q |jD ] }| �||�}|r4| S q4dS )z@ Internal function to get calling class. Returns class or None. N)r� �valuesr� r� r� r� � __bases__r� )r r� r� r� �baseZ_objr r r r� � s zLogger._getClass2c O sh d}d|v r|d }d}d|v r(|d }d}d|v r<|d }| � ||�}|sPd S t|�dkrj|| |d< n&t|�dkr�||d |d< n||d< |d d } |r�| j} n| j} g } | | D ]�\} } }| | v r�q�| d ks�| �| d �s�t�|d | �r�|�s | j}d |v �r|d }|�r.| �|d || |� n| �|| || |� |�rX| �d || |� | � | � q�d S ) Nr r r) r� r� rH ru r� rP r� r( ) r� r/ r] r\ r7 r� r� rX r r� )r r rX rI rJ r r� r� r� r� r\ Z used_targetsru rq r r r r� � sP �� z Logger._logc C s g }d}|r | j }| j}| j}n| j}| j}| j}|D ]H}|dkrh|| |kr~d}t|�dkrbg } q�q6|| |kr6|�|� q6|s�t|�dk r�dS ||vr�dS t� � } | r�| j r�| j d | j kr�| j } q�| s�t d��| j d } | d } |D ]}| �|�r�g } �qq�| j} t| �} || D ]p}|�d�}|dk�r:�q n |dk�rR|d|� }n|}| t|�k�rx| �|��s� dS n|�| ��s dS �q d }||v �r�|| }| j| j| d | jd ||t�| jt�� �d � }|d d k�r�d |d < d}|| D ] }|dk�r�q�d} �q�q�| j�d�dk�sJ| j�d�dk�sJ|�sJt|�dk�rd| �| �}|�rd|j|d< d |d |d< |d d k�r�|d d |d 7 < |d d k�r�|d d |d 7 < t|�dk �r�|S |d d }|D ],}|�|��st� |d |��r�| S �q�dS )z Internal function. FrP Tr r) Nr z Frame information not available.r� rE ) �file�liner� �class�functionru r� r �dater� �?z %(domain)z%(class)r� r� ru ) rW r_ r[ rV r^ rZ r/ r� r� Z currentframe�f_back� f_globalsr r` r7 r� �find� co_filename�f_linenor� �time�strftimerY � localtimerX r� r r� r� )r r r Z check_domainsZ simple_matchr� r^ rZ ru �fZ module_nameZ point_module�co�_lenrS �dZ level_strZ domain_neededr� r� r r r r� � s� � �� � � zLogger._genDict)rC rD )rP )rP )rP )rP )r )r )r )r )8r r r r r� rs r- rf r, r+ r r r r! r" r# r r rv rj rx rk rz rl r} rm re ri rn ro r� r� r� r� r� r� r� r� r� rF rO r� r� r� rr r� r� r� r� r� r� r� r� r� r� r� r r r r r � sd H ; 4r )�__all__r r� r� r� r� r# r� r< Zos.pathr$ �objectr r r r" r r r r r r r �<module> s. -( * core/__pycache__/fw_policy.cpython-39.opt-1.pyc 0000644 00000135473 15025011705 0015300 0 ustar 00 a ���gD# � @ s� d dl Z d dlmZ d dlmZmZmZmZmZm Z m Z m Z m Z m Z mZ d dlmZmZmZmZmZmZmZmZmZmZmZ d dlm Z d dl m Z d dl m Z d dl!m"Z" G d d � d e#�Z$dS ) � N)�log) �portStr� checkIPnMask� checkIP6nMask� checkProtocol�enable_ip_forwarding�check_single_address�portInPortRange�get_nf_conntrack_short_name�coalescePortRange�breakPortRange�checkTcpMssClamp) � Rich_Rule� Rich_Accept� Rich_Service� Rich_Port� Rich_Protocol�Rich_Masquerade�Rich_ForwardPort�Rich_SourcePort�Rich_IcmpBlock� Rich_IcmpType�Rich_Tcp_Mss_Clamp)�FirewallTransaction)�errors)� FirewallError)�SOURCE_IPSET_TYPESc @ sv e Zd Zdd� Zdd� Zdd� Zdd� Zd d � Zd d � Zd d� Z dd� Z dd� Z dd� Z d�dd�Z dd� Z�d dd�Z�dd d �Z�dd d �Zd d!� Zd"d#� Zd$d%� Zd&d'� Z�dd*d+�Zd,d-� Z�dd.d/�Zd0d1� Zd2d3� Zd4d5� Zd6d7� Z d8d9� Z �dd:d;�Z d<d=� Z �dd>d?�Z d@dA� Z!dBdC� Z"dDdE� Z#dFdG� Z$dHdI� Z%dJdK� Z&dLdM� Z'�ddNdO�Z(dPdQ� Z)�ddRdS�Z*dTdU� Z+dVdW� Z,dXdY� Z-dZd[� Z.d\d]� Z/�d d^d_�Z0d`da� Z1�d dbdc�Z2ddde� Z3dfdg� Z4dhdi� Z5djdk� Z6dldm� Z7dndo� Z8dpdq� Z9�d drds�Z:dtdu� Z;�d dvdw�Z<dxdy� Z=dzd{� Z>d|d}� Z?d~d� Z@d�d�� ZAd�d�� ZB�d d�d��ZCd�d�� ZD�dd�d��ZEd�d�� ZFd�d�� ZGd�d�� ZHd�d�� ZI�dd�d��ZJd�d�� ZK�dd�d��ZLd�d�� ZMd�d�� ZNd�d�� ZO�dd�d��ZPd�d�� ZQ�dd�d��ZRd�d�� ZSd�d�� ZT�dd�d��ZU�dd�d��ZV�dd�d��ZWd�d�� ZX�dd�d��ZYd�d�� ZZ�dd�d��Z[d�d�� Z\d�d�� Z]d�d�� Z^�dd�d��Z_d�d�� Z`�dd�d��Zad�dÄ Zbd�dń Zcd�dDŽ Zd�dd�dɄZed�d˄ Zfd�d̈́ Zg�dd�dτZhd�dф Zid�dӄ Zjd�dՄ Zkd�dׄ Zld�dل Zmd�dۄ Znd�d݄ Zod�d߄ Zpd�d� Zq�d d�d�Zr�d d�d�Zsd�d� Ztd�d� Zud�d� Zvd�d� Zw�d d�d�Zxd�d� Zyd�d� Zzd�d�� Z{d�d�� Z|d�d�� Z}d�d�� Z~�d d�d��ZdS ( �FirewallPolicyc C s || _ i | _i | _d S �N)�_fw�_chains� _policies)�self�fw� r$ �;/usr/lib/python3.9/site-packages/firewall/core/fw_policy.py�__init__ s zFirewallPolicy.__init__c C s d| j | j| jf S )Nz %s(%r, %r))� __class__r r! �r" r$ r$ r% �__repr__ s zFirewallPolicy.__repr__c C s | j �� | j�� d S r )r �clearr! r( r$ r$ r% �cleanup s zFirewallPolicy.cleanupc C s t | j�}|�| jj� |S r )r r Zadd_pre�full_check_config)r" �tr$ r$ r% �new_transaction$ s z FirewallPolicy.new_transactionc C s t | j�� �S r )�sortedr! �keysr( r$ r$ r% � get_policies+ s zFirewallPolicy.get_policiesc C s4 g }| � � D ] }| �|�}|js |�|� q t|�S r )r1 � get_policy�derived_from_zone�appendr/ )r" �policies�p�p_objr$ r$ r% �"get_policies_not_derived_from_zone. s z1FirewallPolicy.get_policies_not_derived_from_zonec C sv g }| � � D ]d}| �|�}t|j�t| jj�� �tddg�B @ r t|j�t| jj�� �tddg�B @ r |�|� q |S )N�HOST�ANY) r8 r2 �set� ingress_zonesr �zoneZget_active_zones� egress_zonesr4 )r" Zactive_policies�policyr7 r$ r$ r% �)get_active_policies_not_derived_from_zone6 s &$� z8FirewallPolicy.get_active_policies_not_derived_from_zonec C s | j �|�}| j| S r )r � check_policyr! )r" r? r6 r$ r$ r% r2 @ s zFirewallPolicy.get_policyc C s || j |j< d S r )r! �name)r" �objr$ r$ r% � add_policyD s zFirewallPolicy.add_policyc C s& | j | }|jr| �|� | j |= d S r )r! �applied�unapply_policy_settings)r" r? rC r$ r$ r% � remove_policyG s z FirewallPolicy.remove_policyNc C sJ | � � D ]<}| j| }|jr q|| �� v rt�d|� | j||d� qd S )NzApplying policy '%s'��use_transaction)r1 r! r3 r@ r Zdebug1�apply_policy_settings)r" rI r? r7 r$ r$ r% �apply_policiesM s z FirewallPolicy.apply_policiesc C s | j | }||_d S r )r! rE )r" r? rE rC r$ r$ r% �set_policy_appliedV s z!FirewallPolicy.set_policy_appliedc C sz | j �|�}| j| }|r |js*|s.|js.d S |r8d|_|d u rJ| �� }n|}|r�|jsb| �|�n| �|�D ]\}}| �|d|||� ql|js�| � |||� dD �]x} t | � |�| �} t | t �r�|r�| s�|s�| s�q�| g} | D �]:} | dkr�| �||| |� q�| dk�r q�q�| dk�r,| j|||g| �R � q�| dk�rH| �||| |� q�| dk�rn| �||| d | d |� q�| d k�r�| �||| |� q�| d k�r�| �||| d | d |� q�| d k�r�| �|||� q�| d k�r�| �||t| d�|� q�| dk�r�q�q�| dk�rq�q�t�d|| | � q�q�|�sb|j�s4| �|�n| �|�D ] \}}| �|d|||� �q>d|_|d u �rv|�|� d S )NT) �services�ports� masquerade� forward_ports� source_ports� icmp_blocks� rules_str� protocols�icmp_block_inversionr< r> rR rU rP rM rN r � rT rQ rO rS ��rule_strr< r> z5Policy '%s': Unknown setting '%s:%s', unable to applyF)r rA r! rE r. r3 �%_get_table_chains_for_policy_dispatch�#_get_table_chains_for_zone_dispatch�gen_chain_rules�_ingress_egress_zones�getattrr2 � isinstance�bool� _icmp_block� _forward_port�_service�_port� _protocol� _source_port� _masquerade�_FirewallPolicy__ruler r �warning�execute) r" �enabler? rI �_policyrC � transaction�table�chain�keyZ args_list�argsr$ r$ r% �_policy_settingsZ s� � � � � � �� z FirewallPolicy._policy_settingsc C s | j d||d� d S )NTrH �rq �r" r? rI r$ r$ r% rJ � s z$FirewallPolicy.apply_policy_settingsc C s | j d||d� d S )NFrH rr rs r$ r$ r% rF � s z&FirewallPolicy.unapply_policy_settingsc C s | � |��� S r )r2 Zexport_config_dict�r" r? r$ r$ r% � get_config_with_settings_dict� s z,FirewallPolicy.get_config_with_settings_dictc s� ddl m� d � �fdd� }� �fdd�}�j�jf�j�jf�j�jf�j�j f�j �j f||f�j �j f�j�jf�j�jf�j�jfd� }��|�}t�|�}|�|�j�� � �j�d|gi� ��|�} �j�| |�\} } | D ]n} t | | t ��rF| | D ]>} t | t ��r.|| d |g| �R � n|| d || � �qq�|| d |� q�| D ]�} t | | t ��r�| | D ]L} t | t ��r�|| d |g| �R d|d �� n|| d || d|d � �qxn|| d |d|d � �q\d S ) Nr )r c s �j | � |d�d|d� d S )NrW r ��timeout�sender)�add_rule)r? rX rw rx �r r" r$ r% �add_rule_wrapper� s zFFirewallPolicy.set_config_with_settings_dict.<locals>.add_rule_wrapperc s �� | � |d�� d S )NrW )� remove_rule)r? rX rz r$ r% �remove_rule_wrapper� s zIFirewallPolicy.set_config_with_settings_dict.<locals>.remove_rule_wrapper) rM rN rR rO rP Z rich_rulesrT rQ r< r> r5 rV rv )r N) �firewall.core.richr � add_service�remove_service�add_port� remove_port�add_icmp_block�remove_icmp_block�add_masquerade�remove_masquerade�add_forward_port�remove_forward_port� add_protocol�remove_protocol�add_source_port�remove_source_port�add_ingress_zone�remove_ingress_zone�add_egress_zone�remove_egress_zoner2 �copyZimport_config_dictr Zget_all_io_objects_dictr, ru Z get_added_and_removed_settingsr^ �list�tuple)r" r? Zsettingsrx r{ r} Z setting_to_fnZold_objZ check_objZ old_settingsZ add_settingsZremove_settingsro rp r$ rz r% � set_config_with_settings_dict� sD � " z,FirewallPolicy.set_config_with_settings_dictc C s& |st tj��|dvr"| j�|� d S �N)r9 r: �r r Z INVALID_ZONEr Z check_zone�r" r= r$ r$ r% �check_ingress_zone� s z!FirewallPolicy.check_ingress_zonec C s | � |� |S r )r� r� r$ r$ r% Z__ingress_zone_id� s z FirewallPolicy.__ingress_zone_idr Tc C s | j �|�}| j �|� | j �� | j| }| �|�} | |jv rTttj d||f ��|d u rf| � � } n|} |r�|j r�| � d|| � | � || ||� | �| j|| � |j s�|| �� v r�| j|| d� | �| j|d� n| � d|| � n | � || ||� | �| j|| � |d u �r| �d� d S �N�'%s' already in '%s'FrH T)r rA � check_timeout� check_panicr! � _FirewallPolicy__ingress_zone_idr< r r �ALREADY_ENABLEDr. rE r\ �&_FirewallPolicy__register_ingress_zone�add_fail�(_FirewallPolicy__unregister_ingress_zoner@ rJ rL ri � r" r? r= rw rx rI Z allow_applyrk �_obj�zone_idrl r$ r$ r% r� � s4 � z FirewallPolicy.add_ingress_zonec C s |j �|� d S r )r< r4 �r" r� r� rw rx r$ r$ r% Z__register_ingress_zone s z&FirewallPolicy.__register_ingress_zonec C s� | j �|�}| j �� | j| }| �|�}||jvrHttjd||f ��|d u rZ| � � }n|}|j r�t |j�dkr�| � ||� n| � d||� | �||� |�| j||d d � || �� v r�| � d||� n|�| j||� |d u r�|�d� |S �N�'%s' not in '%s'rV FT)r rA r� r! r� r< r r � NOT_ENABLEDr. rE �lenrF r\ r� r� r� r@ �add_postri �r" r? r= rI rk r� r� rl r$ r$ r% r� s. � z"FirewallPolicy.remove_ingress_zonec C s ||j v r|j �|� d S r )r< �remove�r" r� r� r$ r$ r% Z__unregister_ingress_zone4 s z(FirewallPolicy.__unregister_ingress_zonec C s | � |�| �|�jv S r )r� r2 r< �r" r? r= r$ r$ r% �query_ingress_zone8 s z!FirewallPolicy.query_ingress_zonec C s | � |�jS r )r2 r< rt r$ r$ r% �list_ingress_zones; s z!FirewallPolicy.list_ingress_zonesc C s& |st tj��|dvr"| j�|� d S r� r� r� r$ r$ r% �check_egress_zone@ s z FirewallPolicy.check_egress_zonec C s | � |� |S r )r� r� r$ r$ r% Z__egress_zone_idF s z FirewallPolicy.__egress_zone_idc C s | j �|�}| j �|� | j �� | j| }| �|�} | |jv rTttj d||f ��|d u rf| � � } n|} |r�|j r�| � d|| � | � || ||� | �| j|| � |j s�|| �� v r�| j|| d� | �| j|d� n| � d|| � n | � || ||� | �| j|| � |d u �r| �d� d S r� )r rA r� r� r! � _FirewallPolicy__egress_zone_idr> r r r� r. rE r\ �%_FirewallPolicy__register_egress_zoner� �'_FirewallPolicy__unregister_egress_zoner@ rJ rL ri r� r$ r$ r% r� J s4 � z FirewallPolicy.add_egress_zonec C s |j �|� d S r )r> r4 r� r$ r$ r% Z__register_egress_zonep s z%FirewallPolicy.__register_egress_zonec C s� | j �|�}| j �� | j| }| �|�}||jvrHttjd||f ��|d u rZ| � � }n|}|j r�t |j�dkr�| � ||� n| � d||� | �||� |�| j||d d � || �� v r�| � d||� n|�| j||� |d u r�|�d� |S r� )r rA r� r! r� r> r r r� r. rE r� rF r\ r� r� r� r@ r� ri r� r$ r$ r% r� s s. � z!FirewallPolicy.remove_egress_zonec C s ||j v r|j �|� d S r )r> r� r� r$ r$ r% Z__unregister_egress_zone� s z'FirewallPolicy.__unregister_egress_zonec C s | � |�| �|�jv S r )r� r2 r> r� r$ r$ r% �query_egress_zone� s z FirewallPolicy.query_egress_zonec C s | � |�jS r )r2 r> rt r$ r$ r% �list_egress_zones� s z FirewallPolicy.list_egress_zonesc C s |� � d S r )�check�r" �ruler$ r$ r% � check_rule� s zFirewallPolicy.check_rulec C s | � |� t|�S r )r� �strr� r$ r$ r% Z __rule_id� s zFirewallPolicy.__rule_idc C sx |sd S |j r,t|j �r dS t|j �rtdS nHt|d�r@|jr@dS t|d�rt|jrt| �|j� | �|j� | �|j�S d S )N�ipv4�ipv6�mac� �ipset) �addrr r �hasattrr� r� � _check_ipset_type_for_source�_check_ipset_applied� _ipset_family)r" �sourcer$ r$ r% �_rule_source_ipv� s z FirewallPolicy._rule_source_ipvc C s | � ||||� d S r )� _rule_prepare)r" rj r? r� rl r$ r$ r% Z__rule� s zFirewallPolicy.__rulec C s� | j �|�}| j �|� | j �� | j| }| �|�}||jv rd|jrL|jn|} tt j d|| f ��|d u rv| � � } n|} |j r�| � d||| � | �||||� | �| j||� |d u r�| �d� |S �Nr� T)r rA r� r� r! �_FirewallPolicy__rule_idrS r3 r r r� r. rE rg � _FirewallPolicy__register_ruler� � _FirewallPolicy__unregister_ruleri ) r" r? r� rw rx rI rk r� �rule_id�_namerl r$ r$ r% ry � s( � zFirewallPolicy.add_rulec C s |j �|� d S r )rS r4 )r" r� r� rw rx r$ r$ r% Z__register_rule� s z FirewallPolicy.__register_rulec C s� | j �|�}| j �� | j| }| �|�}||jvrX|jr@|jn|}ttj d||f ��|d u rj| � � }n|}|j r�| � d|||� |� | j||� |d u r�|�d� |S �Nr� FT)r rA r� r! r� rS r3 r r r� r. rE rg r� r� ri ) r" r? r� rI rk r� r� r� rl r$ r$ r% r| � s$ � zFirewallPolicy.remove_rulec C s ||j v r|j �|� d S r )rS r� )r" r� r� r$ r$ r% Z__unregister_rule� s z FirewallPolicy.__unregister_rulec C s | � |�| �|�jv S r )r� r2 rS )r" r? r� r$ r$ r% � query_rule� s zFirewallPolicy.query_rulec C s | � |�jS r )r2 rS rt r$ r$ r% � list_rules s zFirewallPolicy.list_rulesc C s | j �|� d S r )r � check_service�r" �servicer$ r$ r% r� s z FirewallPolicy.check_servicec C s | � |� |S r )r� r� r$ r$ r% Z __service_id s zFirewallPolicy.__service_idc C s� | j �|�}| j �|� | j �� | j| }| �|�}||jv rd|jrL|jn|} tt j d|| f ��|d u rv| � � } n|} |j r�| � d||| � | �||||� | �| j||� |d u r�| �d� |S r� )r rA r� r� r! �_FirewallPolicy__service_idrM r3 r r r� r. rE rb �!_FirewallPolicy__register_servicer� �#_FirewallPolicy__unregister_serviceri ) r" r? r� rw rx rI rk r� � service_idr� rl r$ r$ r% r s( � zFirewallPolicy.add_servicec C s |j �|� d S r )rM r4 )r" r� r� rw rx r$ r$ r% Z__register_service) s z!FirewallPolicy.__register_servicec C s� | j �|�}| j �� | j| }| �|�}||jvrX|jr@|jn|}ttj d||f ��|d u rj| � � }n|}|j r�| � d|||� |� | j||� |d u r�|�d� |S r� )r rA r� r! r� rM r3 r r r� r. rE rb r� r� ri ) r" r? r� rI rk r� r� r� rl r$ r$ r% r� , s$ � z FirewallPolicy.remove_servicec C s ||j v r|j �|� d S r )rM r� )r" r� r� r$ r$ r% Z__unregister_serviceG s z#FirewallPolicy.__unregister_servicec C s | � |�| �|�jv S r )r� r2 rM )r" r? r� r$ r$ r% � query_serviceK s z FirewallPolicy.query_servicec C s | � |�jS r )r2 rM rt r$ r$ r% � list_servicesN s z FirewallPolicy.list_servicesc C sN g }|D ]@}z| j j�|�}W n ty< ttj|��Y n0 |�|� q|S r )r �helper� get_helperr r �INVALID_HELPERr4 )r" �helpers�_helpersr� �_helperr$ r$ r% � get_helpers_for_service_helpersQ s z.FirewallPolicy.get_helpers_for_service_helpersc C s� g }|D ]�}z| j j�|�}W n ty< ttj|��Y n0 t|j�dk r�t|j �}z | j j�|�}|� |� W q� ty� |r�t � d| � Y qY q�0 q|� |� q|S )NrV z Helper '%s' is not available) r r� r� r r r� r� rN r �moduler4 r rh )r" �modulesrj r� r� r� �_module_short_namer� r$ r$ r% � get_helpers_for_service_modules[ s" z.FirewallPolicy.get_helpers_for_service_modulesc C s | j �|� | j �|� d S r )r � check_port� check_tcpudp�r" �port�protocolr$ r$ r% r� t s zFirewallPolicy.check_portc C s | � ||� t|d�|fS �N�-�r� r r� r$ r$ r% Z __port_idx s zFirewallPolicy.__port_idc sp | j �|�}| j �|� | j �� | j| }tt� fdd�|j��} | D ]8} t|| d �rH|j rf|j n|} t t j d|� | f ��qHt |dd� | D ��\} } |d u r�| �� }n|}|jr�| D ] }| �d|t|d�� |� q�| D ] }| �d |t|d�� |� q�| D ]0}| �|� �} | �|| ||� |�| j|| � q�| D ]"}| �|� �} |�| j|| � �q4|d u �rl|�d� |S ) Nc s | d � kS �NrV r$ ��x�r� r$ r% �<lambda>� � z)FirewallPolicy.add_port.<locals>.<lambda>r �'%s:%s' already in '%s'c S s g | ] \}}|�qS r$ r$ ��.0rc rd r$ r$ r% � <listcomp>� r� z+FirewallPolicy.add_port.<locals>.<listcomp>Tr� F)r rA r� r� r! r� �filterrN r r3 r r r� r r. rE rc r �_FirewallPolicy__port_id� _FirewallPolicy__register_portr� � _FirewallPolicy__unregister_portr� ri �r" r? r� r� rw rx rI rk r� �existing_port_ids�port_idr� � added_ranges�removed_rangesrl �ranger$ r� r% r� | s< � zFirewallPolicy.add_portc C s |j �|� d S r )rN r4 �r" r� r� rw rx r$ r$ r% Z__register_port� s z FirewallPolicy.__register_portc sh | j �|�}| j �� | j| }tt� fdd�|j��}|D ]}t||d �r< qzq<|jr`|jn|} t t j d|� | f ��t |dd� |D ��\} } |d u r�| � � } n|} |jr�| D ] } | �d|t| d�� | � q�| D ] } | �d |t| d�� | � q�| D ]0} | �| � �}| �||dd � | �| j||� q�| D ]"} | �| � �}| �| j||� �q,|d u �rd| �d� |S ) Nc s | d � kS r� r$ r� r� r$ r% r� � r� z,FirewallPolicy.remove_port.<locals>.<lambda>r �'%s:%s' not in '%s'c S s g | ] \}}|�qS r$ r$ r� r$ r$ r% r� � r� z.FirewallPolicy.remove_port.<locals>.<listcomp>Tr� F)r rA r� r! r� r� rN r r3 r r r� r r. rE rc r r� r� r� r� r� ri �r" r? r� r� rI rk r� r� r� r� r� r rl r r$ r� r% r� � s< � zFirewallPolicy.remove_portc C s ||j v r|j �|� d S r )rN r� �r" r� r� r$ r$ r% Z__unregister_port� s z FirewallPolicy.__unregister_portc C s2 | � |�jD ] \}}t||�r ||kr dS q dS �NTF)r2 rN r �r" r? r� r� rc rd r$ r$ r% � query_port� s zFirewallPolicy.query_portc C s | � |�jS r )r2 rN rt r$ r$ r% � list_ports� s zFirewallPolicy.list_portsc C s t |�sttj|��d S r )r r r ZINVALID_PROTOCOL�r" r� r$ r$ r% �check_protocol� s z FirewallPolicy.check_protocolc C s t |�sttjd| ��d S )Nzatcp-mss-clamp value must be greater than or equal to 536, or the value 'pmtu'. Invalid value '%s')r r r � INVALID_RULE)r" �tcp_mss_clamp_valuer$ r$ r% �check_tcp_mss_clamp� s z"FirewallPolicy.check_tcp_mss_clampc C s | � |� |S r )r r r$ r$ r% Z __protocol_id� s z FirewallPolicy.__protocol_idc C s� | j �|�}| j �|� | j �� | j| }| �|�}||jv rd|jrL|jn|} tt j d|| f ��|d u rv| � � } n|} |j r�| � d||| � | �||||� | �| j||� |d u r�| �d� |S r� )r rA r� r� r! � _FirewallPolicy__protocol_idrT r3 r r r� r. rE rd �"_FirewallPolicy__register_protocolr� �$_FirewallPolicy__unregister_protocolri ) r" r? r� rw rx rI rk r� � protocol_idr� rl r$ r$ r% r� � s( � zFirewallPolicy.add_protocolc C s |j �|� d S r )rT r4 )r" r� r rw rx r$ r$ r% Z__register_protocol s z"FirewallPolicy.__register_protocolc C s� | j �|�}| j �� | j| }| �|�}||jvrX|jr@|jn|}ttj d||f ��|d u rj| � � }n|}|j r�| � d|||� |� | j||� |d u r�|�d� |S r� )r rA r� r! r rT r3 r r r� r. rE rd r� r ri ) r" r? r� rI rk r� r r� rl r$ r$ r% r� s( � � z FirewallPolicy.remove_protocolc C s ||j v r|j �|� d S r )rT r� )r" r� r r$ r$ r% Z__unregister_protocol( s z$FirewallPolicy.__unregister_protocolc C s | � |�| �|�jv S r )r r2 rT )r" r? r� r$ r$ r% �query_protocol, s z FirewallPolicy.query_protocolc C s | � |�jS r )r2 rT rt r$ r$ r% �list_protocols/ s z FirewallPolicy.list_protocolsc C s | � ||� t|d�|fS r� r� r� r$ r$ r% Z__source_port_id4 s z FirewallPolicy.__source_port_idc sp | j �|�}| j �|� | j �� | j| }tt� fdd�|j��} | D ]8} t|| d �rH|j rf|j n|} t t j d|� | f ��qHt |dd� | D ��\} } |d u r�| �� }n|}|jr�| D ] }| �d|t|d�� |� q�| D ] }| �d |t|d�� |� q�| D ]0}| �|� �} | �|| ||� |�| j|| � q�| D ]"}| �|� �} |�| j|| � �q4|d u �rl|�d� |S ) Nc s | d � kS r� r$ r� r� r$ r% r� ? r� z0FirewallPolicy.add_source_port.<locals>.<lambda>r r� c S s g | ] \}}|�qS r$ r$ r� r$ r$ r% r� F r� z2FirewallPolicy.add_source_port.<locals>.<listcomp>Tr� F)r rA r� r� r! r� r� rQ r r3 r r r� r r. rE re r � _FirewallPolicy__source_port_id�%_FirewallPolicy__register_source_portr� �'_FirewallPolicy__unregister_source_portr� ri r� r$ r� r% r� 8 s< � z FirewallPolicy.add_source_portc C s |j �|� d S r )rQ r4 r r$ r$ r% Z__register_source_port` s z%FirewallPolicy.__register_source_portc sh | j �|�}| j �� | j| }tt� fdd�|j��}|D ]}t||d �r< qzq<|jr`|jn|} t t j d|� | f ��t |dd� |D ��\} } |d u r�| � � } n|} |jr�| D ] } | �d|t| d�� | � q�| D ] } | �d |t| d�� | � q�| D ]0} | �| � �}| �||dd � | �| j||� q�| D ]"} | �| � �}| �| j||� �q,|d u �rd| �d� |S ) Nc s | d � kS r� r$ r� r� r$ r% r� i r� z3FirewallPolicy.remove_source_port.<locals>.<lambda>r r c S s g | ] \}}|�qS r$ r$ r� r$ r$ r% r� r r� z5FirewallPolicy.remove_source_port.<locals>.<listcomp>Tr� F)r rA r� r! r� r� rQ r r3 r r r� r r. rE re r r r r� r r� ri r r$ r� r% r� c s< � z!FirewallPolicy.remove_source_portc C s ||j v r|j �|� d S r )rQ r� r r$ r$ r% Z__unregister_source_port� s z'FirewallPolicy.__unregister_source_portc C s2 | � |�jD ] \}}t||�r ||kr dS q dS r )r2 rQ r r r$ r$ r% �query_source_port� s z FirewallPolicy.query_source_portc C s | � |�jS r )r2 rQ rt r$ r$ r% �list_source_ports� s z FirewallPolicy.list_source_portsc C s� | j �|�}| j �|� | j �� | j| }|jrR|jr>|jn|}ttj d| ��|d u rd| � � }n|}|j r|| � d||� | � |||� |�| j|� |d u r�|�d� |S )Nz"masquerade already enabled in '%s'T)r rA r� r� r! rO r3 r r r� r. rE rf �$_FirewallPolicy__register_masquerader� �&_FirewallPolicy__unregister_masqueraderi ) r" r? rw rx rI rk r� r� rl r$ r$ r% r� � s& � z FirewallPolicy.add_masqueradec C s d|_ d S �NT�rO )r" r� rw rx r$ r$ r% Z__register_masquerade� s z$FirewallPolicy.__register_masqueradec C s� | j �|�}| j �� | j| }|jsF|jr2|jn|}ttjd| ��|d u rX| � � }n|}|j rp| � d||� |� | j |� |d u r�|�d� |S )Nz masquerade not enabled in '%s'FT)r rA r� r! rO r3 r r r� r. rE rf r� r ri )r" r? rI rk r� r� rl r$ r$ r% r� � s" � z FirewallPolicy.remove_masqueradec C s d|_ d S �NFr �r" r� r$ r$ r% Z__unregister_masquerade� s z&FirewallPolicy.__unregister_masqueradec C s | � |�jS r )r2 rO rt r$ r$ r% �query_masquerade� s z FirewallPolicy.query_masqueradec C sZ | j �|� | j �|� |r(| j �|� |rBt||�sBttj|��|sV|sVttjd��d S )Nz.port-forwarding is missing to-port AND to-addr)r r� r� r r r Z INVALID_ADDRZINVALID_FORWARD)r" �ipvr� r� �toport�toaddrr$ r$ r% �check_forward_port� s �z!FirewallPolicy.check_forward_portc C sL t d|�r | �d||||� n| �d||||� t|d�|t|d�t|�fS )Nr� r� r� )r r$ r r� )r" r� r� r" r# r$ r$ r% Z__forward_port_id� s �z FirewallPolicy.__forward_port_idc C s� | j �|�} | j �|� | j �� | j| } | �||||�} | | jv rp| jrR| jn| } tt j d||||| f ��|d u r�| � � } n|} | j r�| � d| | ||||� | �| | ||� | �| j| | � |d u r�| �d� | S )Nz '%s:%s:%s:%s' already in '%s'T)r rA r� r� r! � _FirewallPolicy__forward_port_idrP r3 r r r� r. rE ra �&_FirewallPolicy__register_forward_portr� �(_FirewallPolicy__unregister_forward_portri )r" r? r� r� r" r# rw rx rI rk r� � forward_idr� rl r$ r$ r% r� � s0 �� � z FirewallPolicy.add_forward_portc C s |j �|� d S r )rP r4 )r" r� r( rw rx r$ r$ r% Z__register_forward_port s z&FirewallPolicy.__register_forward_portc C s� | j �|�}| j �� | j| }| �||||�} | |jvrd|jrF|jn|} ttj d||||| f ��|d u rv| � � } n|} |j r�| � d|| ||||� | � | j|| � |d u r�| �d� |S )Nz'%s:%s:%s:%s' not in '%s'FT)r rA r� r! r% rP r3 r r r� r. rE ra r� r' ri ) r" r? r� r� r" r# rI rk r� r( r� rl r$ r$ r% r� s, �� � z"FirewallPolicy.remove_forward_portc C s ||j v r|j �|� d S r )rP r� )r" r� r( r$ r$ r% Z__unregister_forward_port1 s z(FirewallPolicy.__unregister_forward_portc C s | � ||||�}|| �|�jv S r )r% r2 rP )r" r? r� r� r" r# r( r$ r$ r% �query_forward_port5 s z!FirewallPolicy.query_forward_portc C s | � |�jS r )r2 rP rt r$ r$ r% �list_forward_ports: s z!FirewallPolicy.list_forward_portsc C s | j �|� d S r )r Zcheck_icmptype�r" �icmpr$ r$ r% �check_icmp_block? s z FirewallPolicy.check_icmp_blockc C s | � |� |S r )r- r+ r$ r$ r% Z__icmp_block_idB s z FirewallPolicy.__icmp_block_idc C s� | j �|�}| j �|� | j �� | j| }| �|�}||jv rd|jrL|jn|} tt j d|| f ��|d u rv| � � } n|} |j r�| � d||| � | �||||� | �| j||� |d u r�| �d� |S r� )r rA r� r� r! � _FirewallPolicy__icmp_block_idrR r3 r r r� r. rE r` �$_FirewallPolicy__register_icmp_blockr� �&_FirewallPolicy__unregister_icmp_blockri ) r" r? r, rw rx rI rk r� �icmp_idr� rl r$ r$ r% r� F s( � z FirewallPolicy.add_icmp_blockc C s |j �|� d S r )rR r4 )r" r� r1 rw rx r$ r$ r% Z__register_icmp_blockc s z$FirewallPolicy.__register_icmp_blockc C s� | j �|�}| j �� | j| }| �|�}||jvrX|jr@|jn|}ttj d||f ��|d u rj| � � }n|}|j r�| � d|||� |� | j||� |d u r�|�d� |S r� )r rA r� r! r. rR r3 r r r� r. rE r` r� r0 ri ) r" r? r, rI rk r� r1 r� rl r$ r$ r% r� f s$ � z FirewallPolicy.remove_icmp_blockc C s ||j v r|j �|� d S r )rR r� )r" r� r1 r$ r$ r% Z__unregister_icmp_block� s z&FirewallPolicy.__unregister_icmp_blockc C s | � |�| �|�jv S r )r. r2 rR )r" r? r, r$ r$ r% �query_icmp_block� s z FirewallPolicy.query_icmp_blockc C s | � |�jS r )r2 rR rt r$ r$ r% �list_icmp_blocks� s z FirewallPolicy.list_icmp_blocksc C s� | j �|�}| j �� | j| }|jrF|jr2|jn|}ttjd| ��|d u rX| � � }n|}|j r�|j D ]}| � d|||� qh| � d||� | �||� |�| j||� |j r�|j D ]}| � d|||� q�| � d||� |d u r�|�d� |S )Nz,icmp-block-inversion already enabled in '%s'FT)r rA r� r! rU r3 r r r� r. rE rR r` �_icmp_block_inversion�._FirewallPolicy__register_icmp_block_inversionr� �*_FirewallPolicy__undo_icmp_block_inversionri ) r" r? rx rI rk r� r� rl rp r$ r$ r% �add_icmp_block_inversion� s2 � z'FirewallPolicy.add_icmp_block_inversionc C s d|_ d S r �rU )r" r� rx r$ r$ r% Z __register_icmp_block_inversion� s z.FirewallPolicy.__register_icmp_block_inversionc C s` | � � }|jr*|jD ]}| �d|||� qd|_|jrR|jD ]}| �d|||� q<|�d� d S )NFT)r. rE rR r` rU ri )r" rk r� rl rp r$ r$ r% Z__undo_icmp_block_inversion� s z*FirewallPolicy.__undo_icmp_block_inversionc C s� | j �|�}| j �� | j| }|jsF|jr2|jn|}ttjd| ��|d u rX| � � }n|}|j r�|j D ]}| � d|||� qh| � d||� | �|� |�| j|d � |j r�|j D ]}| � d|||� q�| � d||� |d u r�|�d� |S )Nz(icmp-block-inversion not enabled in '%s'FT)r rA r� r! rU r3 r r r� r. rE rR r` r4 �0_FirewallPolicy__unregister_icmp_block_inversionr� r5 ri )r" r? rI rk r� r� rl rp r$ r$ r% �remove_icmp_block_inversion� s6 � � z*FirewallPolicy.remove_icmp_block_inversionc C s d|_ d S r r8 r r$ r$ r% Z!__unregister_icmp_block_inversion� s z0FirewallPolicy.__unregister_icmp_block_inversionc C s | � |�jS r )r2 rU rt r$ r$ r% �query_icmp_block_inversion� s z)FirewallPolicy.query_icmp_block_inversionc C s� | j j�|�}|jr*| j jj|j d }n|}|rT|| jv rt||f| j| v rtd S n || jvsp||f| j| vrtd S | j �� D ]2}|jr~||� � v r~|� ||||�} |� || � q~| � ||||fg� |� | j || ||fg� d S �Nr )r r? r2 r3 r= Z_zone_policiesr �enabled_backends�policies_supportedZget_available_tablesZbuild_policy_chain_rules� add_rules�_register_chainsr� ) r" r? �createrm rn rl rC Ztracking_policy�backend�rulesr$ r$ r% r[ � s* � � �z FirewallPolicy.gen_chain_rulesc C s^ |D ]T\}}|r*| j �|g ��||f� q| j | �||f� t| j | �dkr| j |= qd S r< )r � setdefaultr4 r� r� )r" r? rA Ztablesrm rn r$ r$ r% r@ s z FirewallPolicy._register_chainsc C s$ | j j�|�dkrd S | j j�|�S )Nzhash:mac)r r� �get_typeZ get_family�r" rB r$ r$ r% r� s z FirewallPolicy._ipset_familyc C s | j j�|�S r )r r� rE rF r$ r$ r% Z __ipset_type! s zFirewallPolicy.__ipset_typec C s d� |g| jj�|� �S )N�,)�joinr r� Z get_dimension)r" rB �flagr$ r$ r% �_ipset_match_flags$ s z!FirewallPolicy._ipset_match_flagsc C s | j j�|�S r )r r� Z check_appliedrF r$ r$ r% r� ' s z#FirewallPolicy._check_ipset_appliedc C s* | � |�}|tvr&ttjd||f ��d S )Nz.ipset '%s' with type '%s' not usable as source)�_FirewallPolicy__ipset_typer r r Z INVALID_IPSET)r" rB Z_typer$ r$ r% r� * s ��z+FirewallPolicy._check_ipset_type_for_sourcec s� t |j�tkr��jj�|jj�}|d u r2|jjg}|jD ]H}||v rFq8��|� |� |� t � |�}||j_�j |||||d� q8g } |j r�|j g} nH|jr�t|jt�s�t|jt�rވjj�|jj�� � jrއ fdd�dD �} ��|j�} | �r"|j �r |j | k�r"ttjd| |j f ��n| g} | �s0ddg} �fdd�| D �} | |_t�fd d�| D ��D �]2} t |j�tk�r��jj�|jj�}g } t|j�d k�r�|j�r�ttjd ��| D ].} | |jv �r�| � | ��r�| � |j| � �q�n | � d � | D �]�}t |j �t k�r�� |j |�}|��!|j"�7 }t#t|�d d � d�}g }|D ]�}|j$}t%|�}|�&dd�}|� |� |j dk�r�| � |j ��s��qBt|j'�dk �r�|� |� n6|j'D ].\}}| �(||||||j|�}|�)| |� �q��qB|�*|� |j'D ]*\}}| �+||||||�}|�)| |� �q�|j,D ]$}| �-|||||�}|�)| |� �q |j.D ]*\}}| �/||||||�}|�)| |� �qL�q�q^t |j�t0k�r�|jj1}|jj2}��3||� | �+||||d |�}|�)| |� �q^t |j�t4k�r|jj5}��6|� | �-|||d |�}|�)| |� �q^t |j�t7k�rX|jj5}��8|� | �9|||d |�}|�)| |� �q^t |j�t:k�r�|�r�| D ] } | � | ��rr|�;t<| � �qr| �=|||�}|�)| |� �q^t |j�t>k�rH|jj1}|jj2}|jj?}|jj@}| D ]<} | � | ��r��A| ||||� |�r�|�r�|�;t<| � �q�| �B|||||||�}|�)| |� �q^t |j�tCk�r�|jj1}|jj2}��3||� | �/||||d |�}|�)| |� n�t |j�tk�s�t |j�tk�rR�jj�|jj�� |j �r � j�r |j � jv�r ttjDd|j |jjf ��t |j�tk�r4|j �r4t |j �t k�r4ttjd��| �E||� |�}|�)| |� n>|jd u �rz| �F|||�}|�)| |� nttjdt |j� ���q^d S )N��included_servicesc s g | ]}|� j v r|�qS r$ )� destination�r� r! )�ictr$ r% r� G r� z0FirewallPolicy._rule_prepare.<locals>.<listcomp>�r� r� z;Source address family '%s' conflicts with rule family '%s'.r� r� c s g | ]}� j �|�r|�qS r$ )r �is_ipv_enabledrO r( r$ r% r� X r� c s g | ]}� j �|��qS r$ )r �get_backend_by_ipv)r� r� r( r$ r% r� ] r� r z"Destination conflict with service.c S s | j S r �rB r� r$ r$ r% r� u r� z.FirewallPolicy._rule_prepare.<locals>.<lambda>�ro � conntrack�natr� rV z3rich rule family '%s' conflicts with icmp type '%s'z'IcmpBlock not usable with accept actionzUnknown element %s)G�type�elementr r r� � get_servicerB �includesr� r4 r� �deepcopyr� �familyr^ r r �config� get_icmptyperN r� r� r r r �ipvsr; r� �is_ipv_supported�actionr r� r� r� r� r/ r� r �replacerN � build_policy_helper_ports_rulesr? Z add_modules�build_policy_ports_rulesrT �build_policy_protocol_rulesrQ � build_policy_source_ports_rulesr r� r� r� r �valuer r r Z build_policy_tcp_mss_clamp_rulesr r� r � build_policy_masquerade_rulesr Zto_portZ to_addressr$ � build_policy_forward_port_rulesr ZINVALID_ICMPTYPE� build_policy_icmp_block_rulesZ*build_policy_rich_source_destination_rules) r" rj r? r� rl rM �svc�includeZ_ruler` Z source_ipvrB Z destinationsr! rN r� r� r� r� r� � nat_moduler� �protorC r� r r" r# r$ )rP r" r% r� 2 sJ � � � � � � � � � � � � � � ��� �� ��z FirewallPolicy._rule_preparec C s> | j j�|�}| �|j|�}|| �|j�7 }tt|�dd� d�}|d u rN|g}|j D ]6}||v rbqT| � |� |� |� | j |||||d� qTg } dD ]f} | j � | �s�q�| j �| �} t|j�dkr�| |jv r�| � | |j| f� q�| d f| vr�| � | d f� q�| D �]6\} } |D ]�} | j}t|�}| j�dd�}|�|� | jd k�rV| �| j��sV�qt| j�d k �rr|�|� n6| jD ].\}}| �||||| | j|�}|�| |� �qx�q|jD ](\}}| �||||| �}|�| |� �q�|j D ]"}| � |||| �}|�| |� �q�|j D ](\}}| � ||||| �}|�| |� �q �q d S ) Nc S s | j S r rT r� r$ r$ r% r� � r� z)FirewallPolicy._service.<locals>.<lambda>rU rL rQ r rV rW r� rV ) r r� rZ r� r� r� r� r/ r; r[ r� r4 rb rR rS r� rN r� r rc Z add_moduler] ra rN rd rB r? re rT rf rQ rg )r" rj r? r� rl rM rl r� rm Z backends_ipvr! rB rN r� r� r� rn r� ro rC r� r$ r$ r% rb � sj � � � �zFirewallPolicy._servicec C s8 | j �� D ](}|jsq |�||||�}|�||� q d S r )r r= r> re r? �r" rj r? r� r� rl rB rC r$ r$ r% rc : s �zFirewallPolicy._portc C s6 | j �� D ]&}|jsq |�|||�}|�||� q d S r )r r= r> rf r? )r" rj r? r� rl rB rC r$ r$ r% rd C s zFirewallPolicy._protocolc C s8 | j �� D ](}|jsq |�||||�}|�||� q d S r )r r= r> rg r? rp r$ r$ r% re K s zFirewallPolicy._source_portc C s8 d}|� t|� | j�|�}|�||�}|�||� d S )Nr� )r� r r rS ri r? )r" rj r? rl r! rB rC r$ r$ r% rf S s zFirewallPolicy._masqueradec C sX t d|�rd}nd}|r(|r(|�t|� | j�|�} | �||||||�} |�| | � d S )Nr� r� )r r� r r rS rj r? ) r" rj r? rl r� r� r" r# r! rB rC r$ r$ r% ra [ s �z FirewallPolicy._forward_portc C sz | j j�|�}| j �� D ]\}|js$qd}|jrTdD ] }||jv r2|�|�s2d} qTq2|rZq|�|||�} |�|| � qd S )NFrQ T) r r^ r_ r= r> rN ra rk r? ) r" rj r? r, rl rP rB Z skip_backendr! rC r$ r$ r% r` j s zFirewallPolicy._icmp_blockc C sb | j | j}|dv rd S | �|�s.|dkr.d S | j�� D ]$}|jsDq8|�||�}|�||� q8d S )N)ZDROPz %%REJECT%%ZREJECTZACCEPT)r! �targetr; r r= r> Z'build_policy_icmp_block_inversion_rulesr? )r" rj r? rl rq rB rC r$ r$ r% r4 s z$FirewallPolicy._icmp_block_inversionc C s& t | j�}| �|||� |�d� d S r )r r r\ ri )r" rj r? rl r$ r$ r% �!_ingress_egress_zones_transaction� s z0FirewallPolicy._ingress_egress_zones_transactionc C s | j | }|j}|j}t� }t� }t� } t� } |D ]:} | dv r@q2|t| jj�| ��O }| t| jj�| ��O } q2|D ]:} | dv r�qr|t| jj�| ��O }| t| jj�| ��O } qr| j�� D ]D} | j s�q�| � |�D ],\} }| � ||| |||| | �}|� | |� q�q�d S )N)r: r9 ) r! r< r> r; r r= Zlist_interfacesZ list_sourcesr= r> rY Z!build_policy_ingress_egress_rulesr? )r" rj r? rl rC r< r> Zingress_interfacesZegress_interfacesZingress_sourcesZegress_sourcesr= rB rm rn rC r$ r$ r% r\ � s4 �z$FirewallPolicy._ingress_egress_zonesc C s | j | }d|jv r<d|jv r<g d�}| jjs8|�d� |S d|jv rbdg}| jjs^|�d� |S d|jv rtddgS d|jv r�d|jv r�g d�}| jjs�|�d� |S d|jv �rg d �}| jjs�|�d� | jjd kr�|�d � n,|jD ]}| jj�|�j r� �qq�|�d � |S d|jv �rzd d g}| jj�s<|�d� |jD ] }| jj�|�j �rB �qv�qB|�d � |�d� |S d g}| jj�s�|�d� | jjd k�r�|�d � n0|jD ] }| jj�|�j �r� �qސq�|�d � |jD ] }| jj�|�j �r� �q�q�|�d � |�d� |S dS )z:Create a list of (table, chain) needed for policy dispatchr: r9 )�r� ZINPUT�rW � PREROUTING��mangleru ��rawru rs )r� �OUTPUT)rW rz )�r� ZFORWARDrt �rW Z POSTROUTINGrv �r{ rt rv Znftablesr| r{ rt rv N) r! r< r> r �nftables_enabledr4 Z_firewall_backendr= Zget_zoneZ interfaces)r" r? rC �tcr= r$ r$ r% rY � sl z4FirewallPolicy._get_table_chains_for_policy_dispatchc C sf | j | }d|jv r0dg}| jjs,|�d� |S d|jv rBg d�S d|jv rRdgS ttjd| ��dS ) z8Create a list of (table, chain) needed for zone dispatchr9 rs rx r: r} r| zInvalid policy: %sN) r! r> r r~ r4 r< r r �INVALID_POLICY)r" r? rC r r$ r$ r% rZ s z2FirewallPolicy._get_table_chains_for_zone_dispatchFc C s� | j j�|�}|jr |j}n|| }d|jv rh|dkr>d| S |dkrNd| S |jsd|dv rdd| S �nd|jv r�|js�|dv r�d| S n�d |jv r�|dkr�d | S |d kr�|r�d | S d| S n|d v r�d| S n�d |jv �r.|dkr�d | S |d k�r|�rd | S d| S n|d v �r||j�s|d| S nN|j�s||dk�rHd | S |d k�rj|�r`d | S d| S n|d v �r|d| S ttjd|||f ��d S )Nr9 r� ZIN_ry ZPRE_)rw rW )r� rW ZOUT_r: ZFWD_rW ZPOST_)rw ry z.Can't convert policy to chain name: %s, %s, %s) r r? r2 r3 r> r< r r r� )r" r? rm Z policy_prefixZisSNATrC �suffixr$ r$ r% �policy_base_chain_name! sZ z%FirewallPolicy.policy_base_chain_name)N)N)N)N)r NNT)N)r NNT)N)r NN)N)r NN)N)r NN)N)r NN)N)r NN)N)r NN)N)NN)NN)NNr NN)NNN)NN)r NN)N)NN)N)N)N)NN)F)��__name__� __module__� __qualname__r& r) r+ r. r1 r8 r@ r2 rD rG rK rL rq rJ rF ru r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� rg ry r� r| r� r� r� r� r� r r� r� r� r� r� r� r� r� r� r� r� r� r� r r r r r r� r r� r r r r r� r r� r r r r� r r� r r r$ r% r� r& r� r' r) r* r- r. r� r/ r� r0 r2 r3 r7 r5 r6 r: r9 r; r[ r@ r� rK rJ r� r� r� rb rc rd re rf ra r` r4 rr r\ rY rZ r� r$ r$ r$ r% r s> F 5 � & # � & # � � � � � (� ) � � � (� ) � � � � � � ' ' I @ � Vr )%r� Zfirewall.core.loggerr Zfirewall.functionsr r r r r r r r r r r r~ r r r r r r r r r r r Z firewall.core.fw_transactionr Zfirewallr Zfirewall.errorsr Zfirewall.core.baser �objectr r$ r$ r$ r% �<module> s 44 core/__pycache__/watcher.cpython-39.pyc 0000644 00000005362 15025011705 0013774 0 ustar 00 a ���g� � @ s* d gZ ddlmZmZ G dd � d e�ZdS )�Watcher� )�Gio�GLibc @ sd e Zd Zdd� Zdd� Zdd� Zdd� Zd d � Zd d � Zd d� Z dd� Z dd� Z dd� Z dd� Z dS )r c C s" || _ || _i | _i | _g | _d S �N)� _callback�_timeout� _monitors� _timeouts�_blocked)�self�callback�timeout� r �9/usr/lib/python3.9/site-packages/firewall/core/watcher.py�__init__ s zWatcher.__init__c C s: t j�|�}|�t jjd �| j|< | j| �d| j� d S �NZchanged) r �File� new_for_pathZmonitor_directory�FileMonitorFlags�NONEr �connect�_file_changed_cb)r Z directory�gfiler r r � add_watch_dir" s � zWatcher.add_watch_dirc C s: t j�|�}|�t jjd �| j|< | j| �d| j� d S r ) r r r Z monitor_filer r r r r )r �filenamer r r r �add_watch_file( s � zWatcher.add_watch_filec C s | j �� S r )r �keys)r r r r � get_watches. s zWatcher.get_watchesc C s || j v S r �r �r r r r r � has_watch1 s zWatcher.has_watchc C s | j |= d S r r r r r r � remove_watch4 s zWatcher.remove_watchc C s || j vr| j �|� d S r )r �appendr r r r � block_source7 s zWatcher.block_sourcec C s || j v r| j �|� d S r )r �remover r r r �unblock_source; s zWatcher.unblock_sourcec C s0 t | j�� �D ] }t�| j| � | j|= qd S r )�listr r r � source_remover r r r �clear_timeouts? s zWatcher.clear_timeoutsc C s || j vr| �|� | j|= d S r )r r r r r r r �_call_callbackD s zWatcher._call_callbackc C s� |� � }|| jv r8|| jv r4t�| j| � | j|= d S |tjjksh|tjjksh|tjj ksh|tjj kr�|| jv r�t�| j| � | j|= t� | j | j |�| j|< d S r )Zget_parse_namer r r r' r ZFileMonitorEventZCHANGEDZCREATEDZDELETEDZATTRIBUTE_CHANGEDZtimeout_add_secondsr r) )r ZmonitorZgio_fileZgio_other_fileZeventr r r r r I s& � � � �zWatcher._file_changed_cbN)�__name__� __module__� __qualname__r r r r r r! r# r% r( r) r r r r r r s N)�__all__Z gi.repositoryr r �objectr r r r r �<module> s core/__pycache__/fw_ifcfg.cpython-39.opt-1.pyc 0000644 00000002627 15025011705 0015051 0 ustar 00 a ���g � @ sT d Z ddgZddlZddlZddlmZ ddlmZ ddlm Z dd� Z d d� Z dS ) z.Functions to search for and change ifcfg files�search_ifcfg_of_interface�ifcfg_set_zone_of_interface� N)�config)�log)�ifcfgc C s� t j�tj�sdS tt �tj��D ]`}|�d�s2q"dD ]}|�|�r6q6q6d|v rRq"t dtj|f �}|� � |� d�| kr"| S q"dtj| f }t j�|�r�t |�}|� � |S dS )z6search ifcfg file for the interface in config.IFCFGDIRNzifcfg-)z.bakz.origz.rpmnewz.rpmorigz.rpmsavez-range�.z%s/%sZDEVICEz %s/ifcfg-%s) �os�path�existsr ZIFCFGDIR�sorted�listdir� startswith�endswithr �read�get)� interface�filenameZignored� ifcfg_file� r �:/usr/lib/python3.9/site-packages/firewall/core/fw_ifcfg.pyr ! s( c C sl | du r d} t |�}|durh|�d�| krh|�d�du r@| dksht�d| |jf � |�d| � |�� dS )zYSet zone (ZONE=<zone>) in the ifcfg file that uses the interface (DEVICE=<interface>)N� ZZONEzSetting ZONE=%s in '%s')r r r Zdebug1r �set�write)�zoner r r r r r ? s �� ) �__doc__�__all__r Zos.pathZfirewallr Zfirewall.core.loggerr Zfirewall.core.io.ifcfgr r r r r r r �<module> s core/__pycache__/watcher.cpython-39.opt-1.pyc 0000644 00000005362 15025011705 0014733 0 ustar 00 a ���g� � @ s* d gZ ddlmZmZ G dd � d e�ZdS )�Watcher� )�Gio�GLibc @ sd e Zd Zdd� Zdd� Zdd� Zdd� Zd d � Zd d � Zd d� Z dd� Z dd� Z dd� Z dd� Z dS )r c C s" || _ || _i | _i | _g | _d S �N)� _callback�_timeout� _monitors� _timeouts�_blocked)�self�callback�timeout� r �9/usr/lib/python3.9/site-packages/firewall/core/watcher.py�__init__ s zWatcher.__init__c C s: t j�|�}|�t jjd �| j|< | j| �d| j� d S �NZchanged) r �File� new_for_pathZmonitor_directory�FileMonitorFlags�NONEr �connect�_file_changed_cb)r Z directory�gfiler r r � add_watch_dir" s � zWatcher.add_watch_dirc C s: t j�|�}|�t jjd �| j|< | j| �d| j� d S r ) r r r Z monitor_filer r r r r )r �filenamer r r r �add_watch_file( s � zWatcher.add_watch_filec C s | j �� S r )r �keys)r r r r � get_watches. s zWatcher.get_watchesc C s || j v S r �r �r r r r r � has_watch1 s zWatcher.has_watchc C s | j |= d S r r r r r r � remove_watch4 s zWatcher.remove_watchc C s || j vr| j �|� d S r )r �appendr r r r � block_source7 s zWatcher.block_sourcec C s || j v r| j �|� d S r )r �remover r r r �unblock_source; s zWatcher.unblock_sourcec C s0 t | j�� �D ] }t�| j| � | j|= qd S r )�listr r r � source_remover r r r �clear_timeouts? s zWatcher.clear_timeoutsc C s || j vr| �|� | j|= d S r )r r r r r r r �_call_callbackD s zWatcher._call_callbackc C s� |� � }|| jv r8|| jv r4t�| j| � | j|= d S |tjjksh|tjjksh|tjj ksh|tjj kr�|| jv r�t�| j| � | j|= t� | j | j |�| j|< d S r )Zget_parse_namer r r r' r ZFileMonitorEventZCHANGEDZCREATEDZDELETEDZATTRIBUTE_CHANGEDZtimeout_add_secondsr r) )r ZmonitorZgio_fileZgio_other_fileZeventr r r r r I s& � � � �zWatcher._file_changed_cbN)�__name__� __module__� __qualname__r r r r r r! r# r% r( r) r r r r r r s N)�__all__Z gi.repositoryr r �objectr r r r r �<module> s core/__pycache__/prog.cpython-39.pyc 0000644 00000001352 15025011705 0013301 0 ustar 00 a ���g� � @ s d dl Z dgZddd�ZdS )� N�runProgc C s� |d u r g }| g| }d }|rTt |d�� }|�� �� }W d � n1 sJ0 Y ddi}z tj|tjtjtjd|d�}W n ty� Y dS 0 |�|�\}} |� dd�}|j |fS ) N�r�LANG�CT)�stdin�stderr�stdoutZ close_fds�env)� � zutf-8�replace) �open�read�encode� subprocess�Popen�PIPEZSTDOUT�OSErrorZ communicate�decode� returncode) �prog�argvr �argsZ input_stringZhandler Zprocess�outputZ err_output� r �6/usr/lib/python3.9/site-packages/firewall/core/prog.pyr s& * � )NN)r �__all__r r r r r �<module> s core/__pycache__/fw_ipset.cpython-39.opt-1.pyc 0000644 00000017143 15025011705 0015116 0 ustar 00 a ���gb' � @ sf d Z dgZddlmZ ddlmZmZmZm Z ddl m Z ddl m Z ddlmZ G dd� de�Zd S ) z ipset backend� FirewallIPSet� )�log)� remove_default_create_options�normalize_ipset_entry� check_entry_overlaps_existing� check_for_overlapping_entries)�IPSet)�errors)� FirewallErrorc @ s� e Zd Zdd� Zdd� Zdd� Zdd� Zd d � Zd d � Zd d� Z d6dd�Z dd� Z dd� Z dd� Z d7dd�Zd8dd �Zd9d d �Zd d � Zd:d"d#�Zd$d%� Zd&d'� Zd(d)� Zd;d*d+�Zd,d-� Zd.d/� Zd0d1� Zd2d3� Zd4d5� ZdS )<r c C s || _ i | _d S �N)�_fw�_ipsets)�self�fw� r �:/usr/lib/python3.9/site-packages/firewall/core/fw_ipset.py�__init__# s zFirewallIPSet.__init__c C s d| j | jf S )Nz%s(%r))� __class__r �r r r r �__repr__' s zFirewallIPSet.__repr__c C s | j �� d S r )r �clearr r r r �cleanup, s zFirewallIPSet.cleanupc C s || � � vrttj|��d S r )� get_ipsetsr r Z INVALID_IPSET�r �namer r r � check_ipset/ s zFirewallIPSet.check_ipsetc C s || � � v S r )r r r r r � query_ipset3 s zFirewallIPSet.query_ipsetc C s t | j�� �S r )�sortedr �keysr r r r r 6 s zFirewallIPSet.get_ipsetsc C s t | j�dkS )Nr )�lenr r r r r � has_ipsets9 s zFirewallIPSet.has_ipsetsFc C s& | � |� | j| }|r"| �|� |S r )r r �check_applied_obj�r r �applied�objr r r � get_ipset< s zFirewallIPSet.get_ipsetc C s | j jr| j j�� rdS dS )NFT)r �nftables_enabledZdirectZhas_runtime_configurationr r r r �omit_native_ipsetC s z FirewallIPSet.omit_native_ipsetc C s< g }| j jr|�| j j� | j jr8| �� s8|�| j j� |S r )r r& �appendZnftables_backendZ ipset_enabledr' Z ipset_backend)r �backendsr r r r) K s zFirewallIPSet.backendsc C s0 |j | jjvr ttjd|j ��|| j|j< d S )Nz '%s' is not supported by ipset.)�typer Zipset_supported_typesr r Z INVALID_TYPEr r �r r$ r r r � add_ipsetS s �zFirewallIPSet.add_ipsetc C s| | j | }|jrd|sdz | �� D ]}|�|� q W qp ty` } zttj|��W Y d }~qpd }~0 0 n t� d|� | j |= d S )Nz,Keeping ipset '%s' because of timeout option) r r# r) � set_destroy� Exceptionr r �COMMAND_FAILEDr �debug1)r r Zkeepr$ �backend�msgr r r � remove_ipsetY s $ zFirewallIPSet.remove_ipsetNc C s, | j | }|r|n| �� D �] }|jdkr�|�� }||v r�d|jvsz|jd dksz|j|| d kszt|j�|| d kr�z|�|� W n0 ty� } zt t j |��W Y d }~n d }~0 0 | j j �r�z|�|j|j|j� W n2 t�y } zt t j |��W Y d }~n.d }~0 0 d|_d|jv �r4|jd dk�r4qz|�|j� W n2 t�yv } zt t j |��W Y d }~n d }~0 0 |jD ]L}z|�|j|� W n2 t�y� } zt t j |��W Y d }~n d }~0 0 �q~qz |�|j|j|j|jd � W n2 t�y } zt t j |��W Y d }~qd }~0 0 d|_qd S )N�ipset�timeout�0r � T)r r) r Zset_get_active_terse�optionsr* �rm_def_cr_optsr- r. r r r/ r �_individual_callsZ set_creater# � set_flush�entries�set_add� set_restore)r r r) r$ r1 Zactiver2 �entryr r r � apply_ipsete sX �� ��" " �" ( �"zFirewallIPSet.apply_ipsetc C s< | � � D ].}| j| }d|_t�d| � | �||� qd S )NFzApplying ipset '%s')r r r# r r0 r@ )r r) r r$ r r r � apply_ipsets� s zFirewallIPSet.apply_ipsetsc C sz | � � D ]l}|jdkrq| �� D ]R}z| �|� |�|� W q typ } z |jtjkr\|�W Y d }~q d }~0 0 q qd S )NZnftables) r) r r � check_appliedr- r �coder � NOT_APPLIED)r r1 r4 r2 r r r �flush� s zFirewallIPSet.flushTc C s | j ||d�jS )N�r# )r% r* )r r r# r r r �get_type� s zFirewallIPSet.get_typec C s t | j|dd�j�d��S )NTrF �,)r r% r* �splitr r r r � get_dimension� s zFirewallIPSet.get_dimensionc C s | � |�}| �|� d S r )r% r! �r r r$ r r r rB � s zFirewallIPSet.check_appliedc C s |j sttj|j��d S r )r# r r rD r r+ r r r r! � s �z FirewallIPSet.check_applied_objc C s. | j ||d�}d|jv r*|jd dkr*dS dS )NrF ZfamilyZinet6Zipv6Zipv4)r% r8 r" r r r � get_family� s zFirewallIPSet.get_familyc C s� | j |dd�}t|�}t�||j|j� ||jv rFttj d||f ��t ||j� z | � � D ]}|� |j |� q\W n0 ty� } zttj|��W Y d }~n.d }~0 0 d|jvs�|jd dkr�|j�|� d S )NTrF z'%s' already is in '%s'r5 r6 )r% r r � check_entryr8 r* r< r r ZALREADY_ENABLEDr r) r= r r. r/ r( �r r r? r$ r1 r2 r r r � add_entry� s � "zFirewallIPSet.add_entryc C s� | j |dd�}t|�}||jvr4ttjd||f ��z | �� D ]}|�|j|� q>W n0 t y� } zttj |��W Y d }~n.d }~0 0 d|j vs�|j d dkr�|j� |� d S )NTrF z'%s' not in '%s'r5 r6 ) r% r r< r r Z NOT_ENABLEDr) Z set_deleter r. r/ r8 �removerN r r r � remove_entry� s � "zFirewallIPSet.remove_entryc C sD | j |dd�}t|�}d|jv r:|jd dkr:ttj|��||jv S �NTrF r5 r6 )r% r r8 r r ZIPSET_WITH_TIMEOUTr< )r r r? r$ r r r � query_entry� s zFirewallIPSet.query_entryc C s | j |dd�}|jS )NTrF )r% r< rK r r r � get_entries� s zFirewallIPSet.get_entriesc C s4 | j |dd�}t|� |D ]}t�||j|j� qd|jvsJ|jd dkrP||_z | �� D ]}|�|j � qZW n0 t y� } zt t j |��W Y d }~nd }~0 0 d|_zP| �� D ]B}| jjr�|jD ]}|�|j |� q�q�|�|j |j|j|jd � q�W n2 t �y( } zt t j |��W Y d }~nd }~0 0 d|_d S rR )r% r r rM r8 r* r< r) r; r r. r r r/ r# r r: r= r> )r r r< r$ r? r1 r2 r r r � set_entries� s0 " � "zFirewallIPSet.set_entries)F)F)N)N)T)T) �__name__� __module__� __qualname__r r r r r r r r% r' r) r, r3 r@ rA rE rG rJ rB r! rL rO rQ rS rT rU r r r r r " s2 1 N)�__doc__�__all__Zfirewall.core.loggerr Zfirewall.core.ipsetr r9 r r r Zfirewall.core.io.ipsetr Zfirewallr Zfirewall.errorsr �objectr r r r r �<module> s core/__pycache__/nftables.cpython-39.opt-1.pyc 0000644 00000125343 15025011705 0015076 0 ustar 00 a ���gɆ � % @ s� d dl Z d dlZd dlZd dlmZ d dlmZmZmZm Z m Z d dl m Z m Z mZmZmZmZmZ d dlmZmZmZmZmZmZmZmZm Z d dl m Z d dl m Z dZ!e!d d Z"e!d d Z#d Z$d Z%i ddde% fidde% fdde% fdde% fd�dd e% fdd e% fdd e% fdd e% fd�d�Z&dEdd�Z'e'd d d �e'd d �e'd d �e'd d �e'd d d!�e'd d d"�e'd d d �e'd d#d$�e'd d d%�e'd d d$�e'd d&d$�e'd d d'�e'd d#d �e'd d d(�e'd d d �e'd d&�e'd d d)�e'd d d*�e'd d d+�e'd d#�e'd d&d$�e'd d,�e'd d-�e'd d.�e'd d d/�e'd d0�e'd d1�e'd d2�e'd d#d)�e'd d d3�e'd d#d+�e'd d d4�e'd d0d$�e'd d0d �d5�"e'd6d d)�e'd6d&d �e'd6d d+�e'd6d d$�e'd6d �e'd6d �e'd6d �e'd6d d/�e'd6d7�e'd6d8�e'd6d9�e'd6d:�e'd6d;�e'd6d<�e'd6d d �e'd6d=�e'd6d&�e'd6d d!�e'd6d>�e'd6d d(�e'd6d?�e'd6d@�e'd6d0�e'd6d0d$�e'd6d0d �e'd6d&d$�e'd6d&d+�dA�dB�Z(G dCdD� dDe)�Z*dS )F� N)�log)� check_mac� getPortRange� normalizeIP6�check_single_address� check_address)� FirewallError� UNKNOWN_ERROR� INVALID_RULE�INVALID_ICMPTYPE� INVALID_TYPE� INVALID_ENTRY� INVALID_PORT) � Rich_Accept� Rich_Reject� Rich_Drop� Rich_Mark�Rich_Masquerade�Rich_ForwardPort�Rich_IcmpBlock�Rich_Tcp_Mss_Clamp� Rich_NFLog)�DEFAULT_ZONE_TARGET)�NftablesZ firewalld�_Z policy_dropZprobeZpolicy_� � PREROUTING� preroutingij���i����Z postrouting�d �output)r � POSTROUTING�OUTPUT�inputZforward)r �INPUT�FORWARDr! )�raw�mangle�nat�filterc C sH dd| dd�id|d�ig}|d urD|� dd| dd�id|d�i� |S )N�match�payload�type��protocol�field�==��left�op�right�code)�append)r- r+ r4 � fragments� r7 �:/usr/lib/python3.9/site-packages/firewall/core/nftables.py�_icmp_types_fragmentsT s � � r9 �icmp�destination-unreachable� � echo-reply� echo-request� � �redirect� � �parameter-problem� � � � � �router-advertisement�router-solicitation� source-quench� � time-exceeded�timestamp-reply�timestamp-request� � )"�communication-prohibitedr; r= r> zfragmentation-neededzhost-precedence-violation�host-prohibitedz host-redirectz host-unknown�host-unreachablez ip-header-badznetwork-prohibitedznetwork-redirectznetwork-unknownznetwork-unreachablerD �port-unreachablezprecedence-cutoffzprotocol-unreachablerA zrequired-option-missingrJ rK rL zsource-route-failedrN rO rP ztos-host-redirectztos-host-unreachableztos-network-redirectztos-network-unreachable�ttl-zero-during-reassembly�ttl-zero-during-transit�icmpv6�mld-listener-done�mld-listener-query�mld-listener-report�mld2-listener-reportznd-neighbor-advert�nd-neighbor-solicit�packet-too-bigz nd-redirect�nd-router-advertznd-router-solicit)zaddress-unreachablez bad-headerz beyond-scoperS r; r= r> z failed-policyrZ r[ r\ r] zneighbour-advertisementzneighbour-solicitation�no-router_ rD rV rA z reject-routerJ rK rN rW rX zunknown-header-typezunknown-option��ipv4�ipv6c @ sh e Zd Zd ZdZdd� Zdd� Zdd� Zdd � Zd d � Z d d � Z dd� Z dd� Z dd� Z d�dd�Zdd� Zdd� Zdd � Zd d � Zd d � Zd�d!d"�Zd#d$� Zd�d&d'�Zd(d)� Zd*d+� Zd�d-d.�Zd/d0� Zd1d2� Zd3d4� Z d5d6� Z d7d8� Z d9d:� Z d;d<� Z d=d>� Z!d?d@� Z"dAdB� Z#dCdD� Z$dEdF� Z%dGdH� Z&dIdJ� Z'dKdL� Z(dMdN� Z)d�dOdP�Z*dQdR� Z+dSdT� Z,dUdV� Z-dWdX� Z.d�dYdZ�Z/d�d[d\�Z0d�d]d^�Z1d�d_d`�Z2dadb� Z3d�dcdd�Z4d�dedf�Z5d�dgdh�Z6didj� Z7d�dkdl�Z8dmdn� Z9d�dodp�Z:dqdr� Z;dsdt� Z<dudv� Z=dwdx� Z>d�dydz�Z?d�d{d|�Z@d}d~� ZAd�dd��ZBd�d�� ZCd�d�� ZDd�d�� ZEd�d�� ZFd�d�� ZGd�d�� ZHd�d�� ZId�d�d��ZJdS )��nftablesTc C sZ || _ d| _d| _g | _i | _i | _i | _i | _i | _t � | _ | j � d� | j � d� d S )NTF) �_fwZrestore_command_exists�supports_table_ownerZavailable_tables�rule_to_handle�rule_ref_count�rich_rule_priority_counts�policy_priority_counts�zone_source_index_cacher re �set_echo_outputZset_handle_output)�self�fwr7 r7 r8 �__init__� s znftables.__init__c C s z�ddddiidddt dd gd �iigi}| j�|�\}}}|rHtd ��ddddiid ddt d �iigi}| j�d� | j�|�\}}}| j�d� |d d d d }| �dddt d �ii| j�� � d|vs�d |vr�td ��t� d� d| _ W n t� d� d| _ Y n0 d S )Nre �metainfo�json_schema_versionrB �add�table�inet�owner�persist)�family�name�flagsz!nftables probe table owner failed�list�rx ry FTrz �deletez3nftables: probe_support(): owner flag is supported.z7nftables: probe_support(): owner flag is NOT supported.) �TABLE_NAME_PROBEre �json_cmd� ValueErrorrm �set_rulerf �get_log_deniedr �debug2rg )rn �rules�rcr r rz r7 r7 r8 �_probe_support_table_owner� sH ����� �� � z#nftables._probe_support_table_ownerc C s | � � d S �N)r� �rn r7 r7 r8 � probe_support� s znftables.probe_supportc C sx dD ]}||v r qqd|| d v r^|| d d d || d d d f}|| d d= n(d|| d v r�d }|| d d= nd S || d d }|r�|dkr�||v r�||| v r�|| � |� n�|dk�rt||vr�g ||< |�r&||| v�r|| �|� || jd d � d � || �|�}n t|| �}|| }||= |d k�rT||d < n |d8 }||d< ||d d d< d S )N�rs �insertr} �%%ZONE_SOURCE%%�rule�zone�address�%%ZONE_INTERFACE%%rx r} c S s | d S )Nr r7 )�xr7 r7 r8 �<lambda> � z3nftables._run_replace_zone_source.<locals>.<lambda>)�keyr r� rB rs �index)�remover5 �sortr� �len)rn r� rl �verbZ zone_sourcerx r� � _verb_snippetr7 r7 r8 �_run_replace_zone_source� sD � � z!nftables._run_replace_zone_sourcec C sB d|v rdt �|d �iS d|v r4dt �|d �iS ttd��d S )Nr� r} rs zFailed to reverse rule)�copy�deepcopyr r )rn �dictr7 r7 r8 � reverse_rule s znftables.reverse_rulec C s� dD ]}||v r qq||| d v �r�|| d | }|| d |= t |�tkr\ttd��|| d d || d d f}|dkr�||vs�||| vs�|| | dkr�ttd��|| | d 8 < n�||vr�i ||< ||| vr�d|| |< d}t|| �� �D ]J}||k�r"|d k�r" �qP||| | 7 }||k�r|d k�r �qP�q|| | d 7 < || } ||= |dk�r�| |d < n |d 8 }| |d < ||d d d < d S ) Nr� r� z%priority must be followed by a numberrx �chainr} r z*nonexistent or underflow of priority countrB r� rs r� )r+ �intr r r �sorted�keys) rn r� Zpriority_counts�tokenr� �priorityr� r� �pr� r7 r7 r8 �_set_rule_replace_priority sH �� z#nftables._set_rule_replace_priorityc C sb dD ]X}||v rd|| v rt �|| d �}dD ]}||v r2||= q2tj|dd�}| S qd S )Nr� r� )r� �handleZpositionT)Z sort_keys)r� r� �json�dumps)rn r� r� �rule_keyZnon_keyr7 r7 r8 � _get_rule_keyN s znftables._get_rule_keyc C sX g d�}g d�}g }g }t �| j�}t �| j�}t �| j�} | j� � } |D �]�} t| �tkrjtt d| ��|D ]} | | v rn q�qn| | vr�tt d| ��| � | �} | | v �r4t � d| j| | | � | dkr�| | d7 < qJnV| | dkr�| | d8 < qJn6| | dk�r | | d8 < ntt d| | | f ��n| �rL| dk�rLd| | < |�| � t �| �}| �r�ttd || d d ��|| d d < | �||d � | �||d � | �|| � | dk�r�dd |d d d |d d d |d d d | j| d�ii}|�|� qJddddiig| i}t �� dk�rDt �d| jt�|�� | j�|�\}}}|dk�rxtdd|t�|�f ��|| _|| _| | _| | _d}|D ]�} |d7 }| � | �} | �s��q�d| v �r�| j| = | j| = �q�|D ] } | |d | v �r� �q��q�| |d | v�r�q�t |d | | d d k�r2�q�|d | | d d | j| < �q�d S )N)rs r� r} �flush�replace)rs r� r� z#rule must be a dictionary, rule: %sz no valid verb found, rule: %sz %s: prev rule ref cnt %d, %sr} rB z)rule ref count bug: rule_key '%s', cnt %dr� �expr�%%RICH_RULE_PRIORITY%%�%%POLICY_PRIORITY%%rx rt r� )rx rt r� r� re rq rr rG z.%s: calling python-nftables with JSON blob: %sr z '%s' failed: %s JSON blob: %szpython-nftablesr� ) r� r� rj rk rl ri r+ r� r r r r� r r� � __class__r5 r{ r( r� r� rh ZgetDebugLogLevelZdebug3r� r� re r r� �TABLE_NAME_POLICY)rn r� � log_deniedZ _valid_verbsZ_valid_add_verbsZ_deduplicated_rulesZ_executed_rulesrj rk rl ri r� r� r� Z_ruleZ json_blobr� r �errorr� r7 r7 r8 � set_rules\ s� � � & � � znftables.set_rulesc C s | � |g|� dS )N� )r� )rn r� r� r7 r7 r8 r� � s znftables.set_ruleNc C s |r |gS t �� S r� )�IPTABLES_TO_NFT_HOOKr� �rn rt r7 r7 r8 �get_available_tables� s z nftables.get_available_tablesc C sB ddd|d�ii}|t kr<| jjr<| jr<ddg|d d d< |gS )Nrs rt ru r| rv rw rz )� TABLE_NAMErf Z_nftables_table_ownerrg )rn rt r� r7 r7 r8 �_build_add_table_rules� s ���z nftables._build_add_table_rulesc C s | � |�ddd|d�iig S )Nr} rt ru r| )r� r� r7 r7 r8 �_build_delete_table_rules� s �z"nftables._build_delete_table_rulesc C s( i | _ i | _i | _i | _i | _| �t�S r� )rh ri rj rk rl r� r� r� r7 r7 r8 �build_flush_rules� s znftables.build_flush_rulesc C sP ddd�| }|ddt dd|f dd d d iid d ddgid�idd igd�iiS )Nrs r} �TFr� ru �%s_%sr( r) �ctr� �state�in�set� established�relatedr0 �accept�rx rt r� r� )r� )rn �enable�hook�add_delr7 r7 r8 � _build_set_policy_rules_ct_rule� s ���z(nftables._build_set_policy_rules_ct_rulec C sN g }|dkrZ|� | �t�� dD ]6}|�dddtdd|f d|d t d d d �ii� q n�|d k�r&|� | �t�� dD ]�}|| }|�� }d|� �}|�dddt|d|dt d d d �ii� |�| �d|�� |dkr�dd i}n |d kr�d d i}ndddd�i}|�dddt||gd�ii� qxn$|dk�r@|| �t�7 }n tt d��|S )NZPANIC)r r rs r� ru r� r% r( i���rB �drop)rx rt ry r+ r� �prio�policy�DROP)r# r$ r! Zfilter_r T�ACCEPTr� �reject�icmpx�admin-prohibited�r+ r� r� r� znot implemented) �extendr� r� r5 �NFT_HOOK_OFFSET�lowerr� r� r r )rn r� Zpolicy_detailsr� r� Zd_policyZ chain_nameZ expr_fragmentr7 r7 r8 �build_set_policy_rules� s` � � ����� z nftables.build_set_policy_rulesc C s8 t � }|r|gnt�� D ]}|�t| �� � qt|�S r� )r� �ICMP_TYPES_FRAGMENTSr� �updater{ )rn �ipvZ supportedZ_ipvr7 r7 r8 �supported_icmp_types5 s z nftables.supported_icmp_typesc C s | � t�S r� )r� r� r� r7 r7 r8 �build_default_tables? s z nftables.build_default_tables�offc C s" g }t d �� D ]�}|�dddtd| ddt d | d t d | d d �ii� d D ]&}|�dddtd ||f d �ii� qXdD ]6}|�dddtd| ddd ||f iigd�ii� q�qt d �� D �] }|�dddtd| ddt d | d t d | d d �ii� |dv �r|dD ]Z}|�dddtd||f d �ii� |�dddtd| ddd||f iigd�ii� �q q�d D ](}|�dddtd||f d �ii� �q�dD ]8}|�dddtd| ddd||f iigd�ii� �q�q�t d �� D ]F}|�dddtd| ddt d | d t d | d d �ii� �q�|�dddtdd ddd d iid d d d!gid"�id#d igd�ii� |�dddtdd ddd d$iid d%d"�id#d igd�ii� |�dddtdd dd&d d'iid(d)d"�id#d igd�ii� |d*k�rR|�dddtdd ddd d iid d d+gid"�i| �|�d,d-d.iigd�ii� |�dddtdd ddd d iid d d+gid"�id/d igd�ii� d D ](}|�dddtd0d|f d �ii� �q�dD ]8}|�dddtdd ddd0d|f iigd�ii� �q�|d*k�r<|�dddtdd | �|�d,d-d1iigd�ii� |�dddtdd d2d3d4d5�igd�ii� |�dddtdd6 ddd d iid d d d!gid"�id#d igd�ii� |�dddtdd6 ddd d$iid d%d"�id#d igd�ii� |�dddtdd6 dd&d d'iid(d)d"�id#d igd�ii� |d*k�r||�dddtdd6 ddd d iid d d+gid"�i| �|�d,d-d.iigd�ii� |�dddtdd6 ddd d iid d d+gid"�id/d igd�ii� d7D ](}|�dddtd0d6|f d �ii� �q�dD ]Z}|�dddtd0d6|f d �ii� |�dddtdd6 ddd0d6|f iigd�ii� �q�d8D ](}|�dddtd0d6|f d �ii� �qP|d*k�r�|�dddtdd6 | �|�d,d-d1iigd�ii� |�dddtdd6 d2d3d4d5�igd�ii� |�dddtdd9 ddd d iid d d d!gid"�id#d igd�ii� |�dddtd:dd&d d;iid(d)d"�id#d igd�ii� d7D ]Z}|�dddtd0d9|f d �ii� |�dddtdd9 ddd0d9|f iigd�ii� �qbd8D ]Z}|�dddtd0d9|f d �ii� |�dddtdd9 ddd0d9|f iigd�ii� �q�|S )<Nr& rs r� ru z mangle_%sr( �%sr rB )rx rt ry r+ r� r� )� POLICIES_pre�ZONES� POLICIES_postz mangle_%s_%s�rx rt ry )r� r� �jump�targetr� r' znat_%s)r! )r� r� � nat_%s_%sz filter_%sr# r) r� r� r� r� r� r� r� r0 r� �status�dnat�meta�iifnamer/ �lor� Zinvalidr �prefixzSTATE_INVALID_DROP: r� � filter_%s_%szFINAL_REJECT: r� r� r� r� r$ )r� )r� r! � filter_OUTPUT�oifname)r� r� r5 r� �_pkttype_match_fragment)rn r� Z default_rulesr� Zdispatch_suffixr7 r7 r8 �build_default_rulesB s � � � � � � � � � ��� ��� ��� � �� ��� � � �� � ��� ��� ��� � �� ��� � � � � �� � ��� ��� � � � �z nftables.build_default_rulesc C s2 |dkrddgS |dkr dgS |dkr.ddgS g S )Nr( r# r$ r& r r' r r7 r� r7 r7 r8 �get_zone_table_chains s z nftables.get_zone_table_chainsc sJ �j j�|���jdk r dnd��dkr4�dkr4dnd} �j j�|�t| �� g } g } g } g } |D ]V}|t|�d d kr�| �d d d d iid|d t|�d � d d�i� q`| �|� q`|D ]X}|t|�d d k�r | �d d d diid|d t|�d � d d�i� q�| �|� q�| �r>| �d d d d iidd| id�i� | �rf| �d d d diidd| id�i� |�r�|D ]}| ���d|�� �qp|�r�|D ]}| ���d|�� �q�� ������fdd�}g }| �r| D ]:}| �r�| D ]}|�|||�� �q�n|�||d �� �q�n4| �r6| D ]}|�|d |�� �q n|�|d d �� |S )Nr �pre�postr' r TFrB �+r) r� r� r� r/ �*r0 r� r� �saddr�daddrc s� | rT|rTd| d d v rTd|d d v rT| d d d d |d d d d krTd S g }| rf|� | � |rt|� |� |� ddd�� f ii� dtd ���f |d �}|������ �r�d d |iiS d d |iiS d S )Nr* r) r1 r- r� r� r� ru z%s_%s_POLICIES_%sr� rs r� r} )r5 r� r� �_policy_priority_fragment)�ingress_fragment�egress_fragment�expr_fragmentsr� ��_policyr� � chain_suffixr� �p_objrn rt r7 r8 � _generate_policy_dispatch_ruleR s0 ��� � zRnftables.build_policy_ingress_egress_rules.<locals>._generate_policy_dispatch_rule) rf r� � get_policyr� �policy_base_chain_name�POLICY_CHAIN_PREFIXr� r5 �_rule_addr_fragment)rn r� r� rt r� Zingress_interfacesZegress_interfacesZingress_sourcesZegress_sources�isSNATZingress_fragmentsZegress_fragmentsZ$ingress_interfaces_without_wildcardsZ#egress_interfaces_without_wildcardsZingress_interfaceZegress_interface�src�dstr r� r� r� r7 r� r8 �!build_policy_ingress_egress_rules! sf � � � � z*nftables.build_policy_ingress_egress_rulesFc C sN |dkr|dkrdnd}| j jj||t|d�} dddddd�| } |t|�d d krn|d t|�d � d }d } |d kr�| d d|| f iig} n,ddd| iid|d�i| d d|| f iig} |r�|s�d} dtd||f | d�}|�| �� � nP|�rd} dtd||f | d�}n.d} dtd||f | d�}|�s@|�| �� � | d|iigS )Nr' r TF�r r� r� �r r r# r$ r! rB r� r� �gotor� r� r) r� r� r/ r0 r� ru � %s_%s_ZONESr� rs r} r� )rf r� r r r� r� r� �_zone_interface_fragment)rn r� r� r� � interfacert r� r5 r r� �opt�actionr� r� r� r7 r7 r8 �!build_zone_source_interface_rules� sZ �� �� � � �z*nftables.build_zone_source_interface_rulesc C s� |dkr|dkrdnd}| j jj||t|d�}ddd�| } d d d d d d �| } d } d td||f | �| |�| dd||f iigd�} | �| �||�� | d| iigS )Nr' r TFr r� r} r� r� r� r r ru r r� r� r� r� )rf r� r r r� r r� �_zone_source_fragment) rn r� r� r� r� rt r� r r� r� r r r� r7 r7 r8 � build_zone_source_address_rules� s* �� ��z(nftables.build_zone_source_address_rulesc C sp ddd�| }|dkr"|dkr"dnd}| j jj||t|d�}| j j�|�}g } | �|d d td ||f d �ii� d D ](} | �|d d td||| f d �ii� qt|jr�| �ddd td ||f ddd||df iigd�ii� d D ]<} | �|dd td ||f ddd||| f iigd�ii� q�|j�r^| �ddd td ||f ddd||df iigd�ii� | j jj| j } | j � � dk�r�|dk�r�| t dddfv �r�| } | t dfv �r�d} | �|dd td ||f | � | j � � �ddd || f iigd�ii� |dk�r^| t d dddfv �r^| t ddfv �r,| � � } n | �� d i} | �|dd td ||f | gd�ii� |�sl| �� | S ) Nrs r} r� r' r TFr r� ru r� r� )r� r �deny�allowr� �%s_%s_%sr� r� r� r� r� r� r� r( ZREJECTz %%REJECT%%r� r r� zfilter_%s_%s: r� )rf r� r r r r5 r� Zderived_from_zoneZ _policiesr� r� r r� �_reject_fragmentr� �reverse)rn r� r� rt r� r� r r� r r� r r� Z log_suffix�target_fragmentr7 r7 r8 �build_policy_chain_rules� sx � � � � � �� � � z!nftables.build_policy_chain_rulesc C s< |dkr i S |dv r,ddddiid|d�iS t td |��d S ) N�all)�unicast� broadcastZ multicastr) r� r� �pkttyper/ r0 zInvalid pkttype "%s"�r r )rn r r7 r7 r8 r� s �z nftables._pkttype_match_fragmentc C s dddd�idddd�idddd�idddd�idddd�idddd�idddd�idddd�idddd�idddd�iddd d�iddd d�iddd d�iddd d�idd d d�iddd d�iddd d�iddd d�iddd d�idddd�idddd�idddiidddiid�}|| S )Nr� r: rT r� znet-prohibitedr� rY znet-unreachablerU rV r� zprot-unreachablezaddr-unreachablera r+ z tcp reset)zicmp-host-prohibitedz host-prohibzicmp-net-prohibitedz net-prohibzicmp-admin-prohibitedz admin-prohibzicmp6-adm-prohibitedzadm-prohibitedzicmp-net-unreachablez net-unreachzicmp-host-unreachablez host-unreachzicmp-port-unreachablezicmp6-port-unreachablez port-unreachzicmp-proto-unreachablez proto-unreachzicmp6-addr-unreachable� addr-unreachzicmp6-no-routera z tcp-resetztcp-rstr7 )rn Z reject_typeZfragsr7 r7 r8 �_reject_types_fragment s2 � z nftables._reject_types_fragmentc C s dddd�iS )Nr� r� r� r� r7 r� r7 r7 r8 r 9 s �znftables._reject_fragmentc C s ddddiiddddgid �iS ) Nr) r� r� �l4protor/ r� r: rY r0 r7 r� r7 r7 r8 �_icmp_match_fragment= s �z nftables._icmp_match_fragmentc C sn |si S ddddd�}z|j �d�}W n tyB ttd��Y n0 dt|j d |� �||j |d d �iS ) N�secondZminuteZhourZday)�s�m�h�d�/zExpected '/' in limit�limitr rB )ZrateZper)�valuer� r� r r r� )rn r, Z rich_to_nft�ir7 r7 r8 �_rich_rule_limit_fragmentB s � �z"nftables._rich_rule_limit_fragmentc C s� t |j�ttttfv rn<|jrJt |j�ttt t fvrTt t dt |j� ��n t t d��|j dkr�t |j�tttfv s�t |j�tt fv r�dS t |j�tfv s�t |j�tt fv r�dS n|j dk r�dS dS d S )N�Unknown action %szNo rule action specified.r r r r� r� )r+ �elementr r r r r r r r r r r r� �rn � rich_ruler7 r7 r8 �_rich_rule_chain_suffixU s$ �� z nftables._rich_rule_chain_suffixc C s: |j s|jsttd��|jdkr$dS |jdk r2dS dS d S )NzNot log or auditr r r� r� )r �auditr r r� r2 r7 r7 r8 � _rich_rule_chain_suffix_from_logk s z)nftables._rich_rule_chain_suffix_from_logc C s dd iS )Nr� r7 r� r7 r7 r8 r v s z!nftables._zone_interface_fragmentc C sN t d|�rt|�}n,td|�r@|�d�}t|d �d |d }d||d�iS )Nrd r+ r rB r� )r� r� )r r r �split)rn r� r� Z addr_splitr7 r7 r8 r y s z nftables._zone_source_fragmentc C s d|j iS )Nr� �r� )rn r� r7 r7 r8 r� � s z"nftables._policy_priority_fragmentc C s |r|j dkri S d|j iS )Nr r� r8 r2 r7 r7 r8 � _rich_rule_priority_fragment� s z%nftables._rich_rule_priority_fragmentc C s |j s i S | jj�||t�}ddd�| }| �|�}i } t|j �tkr||j jrZt |j j�nd| d< |j j r�t |j j �| d< n,|j j r�d|j j kr�dn|j j } d | | d < |j j r�d |j j | d < d t d |||f || �|j j�d| ig d�} | �| �|�� |d| iiS )Nrs r} r� r �groupzqueue-thresholdZwarning�warnr� �levelr� ru r r r� r� )r rf r� r r r6 r+ r r: r� Z thresholdr< r� r� r/ r, r� r9 ) rn r� r3 r� rt r� r� r� r Z log_optionsr< r� r7 r7 r8 �_rich_rule_log� s4 ���znftables._rich_rule_logc C s� |j s i S | jj�||t�}ddd�| }| �|�}dtd|||f || �|j j�dddiig d �} | � | � |�� |d | iiS ) Nrs r} r� ru r r r< r5 r� r� ) r5 rf r� r r r6 r� r/ r, r� r9 ) rn r� r3 r� rt r� r� r� r r� r7 r7 r8 �_rich_rule_audit� s ���znftables._rich_rule_auditc C s� |j s i S | jj�||t�}ddd�| }| �|�}d|||f } t|j �tkr\dd i} �n t|j �tkr�|j jr�| � |j j�} ndd i} n�t|j �t kr�dd i} n�t|j �t k�rHd}| jj�||t�}d|||f } |j j � d �} t| �d k�r,dd d d iiddd d d ii| d gi| d gid�i} ndd d d ii| d d�i} nttdt|j � ��dt| || �|j j�| g d�} | �| �|�� |d| iiS )Nrs r} r� r r� r� r� r& r+ rB r� r� �mark�^�&r �r� r- r0 ru r� r� )r rf r� r r r4 r+ r r r# r r r� r7 r� r r r� r/ r, r� r9 ) rn r� r3 r� rt r� r� r� r r� Z rule_actionr- r� r7 r7 r8 �_rich_rule_action� sL "� � ���znftables._rich_rule_actionc C s� |� d�r0| �|td�d � d|kr(dnd|�S t|�r>d}n�td|�rNd}nvtd|�r�d}tj|dd�}d |jj |j d �i}nDtd |�r�d }t |�}n,d }|� d �}d t |d �t |d �d �i}dd||d�i|r�dnd|d�iS d S )N�ipset:r� TF�etherrc �ip)�strictr� ��addrr� rd �ip6r+ r rB r) r* r, �!=r/ r0 )� startswith�_set_match_fragmentr� r r r � ipaddress� IPv4Network�network_address� compressed� prefixlenr r7 r� )rn Z addr_fieldr� �invertrx Znormalized_addressZaddr_lenr7 r7 r8 r � s, & � �z nftables._rule_addr_fragmentc C s6 |si S |dvr t td| ��ddddiid|d�iS ) Nrb zInvalid familyr) r� r� �nfprotor/ r0 r! )rn Z rich_familyr7 r7 r8 �_rich_rule_family_fragment� s � �z#nftables._rich_rule_family_fragmentc C s8 |si S |j r|j }n|jr&d|j }| jd||jd�S )NrD r� �rS )rI �ipsetr rS )rn Z rich_destr� r7 r7 r8 � _rich_rule_destination_fragment s z(nftables._rich_rule_destination_fragmentc C sZ |si S |j r|j }n2t|d�r.|jr.|j}nt|d�rH|jrHd|j }| jd||jd�S )N�macrW rD r� rV )rI �hasattrrY rW r rS )rn Z rich_sourcer� r7 r7 r8 �_rich_rule_source_fragment s z#nftables._rich_rule_source_fragmentc C sP t |�}t|t�r$|dk r$tt��n(t|�dkr8|d S d|d |d giS d S )Nr rB �range)r � isinstancer� r r r� )rn �portr\ r7 r7 r8 �_port_fragment! s znftables._port_fragmentc C s& ddd�| }d}| j j�||t�} g } |r>| �| �|j�� |rT| �| �d|�� |r|| �| �|j �� | �| � |j �� | �dd|dd �id | � |�d �i� g } |r�| �| � ||||| �� | �| �||||| �� | �| �||||| �� n.| �|d d td|| f | dd ig d�ii� | S )Nrs r} r� r( r� r) r* �dportr, r/ r0 r� ru � %s_%s_allowr� r� �rf r� r r r5 rU rx r rX � destinationr[ �sourcer_ r= r> rC r� � rn r� r� �protor^ rc r3 r� rt r� r� r� r7 r7 r8 �build_policy_ports_rules* s8 �� � z!nftables.build_policy_ports_rulesc C s ddd�| }d}| j j�||t�}g } |r>| �| �|j�� |rT| �| �d|�� |r|| �| �|j �� | �| � |j �� | �dddd iid |d �i� g } |r�| �| � ||||| �� | �| � ||||| �� | �| �||||| �� n.| �|d d td||f | dd ig d�ii� | S )Nrs r} r� r( r� r) r� r� r$ r/ r0 r� ru ra r� r� )rf r� r r r5 rU rx r rX rc r[ rd r= r> rC r� ) rn r� r� r- rc r3 r� rt r� r� r� r7 r7 r8 �build_policy_protocol_rulesJ s4 � � z$nftables.build_policy_protocol_rulesc C s� d}d}| j j�||t�}ddd�| } g } |r^| �| �|j�� | �| �|j�� | � |�}| �dddd d d �id d �i� |dks�|d u r�| �ddddd�idddiid�i� n | �ddddd�i|d�i� | ddt d||f | d�iigS ) Nr r( rs r} r� r) r� r* �tcprz r, Zsyn)r2 r1 r3 Zpmtur& z tcp optionZmaxseg�size)ry r. Zrtr� ZmturB r� ru r� r� ) rf r� r r r5 rX rc r[ rd r4 r� ) rn r� r� Ztcp_mss_clamp_valuerc r3 r rt r� r� r� r7 r7 r8 � build_policy_tcp_mss_clamp_rulesi s2 � � � �z)nftables.build_policy_tcp_mss_clamp_rulesc C s& ddd�| }d}| j j�||t�} g } |r>| �| �|j�� |rT| �| �d|�� |r|| �| �|j �� | �| � |j �� | �dd|dd �id | � |�d �i� g } |r�| �| � ||||| �� | �| �||||| �� | �| �||||| �� n.| �|d d td|| f | dd ig d�ii� | S )Nrs r} r� r( r� r) r* �sportr, r/ r0 r� ru ra r� r� rb re r7 r7 r8 � build_policy_source_ports_rules� s8 �� � z(nftables.build_policy_source_ports_rulesc C s� d}| j j�||t�} ddd�| } g } |rR| �dddtd||f ||d�ii� g } |rl| �| �d |�� | �d d |d d �id| �|�d�i� | �dd||f i� | �| ddtd| | d�ii� | S )Nr( rs r} r� z ct helperru z helper-%s-%s)rx rt ry r+ r- r� r) r* r` r, r/ r0 r� �filter_%s_allowr� )rf r� r r r5 r� r r_ ) rn r� r� rf r^ rc Z helper_nameZmodule_short_namert r� r� r� r� r7 r7 r8 � build_policy_helper_ports_rules� s6 � �� � z(nftables.build_policy_helper_ports_rulesc C s� ddd�| }| j j�||t�}g } |rv|t|�d dkrT|d t|�d � d }ddd d iid |d �id d ig} n| �d|�d d ig} dtd| | d�} | �|d| ii� | S )Nrs r} r� rB r� r� r) r� r� r� r/ r0 r� r� ru rn r� r� )rf r� r r r� r r� r5 ) rn r� r� r� rt r rd r� r� r� r� r� r7 r7 r8 �build_zone_forward_rules� s( ���z!nftables.build_zone_forward_rulesc C s� ddd�| }g }g }|r\|� | �|j�� |� | �|j�� |� | �|j�� | �|�}n"|� ddddiidd d �i� d }d }| jj j ||t d d�} dt d| |f |ddddiiddd �idd ig d�} | � | �|�� |� |d| ii� |S )Nrs r} r� r) r� r� rT r/ rc r0 r r' Tr ru r� r� rK r� Z masquerader� r� )r5 rU rx rX rc r[ rd r4 rf r� r r r� r� r9 ) rn r� r� r3 r� r� r� r rt r� r� r7 r7 r8 � build_policy_masquerade_rules� s< � ����z&nftables.build_policy_masquerade_rulesc C sp d}| j j�||t�} ddd�| } g } |rn| �| �|j�� | �| �|j�� | �| � |j �� | � |�} n8d} |r�t d|�r�d} | �ddd d iid | d �i� d } | �dd|dd�id | � |�d �i� |�r$t d|�r�t|�}|�r|dk�r| �d|| � |�d�i� n| �dd|ii� n| �dd| � |�ii� dtd| | f | d�}|�| �|�� | d|iigS )Nr' rs r} r� rc rd r) r� r� rT r/ r0 r r* r` r, r� r� )rI r^ rI rA r^ ru r� r� r� )rf r� r r r5 rU rx rX rc r[ rd r4 r r_ r r� r� r9 )rn r� r� r^ r- ZtoportZtoaddrr3 rt r� r� r� r rT r� r7 r7 r8 � build_policy_forward_port_rules� sJ � �� �z(nftables.build_policy_forward_port_rulesc C s2 |t | v rt | | S ttd|| j|f ��d S )Nz)ICMP type '%s' not supported by %s for %s)r� r r ry )rn r� Z icmp_typer7 r7 r8 � _icmp_types_to_nft_fragments( s �z%nftables._icmp_types_to_nft_fragmentsc C s: d}| j j�||t�}ddd�| }|r6|jr6|j}n<|jrjg }d|jv rT|�d� d|jv rr|�d� nddg}g } |D �]�} | j j�|�r�d||f } dd i} nd ||f } | �� } g } |r�| �| � |j �� | �| � |j�� | �| � |j �� | �| �| |j�� |�r�| �| �||||| �� | �| �||||| �� |j�rb| �| �||||| �� nN| �|�}d td |||f | | �� g d �}|�| �|�� | �|d |ii� qz| j �� dk�r| j j�|��s| �|d d t| | | �| j �� �ddd||f iig d �ii� | �|d d t| | | g d �ii� qz| S )Nr( rs r} r� rc rd ra r� z %s_%s_denyru r r� r� r� r r� �%s_%s_ICMP_BLOCK: )rf r� r r �ipvsrc r5 �query_icmp_block_inversionr rU rx rX r[ rd r� rs ry r= r> r rC r4 r� r� r9 r� r� )rn r� r� Zictr3 rt r� r� ru r� r� Z final_chainr r� r r� r7 r7 r8 � build_policy_icmp_block_rules/ sl � ��� �z&nftables.build_policy_icmp_block_rulesc C s� d}| j j�||t�}g }ddd�| }| j j�|�r@| �� }ndd i}|�|ddtd||f d | �� |gd �ii� | j � � d kr�| j j�|�r�|�|ddtd||f d | �� | � | j � � �d d d||f iigd �ii� |S )Nr( rs r} r� r� r� ru r� rF �rx rt r� r� r� r� r r� rt ) rf r� r r rv r r5 r� r% r� r� )rn r� r� rt r� r� r� r r7 r7 r8 �'build_policy_icmp_block_inversion_rulesk s4 �� �� z0nftables.build_policy_icmp_block_inversion_rulesc C s$ g }d}| j jdkr ddg}n<| j jdkr8ddg}d}n"| j jdkrRg d�}d}ng d�}d d d d iid dd�id d|dd�id dd�ig}|dkr�|�dddii� |�dd i� |�dddt||d �ii� | j jd v�r |�dddt|d d d d d!�id d"d#d$gid�id%d igd �ii� |S )&NZfilter_PREROUTINGZlooser� r? � loose-forward�filter_FORWARD�strict-forward)r� r? Ziifr) r� r� rT r/ rd r0 ZfibZoif)rz �resultFr� r r� zrpfilter_DROP: r� r� r� ru r� �rz r| r* rY r+ r, r� r` r^ r� )rf �_ipv6_rpfilterr5 r� )rn r� r� Zrpfilter_chainZ fib_flagsr� r7 r7 r8 �build_rpfilter_rules� sX ���� � � ��� z nftables.build_rpfilter_rulesc C s� g d�}dd� |D �}ddddd�id d |id �ig}| j jd v rT|�d ddii� |�| �d�� g }|�dddtdd|d�ii� d}| j �� dkr�|d7 }| j jdv r�|d7 }|�dddtd||d�ii� |S )N) z ::0.0.0.0/96z::ffff:0.0.0.0/96z2002:0000::/24z2002:0a00::/24z2002:7f00::/24z2002:ac10::/28z2002:c0a8::/32z2002:a9fe::/32z2002:e000::/19c S s2 g | ]*}d |� d�d t|� d�d �d�i�qS )r� r+ r rB rH )r7 r� )�.0r� r7 r7 r8 � <listcomp>� r� z5nftables.build_rfc3964_ipv4_rules.<locals>.<listcomp>r) r* rJ r� r, r/ r� r0 )r r r r� zRFC3964_IPv4_REJECT: r" rs r� ru r� rB rx rG r� r~ r{ )rf Z _log_deniedr5 r# r� r� r )rn Z daddr_setr� r� Z forward_indexr7 r7 r8 �build_rfc3964_ipv4_rules� s< �� � � z!nftables.build_rfc3964_ipv4_rulesc C s� d}g }|� | �|j�� |� | �|j�� |� | �|j�� g }|� | �|||||�� |� | �|||||�� |� | � |||||�� |S )Nr( ) r5 rU rx rX rc r[ rd r= r> rC )rn r� r� r3 rt r� r� r7 r7 r8 �*build_policy_rich_source_destination_rules� s z3nftables.build_policy_rich_source_destination_rulesc C s |dv r dS dS )N)rc rd ZebTFr7 )rn r� r7 r7 r8 �is_ipv_supported� s znftables.is_ipv_supportedc C s� ddd�}|| || ddg|| dd|| g|| dd|| g|| dg|| || || g|| ddg|| dd|| g|| dgdd � }||v r�|| S t td | ��d S ) NZ ipv4_addrZ ipv6_addrrb Z inet_protoZ inet_servicer? ZifnameZ ether_addr) zhash:ipz hash:ip,portzhash:ip,port,ipzhash:ip,port,netz hash:ip,markzhash:netz hash:net,netz hash:net,portzhash:net,port,netzhash:net,iface�hash:macz!ipset type name '%s' is not valid)r r )rn r� r+ Zipv_addr�typesr7 r7 r8 �_set_type_list� s( � ��znftables._set_type_listc C s� |r d|v r |d dkr d}nd}dt || �||�d�}|�d�d �d �D ]}|d v rLd g|d < qhqL|r�d |v r�t|d �|d < d|v r�t|d �|d< dd|iigS )Nrx �inet6rd rc ru )rx rt ry r+ �:rB �,)rF �netr^ �intervalrz �timeoutZmaxelemrj rs r� )r� r� r7 r� )rn ry r+ �optionsr� Zset_dict�tr7 r7 r8 �build_set_create_rules s$ � z nftables.build_set_create_rulesc C s$ | � |||�}| �|| j�� � d S r� )r� r� rf r� )rn ry r+ r� r� r7 r7 r8 � set_create$ s znftables.set_createc C s* dddt |d�ii}| �|| j�� � d S )Nr} r� ru r� )r� r� rf r� )rn ry r� r7 r7 r8 � set_destroy( s � znftables.set_destroyc C s | j j�|�j�d�d �d�}g }|D ]�}|dkrd|�dddii� |�dd |rVd nd d �i� q(|d v r�|�d| �|�|r�dndd �i� q(|dkr�|�dd|r�dndii� q(|dkr�|�dddii� q(ttd| ��q(dt |�dkr�d|in|d |�rdndd| d�iS ) Nr� rB r� r^ r� r� r$ r* �thr` rl r, )rF r� rY r� r� Zifacer� r� r? z-Unsupported ipset type for match fragment: %sr) �concatr rK r/ �@r0 ) rf rW � get_ipsetr+ r7 r5 �_set_get_familyr r r� )rn ry Z match_destrS � type_formatr6 �formatr7 r7 r8 rM . s* � � �z nftables._set_match_fragmentc C s8 | j j�|�}|j�d�d �d�}|�d�}t|�t|�krHttd��g }t|�D �]�\}}|dk�r z|| � d�} W n$ t y� |� d� || } Y n,0 |� || d | � � || | d d � } z| � d�} W n t y� |� | � Y n(0 |� d| d | � | | d d � gi� qT|d v �r d|| v �rP|� d|| �d�i� n�z|| � d �} W nJ t �y� || } d |j v �r�|j d d k�r�t | �} |� | � Y n^0 || d | � } d |j v �r�|j d d k�r�t | �} |� d | t|| | d d � �d�i� qT|� || � qTt|�dk�r4d|igS |S )Nr� rB r� z+Number of values does not match ipset type.r^ ri �-r\ )rF r� r+ rx r� r� rH r� )rf rW r� r+ r7 r� r r � enumerater� r� r5 r� r r� ) rn ry �entry�objr� Z entry_tokens�fragmentr. r� r� Zport_strrI r7 r7 r8 �_set_entry_fragmentE sP � ( � z nftables._set_entry_fragmentc C s0 g }| � ||�}|�dddt||d�ii� |S )Nrs r1 ru �rx rt ry �elem)r� r5 r� )rn ry r� r� r1 r7 r7 r8 �build_set_add_rulesy s � z nftables.build_set_add_rulesc C s" | � ||�}| �|| j�� � d S r� )r� r� rf r� )rn ry r� r� r7 r7 r8 �set_add� s znftables.set_addc C s8 | � ||�}dddt||d�ii}| �|| j�� � d S )Nr} r1 ru r� )r� r� r� rf r� )rn ry r� r1 r� r7 r7 r8 � set_delete� s � znftables.set_deletec C s dddt |d�iigS )Nr� r� ru r� )r� )rn ry r7 r7 r8 �build_set_flush_rules� s �z nftables.build_set_flush_rulesc C s | � |�}| �|| j�� � d S r� )r� r� rf r� )rn ry r� r7 r7 r8 � set_flush� s znftables.set_flushc C sJ | j j�|�}|jdkr d}n(|jrBd|jv rB|jd dkrBd}nd}|S )Nr� rE rx r� rJ rF )rf rW r� r+ r� )rn ry rW rx r7 r7 r8 r� � s �znftables._set_get_familyc C s� g }|� | �|||�� |� | �|�� d}|D ]D}|� | �||�� |d7 }|dkr0| �|| j�� � |�� d}q0| �|| j�� � d S )Nr rB i� )r� r� r� r� r� rf r� �clear) rn Zset_name� type_name�entriesZcreate_optionsZ entry_optionsr� �chunkr� r7 r7 r8 � set_restore� s znftables.set_restore)N)N)r� )F)F)NN)NN)NN)NN)NN)N)N)N)F)N)N)F)NN)K�__name__� __module__� __qualname__ry Zpolicies_supportedrp r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r r r r r� r# r r% r/ r4 r6 r r r� r9 r= r> rC r rU rX r[ r_ rg rh rk rm ro rp rq rr rs rw ry r� r� r� r� r� r� r� r� rM r� r� r� r� r� r� r� r� r7 r7 r7 r8 re � s� 0,.e C V c � 2B + � � ! ! � + < +( 4 �re )N)+r� r� rN Zfirewall.core.loggerr Zfirewall.functionsr r r r r Zfirewall.errorsr r r r r r r Zfirewall.core.richr r r r r r r r r Zfirewall.core.baser Znftables.nftablesr r� r� r~ r r� r� r9 r� �objectre r7 r7 r7 r8 �<module> s� $, � � �� �& ��E core/__pycache__/fw_ipset.cpython-39.pyc 0000644 00000017143 15025011705 0014157 0 ustar 00 a ���gb' � @ sf d Z dgZddlmZ ddlmZmZmZm Z ddl m Z ddl m Z ddlmZ G dd� de�Zd S ) z ipset backend� FirewallIPSet� )�log)� remove_default_create_options�normalize_ipset_entry� check_entry_overlaps_existing� check_for_overlapping_entries)�IPSet)�errors)� FirewallErrorc @ s� e Zd Zdd� Zdd� Zdd� Zdd� Zd d � Zd d � Zd d� Z d6dd�Z dd� Z dd� Z dd� Z d7dd�Zd8dd �Zd9d d �Zd d � Zd:d"d#�Zd$d%� Zd&d'� Zd(d)� Zd;d*d+�Zd,d-� Zd.d/� Zd0d1� Zd2d3� Zd4d5� ZdS )<r c C s || _ i | _d S �N)�_fw�_ipsets)�self�fw� r �:/usr/lib/python3.9/site-packages/firewall/core/fw_ipset.py�__init__# s zFirewallIPSet.__init__c C s d| j | jf S )Nz%s(%r))� __class__r �r r r r �__repr__' s zFirewallIPSet.__repr__c C s | j �� d S r )r �clearr r r r �cleanup, s zFirewallIPSet.cleanupc C s || � � vrttj|��d S r )� get_ipsetsr r Z INVALID_IPSET�r �namer r r � check_ipset/ s zFirewallIPSet.check_ipsetc C s || � � v S r )r r r r r � query_ipset3 s zFirewallIPSet.query_ipsetc C s t | j�� �S r )�sortedr �keysr r r r r 6 s zFirewallIPSet.get_ipsetsc C s t | j�dkS )Nr )�lenr r r r r � has_ipsets9 s zFirewallIPSet.has_ipsetsFc C s& | � |� | j| }|r"| �|� |S r )r r �check_applied_obj�r r �applied�objr r r � get_ipset< s zFirewallIPSet.get_ipsetc C s | j jr| j j�� rdS dS )NFT)r �nftables_enabledZdirectZhas_runtime_configurationr r r r �omit_native_ipsetC s z FirewallIPSet.omit_native_ipsetc C s< g }| j jr|�| j j� | j jr8| �� s8|�| j j� |S r )r r& �appendZnftables_backendZ ipset_enabledr' Z ipset_backend)r �backendsr r r r) K s zFirewallIPSet.backendsc C s0 |j | jjvr ttjd|j ��|| j|j< d S )Nz '%s' is not supported by ipset.)�typer Zipset_supported_typesr r Z INVALID_TYPEr r �r r$ r r r � add_ipsetS s �zFirewallIPSet.add_ipsetc C s| | j | }|jrd|sdz | �� D ]}|�|� q W qp ty` } zttj|��W Y d }~qpd }~0 0 n t� d|� | j |= d S )Nz,Keeping ipset '%s' because of timeout option) r r# r) � set_destroy� Exceptionr r �COMMAND_FAILEDr �debug1)r r Zkeepr$ �backend�msgr r r � remove_ipsetY s $ zFirewallIPSet.remove_ipsetNc C s, | j | }|r|n| �� D �] }|jdkr�|�� }||v r�d|jvsz|jd dksz|j|| d kszt|j�|| d kr�z|�|� W n0 ty� } zt t j |��W Y d }~n d }~0 0 | j j �r�z|�|j|j|j� W n2 t�y } zt t j |��W Y d }~n.d }~0 0 d|_d|jv �r4|jd dk�r4qz|�|j� W n2 t�yv } zt t j |��W Y d }~n d }~0 0 |jD ]L}z|�|j|� W n2 t�y� } zt t j |��W Y d }~n d }~0 0 �q~qz |�|j|j|j|jd � W n2 t�y } zt t j |��W Y d }~qd }~0 0 d|_qd S )N�ipset�timeout�0r � T)r r) r Zset_get_active_terse�optionsr* �rm_def_cr_optsr- r. r r r/ r �_individual_callsZ set_creater# � set_flush�entries�set_add� set_restore)r r r) r$ r1 Zactiver2 �entryr r r � apply_ipsete sX �� ��" " �" ( �"zFirewallIPSet.apply_ipsetc C s< | � � D ].}| j| }d|_t�d| � | �||� qd S )NFzApplying ipset '%s')r r r# r r0 r@ )r r) r r$ r r r � apply_ipsets� s zFirewallIPSet.apply_ipsetsc C sz | � � D ]l}|jdkrq| �� D ]R}z| �|� |�|� W q typ } z |jtjkr\|�W Y d }~q d }~0 0 q qd S )NZnftables) r) r r � check_appliedr- r �coder � NOT_APPLIED)r r1 r4 r2 r r r �flush� s zFirewallIPSet.flushTc C s | j ||d�jS )N�r# )r% r* )r r r# r r r �get_type� s zFirewallIPSet.get_typec C s t | j|dd�j�d��S )NTrF �,)r r% r* �splitr r r r � get_dimension� s zFirewallIPSet.get_dimensionc C s | � |�}| �|� d S r )r% r! �r r r$ r r r rB � s zFirewallIPSet.check_appliedc C s |j sttj|j��d S r )r# r r rD r r+ r r r r! � s �z FirewallIPSet.check_applied_objc C s. | j ||d�}d|jv r*|jd dkr*dS dS )NrF ZfamilyZinet6Zipv6Zipv4)r% r8 r" r r r � get_family� s zFirewallIPSet.get_familyc C s� | j |dd�}t|�}t�||j|j� ||jv rFttj d||f ��t ||j� z | � � D ]}|� |j |� q\W n0 ty� } zttj|��W Y d }~n.d }~0 0 d|jvs�|jd dkr�|j�|� d S )NTrF z'%s' already is in '%s'r5 r6 )r% r r � check_entryr8 r* r< r r ZALREADY_ENABLEDr r) r= r r. r/ r( �r r r? r$ r1 r2 r r r � add_entry� s � "zFirewallIPSet.add_entryc C s� | j |dd�}t|�}||jvr4ttjd||f ��z | �� D ]}|�|j|� q>W n0 t y� } zttj |��W Y d }~n.d }~0 0 d|j vs�|j d dkr�|j� |� d S )NTrF z'%s' not in '%s'r5 r6 ) r% r r< r r Z NOT_ENABLEDr) Z set_deleter r. r/ r8 �removerN r r r � remove_entry� s � "zFirewallIPSet.remove_entryc C sD | j |dd�}t|�}d|jv r:|jd dkr:ttj|��||jv S �NTrF r5 r6 )r% r r8 r r ZIPSET_WITH_TIMEOUTr< )r r r? r$ r r r � query_entry� s zFirewallIPSet.query_entryc C s | j |dd�}|jS )NTrF )r% r< rK r r r � get_entries� s zFirewallIPSet.get_entriesc C s4 | j |dd�}t|� |D ]}t�||j|j� qd|jvsJ|jd dkrP||_z | �� D ]}|�|j � qZW n0 t y� } zt t j |��W Y d }~nd }~0 0 d|_zP| �� D ]B}| jjr�|jD ]}|�|j |� q�q�|�|j |j|j|jd � q�W n2 t �y( } zt t j |��W Y d }~nd }~0 0 d|_d S rR )r% r r rM r8 r* r< r) r; r r. r r r/ r# r r: r= r> )r r r< r$ r? r1 r2 r r r � set_entries� s0 " � "zFirewallIPSet.set_entries)F)F)N)N)T)T) �__name__� __module__� __qualname__r r r r r r r r% r' r) r, r3 r@ rA rE rG rJ rB r! rL rO rQ rS rT rU r r r r r " s2 1 N)�__doc__�__all__Zfirewall.core.loggerr Zfirewall.core.ipsetr r9 r r r Zfirewall.core.io.ipsetr Zfirewallr Zfirewall.errorsr �objectr r r r r �<module> s core/__pycache__/fw.cpython-39.opt-1.pyc 0000644 00000105274 15025011705 0013715 0 ustar 00 a ���gs� � @ s� d gZ ddlZddlZddlZddlZddlZddlmZmZ ddl m Z ddl m Z ddl m Z ddl mZ ddl mZ dd l mZ dd l mZ dd lmZ dd lmZ dd lmZ ddlmZ ddlmZ ddl m Z ddl m Z ddl m!Z! ddl"m#Z# ddl$m%Z% ddl&m'Z'm(Z( ddl)m*Z* ddl+m,Z, ddl-m.Z. ddl/m0Z0 ddl1m2Z2 ddl3m4Z4 dd l5m6Z6m7Z7 dd l8m9Z9 dd l:m;Z; dd l<m=Z= dd l>m?Z? dd!l@mAZA dd"lBmCZC dd#l mDZD dd$lEmFZF G d%d � d eG�ZHdS )&�Firewall� N)�Dict�List)�config)� functions)� ipXtables)�ebtables)�nftables)�ipset)�modules)�FirewallIcmpType)�FirewallService)� FirewallZone)�FirewallDirect)�FirewallConfig)�FirewallPolicies)� FirewallIPSet)�FirewallTransaction)�FirewallHelper)�FirewallPolicy)�nm_get_bus_name�nm_get_interfaces_in_zone)�log)� IO_Object)�firewalld_conf)�Direct)�service_reader)�icmptype_reader)� zone_reader�Zone)� ipset_reader)� IPSET_TYPES)� helper_reader)� policy_reader)�check_on_disk_config)� Rich_Rule)�errors)� FirewallErrorc @ sZ e Zd Zd�dd�Zdd� Zdd� Zdd � Zi feee e f d �d d �Z d d� Z dd� Z dd� Zdd� Zdd� Zdd� Zdd� Zdd � Zd�d d �Zd d � Zd!d"� Zd�d#d$�Zd�d%d&�Zd'd(� Zd)d*� Zd+d,� Zd-d.� Z d/d0� Z d1d2� Z d3d4� Z d�d5d6�Z d7d8� Z!d9d:� Z"d;d<� Z#d=d>� Z$d?d@� Z%dAdB� Z&dCdD� Z'dEdF� Z(dGdH� Z)dIdJ� Z*dKdL� Z+d�dNdO�Z,d�dPdQ�Z-dRdS� Z.d�dTdU�Z/d�dVdW�Z0d�dXdY�Z1d�dZd[�Z2d\d]� Z3d^d_� Z4d`da� Z5dbdc� Z6ddde� Z7dfdg� Z8dhdi� Z9djdk� Z:dldm� Z;dndo� Z<dpdq� Z=drds� Z>dtdu� Z?d�dvdw�Z@dxdy� ZAdzd{� ZBd|d}� ZCd~d� ZDd�d�� ZEd�d�� ZFd�d�� ZGd�d�� ZHd�d�� ZId�d�� ZJdMS )�r Fc C s� t tj�| _|| _|sXt�| �| _t�| �| _ t � � | _ t � � | _ t�| �| _t�� | _t| �| _t| �| _t| �| _t| �| _t| �| _t� | _ t | �| _ t | �| _ t | �| _!| �"� d S �N)#r r �FIREWALLD_CONF�_firewalld_conf�_offliner � ip4tables�ip4tables_backend� ip6tables�ip6tables_backendr �ebtables_backendr � ipset_backendr �nftables_backendr �modules_backendr �icmptyper �servicer �zoner �directr r �policiesr r �helperr �policy�_Firewall__init_vars)�selfZoffline� r= �4/usr/lib/python3.9/site-packages/firewall/core/fw.py�__init__G s& zFirewall.__init__c C sD d| j | j| j| j| j| j| j| j| j| j | j | j | j | j | jf S )Nz:%s(%r, %r, %r, %r, %r, %r, %r, %r, %r, %r, %r, %r, %r, %r))� __class__�ip4tables_enabled�ip6tables_enabled�ebtables_enabled�_state�_panic� _default_zone�_module_refcount�_marks�cleanup_on_exit�cleanup_modules_on_exit�_ipv6_rpfilter� ipset_enabled�_individual_calls� _log_denied�r< r= r= r> �__repr___ s ��zFirewall.__repr__c C s� d| _ d| _tj| _g | _g | _i | _g | _tj | _ tj | _ tj | _tj| _tj| _tj| _tj| _tj| _tj| _tj| _ | j r�d| _ d| _ d| _ d| _!t"| _#d| _$n0d| _ g | _%d| _ g | _&d| _ d| _!t"| _#d| _$d S )NZINITFT)'rD rE r Z FALLBACK_ZONErF �_default_zone_interfacesZ_nm_assigned_interfacesrG rH ZFALLBACK_CLEANUP_ON_EXITrI Z FALLBACK_CLEANUP_MODULES_ON_EXITrJ ZFALLBACK_IPV6_RPFILTERrK ZFALLBACK_INDIVIDUAL_CALLSrM ZFALLBACK_LOG_DENIEDrN ZFALLBACK_FIREWALL_BACKEND�_firewall_backendZ FALLBACK_FLUSH_ALL_ON_RELOAD�_flush_all_on_reloadZFALLBACK_RFC3964_IPV4� _rfc3964_ipv4Z FALLBACK_ALLOW_ZONE_DRIFTINGZ_allow_zone_driftingZ FALLBACK_NFTABLES_TABLE_OWNER�_nftables_table_ownerr+ rA rB rC rL r! �ipset_supported_types�nftables_enabled�ipv4_supported_icmp_types�ipv6_supported_icmp_typesrO r= r= r> Z __init_varsh s@ zFirewall.__init_varsc s� i }� fdd�� j �� D �|d< � fdd�� j�� D �|d< � fdd�� j�� D �|d< � fdd�� j�� D �|d < � fd d�� j� � D �|d < � fd d�� j � � D �|d < i |d< � j � d�|d d< i |d< i |d d< t� j�� ��t� j�� ��D ] }� j�|�|d d |< q�t� j�� ��t� j�� ��D ]�}|� jv�sR|� jv�r6t�� j�|��|d d |< g |d d | _|� jv�r�|d d | j�d� |� jv�r6|d d | j�d� �q6|S )zH Returns a dict of dicts of all runtime config objects. c s i | ]}|� j �|��qS r= )r � get_ipset)�.0�_ipsetrO r= r> � <dictcomp>� � z4Firewall.get_all_io_objects_dict.<locals>.<dictcomp>�ipsetsc s i | ]}|� j �|��qS r= )r9 � get_helper)r[ r9 rO r= r> r] � r^ �helpersc s i | ]}|� j �|��qS r= )r4 � get_icmptype)r[ r4 rO r= r> r] � r^ � icmptypesc s i | ]}|� j �|��qS r= )r5 � get_service)r[ r5 rO r= r> r] � r^ �servicesc s i | ]}|� j �|��qS r= )r6 �get_zone)r[ r6 rO r= r> r] � r^ �zonesc s i | ]}|� j �|��qS r= )r: Z get_policy)r[ r: rO r= r> r] � r^ r8 Zconf�FirewallBackend�runtimeZicmptypes_unsupported�ipv4�ipv6)r � get_ipsetsr9 � get_helpersr4 � get_icmptypesr5 � get_servicesr6 � get_zonesr: Z"get_policies_not_derived_from_zoner* �get�setr � differencerb � intersectionrX rY �copyZ destination�append)r< Z conf_dictr4 r= rO r> �get_all_io_objects_dict� s8 � � � z Firewall.get_all_io_objects_dict)�extra_io_objectsc C sn | � � }|D ] }|| D ]}||| |j< qq g d�}|D ].}|| }|�� D ]\}} | �| �� |� qNq:d S )N)r_ ra rc re rg r8 )rw �name�itemsZcheck_config_dictZexport_config_dict) r< rx Zall_io_objectsZtype_key�obj�orderZ io_obj_typeZio_objsry Zio_objr= r= r> �full_check_config� s zFirewall.full_check_configc C s� | j r$d| j�� vr$t�d� d| _ | jrHd| j�� vrHt�d� d| _| jrld| j�� vrlt�d� d| _| j s�| js�| j s�t t j d��d S )N�filterziptables is not usable.Fzip6tables is not usable.zebtables is not usable.zNo IPv4 and IPv6 firewall.) rA r- �get_available_tablesr �info1rB r/ rC r0 rW r' r& � UNKNOWN_ERRORrO r= r= r> �_start_check_tables� s& � � � �z Firewall._start_check_tablesc C s� z| j �� W n: tyH | jr.t�d� nt�d� g | _d| _Y n0 | j � � | _| j � � | j j s�| j j r|t�d� n"| jr�t�d� n t�d� d| _| jr�| j�d�| _n| jr�| j �� | _ng | _| j� � | jj �s| jj r�t�d� n$| j�r t�d � n t�d � d| _| j�r2| j�d �| _n | j�rH| j�� | _ng | _| j� � | jj �s�| jj �rxt�d � n$| j�r�t�d � n t�d� d| _| j�r�| j�s�| jj�s�t�d� | j�� | j�r�| jj �s�t�d� d S )Nzaipset not usable, disabling ipset usage in firewall. Other set backends (nftables) remain usable.z4ipset not usable, disabling ipset usage in firewall.FzFiptables-restore is missing, using individual calls for IPv4 firewall.zMiptables-restore and iptables are missing, IPv4 direct rules won't be usable.zCiptables-restore and iptables are missing, disabling IPv4 firewall.rj zGip6tables-restore is missing, using individual calls for IPv6 firewall.zOip6tables-restore and ip6tables are missing, IPv6 direct rules won't be usable.zEip6tables-restore and ip6tables are missing, disabling IPv6 firewall.rk zHebtables-restore is missing, using individual calls for bridge firewall.zKebtables-restore and ebtables are missing, eb direct rules won't be usable.zEebtables-restore and ebtables are missing, disabling bridge firewall.zSebtables-restore is not supporting the --noflush option, will therefore not be usedzpConfiguration has NftablesTableOwner=True, but it's not supported by nftables. Table ownership will be disabled.) r1 Zset_list� ValueErrorrW r r� �warningrV rL Zset_supported_typesr- Z fill_exists�restore_command_existsZcommand_existsrA r2 Zsupported_icmp_typesrX r/ rB rY r0 rC rM �restore_noflush_option�debug1Z probe_supportrU Zsupports_table_ownerrO r= r= r> �_start_probe_backends� sn � ���z Firewall._start_probe_backendsc C s� t �dtj� z| j�� W n: tyV } z"t �|� t �d� W Y d }~�n2d }~0 0 | j�d�rr| j�d�| _ | j�d�r�| j�d�}|d ur�|� � dv r�d| _ t �d| j � | j�d�r�| j�d�}|d ur�|� � d v r�d | _ t �d | j � | j�d ��rR| j�d �}|d u�rR|� � d v �rRt �d � z| j �� W n t�yP Y n0 | j�d��r�| j�d�}|d u�r�|� � dv �r�d| _nV|� � dv �r�d| _n@|� � dv �r�d| _n*|� � dv �r�d| _n|� � dv �r�d| _t �d| j� d�� | j�d��r8| j�d�}|d u�r8|� � d v �r8t �d� d | _| j�d ��r�| j�d �}|d u �sj|� � dk�rrd | _n|� � | _t �d | j� | j�d ��r�| j�d �| _t �d | j� | j�d!��r�| j�d!�}|� � dv �r�d| _nd | _t �d"| j� | j�d#��r<| j�d#�}|� � dv �r(d| _nd | _t �d$| j� | j�d%��r�| j�d%�}|� � dv �rld| _nd | _t �d&| j� | j�t�| j�� d S )'Nz"Loading firewalld config file '%s'z0Using fallback firewalld configuration settings.� DefaultZoneZ CleanupOnExit)�noZfalseFz CleanupOnExit is set to '%s'ZCleanupModulesOnExit)�yes�trueTz#CleanupModulesOnExit is set to '%s'ZLockdownzLockdown is enabledZ IPv6_rpfilterr� )r� r� �strictr� )�looser� )� loose-forwardr� )�strict-forwardr� zIPv6_rpfilter is set to '�'ZIndividualCallszIndividualCalls is enabled� LogDeniedZoffzLogDenied is set to '%s'rh z FirewallBackend is set to '%s'ZFlushAllOnReloadz FlushAllOnReload is set to '%s'Z RFC3964_IPv4zRFC3964_IPv4 is set to '%s'ZNftablesTableOwnerz!NftablesTableOwner is set to '%s')r r� r r) r* �read� Exceptionr� rq rF �lowerrI rJ r8 Zenable_lockdownr' rK rM rN rR rS rT rU �set_firewalld_confru �deepcopy)r< �msg�valuer= r= r> �_start_load_firewalld_conf1 s� " � � � � � �z#Firewall._start_load_firewalld_confc C s� t �d� z| jj�� W nX tyr } z@| j�� rJt �d| jjj|� nt �d| jjj|� W Y d }~n d }~0 0 | j � t � | j�� d S )NzLoading lockdown whitelistz*Failed to load lockdown whitelist '%s': %s) r r� r8 Zlockdown_whitelistr� r� Zquery_lockdown�error�filenamer Z set_policiesru r� �r< r� r= r= r> � _start_load_lockdown_whitelist� s � �z'Firewall._start_load_lockdown_whitelistc C sL | � tj� | �tj� | �tj� | �tj� | � tj � | � tj � d S r( ) �_loader_ipsetsr ZFIREWALLD_IPSETS�_loader_icmptypesZFIREWALLD_ICMPTYPES�_loader_helpersZFIREWALLD_HELPERS�_loader_servicesZFIREWALLD_SERVICES� _loader_zonesZFIREWALLD_ZONES�_loader_policiesZFIREWALLD_POLICIESrO r= r= r> �_start_load_stock_config� s z!Firewall._start_load_stock_configc C sL | � tj� | �tj� | �tj� | �tj� | � tj � | � tj � d S r( ) r� r ZETC_FIREWALLD_IPSETSr� ZETC_FIREWALLD_ICMPTYPESr� ZETC_FIREWALLD_HELPERSr� ZETC_FIREWALLD_SERVICESr� ZETC_FIREWALLD_ZONESr� ZETC_FIREWALLD_POLICIESrO r= r= r> �_start_load_user_config� s z Firewall._start_load_user_configc C s� | j �� D ] }| j�t�| j �|��� q | j �� D ] }| j� t�| j � |��� q4| j � � D ] }| j � t�| j �|��� q^| j �� D ] }| j�t�| j �|��� q�| j �� D ] }| j�t�| j �|��� q�| j�t�| j �� �� i }| j �� D ]�}| j �|�}d|j v�r0| j � t�| j �|��� q�t j �!|j �} | |v�r|t"� } | | _ | �#| j � |j | _ d| _$d| _%| || < t&�'d| |j t j(|j)� || �*|� q�|D ]}| j � || � �q�d S )N�/Fz"Combining zone '%s' using '%s%s%s')+r rl r � add_ipsetru r� rZ rn r4 � add_icmptyperb rm r9 � add_helperr` ro r5 � add_servicerd �get_policy_objectsr: Z add_policy�get_policy_objectr7 Zset_permanent_configZ get_directrp rf ry r6 �add_zone�os�path�basenamer � check_name�defaultZforwardr r� �sepr� �combine) r< r\ r4 r9 r5 r: Zcombined_zonesr6 Zz_objZ combined_nameZ combined_zoner= r= r> � _start_copy_config_to_runtime� s\ ������ � �z&Firewall._start_copy_config_to_runtimec C sz t tj�}tj�tj�rjt�dtj � z |�� W n4 t yh } z t� dtj|� W Y d }~n d }~0 0 | j� |� d S )Nz Loading direct rules file '%s'z)Failed to load direct rules file '%s': %s) r r ZFIREWALLD_DIRECTr� r� �existsr r� r� r� r� Z set_direct)r< r{ r� r= r= r> �_start_load_direct_rules� s � �z!Firewall._start_load_direct_rulesc C s t | �}|s| j|d� |r |s4| j�� rF| j�� rF|�d� |�� |rb|rbt�d� | j � � | j |d� |�d� |�� | j�� r�| j�� r�t�d� | j� � t�d� | j |d� t�d� | jj|d� | jjd | j|d� t�d� | jj|d� |�d� |�� d S )N��use_transactionTzUnloading firewall moduleszApplying ipsetszApplying default rule setzApplying used zoneszApplying used policies)r �flushr �backendsZ has_ipsets�execute�clearr r� r3 �unload_firewall_modules�apply_default_tablesZ apply_ipsets�apply_default_rulesr6 Z apply_zones�change_default_zonerF r: Zapply_policies)r< �reload�complete_reload� transactionr= r= r> �_start_apply_objects� s< �� � z Firewall._start_apply_objectsc C s� t | �}| j�� r�t�d� | j�|� z|�d� |�� W nR ty~ } z(t|j d|j rb|j nd ��W Y d }~n d }~0 t y� � Y n0 |�d� |�� d S )Nz2Applying direct chains rules and passthrough rulesTz Direct: %s� ) r r7 Zhas_configurationr r� Z apply_directr� r� r' �coder� r� )r< r� �er= r= r> �_start_apply_direct_rules s 0 z"Firewall._start_apply_direct_rulesc C s� dD ]$}|| j �� vrttjd�|���q| j| j �� vr~d| j �� v rNd}nd| j �� v rbd}nd}t�d| j|� || _nt� d| j� | j s�| � � | � � | j dkr�d }n| j }| �|�s�ttjd �| j ���d S ) N)�blockZdropZtrustedzZone '{}' is not available.ZpublicZexternalr� z+Default zone '%s' is not valid. Using '%s'.zUsing default zone '%s'Ziptablesr, z'Firewall backend '{}' is not available.)r6 rp r' r& � INVALID_ZONE�formatrF r r� r� r+ r} r� rR �is_backend_enabledr� )r< �zr6 Zbackend_to_checkr= r= r> � _start_check5 s4 � ��zFirewall._start_checkc C s� | � � | �� | �| j� | js*| �� | �� | �� | �� | � � | � � | jr\d S t � � dkrpt � � }| j||d� | �� t � � dkr�t � � }t �d|| � d S )Nr �r� r� � z%Flushing and applying took %f seconds)r� r� �_select_firewall_backendrR r+ r� r� r� r� r� r� r ZgetDebugLogLevel�timer� r� Zdebug2)r< r� r� Ztm1Ztm2r= r= r> �_startX s& zFirewall._startc C st | � � | j�� | j�t�| j�� | �| j� | j s@| � � | � � | � � | � � | j rbdS | j||d� dS )z� This is basically _start() with at least the following differences: - built-in defaults for firewalld.conf - no lockdown list - no user config (/etc/firewalld) - no direct rules Nr� )�cleanupr* � set_defaultsr r� ru r� r� rR r+ r� r� r� r� r� )r< r� r� r= r= r> �_start_failsafew s zFirewall._start_failsafec C s� z | � � W n� ty� } z�t�d� z | �� d| _| �d� W nv ty� } z^t�|� t�� t�|� t�d� z | �� W n ty� Y n0 t � t j � W Y d }~n d }~0 0 |�W Y d }~nd }~0 0 d| _| �d� d S )NzLFailed to load user configuration. Falling back to full stock configuration.�FAILED�ACCEPTz�Failed to load full stock configuration. This likely indicates a system level issue, e.g. the firewall backend (nftables, iptables) is broken. All hope is lost. Exiting.�RUNNING) r� r� r r� r� rD � set_policy� exceptionr� �sys�exitr& r� )r< Z original_exZnew_exr= r= r> �start� s* "zFirewall.startc c s: t j�|�sd S tt �|��D ]}|�d�s.q |V q d S )N�.xml)r� r� �isdir�sorted�listdir�endswith)r< r� r� r= r= r> � _loader_config_file_generator� s z&Firewall._loader_config_file_generatorc C s� | � |�D ]v}t�d|tj|� t||�}|j| j�� v r`| j� |j�}t�d|j tj|j � n|j � tj �rtd|_| j�|� q d S )Nz Loading service file '%s%s%s'�Overrides '%s%s%s'T)r� r r� r� r� r ry r ro rd r� r� � startswith� ETC_FIREWALLDr� r� �r< r� r� r{ �orig_objr= r= r> r� � s �zFirewall._loader_servicesc C s� | � |�D ]v}t�d|tj|� t||�}|j| j�� v r`| j� |j�}t�d|j tj|j � n|j � tj �rtd|_| j�|� q d S )NzLoading ipset file '%s%s%s'r� T)r� r r� r� r� r ry r rl rZ r� r� r� r� r� r� r� r= r= r> r� � s �zFirewall._loader_ipsetsc C s� | � |�D ]v}t�d|tj|� t||�}|j| j�� v r`| j� |j�}t�d|j tj|j � n|j � tj �rtd|_| j�|� q d S )Nz Loading helper file '%s%s%s'r� T)r� r r� r� r� r" ry r rm r` r� r� r� r� r� r� r� r= r= r> r� � s �zFirewall._loader_helpersc C s� | � |�D ]v}t�d|tj|� t||�}|j| j�� v r`| j� |j�}t�d|j tj|j � n|j � tj �rtd|_| j�|� q d S )Nz Loading policy file '%s%s%s'r� T)r� r r� r� r� r# ry r r� r� r� r� r� r� r� Zadd_policy_objectr� r= r= r> r� � s �zFirewall._loader_policiesc C s� | � |�D ]v}t�d|tj|� t||�}|j| j�� v r`| j� |j�}t�d|j tj|j � n|j � tj �rtd|_| j�|� q d S )Nz Loading icmptype file '%s%s%s'r� T)r� r r� r� r� r ry r rn rb r� r� r� r� r� r� r� r= r= r> r� � s �zFirewall._loader_icmptypesc C s t j�|�sd S tt �|��D ]�}|�d�sd|�tj�r t j�d||f �r | j d||f dd� q d||f }t � d|� t |||d�}|r�dt j� |�t j� |�dd� f |_|�|j� |j| j�� v r�| j�|j�}t � d |jt j|j� n|j�tj��r d|_| j�|� q d S ) Nr� z%s/%sT)r� zLoading zone file '%s')Z no_check_namer ���r� )r� r� r� r� r� r� r� r r� r� r r� r r� ry r� rp rf r� r� r� r� )r< r� r� r� ry r{ r� r= r= r> r� � s4 � � �zFirewall._loader_zonesc C sp | j �� | j�� | j�� | j�� | j�� | j�� | j�� | j�� | j �� | j �� | � � d S r( ) r4 r� r5 r6 r r9 r r7 r8 r: r* r; rO r= r= r> r� s zFirewall.cleanupc C sN | j sB| jr(| �� | j�� | �d� | jrBt�d� | j� � | � � d S )Nr� z!Unloading firewall kernel modules) r+ rI r� r r� rJ r r� r3 r� r� rO r= r= r> �stop- s z Firewall.stopc C s� d}d}t |�D ]�\}}|r.| j�|�\}}n$| j| dkrBd}n| j�|�\}}|dkrl|d7 }||7 }q|r�| j�|d� | j| d7 < q|| jv r| j| d8 < | j| dkr| j|= q||fS )Nr r� r� )� enumerater3 � load_modulerG Z unload_module� setdefault) r< Z_modules�enableZ num_failedZ error_msgs�i�module�statusr� r= r= r> �handle_modules< s( zFirewall.handle_modulesc C s |dkrd| _ d S )Nr F)rW )r< �backendr= r= r> r� V s z!Firewall._select_firewall_backendc C s4 | � � D ]}|j|kr| S qttjd| ��d S )Nz'%s' backend does not exist)� all_backendsry r' r& r� )r< ry r� r= r= r> �get_backend_by_name\ s �z Firewall.get_backend_by_namec C s\ | j r | jS |dkr | jr | jS |dkr4| jr4| jS |dkrH| jrH| jS tt j d| ��d S �Nrj rk �ebz-'%s' is not a valid backend or is unavailable) rW r2 rA r- rB r/ rC r0 r' r& � INVALID_IPV�r< �ipvr= r= r> �get_backend_by_ipvc s �zFirewall.get_backend_by_ipvc C sP |dkr| j r| jS |dkr(| jr(| jS |dkr<| jr<| jS ttjd| ��d S r� ) rA r- rB r/ rC r0 r' r& r� r� r= r= r> �get_direct_backend_by_ipvo s �z"Firewall.get_direct_backend_by_ipvc C s< |dkr| j S |dkr | jS |dkr*| jS |dkr8| jS dS )Nr, r. r r F)rA rB rC rW )r< ry r= r= r> r� y s zFirewall.is_backend_enabledc C s8 | j r dS |dkr| jS |dkr&| jS |dkr4| jS dS )NTrj rk r� F)rW rA rB rC r� r= r= r> �is_ipv_enabled� s zFirewall.is_ipv_enabledc C sR g }| j r|�| j� n6| jr*|�| j� | jr<|�| j� | jrN|�| j� |S r( ) rW rv r2 rA r- rB r/ rC r0 �r< r� r= r= r> �enabled_backends� s zFirewall.enabled_backendsc C sP g }| j r|�| j� | jr(|�| j� | jr:|�| j� | jrL|�| j� |S r( ) rA rv r- rB r/ rC r0 rW r2 r r= r= r> r� � s zFirewall.all_backendsNc C sJ |d u rt | �}n|}| �� D ]}|�||�� � q |d u rF|�d� d S �NT)r r � add_rulesZbuild_default_tablesr� )r< r� r� r� r= r= r> r� � s z Firewall.apply_default_tablesc C s� |d u rt | �}n|}| �� D ] }|�| j�}|�||� q | �d�r~| �d�}d|�� v r~| jdkr~|� | j�}|�||� | �d�r�| j r�|� � }|�||� |d u r�|� d� d S )Nrk �rawr� T) r r Zbuild_default_rulesrN r r r� r rK Zbuild_rpfilter_rulesrT Zbuild_rfc3964_ipv4_rulesr� )r< r� r� r� �rulesZ ipv6_backendr= r= r> r� � s" z Firewall.apply_default_rulesc C s | j r| j�� sdS dS )NTF)rW r7 Zhas_runtime_configurationrO r= r= r> � may_skip_flush_direct_backends� s z'Firewall.may_skip_flush_direct_backendsc C s\ |d u rt | �}n|}| �� D ]&}|| �� v r0q |�� }|�||� q |d u rX|�d� d S r )r r� r �build_flush_rulesr r� �r< r� r� r� r r= r= r> �flush_direct_backends� s z Firewall.flush_direct_backendsc C sl |d u rt | �}n|}t�d� | �� s4| j|d� | �� D ]}|�� }|�||� q<|d u rh|�d� d S )NzFlushing rule setr� T) r r r� r r r r r r� r r= r= r> r� � s zFirewall.flushc C s0 |d u r$|dkrdnd}|||d�}|� ||�S )Nr� �DROP)ZINPUTZOUTPUTZFORWARD)Zbuild_set_policy_rules)r< r� r: �policy_detailsZdpr= r= r> �_set_policy_build_rules� s �z Firewall._set_policy_build_rulesc C s| |d u rt | �}n|}t�d||dkr8dt�|�� d�nd� | �� D ] }| �|||�}|�||� qF|d u rx|�d� d S )NzSetting policy to '%s'%sr z (ReloadPolicy=�)r� T) r r r� r Z_unparse_reload_policyr r r r� )r< r: r r� r� r� r r= r= r> r� � s �� zFirewall.set_policyc C sB |sdS | � |�}|s&ttjd| ��| �|�s4dS |�|| j�S )Nr� �'%s' is not a valid backend)r� r' r& r� r� �set_rulerN )r< � backend_name�ruler� r= r= r> r s � z Firewall.rulec C s t td |��}| �|�}|s,ttjd| ��| �|�s:d S | jsZ|jrZ|dk�r| j j �st |�D ]�\}}z|� || j � W qb ty� } zjt�t�� � t�|� t|d |� �D ]0}z|� |�|�| j � W q� ty� Y q�0 q�|�W Y d }~qbd }~0 0 qbn|�|| j � d S )Nr r )�listr~ r� r' r& r� r� rM r� r0 r� r� r rN r� r r� � traceback� format_excr� �reversedZ reverse_ruleZ set_rules) r< r r Z_rulesr� r� r r� Zrruler= r= r> r # s8 � ��� zFirewall.rulesc C s | j rttj��d S r( )rE r' r& Z PANIC_MODErO r= r= r> � check_panicC s zFirewall.check_panicc C s" |}|| j �� vr ttj|��|S r( )r: Z get_policiesr' r& ZINVALID_POLICY)r< r: Z_policyr= r= r> � check_policyG s zFirewall.check_policyc C s6 |}|r|dkr| � � }|| j�� vr2ttj|��|S )Nr� )�get_default_zoner6 rp r' r& r� )r< r6 �_zoner= r= r> � check_zoneM s zFirewall.check_zonec C s t �|�sttj|��d S r( )r ZcheckInterfacer' r& ZINVALID_INTERFACE)r< � interfacer= r= r> �check_interfaceU s zFirewall.check_interfacec C s | j �|� d S r( )r5 � check_service)r< r5 r= r= r> r Y s zFirewall.check_servicec C s t �|�sttj|��d S r( )r � check_portr' r& Z INVALID_PORT)r< �portr= r= r> r \ s zFirewall.check_portc C s* |st tj��|dvr&t tjd| ��d S )N)ZtcpZudpZsctpZdccpz''%s' not in {'tcp'|'udp'|'sctp'|'dccp'})r' r& ZMISSING_PROTOCOLZINVALID_PROTOCOL)r< Zprotocolr= r= r> � check_tcpudp` s ��zFirewall.check_tcpudpc C s t �|�sttj|��d S r( )r ZcheckIPr' r& � INVALID_ADDR)r< �ipr= r= r> �check_iph s zFirewall.check_ipc C sP |dkr t �|�sLttj|��n,|dkr@t �|�sLttj|��n ttjd��d S )Nrj rk z'%s' not in {'ipv4'|'ipv6'})r Z checkIPnMaskr' r& r" Z checkIP6nMaskr� )r< r� �sourcer= r= r> � check_addressl s �zFirewall.check_addressc C s | j �|� d S r( )r4 �check_icmptype)r< Zicmpr= r= r> r' w s zFirewall.check_icmptypec C s> t |t�s td|t|�f ��t|�dk r:ttjd| ��d S )Nz%s is %s, expected intr z#timeout '%d' is not positive number)� isinstance�int� TypeError�typer' r& � INVALID_VALUE)r< �timeoutr= r= r> � check_timeoutz s �zFirewall.check_timeoutc C s� t | � | j}| j�� }| j}| j}|s`i }| j�� D ]}| j�|�j ||< q6| j � � }| � � } g } | j� � D ]} | �| j�| �� qn|s�t�| j�d��} | jd| d� | �� | �� d } z| jd|d� W n( ty� } z|} W Y d }~n d }~0 0 |�r8| D ]2}| j�|j��s| j�r|�s| j � |j� �q|�s�| � � }|| k�r�||v�rbi ||< || D ]0}|| j v �rj|| | || |< || |= �qj| j�� D ]B}||v �r�|| D ]}| j� ||� �q�||= n t �!d|� �q�t"|�dk�r t#|�$� �D ]}t �!d|� ||= �q~| D ]�}| j�|j��r�|j%D ]T}z| j�&|j|� W n8 t'�y� } z |j(t)j*k�rz|�W Y d }~n d }~0 0 �q>n| j�+|� | j�,|j� �q$| j �-|� t.� }|�r| j�� d g D ](}t/|�D ]}| jj |||d � �q�q�|| _| j�s | �d � | j�s�|| jk�r�|d k�rd| �0| j1d �D ]}| j1�2|| j3� �qJnT| �0| j4d �D ]}| j4�2|| j3� �qr| j5�r�| �0| j6d �D ]}| j6�2|| j3� �q�| �r�d | _7| �nd| _7d S )NZ ReloadPolicyr )r Tr� zNew zone '%s'.r z(Lost zone '%s', zone interfaces dropped.r� )Zsenderr� r r� r� )8r$ rE r Zomit_native_ipsetrR rS r6 rp rf � interfacesr7 Zget_runtime_configr rl rv rZ r Z_parse_reload_policyr* rq r� r� r� r� r� Z query_ipsetry rL r1 Z set_destroyrQ �change_zone_of_interfacer r� �lenr �keys�entriesZ add_entryr' r� r& �ALREADY_ENABLEDr� Z apply_ipsetZ set_configr r r r2 r rN r- rB r/ rD )r< r� rE Z_omit_native_ipsetZold_firewall_backendZ flush_allZ_zone_interfacesr6 Z_direct_config�_old_dzZ _ipset_objs�_nameZ reload_policyZstart_exceptionr� r{ Z_new_dz�ifaceZ interface_id�entryr� Z nm_bus_namer r r= r= r> r� � s� � � ���zFirewall.reloadc C s | j S r( )rD rO r= r= r> � get_state s zFirewall.get_statec C s\ | j rttjd��z| �d� W n0 tyP } zttj|��W Y d }~n d }~0 0 d| _ d S )Nzpanic mode already enabledZPANICT)rE r' r& r4 r� r� �COMMAND_FAILEDr� r= r= r> �enable_panic_mode s �"zFirewall.enable_panic_modec C s\ | j sttjd��z| �d� W n0 tyP } zttj|��W Y d }~n d }~0 0 d| _ d S )Nzpanic mode is not enabledr� F)rE r' r& Z NOT_ENABLEDr� r� r: r� r= r= r> �disable_panic_mode s �"zFirewall.disable_panic_modec C s | j S r( )rE rO r= r= r> �query_panic_mode* s zFirewall.query_panic_modec C s | j S r( )rN rO r= r= r> �get_log_denied/ s zFirewall.get_log_deniedc C sb |t jvr&ttjd|d�t j�f ��|| �� krR|| _| j� d|� | j� � n ttj |��d S )Nz'%s', choose from '%s'z','r� ) r ZLOG_DENIED_VALUESr' r& r, �joinr> rN r* rr �writeZ ALREADY_SET)r< r� r= r= r> �set_log_denied2 s �� zFirewall.set_log_deniedc C s | j S r( )rF rO r= r= r> r A s zFirewall.get_default_zonec C s� | � |�}|| jkr~| j}|| _| j�d|� | j�� | jrBd S | j�||� | j�|�j D ] }|| j v r^| j� d|� q^n t t j|��d S )Nr� r� )r rF r* rr r@ r+ r6 r� rf r/ rQ r0 r' r& ZZONE_ALREADY_SET)r< r6 r r5 r7 r= r= r> �set_default_zoneD s zFirewall.set_default_zonec C sD |� � }|�� D ].\}}|s&t|t�r0|||< q||v r||= q|S r( )ru rz r( �bool)r< Z permanentri Zcombined�keyr� r= r= r> �'combine_runtime_with_permanent_settings[ s z0Firewall.combine_runtime_with_permanent_settingsc C s, dD ]"}||v rdd� || D �||< qi }i }t |�� �t |�� �B D ]�}||v rHt|| t�r�t ||v rt|| ng �}tt || �| �||< t|t || �A |@ �||< qHt|| t�s�t|| t��r|| s�|| r�d||< n || �r"|| �s"d||< qHttjd� t || �|���qH||fS )N)Z rich_rulesZ rules_strc S s g | ]}t t|d ���qS ))�rule_str)�strr% )r[ rF r= r= r> � <listcomp>m r^ z;Firewall.get_added_and_removed_settings.<locals>.<listcomp>TFz Unhandled setting type {} key {}) rr r2 r( r rC r) r' r& ZINVALID_SETTINGr� r+ )r< Z old_settingsZ new_settingsZrich_keyZ add_settingsZremove_settingsrD �oldr= r= r> � get_added_and_removed_settingsi s$ z'Firewall.get_added_and_removed_settings)F)FF)FF)FF)F)N)N)N)N)N)NN)F)K�__name__� __module__� __qualname__r? rP r; rw r rG r r r} r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r r r� r� r� r r r� r r� r r r r r r r r r! r$ r& r' r. r� r9 r; r< r= r> rA r rB rE rJ r= r= r= r> r F s� %* Ud0 .# " )I�__all__r� r� ru r� r �typingr r Zfirewallr r Z firewall.corer r r r r Zfirewall.core.fw_icmptyper Zfirewall.core.fw_servicer Zfirewall.core.fw_zoner Zfirewall.core.fw_directr Zfirewall.core.fw_configr Zfirewall.core.fw_policiesr Zfirewall.core.fw_ipsetr Z firewall.core.fw_transactionr Zfirewall.core.fw_helperr Zfirewall.core.fw_policyr Zfirewall.core.fw_nmr r Zfirewall.core.loggerr Zfirewall.core.io.io_objectr Z firewall.core.io.firewalld_confr Zfirewall.core.io.directr Zfirewall.core.io.servicer Zfirewall.core.io.icmptyper Zfirewall.core.io.zoner r Zfirewall.core.io.ipsetr Zfirewall.core.ipsetr! Zfirewall.core.io.helperr" Zfirewall.core.io.policyr# Zfirewall.core.io.functionsr$ Zfirewall.core.richr% r& Zfirewall.errorsr' �objectr r= r= r= r> �<module> sP core/__pycache__/fw_ifcfg.cpython-39.pyc 0000644 00000002627 15025011705 0014112 0 ustar 00 a ���g � @ sT d Z ddgZddlZddlZddlmZ ddlmZ ddlm Z dd� Z d d� Z dS ) z.Functions to search for and change ifcfg files�search_ifcfg_of_interface�ifcfg_set_zone_of_interface� N)�config)�log)�ifcfgc C s� t j�tj�sdS tt �tj��D ]`}|�d�s2q"dD ]}|�|�r6q6q6d|v rRq"t dtj|f �}|� � |� d�| kr"| S q"dtj| f }t j�|�r�t |�}|� � |S dS )z6search ifcfg file for the interface in config.IFCFGDIRNzifcfg-)z.bakz.origz.rpmnewz.rpmorigz.rpmsavez-range�.z%s/%sZDEVICEz %s/ifcfg-%s) �os�path�existsr ZIFCFGDIR�sorted�listdir� startswith�endswithr �read�get)� interface�filenameZignored� ifcfg_file� r �:/usr/lib/python3.9/site-packages/firewall/core/fw_ifcfg.pyr ! s( c C sl | du r d} t |�}|durh|�d�| krh|�d�du r@| dksht�d| |jf � |�d| � |�� dS )zYSet zone (ZONE=<zone>) in the ifcfg file that uses the interface (DEVICE=<interface>)N� ZZONEzSetting ZONE=%s in '%s')r r r Zdebug1r �set�write)�zoner r r r r r ? s �� ) �__doc__�__all__r Zos.pathZfirewallr Zfirewall.core.loggerr Zfirewall.core.io.ifcfgr r r r r r r �<module> s core/__pycache__/modules.cpython-39.pyc 0000644 00000005545 15025011705 0014012 0 ustar 00 a ���g� � @ sB d Z dgZddlmZ ddlmZ ddlmZ G dd� de�Z dS )zmodules backend�modules� )�runProg)�log)�COMMANDSc @ sL e Zd Zdd� Zdd� Zdd� Zdd� Zd d � Zd d � Zd d� Z dd� Z dS )r c C s t d | _t d | _d S )NZmodprobeZrmmod)r � _load_command�_unload_command��self� r �9/usr/lib/python3.9/site-packages/firewall/core/modules.py�__init__ s zmodules.__init__c C s d| j S )Nz%s)� __class__r r r r �__repr__$ s zmodules.__repr__c C s� g }i }z�t dd��x}|D ]b}|s& q~|�� }|�� }|�|d � |d dkrp|d �d�dd� ||d < qg ||d < qW d � n1 s�0 Y W n ty� Y n0 ||fS ) z6 get all loaded kernel modules and their dependencies z /proc/modules�rr � �-�,N���)�open�strip�split�append�FileNotFoundError)r �mods�deps�f�lineZsplitsr r r �loaded_modules' s 0 zmodules.loaded_modulesc C s" t �d| j| j|� t| j|g�S �Nz %s: %s %s)r �debug2r r r �r �moduler r r � load_module< s zmodules.load_modulec C s" t �d| j| j|� t| j|g�S r )r r r r r r r r r � unload_module@ s zmodules.unload_modulec C sP ||vr dS || D ]$}| � |||� ||vr|�|� q||vrL|�|� dS )z get all dependants of a module N)�get_depsr )r r! r �ret�modr r r r$ D s zmodules.get_depsc C s� g }| � � \}}| �d||� dD ]"}||v r"|�|� |�d|� q"|D ]V}|dv s�|�d�s�|�d�s�|�d�s�|�d�s�|�d �s�|�d �rJ| �|||� qJ|S ) z) get all loaded firewall-related modules Z nf_conntrack)Znf_conntrack_ipv4Znf_conntrack_ipv6r )Z ip_tablesZ ip6_tablesZebtablesZiptable_Z ip6table_Znf_Zxt_Zipt_Zip6t_)r r$ �remove�insert� startswith)r r Zmods2r Zbad_bad_moduler& r r r �get_firewall_modulesO s. ������z modules.get_firewall_modulesc C s: | � � D ],}| �|�\}}|dkrt�d||f � qdS )z% unload all firewall-related modules r z Failed to unload module '%s': %sN)r* r# r Zdebug1)r r! �statusr% r r r �unload_firewall_modulesd s z modules.unload_firewall_modulesN) �__name__� __module__� __qualname__r r r r" r# r$ r* r, r r r r r s N) �__doc__�__all__Zfirewall.core.progr Zfirewall.core.loggerr Zfirewall.configr �objectr r r r r �<module> s core/__pycache__/logger.cpython-39.opt-1.pyc 0000644 00000054466 15025011705 0014566 0 ustar 00 a ���g?y � @ s� g d �Z ddlZddlZddlZddlZddlZddlZddlZddlZddl Z ddl Z G dd� de �Z G dd� de �Z G dd� de �ZG d d � d e �ZG d d � d e �ZG d d� de �Ze� ZdS ))� LogTarget�FileLog�Logger�log� Nc @ s2 e Zd ZdZdd� Zd dd�Zdd� Zd d � Zd S ) r z% Abstract class for logging targets. c C s d | _ d S �N)�fd��self� r �8/usr/lib/python3.9/site-packages/firewall/core/logger.py�__init__( s zLogTarget.__init__r c C s t d��d S )Nz%LogTarget.write is an abstract method��NotImplementedError�r �data�level�logger�is_debugr r r �write+ s zLogTarget.writec C s t d��d S )Nz%LogTarget.flush is an abstract methodr r r r r �flush. s zLogTarget.flushc C s t d��d S )Nz%LogTarget.close is an abstract methodr r r r r �close1 s zLogTarget.closeN)r )�__name__� __module__� __qualname__�__doc__r r r r r r r r r & s r c @ s. e Zd Zdd� Zd dd�Zdd� Zdd � Zd S ) � _StdoutLogc C s t �| � tj| _d S r )r r �sys�stdoutr r r r r r 8 s z_StdoutLog.__init__r c C s | j �|� | �� d S r )r r r r r r r r < s z_StdoutLog.writec C s | � � d S r )r r r r r r A s z_StdoutLog.closec C s | j �� d S r �r r r r r r r D s z_StdoutLog.flushN)r �r r r r r r r r r r r r 7 s r c @ s e Zd Zdd� ZdS )� _StderrLogc C s t �| � tj| _d S r )r r r �stderrr r r r r r K s z_StderrLog.__init__N)r r r r r r r r r J s r c @ s. e Zd Zdd� Zd dd�Zdd� Zdd � Zd S ) � _SyslogLogc C s. t �| � t�tj�tjd �tj tj � d S )Nr ) r r �syslogZopenlog�os�path�basenamer �argvZLOG_PIDZ LOG_DAEMONr r r r r S s �z_SyslogLog.__init__r c C s� d }|rt j}nF||jkr"t j}n4||jkr4t j}n"||jkrFt j}n||jkrVt j }|� d�rt|d t |�d � }t |�dkr�|d u r�t � |� n t � ||� d S )N� � r ) r# Z LOG_DEBUG�INFO1ZLOG_INFO�WARNINGZ LOG_WARNING�ERRORZLOG_ERR�FATALZLOG_CRIT�endswith�len)r r r r r �priorityr r r r a s" z_SyslogLog.writec C s t �� d S r )r# Zcloselogr r r r r w s z_SyslogLog.closec C s d S r r r r r r r z s z_SyslogLog.flushN)r r r r r r r" R s r" c @ s< e Zd ZdZddd�Zdd� Zddd �Zd d � Zd d � ZdS )r z< FileLog class. File will be opened on the first write. �wc C s t �| � || _|| _d S r )r r �filename�mode)r r2 r3 r r r r � s zFileLog.__init__c C sv | j r d S tjtjB }| j�d�r,|tjO }t�| j|d�| _ t� | j d� t� | j | j�| _ t � | j t j t j � d S )N�ai� )r r$ �O_CREAT�O_WRONLYr3 � startswith�O_APPEND�openr2 �fchmod�fdopen�fcntlZF_SETFDZ FD_CLOEXEC)r �flagsr r r r9 � s z FileLog.openr c C s( | j s| �� | j �|� | j �� d S r )r r9 r r r r r r r � s z FileLog.writec C s | j s d S | j �� d | _ d S r )r r r r r r r � s z FileLog.closec C s | j s d S | j �� d S r r r r r r r � s z FileLog.flushN)r1 )r ) r r r r r r9 r r r r r r r r s r c @ s� e Zd ZdZdZdZdZdZdZdZ e � Z e � Z e� Zd\d d �Zd d � Zd]dd�Zd^dd�Zd_dd�Zd`dd�Zdd� Zdd� Zdd � Zd d � Zd d � Zd!d"� Zed#fd$d%�Z ed#fd&d'�Z ed#fd(d)�Z ed#fd*d+�Z ed#fd,d-�Z ed#fd.d/�Z!d0d1� Z"d2d3� Z#d4d5� Z$d6d7� Z%d8d9� Z&d:d;� Z'd<d=� Z(d>d?� Z)d@dA� Z*dBdC� Z+dDdE� Z,dadFdG�Z-dHdI� Z.dbdJdK�Z/ed#dfdLdM�Z0ed#dfdNdO�Z1ed#dfdPdQ�Z2dcdRdS�Z3dTdU� Z4dVdW� Z5dXdY� Z6dddZd[�Z7d#S )er aL Format string: %(class)s Calling class the function belongs to, else empty %(date)s Date using Logger.date_format, see time module %(domain)s Full Domain: %(module)s.%(class)s.%(function)s %(file)s Filename of the module %(function)s Function name, empty in __main__ %(label)s Label according to log function call from Logger.label %(level)d Internal logging level %(line)d Line number in module %(module)s Module name %(message)s Log message Standard levels: FATAL Fatal error messages ERROR Error messages WARNING Warning messages INFOx, x in [1..5] Information DEBUGy, y in [1..10] Debug messages NO_INFO No info output NO_DEBUG No debug output INFO_MAX Maximum info level DEBUG_MAX Maximum debug level x and y depend on info_max and debug_max from Logger class initialization. See __init__ function. Default logging targets: stdout Logs to stdout stderr Logs to stderr syslog Logs to syslog Additional arguments for logging functions (fatal, error, warning, info and debug): nl Disable newline at the end with nl=0, default is nl=1. fmt Format string for this logging entry, overloads global format string. Example: fmt="%(file)s:%(line)d %(message)s" nofmt Only output message with nofmt=1. The nofmt argument wins over the fmt argument. Example: from logger import log log.setInfoLogLevel(log.INFO1) log.setDebugLogLevel(log.DEBUG1) for i in range(1, log.INFO_MAX+1): log.setInfoLogLabel(i, "INFO%d: " % i) log.setFormat("%(date)s %(module)s:%(line)d [%(domain)s] %(label)s: " "%(level)d %(message)s") log.setDateFormat("%Y-%m-%d %H:%M:%S") fl = FileLog("/tmp/log", "a") log.addInfoLogging("*", fl) log.addDebugLogging("*", fl) log.addInfoLogging("*", log.syslog, fmt="%(label)s%(message)s") log.debug3("debug3") log.debug2("debug2") log.debug1("debug1") log.info2("info2") log.info1("info1") log.warning("warning\n", nl=0) log.error("error\n", nl=0) log.fatal("fatal") log.info(log.INFO1, "nofmt info", nofmt=1) ���������������r � � c C s� i | _ i | _d| _d| _i | _i | _i | _i | _i | _i | _ |dk rPt d| ��|dk rdt d| ��| j | _ || _ d| _|| _| �| jd� | �| jd� | �| jd� | �| j d� td| j d �D ]:}t| d | |� | �|d� t| d | d d � | |�� q�td| jd �D ]@}t| d | |� | �|d| � t| d| dd � | |�� �q| �| j� | �| j� | �d� | �d� | � d| j | j| j| j g� | � d| j dd� t| j| j d �D �� | � d| j dd� td| jd �D �� dS )z Logger class initialization � r) z Logger: info_max %d is too lowr z Logger: debug_max %d is too lowz FATAL ERROR: zERROR: z WARNING: zINFO%dzinfo%dc s � �fdd�S )Nc s � j �| g|�R i |��S r )�info��message�args�kwargs�r �xr r �<lambda> s �3Logger.__init__.<locals>.<lambda>.<locals>.<lambda>r rK r rK r rM s z!Logger.__init__.<locals>.<lambda>zDEBUG%dz DEBUG%d: zdebug%dc s � �fdd�S )Nc s � j �| g|�R i |��S r )�debugrG rK r r rM ) s rN r rK r rK r rM ( s z%(label)s%(message)sz%d %b %Y %H:%M:%S�*c S s g | ]}|�qS r r ��.0�ir r r � <listcomp>4 � z#Logger.__init__.<locals>.<listcomp>c S s g | ]}|�qS r r rQ r r r rT 6 rU N) �_level� _debug_level�_format� _date_format�_label� _debug_label�_logging�_debug_logging�_domains�_debug_domains� ValueErrorr+ �NO_INFO�INFO_MAX�NO_DEBUG� DEBUG_MAX�setInfoLogLabelr- � TRACEBACKr, �range�setattr�setDebugLogLabel�setInfoLogLevelr* �setDebugLogLevel� setFormat� setDateFormat�setInfoLoggingr! r �setDebugLogging)r Zinfo_maxZ debug_maxrV r r r r � sf �� �� � � �zLogger.__init__c C sF t | j| jd �D ].}|| jvr"q| j| D ]\}}}|�� q,qdS )z Close all logging targets r) N)rg r- rd r\ r )r r �dummy�targetr r r r 8 s z Logger.closerP c C s$ | � |� || jv r | j| S | jS )z Get info log level. )� _checkDomainrV �NOTHING�r �domainr r r �getInfoLogLevel@ s zLogger.getInfoLogLevelc C s8 | � |� || jk r| j}|| jkr*| j}|| j|< dS )z% Set log level [NOTHING .. INFO_MAX] N)rr rs rb rV �r r ru r r r rj G s zLogger.setInfoLogLevelc C s* | � |� || jv r$| j| | j S | jS )z Get debug log level. )rr rW rc rt r r r �getDebugLogLevelP s zLogger.getDebugLogLevelc C s: | � |� |dk rd}|| jkr&| j}|| j | j|< dS )z- Set debug log level [NO_DEBUG .. DEBUG_MAX] r N)rr rd rc rW rw r r r rk W s zLogger.setDebugLogLevelc C s | j S r �rX r r r r � getFormat` s zLogger.getFormatc C s || _ d S r ry �r rX r r r rl c s zLogger.setFormatc C s | j S r �rY r r r r � getDateFormatf s zLogger.getDateFormatc C s || _ d S r r| r{ r r r rm i s zLogger.setDateFormatc C s6 | � |�}|D ]"}| j|| j| jd� || j|< qdS )�U Set log label for level. Level can be a single level or an array of levels. �� min_level� max_levelN)� _getLevels�_checkLogLevelr- rb rZ �r r �label�levelsr r r re l s �zLogger.setInfoLogLabelc C s: | j |dd�}|D ]"}| j|| j| jd� || j|< qdS )r~ r) �r r N)r� r� r* rd r[ r� r r r ri u s �zLogger.setDebugLogLabelNc C s | j ||||dd� dS )z� Set info log target for domain and level. Level can be a single level or an array of levels. Use level ALL to set for all levels. If no format is specified, the default format will be used. r r� N�� _setLogging�r ru rq r �fmtr r r rn ~ s zLogger.setInfoLoggingc C s | j ||||dd� dS )z� Set debug log target for domain and level. Level can be a single level or an array of levels. Use level ALL to set for all levels. If no format is specified, the default format will be used. r) r� Nr� r� r r r ro � s zLogger.setDebugLoggingc C s | j ||||dd� dS )z� Add info log target for domain and level. Level can be a single level or an array of levels. Use level ALL to set for all levels. If no format is specified, the default format will be used. r r� N�� _addLoggingr� r r r �addInfoLogging� s zLogger.addInfoLoggingc C s | j ||||dd� dS )z� Add debg log target for domain and level. Level can be a single level or an array of levels. Use level ALL to set for all levels. If no format is specified, the default format will be used. r) r� Nr� r� r r r �addDebugLogging� s zLogger.addDebugLoggingc C s | j ||||dd� dS )z� Delete info log target for domain and level. Level can be a single level or an array of levels. Use level ALL to set for all levels. If no format is specified, the default format will be used. r r� N�� _delLoggingr� r r r �delInfoLogging� s zLogger.delInfoLoggingc C s | j ||||dd� dS )z� Delete debug log target for domain and level. Level can be a single level or an array of levels. Use level ALL to set for all levels. If no format is specified, the default format will be used. r) r� Nr� r� r r r �delDebugLogging� s zLogger.delDebugLoggingc C s | j |dd�S )zN Is there currently any info logging for this log level (and domain)? r r� ��_isLoggingHere�r r r r r �isInfoLoggingHere� s zLogger.isInfoLoggingHerec C s | j |dd�S )zO Is there currently any debug logging for this log level (and domain)? r) r� r� r� r r r �isDebugLoggingHere� s zLogger.isDebugLoggingHerec O s2 | � |� d|d< | j| j|g|�R i |�� dS )z Fatal error log. r r N)� _checkKWargs�_logr- �r rX rI rJ r r r �fatal� s z Logger.fatalc O s2 | � |� d|d< | j| j|g|�R i |�� dS )z Error log. r r N)r� r� r, r� r r r �error� s z Logger.errorc O s2 | � |� d|d< | j| j|g|�R i |�� dS )z Warning log. r r N)r� r� r+ r� r r r �warning� s zLogger.warningc O sH | j |d| jd� | �|� d|d< | j|| j |g|�R i |�� dS )z� Information log using info level [1..info_max]. There are additional infox functions according to info_max from __init__r) r r r N)r� rb r� r� ra �r r rX rI rJ r r r rF � s z Logger.infoc O sB | j |d| jd� | �|� d|d< | j||g|�R i |�� dS )z� Debug log using debug level [1..debug_max]. There are additional debugx functions according to debug_max from __init__r) r r N)r� rd r� r� r� r r r rO � s z Logger.debugc C s | j | jt�� g i d� d S )N)rI rJ )r� rf � traceback� format_excr r r r � exception� s zLogger.exceptionc C s& ||k s||kr"t d|||f ��d S )Nz*Level %d out of range, should be [%d..%d].�r` )r r r� r� r r r r� � s �zLogger._checkLogLevelc C s. |sd S |� � D ]}|dvrtd| ��qd S )N)�nlr� �nofmtz0Key '%s' is not allowed as argument for logging.)�keysr` )r rJ �keyr r r r� � s zLogger._checkKWargsc C s |r |dkrt d| ��d S )NrE zDomain '%s' is not valid.r� rt r r r rr � s zLogger._checkDomainc C s� || j krbt|t�s t|t�r$|}n|g}|D ]0}|rJ| j|d| jd� q.| j|| j| jd� q.n6|r�dd� t| j | j�D �}ndd� t| j| j�D �}|S )z Generate log level array. r) r c S s g | ]}|�qS r r rQ r r r rT � rU z%Logger._getLevels.<locals>.<listcomp>c S s g | ]}|�qS r r rQ r r r rT � rU ) �ALL� isinstance�list�tupler� rd r- rb rg ZDEBUG1)r r r r� r r r r� � s � � zLogger._getLevelsc C sJ t |t�st |t�r|}n|g}|D ] }t|jt�s$td|jj ��q$|S )z Generate target array. z '%s' is no valid logging target.)r� r� r� � issubclass� __class__r r` r )r rq �targets�_targetr r r � _getTargets� s �zLogger._getTargetsc C s� |r | j }| j}d| jd f}n | j}| j}| j| jd f}t|�dkrP|�� t |d |d �D ]<}||vrpqb|| D ]$\}}}||vrx|� |g �� |� qxqbdS )z% Generate dict with domain by level. r) r N) r_ r] rd r^ r\ r- rb r/ �clearrg � setdefault�append)r r r^ r\ Z_ranger ru rp r r r � _genDomains s zLogger._genDomainsc C sd | � |� | �||�}| �|�}|r,| j}n| j}|D ] }|D ]}|||fg||< q>q6| �|� d S r )rr r� r� r] r\ r� � r ru rq r r� r r� r� r\ r r r r� s zLogger._setLoggingc C sl | � |� | �||�}| �|�}|r,| j}n| j}|D ]&}|D ] }|�|g ��|||f� q>q6| �|� d S r )rr r� r� r] r\ r� r� r� r� r r r r� - s zLogger._addLoggingc C s� | � |� | �||�}| �|�}|r,| j}n| j}|D ]x} |D ]n}| |vrLq>|||f|| v r�|| �|||f� t|| �dkr�|| = q>|| jkr>td| ||j j |f ��q>q6| � |� d S )Nr zENo matching logging for level %d, domain %s, target %s and format %s.) rr r� r� r] r\ �remover/ r� r` r� r r� ) r ru rq r r� r r� r� r\ rV r r r r� < s( � zLogger._delLoggingc C sr | � ||�}|sdS |d d }|r,| j}n| j}|| D ]2\}}}|dksf|�|�sft�|d |�r: dS q:dS )NFru �.rP T)�_genDictr] r\ r7 �fnmatch� fnmatchcase)r r r �_dict� point_domainr\ ru rp r r r r� U s ��zLogger._isLoggingHerec C s� |j jdkrD|j jd }||jv rD|j| }| �|j|j �}|rD|S t�|j �}|j }|j|j v r�t |j |j d�r�|j |j j |kr�dS |j � � D ]J\}}t |tj�r�t ||j�r�t||j�}t |tj�r�|j |kr�| S q�dS )z7 Function to get calling class. Returns class or None. r Z func_codeN)�f_code� co_argcount� co_varnames�f_locals� _getClass2r� �inspectZ getmodule�co_name�__dict__�hasattr�__code__�itemsr� �typesZ ClassType�getattr� FunctionType) r �frameZselfnameZ_self�obj�module�coderp �valuer r r � _getClassi s, � zLogger._getClassc C sV |j �� D ]"}t|tj�r |j|kr | S q |jD ] }| �||�}|r4| S q4dS )z@ Internal function to get calling class. Returns class or None. N)r� �valuesr� r� r� r� � __bases__r� )r r� r� r� �baseZ_objr r r r� � s zLogger._getClass2c O sh d}d|v r|d }d}d|v r(|d }d}d|v r<|d }| � ||�}|sPd S t|�dkrj|| |d< n&t|�dkr�||d |d< n||d< |d d } |r�| j} n| j} g } | | D ]�\} } }| | v r�q�| d ks�| �| d �s�t�|d | �r�|�s | j}d |v �r|d }|�r.| �|d || |� n| �|| || |� |�rX| �d || |� | � | � q�d S ) Nr r r) r� r� rH ru r� rP r� r( ) r� r/ r] r\ r7 r� r� rX r r� )r r rX rI rJ r r� r� r� r� r\ Z used_targetsru rq r r r r� � sP �� z Logger._logc C s g }d}|r | j }| j}| j}n| j}| j}| j}|D ]H}|dkrh|| |kr~d}t|�dkrbg } q�q6|| |kr6|�|� q6|s�t|�dk r�dS ||vr�dS t� � } | r�| j r�| j d | j kr�| j } q�| s�t d��| j d } | d } |D ]}| �|�r�g } �qq�| j} t| �} || D ]p}|�d�}|dk�r:�q n |dk�rR|d|� }n|}| t|�k�rx| �|��s� dS n|�| ��s dS �q d }||v �r�|| }| j| j| d | jd ||t�| jt�� �d � }|d d k�r�d |d < d}|| D ] }|dk�r�q�d} �q�q�| j�d�dk�sJ| j�d�dk�sJ|�sJt|�dk�rd| �| �}|�rd|j|d< d |d |d< |d d k�r�|d d |d 7 < |d d k�r�|d d |d 7 < t|�dk �r�|S |d d }|D ],}|�|��st� |d |��r�| S �q�dS )z Internal function. FrP Tr r) Nr z Frame information not available.r� rE ) �file�liner� �class�functionru r� r �dater� �?z %(domain)z%(class)r� r� ru ) rW r_ r[ rV r^ rZ r/ r� r� Z currentframe�f_back� f_globalsr r` r7 r� �find� co_filename�f_linenor� �time�strftimerY � localtimerX r� r r� r� )r r r Z check_domainsZ simple_matchr� r^ rZ ru �fZ module_nameZ point_module�co�_lenrS �dZ level_strZ domain_neededr� r� r r r r� � s� � �� � � zLogger._genDict)rC rD )rP )rP )rP )rP )r )r )r )r )8r r r r r� rs r- rf r, r+ r r r r! r" r# r r rv rj rx rk rz rl r} rm re ri rn ro r� r� r� r� r� r� r� r� r� rF rO r� r� r� rr r� r� r� r� r� r� r� r� r� r� r� r r r r r � sd H ; 4r )�__all__r r� r� r� r� r# r� r< Zos.pathr$ �objectr r r r" r r r r r r r �<module> s. -( * core/__pycache__/fw_config.cpython-39.pyc 0000644 00000101463 15025011705 0014277 0 ustar 00 a ���g�� � @ s� d gZ ddlZddlZddlZddlZddlmZmZ ddlm Z ddl m Z ddl m Z ddlmZmZmZ ddlmZmZmZ dd lmZmZmZ dd lmZm Z m Z dd l m Z m Z m!Z! dd l"m#Z#m$Z$m%Z% dd lm&Z& ddl'm(Z( G dd � d e)�Z*dS )�FirewallConfig� N)�Dict�List)�config)�log)� IO_Object)�IcmpType�icmptype_reader�icmptype_writer)�Service�service_reader�service_writer)�Zone� zone_reader� zone_writer)�IPSet� ipset_reader� ipset_writer)�Helper� helper_reader� helper_writer)�Policy� policy_reader� policy_writer)�errors)� FirewallErrorc @ sR e Zd Zdd� Zdd� Zdd� Zdd� Zd d � Zi fee e e f d �d d �Z dd� Z dd� Zdd� Zdd� Zdd� Zdd� Zdd� Zd d � Zd d � Zd d!� Zd"d#� Zd$d%� Zd&d'� Zd(d)� Zd*d+� Zd,d-� Z d.d/� Z d0d1� Z d2d3� Z d4d5� Z d6d7� Z!d8d9� Z"d:d;� Z#d<d=� Z$d>d?� Z%d@dA� Z&dBdC� Z'dDdE� Z(dFdG� Z)dHdI� Z*dJdK� Z+dLdM� Z,dNdO� Z-dPdQ� Z.dRdS� Z/dTdU� Z0dVdW� Z1dXdY� Z2dZd[� Z3d\d]� Z4d^d_� Z5d`da� Z6dbdc� Z7ddde� Z8dfdg� Z9dhdi� Z:djdk� Z;dldm� Z<dndo� Z=dpdq� Z>drds� Z?dtdu� Z@dvdw� ZAdxdy� ZBdzd{� ZCd|d}� ZDd~d� ZEd�d�� ZFd�d�� ZGd�d�� ZHd�d�� ZId�d�� ZJd�d�� ZKd�d�� ZLd�d�� ZMd�d�� ZNd�d�� ZOd�d�� ZPd�d�� ZQd�d�� ZRd�d�� ZSd�d�� ZTd�d�� ZUd�d�� ZVd�d�� ZWd�d�� ZXd�d�� ZYd�d�� ZZd�d�� Z[d�d�� Z\d�d�� Z]d�d�� Z^d�d�� Z_d�d�� Z`d�d�� Zad�d�� Zbd�d�� Zcd�d�� Zdd�d�� Zed�d�� Zfd�dÄ Zgd�dń Zhd�dDŽ Zid�dɄ Zjd�d˄ Zkd�d̈́ Zld�S )�r c C s || _ | �� d S �N)�_fw�_FirewallConfig__init_vars)�self�fw� r! �;/usr/lib/python3.9/site-packages/firewall/core/fw_config.py�__init__* s zFirewallConfig.__init__c C sH d| j | j| j| j| j| j| j| j| j| j | j | j | j | j | j| jf S )Nz>%s(%r, %r, %r, %r, %r, %r, %r, %r, %r, %r, %r, %r, %r, %r, %r))� __class__�_ipsets� _icmptypes� _services�_zones�_helpersZpolicy_objects�_builtin_ipsets�_builtin_icmptypes�_builtin_services�_builtin_zones�_builtin_helpers�_builtin_policy_objects�_firewalld_conf� _policies�_direct�r r! r! r" �__repr__. s ��zFirewallConfig.__repr__c C s^ i | _ i | _i | _i | _i | _i | _i | _i | _i | _i | _ i | _ i | _ d | _ d | _ d | _d S r )r% r& r' r( r) �_policy_objectsr* r+ r, r- r. r/ r0 r1 r2 r3 r! r! r" Z __init_vars8 s zFirewallConfig.__init_varsc C s t | j�� �D ]}| j| �� | j|= qt | j�� �D ]}| j| �� | j|= q8t | j�� �D ]}| j| �� | j|= qbt | j�� �D ]}| j| �� | j|= q�t | j�� �D ]}| j| �� | j|= q�t | j�� �D ]}| j| �� | j|= q�t | j �� �D ] }| j | �� | j |= �q t | j �� �D ] }| j | �� | j |= �q6t | j �� �D ] }| j | �� | j |= �qbt | j �� �D ] }| j | �� | j |= �q�| j �r�| j �� | ` d | _ | j�r�| j�� | `d | _| j�r | j�� | `d | _| �� d S r )�listr* �keys�cleanupr% r+ r& r, r' r- r( r. r) r0 r1 r2 r )r �xr! r! r" r8 I sV zFirewallConfig.cleanupc s� i }� fdd�� � � D �|d< � fdd�� �� D �|d< � fdd�� �� D �|d< � fdd�� �� D �|d < � fd d�� �� D �|d < � fd d�� �� D �|d < i |d< � j�d�|d d< |S )zJ Returns a dict of dicts of all permanent config objects. c s i | ]}|� � |��qS r! )� get_ipset)�.0Zipsetr3 r! r" � <dictcomp>� � z:FirewallConfig.get_all_io_objects_dict.<locals>.<dictcomp>�ipsetsc s i | ]}|� � |��qS r! )� get_helper)r; �helperr3 r! r" r< � r= �helpersc s i | ]}|� � |��qS r! )� get_icmptype)r; Zicmptyper3 r! r" r< � r= � icmptypesc s i | ]}|� � |��qS r! )� get_service)r; Zservicer3 r! r" r< � r= �servicesc s i | ]}|� � |��qS r! )�get_zone)r; �zoner3 r! r" r< � r= �zonesc s i | ]}|� � |��qS r! )�get_policy_object)r; Zpolicyr3 r! r" r< � r= �policies�confZFirewallBackend)� get_ipsets� get_helpers� get_icmptypes� get_services� get_zones�get_policy_objectsr0 �get)r � conf_dictr! r3 r" �get_all_io_objects_dict~ s z&FirewallConfig.get_all_io_objects_dict)�extra_io_objectsc C sn | � � }|D ] }|| D ]}||| |j< qq g d�}|D ].}|| }|�� D ]\}} | �| �� |� qNq:d S )N)r> rA rC rE rH rJ )rT �name�itemsZcheck_config_dict�export_config_dict) r rU Zall_io_objectsZtype_key�obj�orderZ io_obj_typeZio_objsrV Zio_objr! r! r" �full_check_config� s z FirewallConfig.full_check_configc C s | j j�� S r )r rJ Zquery_lockdownr3 r! r! r" �lockdown_enabled� s z FirewallConfig.lockdown_enabledc C s | j j�||�S r )r rJ � access_check)r �key�valuer! r! r" r] � s zFirewallConfig.access_checkc C s || _ d S r �r0 )r rK r! r! r" �set_firewalld_conf� s z!FirewallConfig.set_firewalld_confc C s | j S r r` r3 r! r! r" �get_firewalld_conf� s z!FirewallConfig.get_firewalld_confc C s( t j�tj�s| j�� n | j�� d S r )�os�path�existsr ZFIREWALLD_CONFr0 �clear�readr3 r! r! r" �update_firewalld_conf� s z$FirewallConfig.update_firewalld_confc C s� | j | j| j| j| j| jg}|D ]�}t�|�}|D ]v}|| }tj� |j|j �}zt � |d| � W n< t y� } z$t�d||� t�|� W Y d }~n d }~0 0 ||= q2q | j�� | j�� d S )N�%s.old� Backup of file '%s' failed: %s)r( r5 r% r' r) r& �copyrc rd �join�filename�shutil�move� Exceptionr �error�remover0 � set_defaults�write)r rZ Z io_obj_dictZ dict_copyZobj_namerY rV �msgr! r! r" �reset_defaults� s � z FirewallConfig.reset_defaultsc C s || _ d S r �r1 )r rJ r! r! r" � set_policies� s zFirewallConfig.set_policiesc C s | j S r rw r3 r! r! r" � get_policies� s zFirewallConfig.get_policiesc C s, t j�tj�s | jj�� n | jj�� d S r ) rc rd re r ZLOCKDOWN_WHITELISTr1 Zlockdown_whitelistr8 rg r3 r! r! r" �update_lockdown_whitelist� s z(FirewallConfig.update_lockdown_whitelistc C s || _ d S r �r2 )r Zdirectr! r! r" � set_direct� s zFirewallConfig.set_directc C s | j S r r{ r3 r! r! r" � get_direct� s zFirewallConfig.get_directc C s( t j�tj�s| j�� n | j�� d S r )rc rd re r ZFIREWALLD_DIRECTr2 r8 rg r3 r! r! r" � update_direct� s z FirewallConfig.update_directc C s$ t tt| j�� �t| j�� � ��S r )�sorted�setr6 r% r7 r* r3 r! r! r" rL � s �zFirewallConfig.get_ipsetsc C s$ |j r|| j|j< n || j|j< d S r )�builtinr* rV r% �r rY r! r! r" � add_ipset� s zFirewallConfig.add_ipsetc C s8 || j v r| j | S || jv r(| j| S ttj|��d S r )r% r* r r � INVALID_IPSET�r rV r! r! r" r: � s zFirewallConfig.get_ipsetc C st |j | jvr ttj|j ��nB| j|j |kr@ttjd|j ��n |j | jvr^ttjd|j ��| �|� | j|j S )Nzself._ipsets[%s] != objz'%s' not a built-in ipset)rV r% r r � NO_DEFAULTSr* � _remove_ipsetr� r! r! r" �load_ipset_defaults� s � � z"FirewallConfig.load_ipset_defaultsc C s |� � S r �� export_configr� r! r! r" �get_ipset_config s z FirewallConfig.get_ipset_configc C sf t � |�}|jr0tj|_d|_|j|jkr0d|_|�|| �� � | �d|gi� | � |� t |� |S )NFr> ) rk r� r �ETC_FIREWALLD_IPSETSrd �default� import_configrT r[ r� r �r rY rK r9 r! r! r" �set_ipset_config s z FirewallConfig.set_ipset_configc C s� || j v s|| jv r$ttjd| ��t� }|�|� ||_d| |_t j |_ d|_ d|_ |�|| �� � | �d|gi� | �|� t|� |S )Nznew_ipset(): '%s'�%s.xmlFTr> )r% r* r r � NAME_CONFLICTr � check_namerV rm r r� rd r� r� r� rT r[ r� r �r rV rK r9 r! r! r" � new_ipset s � zFirewallConfig.new_ipsetc C s� t j�|�}t j�|�}t j�|�s�|tjkr�| j�� D ]L}| j| }|j |kr8| j|= |j | j v rxd| j |j f S d|f S q8nJ| j �� D ]>}| j | }|j |kr�| j |= |j | jvr�d|f S dS q�dS t � d|� zt||�}W n6 t�y& } z t �d||� W Y d }~dS d }~0 0 |j | j v�rV|j | jv�rV| �|� d|fS |tjk�r�|j | jv �r�| j|j j|_|| j|j < d|fS |j | j v �r�| j |j = || j |j < |j | jv�r�d|fS dS dS )N�updaterr �NNzLoading ipset file '%s'z"Failed to load ipset file '%s': %s�new)rc rd �basename�dirnamere r r� r% r7 rm rV r* r �debug1r rp rq r� r� �r rV rm rd r9 rY ru r! r! r" �update_ipset_from_path' sP z%FirewallConfig.update_ipset_from_pathc C s� |j | jvrttj|j ��|jtjkr>ttjd|jtjf ��d|j|j f }zt � |d| � W n< t y� } z$t � d||� t�|� W Y d }~n d }~0 0 | j|j = d S �Nz '%s' != '%s'� %s/%s.xmlri rj )rV r% r r r� rd r r� �INVALID_DIRECTORYrn ro rp r rq rc rr �r rY rV ru r! r! r" r� l s �� z FirewallConfig._remove_ipsetc C s" |j s |js ttjd|j ��d S )Nz'%s' is built-in ipset)r� r� r r Z BUILTIN_IPSETrV r� r! r! r" �check_builtin_ipset} s �z"FirewallConfig.check_builtin_ipsetc C s | � |� | �|� d S r )r� r� r� r! r! r" � remove_ipset� s zFirewallConfig.remove_ipsetc C s$ | � |� | �||�}| �|� |S r )r� � _copy_ipsetr� )r rY rV r� r! r! r" � rename_ipset� s zFirewallConfig.rename_ipsetc C s | � ||�� �S r )r� r� �r rY rV r! r! r" r� � s zFirewallConfig._copy_ipsetc C s$ t tt| j�� �t| j�� � ��S r )r r� r6 r& r7 r+ r3 r! r! r" rN � s �z FirewallConfig.get_icmptypesc C s$ |j r|| j|j< n || j|j< d S r )r� r+ rV r& r� r! r! r" � add_icmptype� s zFirewallConfig.add_icmptypec C s8 || j v r| j | S || jv r(| j| S ttj|��d S r )r& r+ r r �INVALID_ICMPTYPEr� r! r! r" rB � s zFirewallConfig.get_icmptypec C st |j | jvr ttj|j ��nB| j|j |kr@ttjd|j ��n |j | jvr^ttjd|j ��| �|� | j|j S )Nzself._icmptypes[%s] != objz '%s' not a built-in icmptype)rV r& r r r� r+ �_remove_icmptyper� r! r! r" �load_icmptype_defaults� s � � z%FirewallConfig.load_icmptype_defaultsc C s |� � S r r� r� r! r! r" �get_icmptype_config� s z"FirewallConfig.get_icmptype_configc C sf t � |�}|jr0tj|_d|_|j|jkr0d|_|�|| �� � | �d|gi� | � |� t |� |S )NFrC ) rk r� r �ETC_FIREWALLD_ICMPTYPESrd r� r� rT r[ r� r r� r! r! r" �set_icmptype_config� s z"FirewallConfig.set_icmptype_configc C s� || j v s|| jv r$ttjd| ��t� }|�|� ||_d| |_t j |_ d|_ d|_ |�|| �� � | �d|gi� | �|� t|� |S )Nznew_icmptype(): '%s'r� FTrC )r& r+ r r r� r r� rV rm r r� rd r� r� r� rT r[ r� r r� r! r! r" � new_icmptype� s � zFirewallConfig.new_icmptypec C s� t j�|�}t j�|�}t j�|�s�|tjkr�| j�� D ]L}| j| }|j |kr8| j|= |j | j v rxd| j |j f S d|f S q8nJ| j �� D ]>}| j | }|j |kr�| j |= |j | jvr�d|f S dS q�dS t � d|� zt||�}W n6 t�y& } z t �d||� W Y d }~dS d }~0 0 |j | j v�rV|j | jv�rV| �|� d|fS |tjk�r�|j | jv �r�| j|j j|_|| j|j < d|fS |j | j v �r�| j |j = || j |j < |j | jv�r�d|fS dS dS )Nr� rr r� zLoading icmptype file '%s'z%Failed to load icmptype file '%s': %sr� )rc rd r� r� re r r� r& r7 rm rV r+ r r� r rp rq r� r� r� r! r! r" �update_icmptype_from_path� sP z(FirewallConfig.update_icmptype_from_pathc C s� |j | jvrttj|j ��|jtjkr>ttjd|jtjf ��d|j|j f }zt � |d| � W n< t y� } z$t � d||� t�|� W Y d }~n d }~0 0 | j|j = d S r� )rV r& r r r� rd r r� r� rn ro rp r rq rc rr r� r! r! r" r� s �� z FirewallConfig._remove_icmptypec C s" |j s |js ttjd|j ��d S )Nz'%s' is built-in icmp type)r� r� r r ZBUILTIN_ICMPTYPErV r� r! r! r" �check_builtin_icmptype) s �z%FirewallConfig.check_builtin_icmptypec C s | � |� | �|� d S r )r� r� r� r! r! r" �remove_icmptype. s z FirewallConfig.remove_icmptypec C s$ | � |� | �||�}| �|� |S r )r� �_copy_icmptyper� )r rY rV r� r! r! r" �rename_icmptype2 s z FirewallConfig.rename_icmptypec C s | � ||�� �S r )r� r� r� r! r! r" r� 8 s z FirewallConfig._copy_icmptypec C s$ t tt| j�� �t| j�� � ��S r )r r� r6 r' r7 r, r3 r! r! r" rO = s �zFirewallConfig.get_servicesc C s$ |j r|| j|j< n || j|j< d S r )r� r, rV r' r� r! r! r" � add_serviceA s zFirewallConfig.add_servicec C s< || j v r| j | S || jv r(| j| S ttjd| ��d S )Nzget_service(): '%s')r' r, r r �INVALID_SERVICEr� r! r! r" rD G s zFirewallConfig.get_servicec C st |j | jvr ttj|j ��nB| j|j |kr@ttjd|j ��n |j | jvr^ttjd|j ��| �|� | j|j S )Nzself._services[%s] != objz'%s' not a built-in service)rV r' r r r� r, �_remove_servicer� r! r! r" �load_service_defaultsN s � � z$FirewallConfig.load_service_defaultsc C sn |� � }g }td�D ]P}|j| d |vrL|�t�t||j| d ��� q|�||j| d � qt|�S )N� r �rX �range�IMPORT_EXPORT_STRUCTURE�appendrk �deepcopy�getattr�tuple�r rY rS Z conf_list�ir! r! r" �get_service_configZ s "z!FirewallConfig.get_service_configc C s |� � S r �rX r� r! r! r" �get_service_config_dictf s z&FirewallConfig.get_service_config_dictc C s4 i }t |�D ]\}}|||j| d < q | �||�S �Nr )� enumerater� �set_service_config_dict�r rY rK rS r� r_ r! r! r" �set_service_configi s z!FirewallConfig.set_service_configc C sf t � |�}|jr0tj|_d|_|j|jkr0d|_|�|| �� � | �d|gi� | � |� t |� |S )NFrE ) rk r� r �ETC_FIREWALLD_SERVICESrd r� �import_config_dictrT r[ r� r r� r! r! r" r� p s z&FirewallConfig.set_service_config_dictc C sX || j v s|| jv r$ttjd| ��i }t|�D ]\}}||tj| d < q0| �||�S )N�new_service(): '%s'r ) r' r, r r r� r� r r� �new_service_dict�r rV rK rS r� r_ r! r! r" � new_service~ s �zFirewallConfig.new_servicec C s� || j v s|| jv r$ttjd| ��t� }|�|� ||_d| |_t j |_ d|_ d|_ |�|| �� � | �d|gi� | �|� t|� |S )Nr� r� FTrE )r' r, r r r� r r� rV rm r r� rd r� r� r� rT r[ r� r r� r! r! r" r� � s � z FirewallConfig.new_service_dictc C s� t j�|�}t j�|�}t j�|�s�|tjkr�| j�� D ]L}| j| }|j |kr8| j|= |j | j v rxd| j |j f S d|f S q8nJ| j �� D ]>}| j | }|j |kr�| j |= |j | jvr�d|f S dS q�dS t � d|� zt||�}W n6 t�y& } z t �d||� W Y d }~dS d }~0 0 |j | j v�rV|j | jv�rV| �|� d|fS |tjk�r�|j | jv �r�| j|j j|_|| j|j < d|fS |j | j v �r�| j |j = || j |j < |j | jv�r�d|fS dS dS )Nr� rr r� zLoading service file '%s'z$Failed to load service file '%s': %sr� )rc rd r� r� re r r� r' r7 rm rV r, r r� r rp rq r� r� r� r! r! r" �update_service_from_path� sP z'FirewallConfig.update_service_from_pathc C s� |j | jvrttj|j ��|jtjkr>ttjd|jtjf ��d|j|j f }zt � |d| � W n< t y� } z$t � d||� t�|� W Y d }~n d }~0 0 | j|j = d S r� )rV r' r r r� rd r r� r� rn ro rp r rq rc rr r� r! r! r" r� � s �� z FirewallConfig._remove_servicec C s" |j s |js ttjd|j ��d S )Nz'%s' is built-in service)r� r� r r ZBUILTIN_SERVICErV r� r! r! r" �check_builtin_service� s �z$FirewallConfig.check_builtin_servicec C s | � |� | �|� d S r )r� r� r� r! r! r" �remove_service� s z FirewallConfig.remove_servicec C s$ | � |� | �||�}| �|� |S r )r� � _copy_servicer� )r rY rV r� r! r! r" �rename_service� s z FirewallConfig.rename_servicec C s | � ||�� �S r )r� rX r� r! r! r" r� s z FirewallConfig._copy_servicec C s$ t tt| j�� �t| j�� � ��S r )r r� r6 r( r7 r- r3 r! r! r" rP s �zFirewallConfig.get_zonesc C s$ |j r|| j|j< n || j|j< d S r )r� r- rV r( r� r! r! r" �add_zone s zFirewallConfig.add_zonec C s( || j v r| j |= || jv r$| j|= d S r )r- r( r� r! r! r" � forget_zone s zFirewallConfig.forget_zonec C s< || j v r| j | S || jv r(| j| S ttjd| ��d S )Nzget_zone(): %s)r( r- r r � INVALID_ZONEr� r! r! r" rF s zFirewallConfig.get_zonec C st |j | jvr ttj|j ��nB| j|j |kr@ttjd|j ��n |j | jvr^ttjd|j ��| �|� | j|j S )Nzself._zones[%s] != objz'%s' not a built-in zone)rV r( r r r� r- � _remove_zoner� r! r! r" �load_zone_defaults s � � z!FirewallConfig.load_zone_defaultsc C sn |� � }g }td�D ]P}|j| d |vrL|�t�t||j| d ��� q|�||j| d � qt|�S )N� r r� r� r! r! r" �get_zone_config* s "z FirewallConfig.get_zone_configc C s |� � S r r� r� r! r! r" �get_zone_config_dict6 s z#FirewallConfig.get_zone_config_dictc C s4 i }t |�D ]\}}|||j| d < q | �||�S r� )r� r� �set_zone_config_dictr� r! r! r" �set_zone_config9 s z FirewallConfig.set_zone_configc C sf t � |�}|jr0tj|_d|_|j|jkr0d|_|�|| �� � | �d|gi� | � |� t |� |S )NFrH ) rk r� r �ETC_FIREWALLD_ZONESrd r� r� rT r[ r� r r� r! r! r" r� @ s z#FirewallConfig.set_zone_config_dictc C sX || j v s|| jv r$ttjd| ��i }t|�D ]\}}||tj| d < q0| �||�S )N�new_zone(): '%s'r ) r( r- r r r� r� r r� � new_zone_dictr� r! r! r" �new_zoneN s zFirewallConfig.new_zonec C s� || j v s|| jv r$ttjd| ��t� }|�|� ||_d| |_t j |_ d|_ d|_ |�|| �� � | �d|gi� | �|� t|� |S )Nr� r� FTrH )r( r- r r r� r r� rV rm r r� rd r� r� r� rT r[ r� r r� r! r! r" r� X s z FirewallConfig.new_zone_dictc C s" t j�|�}t j�|�}t j�|�s�|�tj�r�| j� � D ]L}| j| }|j |kr:| j|= |j | j v rzd| j |j f S d|f S q:nJ| j � � D ]>}| j | }|j |kr�| j |= |j | jvr�d|f S dS q�dS t �d|� zt||�}W n6 t�y( } z t �d||� W Y d }~dS d }~0 0 |�tj��rrt|�ttj�k�rrdt j�|�t j�|�dd� f |_ |j | j v�r�|j | jv�r�| �|� d |fS |�tj��r�|j | jv �r�| j|j j|_|| j|j < d|fS |j | j v �r | j |j = || j |j < |j | jv�rd|fS dS dS ) Nr� rr r� zLoading zone file '%s'z!Failed to load zone file '%s': %s�%s/%sr ���r� )rc rd r� r� re � startswithr r� r( r7 rm rV r- r r� r rp rq �lenr� r� r� r! r! r" �update_zone_from_pathk s\ � � z$FirewallConfig.update_zone_from_pathc C s� |j | jvrttj|j ��|j�tj�s@ttj d|jtjf ��d|j|j f }zt � |d| � W n< t y� } z$t �d||� t�|� W Y d }~n d }~0 0 | j|j = d S �Nz '%s' doesn't start with '%s'r� ri rj )rV r( r r r� rd r� r r� r� rn ro rp r rq rc rr r� r! r! r" r� � s �� zFirewallConfig._remove_zonec C s" |j s |js ttjd|j ��d S )Nz'%s' is built-in zone)r� r� r r Z BUILTIN_ZONErV r� r! r! r" �check_builtin_zone� s �z!FirewallConfig.check_builtin_zonec C s | � |� | �|� d S r )r� r� r� r! r! r" � remove_zone� s zFirewallConfig.remove_zonec C sN | � |� |�� }| �|� z| �||�}W n | �|j|� � Y n0 |S r )r� rX r� r� rV )r rY rV Zobj_confr� r! r! r" � rename_zone� s zFirewallConfig.rename_zonec C s$ t tt| j�� �t| j�� � ��S r )r r� r6 r5 r7 r/ r3 r! r! r" rQ � s �z!FirewallConfig.get_policy_objectsc C s$ |j r|| j|j< n || j|j< d S r )r� r/ rV r5 r� r! r! r" �add_policy_object� s z FirewallConfig.add_policy_objectc C s< || j v r| j | S || jv r(| j| S ttjd| ��d S )Nzget_policy_object(): %s)r5 r/ r r �INVALID_POLICYr� r! r! r" rI � s z FirewallConfig.get_policy_objectc C st |j | jvr ttj|j ��nB| j|j |kr@ttjd|j ��n |j | jvr^ttjd|j ��| �|� | j|j S )Nz self._policy_objects[%s] != objz'%s' not a built-in policy)rV r5 r r r� r/ �_remove_policy_objectr� r! r! r" �load_policy_object_defaults� s � � z*FirewallConfig.load_policy_object_defaultsc C s |� � S r r� r� r! r! r" � get_policy_object_config_dict� s z,FirewallConfig.get_policy_object_config_dictc C sf t � |�}|jr0tj|_d|_|j|jkr0d|_|�|| �� � | �d|gi� | � |� t |� |S )NFrJ ) rk r� r �ETC_FIREWALLD_POLICIESrd r� r� rT r[ r� r r� r! r! r" � set_policy_object_config_dict� s z,FirewallConfig.set_policy_object_config_dictc C s� || j v s|| jv r$ttjd| ��t� }|�|� ||_d| |_t j |_ d|_ d|_ |�|| �� � | �d|gi� | �|� t|� |S )Nznew_policy_object(): '%s'r� FTrJ )r5 r/ r r r� r r� rV rm r r� rd r� r� r� rT r[ r� r r� r! r! r" �new_policy_object_dict s z%FirewallConfig.new_policy_object_dictc C s" t j�|�}t j�|�}t j�|�s�|�tj�r�| j� � D ]L}| j| }|j |kr:| j|= |j | j v rzd| j |j f S d|f S q:nJ| j � � D ]>}| j | }|j |kr�| j |= |j | jvr�d|f S dS q�dS t �d|� zt||�}W n6 t�y( } z t �d||� W Y d }~dS d }~0 0 |�tj��rrt|�ttj�k�rrdt j�|�t j�|�dd� f |_ |j | j v�r�|j | jv�r�| �|� d |fS |�tj��r�|j | jv �r�| j|j j|_|| j|j < d|fS |j | j v �r | j |j = || j |j < |j | jv�rd|fS dS dS ) Nr� rr r� zLoading policy file '%s'z#Failed to load policy file '%s': %sr� r r� r� )rc rd r� r� re r� r r� r5 r7 rm rV r/ r r� r rp rq r� r� r� r� r! r! r" � update_policy_object_from_path s\ � � z-FirewallConfig.update_policy_object_from_pathc C s� |j | jvrttj|j ��|j�tj�s@ttj d|jtjf ��d|j|j f }zt � |d| � W n< t y� } z$t �d||� t�|� W Y d }~n d }~0 0 | j|j = d S r� )rV r5 r r r� rd r� r r� r� rn ro rp r rq rc rr r� r! r! r" r� j s �� z$FirewallConfig._remove_policy_objectc C s" |j s |js ttjd|j ��d S )Nz'%s' is built-in policy)r� r� r r ZBUILTIN_POLICYrV r� r! r! r" �check_builtin_policy_object{ s �z*FirewallConfig.check_builtin_policy_objectc C s | � |� | �|� d S r )r� r� r� r! r! r" �remove_policy_object� s z#FirewallConfig.remove_policy_objectc C s$ | � |� | �||�}| �|� |S r )r� �_copy_policy_objectr� )r rY rV Znew_policy_objectr! r! r" �rename_policy_object� s z#FirewallConfig.rename_policy_objectc C s | � ||�� �S r )r� rX r� r! r! r" r� � s z"FirewallConfig._copy_policy_objectc C s$ t tt| j�� �t| j�� � ��S r )r r� r6 r) r7 r. r3 r! r! r" rM � s �zFirewallConfig.get_helpersc C s$ |j r|| j|j< n || j|j< d S r )r� r. rV r) r� r! r! r" � add_helper� s zFirewallConfig.add_helperc C s8 || j v r| j | S || jv r(| j| S ttj|��d S r )r) r. r r �INVALID_HELPERr� r! r! r" r? � s zFirewallConfig.get_helperc C st |j | jvr ttj|j ��nB| j|j |kr@ttjd|j ��n |j | jvr^ttjd|j ��| �|� | j|j S )Nzself._helpers[%s] != objz'%s' not a built-in helper)rV r) r r r� r. �_remove_helperr� r! r! r" �load_helper_defaults� s � � z#FirewallConfig.load_helper_defaultsc C s |� � S r r� r� r! r! r" �get_helper_config� s z FirewallConfig.get_helper_configc C sf t � |�}|jr0tj|_d|_|j|jkr0d|_|�|| �� � | �d|gi� | � |� t |� |S )NFrA ) rk r� r �ETC_FIREWALLD_HELPERSrd r� r� rT r[ r� r r� r! r! r" �set_helper_config� s z FirewallConfig.set_helper_configc C s� || j v s|| jv r$ttjd| ��t� }|�|� ||_d| |_t j |_ d|_ d|_ |�|| �� � | �d|gi� | �|� t|� |S )Nznew_helper(): '%s'r� FTrA )r) r. r r r� r r� rV rm r r� rd r� r� r� rT r[ r� r r� r! r! r" � new_helper� s � zFirewallConfig.new_helperc C s� t j�|�}t j�|�}t j�|�s�|tjkr�| j�� D ]L}| j| }|j |kr8| j|= |j | j v rxd| j |j f S d|f S q8nJ| j �� D ]>}| j | }|j |kr�| j |= |j | jvr�d|f S dS q�dS t � d|� zt||�}W n6 t�y& } z t �d||� W Y d }~dS d }~0 0 |j | j v�rV|j | jv�rV| �|� d|fS |tjk�r�|j | jv �r�| j|j j|_|| j|j < d|fS |j | j v �r�| j |j = || j |j < |j | jv�r�d|fS dS dS )Nr� rr r� zLoading helper file '%s'z#Failed to load helper file '%s': %sr� )rc rd r� r� re r r� r) r7 rm rV r. r r� r rp rq r� r� r� r! r! r" �update_helper_from_path� sP z&FirewallConfig.update_helper_from_pathc C s� |j | jvrttj|j ��|jtjkr>ttjd|jtjf ��d|j|j f }zt � |d| � W n< t y� } z$t � d||� t�|� W Y d }~n d }~0 0 | j|j = d S r� )rV r) r r r� rd r r� r� rn ro rp r rq rc rr r� r! r! r" r� s �� z FirewallConfig._remove_helperc C s" |j s |js ttjd|j ��d S )Nz'%s' is built-in helper)r� r� r r ZBUILTIN_HELPERrV r� r! r! r" �check_builtin_helper' s �z#FirewallConfig.check_builtin_helperc C s | � |� | �|� d S r )r r� r� r! r! r" � remove_helper, s z FirewallConfig.remove_helperc C s$ | � |� | �||�}| �|� |S r )r � _copy_helperr� )r rY rV r r! r! r" � rename_helper0 s z FirewallConfig.rename_helperc C s | � ||�� �S r )r r� r� r! r! r" r 6 s zFirewallConfig._copy_helperN)m�__name__� __module__� __qualname__r# r4 r r8 rT r �strr r r[ r\ r] ra rb rh rv rx ry rz r| r} r~ rL r� r: r� r� r� r� r� r� r� r� r� r� rN r� rB r� r� r� r� r� r� r� r� r� r� rO r� rD r� r� r� r� r� r� r� r� r� r� r� r� r� rP r� r� rF r� r� r� r� r� r� r� r� r� r� r� r� rQ r� rI r� r� r� r� r� r� r� r� r� r� rM r� r? r� r� r� r r r� r r r r r! r! r! r" r ) s� 5 E E E K K E)+�__all__rk rc Zos.pathrn �typingr r Zfirewallr Zfirewall.core.loggerr Zfirewall.core.io.io_objectr Zfirewall.core.io.icmptyper r r Zfirewall.core.io.servicer r r Zfirewall.core.io.zoner r r Zfirewall.core.io.ipsetr r r Zfirewall.core.io.helperr r r Zfirewall.core.io.policyr r r r Zfirewall.errorsr �objectr r! r! r! r" �<module> s" core/__pycache__/icmp.cpython-39.pyc 0000644 00000004161 15025011705 0013263 0 ustar 00 a ���g � # @ s� g d �Z dddddddddd d d d d dddddddddddddddd d d d d d!�"Zd"d#d$d%d&dddd'd(d)d)d*d*d+d,d-d-d.d.d/d0�Zd1d2� Zd3d4� Zd5d6� Zd7d8� Zd9S ):)� ICMP_TYPES� ICMPV6_TYPES�check_icmp_type�check_icmpv6_typez0/0z3/0z3/1z3/2z3/3z3/4z3/5z3/6z3/7z3/9z3/10z3/11z3/12z3/13z3/14z3/15z4/0z5/0z5/1z5/2z5/3z8/0z9/0z10/0z11/0z11/1z12/0z12/1z13/0z14/0z17/0z18/0)"� echo-reply�pongznetwork-unreachablezhost-unreachablezprotocol-unreachable�port-unreachablezfragmentation-neededzsource-route-failedznetwork-unknownz host-unknownznetwork-prohibitedzhost-prohibitedzTOS-network-unreachablezTOS-host-unreachable�communication-prohibitedzhost-precedence-violationzprecedence-cutoffz source-quenchznetwork-redirectz host-redirectzTOS-network-redirectzTOS-host-redirect� echo-request�ping�router-advertisement�router-solicitation�ttl-zero-during-transit�ttl-zero-during-reassemblyz ip-header-badzrequired-option-missingztimestamp-requestztimestamp-replyzaddress-mask-requestzaddress-mask-replyz1/0z1/1z1/3z1/4z2/0z4/1z4/2z128/0z129/0z133/0z134/0z135/0z136/0z137/0)zno-router zaddress-unreachabler zpacket-too-bigr r z bad-headerzunknown-header-typezunknown-optionr r r r r r zneighbour-solicitationzneigbour-solicitationzneighbour-advertisementzneigbour-advertisementZredirectc C s | t v r dS dS �NTF)r ��_name� r �6/usr/lib/python3.9/site-packages/firewall/core/icmp.py�check_icmp_nameV s r c C s | t �� v rdS dS r )r �values�Z_typer r r r [ s r c C s | t v r dS dS r )r r r r r �check_icmpv6_name` s r c C s | t �� v rdS dS r )r r r r r r r e s r N)�__all__r r r r r r r r r r �<module> sz �&� core/__pycache__/ebtables.cpython-39.pyc 0000644 00000016342 15025011705 0014120 0 ustar 00 a ���g�$ � @ s d gZ ddlZddlmZ ddlmZ ddlmZm Z m Z ddl m Z ddl mZ ddlmZmZ ddlZd gg d �g d �d �Zi Zi Zi Ze�� D ]pZg ee< e� ee< ee D ]PZee �d e � ee �deef � ee �de � ee � de � q�q�G dd � d e �Z dS )�ebtables� N)�runProg)�log)�tempFile�readfile� splitArgs)�COMMANDS)� ipXtables�� FirewallError� INVALID_IPVZBROUTING)Z PREROUTINGZ POSTROUTING�OUTPUT)ZINPUTr ZFORWARD)ZbrouteZnat�filterz -N %s_directz-I %s 1 -j %s_directz-I %s_direct 1 -j RETURNz %s_directc @ s� e Zd ZdZd ZdZdd� Zdd� Zdd� Zd d � Z d d � Z d d� Z dd� Z dd� Z dd� Zdd� Zdd� Zdd� Zdd � Zd d � Zd/d d!�Zd"d#� Zd$d%� Zd&d'� Zd(d)� Zd0d+d,�Zd-d.� Zd S )1r ZebFc C sB t | j | _t d| j | _| �� | _| �� | _| �� g | _ d S )Nz %s-restore) r �ipv�_command�_restore_command� _detect_restore_noflush_optionZrestore_noflush_option�_detect_concurrent_option�concurrent_option� fill_exists�available_tables��self� r �:/usr/lib/python3.9/site-packages/firewall/core/ebtables.py�__init__9 s zebtables.__init__c C s$ t j�| j�| _t j�| j�| _d S �N)�os�path�existsr Zcommand_existsr Zrestore_command_existsr r r r r A s zebtables.fill_existsc C s( d}t | jddg�}|d dkr$d}|S )N� z --concurrent�-Lr )r r )r r �retr r r r E s z"ebtables._detect_concurrent_optionc C s. g }z| � |d� W n ty( Y dS 0 dS )N�offFT)� set_rules� ValueError)r �rulesr r r r O s z'ebtables._detect_restore_noflush_optionc C s� g }| j r | j |vr |�| j � |dd� |D �7 }t�d| j| jd�|�� t| j|�\}}|dkr~td| jd�|�|f ��|S )Nc S s g | ] }d | �qS )z%sr )�.0�itemr r r � <listcomp>^ � z"ebtables.__run.<locals>.<listcomp>� %s: %s %s� r �'%s %s' failed: %s) r �appendr �debug2� __class__r �joinr r% )r �args�_args�statusr" r r r Z__runY s �zebtables.__runc C s$ dD ]}||v rt td| ��qd S )N)z %%REJECT%%z%%ICMP%%z %%LOGTYPE%%z'%s' invalid for ebtablesr )r �rule�strr r r �_rule_validatef s �zebtables._rule_validatec C s |t v o|t | v S r )�BUILT_IN_CHAINS)r r �table�chainr r r �is_chain_builtinl s �zebtables.is_chain_builtinc C sJ g }|r4|� d|d|g� |� d|d|dddg� n|� d|d|g� |S )N�-tz-N�-I�1z-jZRETURN�-X)r. )r �addr9 r: r& r r r �build_chain_rulesp s zebtables.build_chain_rulesc C s8 d|g}|r |d|t |�g7 }n |d|g7 }||7 }|S )Nr< r= z-D)r6 )r r@ r9 r: �indexr2 r5 r r r � build_rule{ s zebtables.build_rulec C s t �|�S r )r Zcommon_reverse_rule�r r2 r r r � reverse_rule� s zebtables.reverse_rulec C s t �|� d S r )r Zcommon_check_passthroughrD r r r �check_passthrough� s zebtables.check_passthroughc C s t �|�S r )r Zcommon_reverse_passthroughrD r r r �reverse_passthrough� s z ebtables.reverse_passthroughc C s t � }d}i }|D ]�}|d d � }| �|� dD ]J}z|�|�} W n tyT Y q00 t|�| d kr0|�| � |�| �}q0t|�D ]<\} } tjD ],} | | v r�| � d�r�| � d�s�d| || < q�q�|� |g �� |� q|D ]4}|� d| � || D ]}|� d�|�d � q�q�|�� t�|j�} t�d | j| jd |j| jf � g } | � d � t| j| |jd �\}}t�� d k�r�t|j�}|d u�r�d} |D ]@}tjd| |f ddd� |� d��s�tjddd� | d7 } �q�t� |j� |dk�rtd| jd�| �|f ��d S )Nr )r< z--table� �"z"%s"z*%s r, � r+ z%s: %dz --noflush)�stdin� z%8d: %sr )�nofmt�nlr )rM r- ) r r7 rB r% �len�pop� enumerate�stringZ whitespace� startswith�endswith� setdefaultr. �writer1 �closer �stat�namer r/ r0 r �st_sizer ZgetDebugLogLevelr Zdebug3�unlink)r r& � log_deniedZ temp_filer9 Z table_rulesZ_ruler5 �opt�i�element�crX r2 r4 r" �lines�liner r r r$ � sb � � � �zebtables.set_rulesc C s | � |� | �|�S r )r7 �_ebtables__run)r r5 r\ r r r �set_rule� s zebtables.set_ruleNc C s� g }|r|gnt �� }|D ]f}|| jv r4|�|� qz*| �d|dg� | j�|� |�|� W q ty~ t�d| � Y q0 q|S )Nr< r! z#ebtables table '%s' does not exist.)r8 �keysr r. rc r% r Zdebug1)r r9 r" Ztablesr r r �get_available_tables� s z ebtables.get_available_tablesc C s i S r r )r r9 r r r �get_zone_table_chains� s z ebtables.get_zone_table_chainsc C s> g }t �� D ],}|| �� vr q dD ]}|�d||g� q"q |S )N)z-Fr? z-Zr< �r8 re rf r. )r r& r9 �flagr r r �build_flush_rules� s zebtables.build_flush_rulesc C sV g }|dkrdn|}t �� D ]4}|| �� vr.q t | D ]}|�d|d||g� q6q |S )NZPANICZDROPr< z-Prh )r ZpolicyZpolicy_detailsr& Z_policyr9 r: r r r �build_set_policy_rules� s z ebtables.build_set_policy_rulesc C s g S r r r r r r �build_default_tables� s z ebtables.build_default_tablesr# c C s� g }t D ]�}|| �� vrqt | d d � }|dkrH|tv rH|�t| � d|g}|D ]2}t|�tkrt|�|| � qT|�|t|� � qTq|S )Nr# r< )� DEFAULT_RULESrf � LOG_RULES�extend�type�listr. r )r r\ Z default_rulesr9 Z_default_rules�prefixr5 r r r �build_default_rules� s z ebtables.build_default_rulesc C s || j kS r )r )r r r r r �is_ipv_supported s zebtables.is_ipv_supported)N)r# )�__name__� __module__� __qualname__r rY Zpolicies_supportedr r r r rc r7 r; rA rC rE rF rG r$ rd rf rg rj rk rl rs rt r r r r r 4 s0 @ ) �__all__Zos.pathr Zfirewall.core.progr Zfirewall.core.loggerr Zfirewall.functionsr r r Zfirewall.configr Z firewall.corer Zfirewall.errorsr r rR r8 rm rn Z OUR_CHAINSre r9 �setr: r. r@ �objectr r r r r �<module> s0 � core/__pycache__/ipXtables.cpython-39.pyc 0000644 00000103742 15025011705 0014273 0 ustar 00 a ���gh� � @ s0 d dl Zd dlZd dlmZ d dlmZ d dlmZm Z m Z m Z m Z m Z mZmZ d dlmZ d dlmZmZmZmZmZ d dlmZmZmZm Z m Z m Z m Z m Z m!Z! d dl"m#Z# d dl$Z$d Z%g d �d d gg d �g d�g d �d�Z&ddd�Z'ddd�Z(dd� Z)dd� Z*dd� Z+G dd � d e,�Z-G d d � d e-�Z.dS ) � N)�runProg)�log)�tempFile�readfile� splitArgs� check_mac�portStr�check_single_address� check_address� normalizeIP6)�config)� FirewallError�INVALID_PASSTHROUGH� INVALID_RULE� UNKNOWN_ERROR� INVALID_ADDR) � Rich_Accept� Rich_Reject� Rich_Drop� Rich_Mark� Rich_NFLog�Rich_Masquerade�Rich_ForwardPort�Rich_IcmpBlock�Rich_Tcp_Mss_Clamp)�DEFAULT_ZONE_TARGET� )�INPUT�OUTPUT�FORWARD� PREROUTINGr )r � POSTROUTINGr r r )r r! r )�security�raw�mangle�nat�filterzicmp-host-prohibitedzicmp6-adm-prohibited��ipv4�ipv6�icmp� ipv6-icmpc C s� ddddddd�}| dd� }|D ]t}z|� |�}W n tyJ Y q"Y n0 |dv r�zt||d � W n tyz Y n0 |�|d � || ||< q"|S ) z Inverse valid rule �-D�--delete�-X�--delete-chain��-A�--append�-I�--insert�-Nz --new-chainN�r3 r4 � )�index� Exception�int�pop)�args� replace_args�ret_args�arg�idx� rA �;/usr/lib/python3.9/site-packages/firewall/core/ipXtables.py�common_reverse_rule: s* � rC c C s� ddddddd�}| dd� }|D ]z}z|� |�}W n tyJ Y q"Y n0 |dv r�zt||d � W n tyz Y n0 |�|d � || ||< | S ttd ��dS ) z Reverse valid passthough rule r, r- r. r/ r0 Nr6 r7 �no '-A', '-I' or '-N' arg)r8 � ValueErrorr: r; r r )r< r= r> �xr@ rA rA rB �common_reverse_passthrough_ s0 � �rG c C sh t | �} t g d��}t| |@ �dkr>ttdt| |@ �d ��t g d��}t| |@ �dkrdttd��dS )zZ Check if passthough rule is valid (only add, insert and new chain rules are allowed) )z-Cz--checkr, r- z-Rz --replace�-Lz--listz-Sz --list-rules�-Fz--flush�-Zz--zeror. r/ �-Pz--policyz-Ez--rename-chainr zarg '%s' is not allowedr0 rD N)�set�lenr r �list)r< Z not_allowedZneededrA rA rB �common_check_passthrough� s �� �rO c @ s� e Zd ZdZd ZdZdd� Zdd� Zdd� Zd d � Z d d � Z d d� Z dd� Z dd� Z dd� Zdd� Zdd� Zdd� Zdd � Zd d � Zd d � Zdjd"d#�Zd$d%� Zd&d'� Zd(d)� Zd*d+� Zdkd,d-�Zd.d/� Zdld1d2�Z d3d4� Z d5d6� Z dmd8d9�Z dnd:d;�Z d<d=� Z!d>d?� Z"d@dA� Z#dBdC� Z$dDdE� Z%dFdG� Z&dHdI� Z'dJdK� Z(dLdM� Z)dNdO� Z*dPdQ� Z+dodRdS�Z,dpdTdU�Z-dqdVdW�Z.drdXdY�Z/dZd[� Z0dsd\d]�Z1dtd^d_�Z2dud`da�Z3dvdbdc�Z4ddde� Z5dfdg� Z6dhdi� Z7d!S )w� ip4tablesr( Tc C sd || _ tj| j | _tjd| j | _| �� | _| �� | _ | � � g | _ i | _ i | _ g | _i | _d S )Nz %s-restore)�_fwr ZCOMMANDS�ipv�_command�_restore_command�_detect_wait_option� wait_option�_detect_restore_wait_option�restore_wait_option� fill_exists�available_tables�rich_rule_priority_counts�policy_priority_counts�zone_source_index_cache� our_chains)�self�fwrA rA rB �__init__� s zip4tables.__init__c C s$ t j�| j�| _t j�| j�| _d S �N)�os�path�existsrS Zcommand_existsrT Zrestore_command_exists�r_ rA rA rB rY � s zip4tables.fill_existsc C s� | j r(| j |vr(| j gdd� |D � }ndd� |D �}t�d| j| jd�|�� t| j|�\}}|dkr�td| jd�|�|f ��|S )Nc S s g | ] }d | �qS ��%srA ��.0�itemrA rA rB � <listcomp>� � z#ip4tables.__run.<locals>.<listcomp>c S s g | ] }d | �qS rg rA ri rA rA rB rl � rm � %s: %s %s� r �'%s %s' failed: %s)rV r �debug2� __class__rS �joinr rE )r_ r< �_args�status�retrA rA rB Z__run� s �zip4tables.__runc C s< z|� |�}W n ty" Y dS 0 ||||d �< dS d S )NF� T)r8 rE )r_ �rule�patternZ replacement�irA rA rB � _rule_replace� s zip4tables._rule_replacec C s |t v o|t | v S rb )�BUILT_IN_CHAINS)r_ rR �table�chainrA rA rB �is_chain_builtin� s �zip4tables.is_chain_builtinc C s2 d|g}|r|� d� n |� d� |� |� |gS )N�-tr5 r. )�append)r_ �addr} r~ rx rA rA rB �build_chain_rules� s zip4tables.build_chain_rulesc C s8 d|g}|r |d|t |�g7 }n |d|g7 }||7 }|S )Nr� r3 r, )�str)r_ r� r} r~ r8 r< rx rA rA rB � build_rule� s zip4tables.build_rulec C s t |�S rb )rC �r_ r< rA rA rB � reverse_rule� s zip4tables.reverse_rulec C s t |� d S rb )rO r� rA rA rB �check_passthrough� s zip4tables.check_passthroughc C s t |�S rb )rG r� rA rA rB �reverse_passthrough� s z ip4tables.reverse_passthroughc C s� d}z|� d�}W n ty$ Y n 0 t|�|d krB||d }d }dD ]B}z|� |�}W n tyn Y qJ0 t|�|d krJ||d }qJ||fS )Nr& r� rw r0 )r8 rE rM )r_ r< r} rz r~ �optrA rA rB � passthrough_parse_table_chain� s z'ip4tables.passthrough_parse_table_chainc C s zH|� d�}|�|� |�|�}d|d kr:||d f}n ||d f}W nF ty� z |� d�}|�|� d }W n ty� Y Y d S 0 Y n0 d}|d d v r�d }|r�|s�||v r�|�|� n\|�r |r�||vr�|�|� |jd d � d � |� |�}nt|�}d|d< |�dd|d � d S )N�%%ZONE_SOURCE%%�-m� � � �%%ZONE_INTERFACE%%Tr �r, r- Fc S s | d S )Nr rA )rF rA rA rB �<lambda>' rm z4ip4tables._run_replace_zone_source.<locals>.<lambda>)�keyr3 r7 �%drw )r8 r; rE �remover� �sortrM �insert)r_ rx r] rz �zoneZ zone_source�rule_addr8 rA rA rB �_run_replace_zone_source s: z"ip4tables._run_replace_zone_sourcec C s z|� |�}W n ty" Y �n�0 d}d}d}|�|� |�|�}t|�tkrZttd��d} dD ]B} z|� | �} W n ty� Y qb0 t|�| d krb|| d } qbdD ]Z} z|� | �}W n ty� Y q�0 t|�|d kr�||d } | d v r�d}| d v r�d}q�| | f} |�s^| |v�s>||| v�s>|| | d k�rHttd ��|| | d8 < n�| |v�rpi || < ||| v�r�d || |< d} t || � � �D ]<}||k�r�|�r� �q�| || | 7 } ||k�r� �qܐq�|| | d7 < d ||< |� |d d| � dS )a Change something like -t filter -I public_IN %%RICH_RULE_PRIORITY%% 123 or -t filter -A public_IN %%RICH_RULE_PRIORITY%% 321 into -t filter -I public_IN 4 or -t filter -I public_IN TF���z%priority must be followed by a numberr& �r� z--tablerw )r1 r2 r3 r4 r, r- r6 r� r z*nonexistent or underflow of priority countr3 r7 r� N) r8 rE r; �typer: r r rM r �sorted�keysr� )r_ rx Zpriority_counts�tokenrz r� r� Zinsert_add_index�priorityr} r� �jr~ r8 �prA rA rB �_set_rule_replace_priority0 sj �� z$ip4tables._set_rule_replace_priorityc C s t � }i }t�| j�}t�| j�}t�| j�}|D �]x}|d d � } | �| dddt| j g� | �| dt | j g� z| � d�} W n t y� Y n80 |dkr�q2|dv r�dd d |g| | | d �< n | � | � | � | |d � | � | |d � | �| |� d} dD ]L} z| � | �} W n t �y" Y q�0 t| �| d kr�| � | � | � | �} q�t| �D ]F\} } tjD ]4}|| v �r`| �d��r�| �d��s`d| | | < �q`�qR|�| g ��| � q2|D ]F} || }|�d| � |D ]} |�d�| �d � �q�|�d� �q�|�� t�|j �}t � d| j | j d|j |j!f � g }| j"�rF|�| j"� |�d� t#| j ||j d�\}}t �$� dk�r�t%|j �}|d u�r�d } |D ]@}t j&d| |f d d d � |�d��s�t j&d d d � | d 7 } �q�t�'|j � |d k�rt d | j d�|�|f ��|| _|| _|| _d S )!N� %%REJECT%%�REJECT� --reject-with�%%ICMP%%� %%LOGTYPE%%�off��unicast� broadcastZ multicastr� �pkttype� --pkt-typerw �%%RICH_RULE_PRIORITY%%�%%POLICY_PRIORITY%%r& r� �"z"%s"z*%s ro � zCOMMIT rn z%s: %d�-n��stdinr7 z%8d: %sr )�nofmt�nlr )r� rp )(r �copy�deepcopyr[ r\ r] r{ �DEFAULT_REJECT_TYPErR �ICMPr8 rE r; r� r� rM � enumerate�stringZ whitespace� startswith�endswith� setdefaultr� �writers �closerc �stat�namer rq rr rT �st_sizerX r ZgetDebugLogLevelr �debug3�unlink)r_ �rules� log_denied� temp_fileZ table_rulesr[ r\ r] Z_rulerx rz r} r� �element�cr� r< ru rv �lines�linerA rA rB � set_rules� s� � � � � �zip4tables.set_rulesc C s� | � |dddt| j g� | � |dt| j g� z|�d�}W n tyP Y n:0 |dkr^dS |dv r�d d d |g|||d �< n |�|� t�| j �}t�| j �}t�| j �}| � ||d � | � ||d� | � ||� | �|�}|| _ || _ || _ |S )Nr� r� r� r� r� r� r r� r� r� r� rw r� r� )r{ r� rR r� r8 rE r; r� r� r[ r\ r] r� r� �_ip4tables__run)r_ rx r� rz r[ r\ r] �outputrA rA rB �set_rule� s0 � zip4tables.set_ruleNc C s� g }|r|gnt �� }|D ]n}|| jv r4|�|� qz,| �d|ddg� | j�|� |�|� W q ty� t�d| j|f � Y q0 q|S )Nr� rH r� zA%s table '%s' does not exist (or not enough permission to check).) r| r� rZ r� r� rE r �debug1rR )r_ r} rv ZtablesrA rA rB �get_available_tables s z ip4tables.get_available_tablesc C s� d}t | jg d��}t�d| j| jd|d |d � |d dkr�d}t | jg d��}t�d| j| jd|d |d � |d dkr�d}t�d | j| j|� |S ) Nr )�-wrH r� �7%s: %s: probe for wait option (%s): ret=%u, output="%s"r� r rw )�-w10rH r� r� � %s: %s will be using %s option.)r rS r r� rr rq )r_ rV rv rA rA rB rU s z ip4tables._detect_wait_optionc C s� t � }|�d� |�� d}dD ]d}t| j|g|jd�}t�d| j| j ||d |d � |d dkr d|d vr d |d vr |} q�q t� d | j| j|� t � |j� |S ) Nz#foor )r� z--wait=2r� r� r rw zinvalid optionzunrecognized optionr� ) r r� r� r rT r� r r� rr rS rq rc r� )r_ r� rV Z test_optionrv rA rA rB rW " s � z%ip4tables._detect_restore_wait_optionc C sN i | _ i | _g | _g }t�� D ]*}| �|�s.q dD ]}|�d||g� q2q |S )N)rI r. rJ r� )r[ r\ r] r| r� r� r� )r_ r� r} �flagrA rA rB �build_flush_rules6 s zip4tables.build_flush_rulesc C s� g }|dkrdn|}t �� D ]t}| �|�s,q |dkr6q t | D ]P}|dkrv|| }|dkrz|�d|d|ddg� d}n|}|�d|d ||g� q>q |S ) NZPANIC�DROPr% r& r� r� r1 �-jrK )r| r� r� r� )r_ �policyZpolicy_detailsr� �_policyr} r~ r� rA rA rB �build_set_policy_rulesE s z ip4tables.build_set_policy_rulesc C s g }d}z"| � d| jdkr dnddg�}W nL tyv } z4| jdkrTt�d| � nt�d| � W Y d }~n d }~0 0 |�� }d }|D ]�}|r�|�� �� }|�� }|D ]<} | � d �r�| � d �r�| d d� } n| } | |vr�|� | � q�| jdkr�|� d��s| jdkr�|� d�r�d}q�|S )zQReturn ICMP types that are supported by the iptables/ip6tables command and kernelr �-pr( r* r+ z--helpziptables error: %szip6tables error: %sNF�(�)rw r� zValid ICMP Types:r) zValid ICMPv6 Types:T) r� rR rE r r� � splitlines�strip�lower�splitr� r� r� ) r_ rR rv r� �exr� Zin_typesr� Zsplitsr� rF rA rA rB �supported_icmp_typesX s< � $ ��z ip4tables.supported_icmp_typesc C s g S rb rA rf rA rA rB �build_default_tablesy s z ip4tables.build_default_tablesr� c C s� i }| � d�rlg |d< t� | jd< td D ]@}|d �d| � |d �d||f � | jd �d| � q*| � d��r@g |d< t� | jd< td D ]�}|d �d| � |d �d||f � | jd �d| � |dkr�dD ]8}|d �d||f � | jd �td ||f g�� q�d D ] }|d �d |||f � �q q�| � d ��rg |d < t� | jd < td D ]�}|d �d| � |d �d||f � | jd �d| � |dk�rhdD ]:}|d �d||f � | jd �td ||f g�� �q�d D ] }|d �d |||f � �q��qh| � d ��rPg |d < t� | jd < td D �] }|d �d| � |d �d||f � | jd �d| � |dv �r�dD ]R}|d �d||f � | jd �td ||f g�� |d �d |||f � �q�nddD ]:}|d �d||f � | jd �td ||f g�� �q�d D ] }|d �d |||f � �q,�qBg |d< t� | jd< |d �d� |d �d� |dk�r�|d �d� |d �d� |d �d� |d �d� | jd �td�� dD ]0}|d �d| � | jd �td| �� �q�d D ]}|d �d| � �q|dk�rB|d �d � |d �d � |d �d � |d �d � |dk�r�|d �d � |d �d!� |d �d"� |d �d#� | jd �td$�� d%D ]0}|d �d&| � | jd �td'| �� �q�d D ]B}|d �d&| � |d �d(| � | jd �td'| �� �q�d)D ]0}|d �d&| � | jd �td'| �� �qD|dk�r�|d �d*� |d �d+� |d g d,�7 < | jd �td-�� d%D ]B}|d �d.| � |d �d/| � | jd �td0| �� �q�d)D ]B}|d �d.| � |d �d/| � | jd �td0| �� �qg }|D ]>}|| � � v�rr�q\|| D ] }|�d1|gt|� � �qz�q\|S )2Nr" z -N %s_directz-A %s -j %s_directz %s_directr# r )� POLICIES_pre�ZONES� POLICIES_postz-N %s_%s�%s_%s)r� z-A %s -j %s_%sr$ r% )r )r� r� r& zB-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED,DNAT -j ACCEPTz-A INPUT -i lo -j ACCEPTr� z^-A INPUT -m conntrack --ctstate INVALID %%LOGTYPE%% -j LOG --log-prefix 'STATE_INVALID_DROP: 'z/-A INPUT -m conntrack --ctstate INVALID -j DROPz-N INPUT_directz-A INPUT -j INPUT_directZ INPUT_directz -N INPUT_%szINPUT_%sz-A INPUT -j INPUT_%sz9-A INPUT %%LOGTYPE%% -j LOG --log-prefix 'FINAL_REJECT: 'z-A INPUT -j %%REJECT%%zD-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED,DNAT -j ACCEPTz-A FORWARD -i lo -j ACCEPTz`-A FORWARD -m conntrack --ctstate INVALID %%LOGTYPE%% -j LOG --log-prefix 'STATE_INVALID_DROP: 'z1-A FORWARD -m conntrack --ctstate INVALID -j DROPz-N FORWARD_directz -A FORWARD -j FORWARD_directZFORWARD_direct)r� z -N FORWARD_%sz FORWARD_%sz-A FORWARD -j FORWARD_%s)r� z;-A FORWARD %%LOGTYPE%% -j LOG --log-prefix 'FINAL_REJECT: 'z-A FORWARD -j %%REJECT%%)z-N OUTPUT_directz>-A OUTPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPTz-A OUTPUT -o lo -j ACCEPTz-A OUTPUT -j OUTPUT_directZ OUTPUT_directz -N OUTPUT_%sz-A OUTPUT -j OUTPUT_%sz OUTPUT_%sr� )r� rL r^ r| r� r� �updater )r_ r� Z default_rulesr~ Zdispatch_suffixZfinal_default_rulesr} rx rA rA rB �build_default_rules} s� " " z ip4tables.build_default_rulesc C sd |dkrddhS |dkr*d| � � v r*dhS |dkrFd| � � v rFddhS |dkr`d| � � v r`dhS i S ) Nr& r r r$ r r% r! r# )r� )r_ r} rA rA rB �get_zone_table_chains� s z ip4tables.get_zone_table_chainsc s� | j j�|���jdk r dnd��dkr4�dkr4dnd} | j j�|�t| �� g } g } |D ]} | �d| g� qX|D ]} | �d | g� qp|D ]8} | j j�| �}|d v r�| � |�s�q�| �| � d | �� q�|D ]J} | j j�| �}|d v r�| � |�s�q�t | �r��d v r�q�| �| � d | �� qƇ �����fdd�}g }| �r|| D ]B}| �r^| D ]}|�|||�� �qDn|�rfn|�||d �� �q6nD|�r�n<| �r�| D ]}|�|d |�� �q�n|�r�n|�|d d �� |S )Nr �pre�postr% r! TF�-i�-or' �-s�r! r r �-dc sV ddd�� }d�|d��f d�j g}| r6|�| � |rD|�|� |�d� g� |S )Nr1 r, �TFr� z%s_POLICIES_%sr� r� )r� �extend)�ingress_fragment�egress_fragment�add_delrx �r� r~ � chain_suffix�enable�p_objr} rA rB � _generate_policy_dispatch_rule* s � zSip4tables.build_policy_ingress_egress_rules.<locals>._generate_policy_dispatch_rule) rQ r� � get_policyr� �policy_base_chain_name�POLICY_CHAIN_PREFIXr� r� � check_source�is_ipv_supported�_rule_addr_fragmentr )r_ r r� r} r~ Zingress_interfacesZegress_interfacesZingress_sourcesZegress_sources�isSNATZingress_fragmentsZegress_fragments� interface�addrrR r r� r� r� rA r� rB �!build_policy_ingress_egress_rules sR z+ip4tables.build_policy_ingress_egress_rulesFc C s� |dkr|dkrdnd}| j jj||t|d�} dddddd�| } d } |r^|s^d d | d g} n,|rpd d | g} ndd | g} |s�| d g7 } | d|| || | g7 } | gS )Nr% r! TF�r r� r� �r r! r r r �-gr3 �%s_ZONESr� r1 r, r� )rQ r� r r ) r_ r r� r� r r} r~ r� r r� r� �actionrx rA rA rB �!build_zone_source_interface_rulesZ s( �� z+ip4tables.build_zone_source_interface_rulesc C s� |� d�rP|dd � }|dkr$d}nd}d�|g| jj�|� �}ddd ||gS t|�rz|dkrjttd ��dd d |�� gS t d |�r�t |�}n,t d |�r�|� d�}t |d �d |d }||gS d S )Nzipset:� r� �dst�src�,r� rL � --match-setz Can't match a destination MAC.�mac� --mac-sourcer) �/r rw ) r� rs rQ �ipsetZ get_dimensionr r r �upperr r r r� )r_ r� �address�invertr� �flags� addr_splitrA rA rB r s s" z ip4tables._rule_addr_fragmentc C s� ddd�| }|dkr"|dkr"dnd}| j jj||t|d�} d d d d d d �| } t|�rd|d v rdg S |d | d|d|g} | �| �| |�� | �d| g� | gS )Nr3 r, r� r% r! TFr r� r� r r� r r� r� r )rQ r� r r r r� r ) r_ r r� r� r r} r~ r� r r� r� rx rA rA rB � build_zone_source_address_rules� s" �� z)ip4tables.build_zone_source_address_rulesc C s� ddd�| }ddd�| }|dkr0|dkr0dnd }| j jj||t|d �}| j j�|�} | j| �t|d | d | d | d| d| g�� g } | �||d|g� | �|d | d|g� | �|d | d|g� | �|d | d|g� | �|d| d|g� | �|d| d|g� | j �r6| �||d|dd|df g� | �||d|dd | g� | �||d|dd | g� | �||d|dd | g� | �||d|dd| g� | �||d|dd| g� | j �r�| �||d|dd|df g� | j jj | j } | j � � dk�rb|dk�rb| t ddfv �r8| �||d|ddddd | g � | d k�rb| �||d|ddddd | g � |dk�r�| t d ddd fv �r�| t fv �r�d} n| } | �||d|d| g� |�s�| �� | S ) Nr5 r. r� r1 r, r% r! TFr z%s_log�%s_denyz%s_prez%s_post�%s_allowr� r� r� r� r� r� r& r� r� r� �LOG� --log-prefixz %s_REJECT: r� z %s_DROP: �ACCEPT)rQ r� r r r r^ r� rL r� Zderived_from_zoneZ _policies�target�get_log_deniedr �reverse) r_ r r� r} r~ Z add_del_chainZ add_del_ruler r� r r� r( �_targetrA rA rB �build_policy_chain_rules� sf � � � � z"ip4tables.build_policy_chain_rulesc C s |rddd|j gS g S )Nr� �limitz--limit)�value)r_ r- rA rA rB � _rule_limit� s zip4tables._rule_limitc C s� t |j�ttttfv rn<|jrJt |j�ttt t fvrTt t dt |j� ��n t t d��|j dkr�t |j�tttfv s�t |j�tt fv r�dS t |j�tfv s�t |j�tt fv r�dS n|j dk r�dS dS d S )N�Unknown action %szNo rule action specified.r �allowZdenyr� r� )r� r� r r r r r r r r r r r r� �r_ � rich_rulerA rA rB �_rich_rule_chain_suffix� s$ �� z!ip4tables._rich_rule_chain_suffixc C s: |j s|jsttd��|jdkr$dS |jdk r2dS dS d S )NzNot log or auditr r r� r� )r �auditr r r� r2 rA rA rB � _rich_rule_chain_suffix_from_log� s z*ip4tables._rich_rule_chain_suffix_from_logc C s |j dkrg S d|j gS )Nr r� )r� r2 rA rA rB � _rich_rule_priority_fragment s z&ip4tables._rich_rule_priority_fragmentc C s" |j s g S | jj�||t�}ddd�| }| �|�}d||d||f g} | | �|�7 } t|j �tkr�| |ddg 7 } |j j r�| d|j j g7 } |j j r�| d d |j j g7 } |j j r�| d |j j g7 } nJ| |dd g 7 } |j j r�| d d |j j g7 } |j j �r | dd |j j g7 } | | � |j j�7 } | S )Nr1 r, r� r� r� r� ZNFLOGz --nflog-groupz--nflog-prefixrh z--nflog-thresholdr% r& z --log-level)r rQ r� r r r6 r7 r� r �group�prefixZ threshold�levelr/ r- ) r_ r� r3 r r} � rule_fragmentr� r� r rx rA rA rB �_rich_rule_log s, zip4tables._rich_rule_logc C s� |j s g S ddd�| }| jj�||t�}| �|�}d||d||f g} | | �|�7 } | |7 } t|j�t krrd} n,t|j�t kr�d} nt|j�t kr�d} nd } | d d d | g7 } | | � |j j �7 } | S ) Nr1 r, r� r� r� ZacceptZrejectZdrop�unknownr� ZAUDITz--type)r5 rQ r� r r r6 r7 r� r r r r r/ r- ) r_ r� r3 r r} r; r� r� r rx Z_typerA rA rB �_rich_rule_audit" s$ zip4tables._rich_rule_auditc C s2 |j s g S ddd�| }| jj�||t�}| �|�}d||f } t|j �tkrXddg} n�t|j �tkr�ddg} |j jr�| d|j jg7 } nnt|j �t kr�dd g} nVt|j �t kr�d }| jj�||t�}d||f } dd d |j j g} nt t d t|j � ��d||| g} | | �|�7 } | || 7 } | | �|j j�7 } | S )Nr1 r, r� r� r� r' r� r� r� r$ �MARKz --set-xmarkr0 r� )r rQ r� r r r4 r� r r r r rL r r r7 r/ r- ) r_ r� r3 r r} r; r� r� r r~ Z rule_actionrx rA rA rB �_rich_rule_action; s6 � zip4tables._rich_rule_actionc C s� |sg S g }|j r�|jr"|�d� td|j �rB|dt|j �g7 }q�td|j �r||j �d�}|dt|d �d |d g7 }q�|d|j g7 }nD|jr�|ddg7 }|jr�|�d� | jj � |jd �}|d |j|g7 }|S ) N�!r) r� r r rw r� rL r r ) r r r� r r r r� r rQ r� �_ipset_match_flags)r_ Z rich_destr; r! r rA rA rB � _rich_rule_destination_fragment] s& " z)ip4tables._rich_rule_destination_fragmentc C s |sg S g }|j r�|jr"|�d� td|j �rB|dt|j �g7 }nHtd|j �r||j �d�}|dt|d �d |d g7 }n|d|j g7 }n�t|d�r�|jr�|ddg7 }|jr�|�d� |d |jg7 }nRt|d ��r|j �r|dd g7 }|jr�|�d� | j j � |j d �}|d |j |g7 }|S )NrA r) r� r r rw r r� r r rL r r ) r r r� r r r r� �hasattrr r rQ r� rB )r_ Z rich_sourcer; r! r rA rA rB �_rich_rule_source_fragmentu s0 " z$ip4tables._rich_rule_source_fragmentc C s� ddd�| }d}| j j�||t�} d|g} |rD| ddt|� g7 } |rT| d|g7 } |rx| | �|j�7 } | | �|j�7 } g } |r�| � | � ||||| �� | � | � ||||| �� | � | � ||||| �� n"| � |d | d |g| d d g � | S ) Nr1 r, r� r& r� �--dportrh r� r$ r� r� r' � rQ r� r r r rC � destinationrE �sourcer� r< r> r@ � r_ r r� �proto�portrH r3 r� r} r� r; r� rA rA rB �build_policy_ports_rules� s, ��z"ip4tables.build_policy_ports_rulesc C s� ddd�| }d}| j j�||t�}d|g} |r<| d|g7 } |r`| | �|j�7 } | | �|j�7 } g } |r�| �| � ||||| �� | �| � ||||| �� | �| � ||||| �� n"| �|d| d|g| d d g � | S ) Nr1 r, r� r& r� r� r$ r� r� r' ) rQ r� r r rC rH rE rI r� r< r> r@ ) r_ r r� �protocolrH r3 r� r} r� r; r� rA rA rB �build_policy_protocol_rules� s( ��z%ip4tables.build_policy_protocol_rulesc C s� d}d}| j j�||t�}ddd�| } g d�} |rl| �|�}| | �|�7 } | | �|j�7 } | | �|j �7 } |dks||d u r�| g d�7 } n| d d d |g7 } d d| d ||f g| gS )Nr1 r& r1 r, r� )r� Ztcpz --tcp-flagszSYN,RSTZSYNZpmtu)r� �TCPMSSz--clamp-mss-to-pmtur� rP z --set-mssr� r� ) rQ r� r r r4 r7 rC rH rE rI ) r_ r r� Ztcp_mss_clamp_valuerH r3 r r} r� r� r; rA rA rB � build_policy_tcp_mss_clamp_rules� s z*ip4tables.build_policy_tcp_mss_clamp_rulesc C s� ddd�| }d}| j j�||t�} d|g} |rD| ddt|� g7 } |rT| d|g7 } |rx| | �|j�7 } | | �|j�7 } g } |r�| � | � ||||| �� | � | � ||||| �� | � | � ||||| �� n"| � |d | d |g| d d g � | S ) Nr1 r, r� r& r� z--sportrh r� r$ r� r� r' rG rJ rA rA rB � build_policy_source_ports_rules� s, ��z)ip4tables.build_policy_source_ports_rulesc C sv d}| j j�||t�} ddd�| } | d| ddd|g} |rP| dd t|� g7 } |r`| d |g7 } | d d d |g7 } | gS )Nr# r1 r, r� r$ r� r� rF rh r� r� ZCTz--helper)rQ r� r r r ) r_ r r� rK rL rH Z helper_nameZmodule_short_namer} r� r� rx rA rA rB � build_policy_helper_ports_rules� s z)ip4tables.build_policy_helper_ports_rulesc C s� ddd�| }| j j�||t�}g } |rH| �dd|d| d|dd g� n6t|�rTg S | �dd|d| g| �d |� dd g � | S ) Nr1 r, r� r� r& r$ r� r� r' r� )rQ r� r r r� r r ) r_ r r� r� r} r rI r� r� r� rA rA rB �build_zone_forward_rules� s � ��z"ip4tables.build_zone_forward_rulesc C s� d}| j jj||tdd�}ddd�| }g }|rj| �|�}|| �|�7 }|| �|j�7 }|| �|j �7 }nd}g } | � dd|d ||f g| g d � � | S ) Nr% Tr r1 r, r� r1 r� r� )rA r� �lor� Z MASQUERADE) rQ r� r r r4 r7 rC rH rE rI r� ) r_ r r� r3 r} r� r� r; r r� rA rA rB � build_policy_masquerade_rules s" ��z'ip4tables.build_policy_masquerade_rulesc C s d}| j j�||t�} ddd�| } d} |rPtd|�rH| dt|� 7 } n| |7 } |rn|dkrn| dt|d � 7 } g } |r�| �|�} | �|�} | | � |j �7 } | | � |j �7 } nd } g }|r�|� | �|||d| �� |� d d| d | | f g| d |dt|�ddd| g � |S )Nr% r1 r, r� r r) z[%s]z:%s�-r1 r� r� r� rF r� ZDNATz--to-destination)rQ r� r r r r r r4 r7 rC rH rE rI r� r< )r_ r r� rL rN ZtoportZtoaddrr3 r} r� r� �tor; r r� rA rA rB � build_policy_forward_port_rules' s8 � ��z)ip4tables.build_policy_forward_port_rulesc C s� d}| j j�||t�}ddd�| }| jdkrFddg}ddd |jg} ndd g}dd d |jg} g } | j j�|�r|d | } d} n d| } d} g } |r�| | �|j�7 } | | � |j �7 } | || 7 } |�rP| � | � ||||| �� | � | � ||||| �� |j�r| � | �||||| �� n:| �|�}| � d||d||f g| �|� | ddg � n`| j �� dk�r�| dk�r�| � || d|g| ddddd| g � | � || d|g| d| g � | S )Nr& r1 r, r� r( r� r* r� z --icmp-typer+ Zicmp6z --icmpv6-typer$ r' r# r� r� r� r� r� r� r% r& �%s_ICMP_BLOCK: )rQ r� r r rR r� �query_icmp_block_inversionrC rH rE rI r� r< r> r r@ r4 r7 r) )r_ r r� Zictr3 r} r� r� rK �matchr� Z final_chainZ final_targetr; r rA rA rB � build_policy_icmp_block_rulesI s\ ��������z'ip4tables.build_policy_icmp_block_rulesc C s� d}| j j�||t�}g }d}| j j�|�r�d}| j �� dkr�|rRd|t|�g}nd|g}|d|dd d d d d d| g }|�|� |d7 }nd}|r�d|t|�g}nd|g}|d|dd d |g }|�|� |S )Nr& � r� r� r3 r, r� r� r� r� r� r% r& rZ rw r' )rQ r� r r r[ r) r� r� ) r_ r r� r} r� r� Zrule_idxZ ibi_targetrx rA rA rB �'build_policy_icmp_block_inversion_rulesz s0 � z1ip4tables.build_policy_icmp_block_inversion_rulesc C sx d}g }|| � |j�7 }|| �|j�7 }g }|�| �|||||�� |�| �|||||�� |�| �|||||�� |S )Nr& )rC rH rE rI r� r< r> r@ )r_ r r� r3 r} r; r� rA rA rB �*build_policy_rich_source_destination_rules� s z4ip4tables.build_policy_rich_source_destination_rulesc C s || j kS rb )rR )r_ rR rA rA rB r � s zip4tables.is_ipv_supported)N)N)r� )F)F)NN)NN)NN)NN)NN)N)N)N)8�__name__� __module__� __qualname__rR r� Zpolicies_supportedra rY r� r{ r r� r� r� r� r� r� r� r� r� r� r� rU rW r� r� r� r� r� r� r r r r" r, r/ r4 r6 r7 r< r> r@ rC rE rM rO rQ rR rS rT rV rY r] r_ r` r rA rA rA rB rP � sr &Pa# ! N � 9 " � � " 1"rP c @ s& e Zd ZdZd Zddd�Zdd� ZdS ) � ip6tablesr) Fc C s~ g }g d�}| j jdkr"|dg7 }|�g d�| ddg � |dkr^|�g d�| g d� � |�g d �� |�g d �� |S ) N)r� Zrpfilterz--invertz --validmarkZloosez--loose)r3 r r� r$ r� r� r� )r� r% r& zrpfilter_DROP: ) r3 r r� r$ r� r+ z$--icmpv6-type=neighbour-solicitationr� r' ) r3 r r� r$ r� r+ z"--icmpv6-type=router-advertisementr� r' )rQ Z_ipv6_rpfilterr� )r_ r� r� Zrpfilter_fragmentrA rA rB �build_rpfilter_rules� s$ �� ��z ip6tables.build_rpfilter_rulesc C s� g d�}d}| j d �|� g }|�ddd|g� |D ]L}|�ddd|d|dd d d g � | jjd v r6|�ddd|d|dd ddg � q6|�dddddd|g� |�dddd| j�� dkr�dndd|g� |S )N) z ::0.0.0.0/96z::ffff:0.0.0.0/96z2002:0000::/24z2002:0a00::/24z2002:7f00::/24z2002:ac10::/28z2002:c0a8::/32z2002:a9fe::/32z2002:e000::/19Z RFC3964_IPv4r& r� r5 r3 r� r� r� r� z addr-unreach)r� �allr% r& zRFC3964_IPv4_REJECT: r �4r r� �6�5)r^ r� r� rQ Z _log_deniedr) )r_ Z daddr_listZ chain_namer� ZdaddrrA rA rB �build_rfc3964_ipv4_rules� s. � �� �z"ip6tables.build_rfc3964_ipv4_rulesN)F)ra rb rc rR r� re rj rA rA rA rB rd � s rd )/Zos.pathrc r� Zfirewall.core.progr Zfirewall.core.loggerr Zfirewall.functionsr r r r r r r r Zfirewallr Zfirewall.errorsr r r r r Zfirewall.core.richr r r r r r r r r Zfirewall.core.baser r� r r| r� r� rC rG rO �objectrP rd rA rA rA rB �<module> sJ ( , � ��%* core/__pycache__/__init__.cpython-39.opt-1.pyc 0000644 00000000225 15025011705 0015026 0 ustar 00 a ���g � @ s d S )N� r r r �:/usr/lib/python3.9/site-packages/firewall/core/__init__.py�<module> � core/__pycache__/helper.cpython-39.opt-1.pyc 0000644 00000000322 15025011705 0014544 0 ustar 00 a ���g$ � @ s d Z dZdS )zThe helper maxnamelen� N)�__doc__ZHELPER_MAXNAMELEN� r r �8/usr/lib/python3.9/site-packages/firewall/core/helper.py�<module> s core/__pycache__/icmp.cpython-39.opt-1.pyc 0000644 00000004161 15025011705 0014222 0 ustar 00 a ���g � # @ s� g d �Z dddddddddd d d d d dddddddddddddddd d d d d d!�"Zd"d#d$d%d&dddd'd(d)d)d*d*d+d,d-d-d.d.d/d0�Zd1d2� Zd3d4� Zd5d6� Zd7d8� Zd9S ):)� ICMP_TYPES� ICMPV6_TYPES�check_icmp_type�check_icmpv6_typez0/0z3/0z3/1z3/2z3/3z3/4z3/5z3/6z3/7z3/9z3/10z3/11z3/12z3/13z3/14z3/15z4/0z5/0z5/1z5/2z5/3z8/0z9/0z10/0z11/0z11/1z12/0z12/1z13/0z14/0z17/0z18/0)"� echo-reply�pongznetwork-unreachablezhost-unreachablezprotocol-unreachable�port-unreachablezfragmentation-neededzsource-route-failedznetwork-unknownz host-unknownznetwork-prohibitedzhost-prohibitedzTOS-network-unreachablezTOS-host-unreachable�communication-prohibitedzhost-precedence-violationzprecedence-cutoffz source-quenchznetwork-redirectz host-redirectzTOS-network-redirectzTOS-host-redirect� echo-request�ping�router-advertisement�router-solicitation�ttl-zero-during-transit�ttl-zero-during-reassemblyz ip-header-badzrequired-option-missingztimestamp-requestztimestamp-replyzaddress-mask-requestzaddress-mask-replyz1/0z1/1z1/3z1/4z2/0z4/1z4/2z128/0z129/0z133/0z134/0z135/0z136/0z137/0)zno-router zaddress-unreachabler zpacket-too-bigr r z bad-headerzunknown-header-typezunknown-optionr r r r r r zneighbour-solicitationzneigbour-solicitationzneighbour-advertisementzneigbour-advertisementZredirectc C s | t v r dS dS �NTF)r ��_name� r �6/usr/lib/python3.9/site-packages/firewall/core/icmp.py�check_icmp_nameV s r c C s | t �� v rdS dS r )r �values�Z_typer r r r [ s r c C s | t v r dS dS r )r r r r r �check_icmpv6_name` s r c C s | t �� v rdS dS r )r r r r r r r e s r N)�__all__r r r r r r r r r r �<module> sz �&� core/__pycache__/fw_direct.cpython-39.pyc 0000644 00000031640 15025011705 0014303 0 ustar 00 a ���g�Y � @ sn d gZ ddlmZ ddlmZ ddlmZ ddlmZ ddlm Z ddl m Z ddl m Z G d d � d e�Zd S ) �FirewallDirect� )�LastUpdatedOrderedDict)� ipXtables)�ebtables)�FirewallTransaction)�log)�errors)� FirewallErrorc @ sL e Zd Zdd� Zdd� Zdd� Zdd� Zd d � Zd d � Zd d� Z dd� Z dNdd�Z dd� Z dd� Z dOdd�Zdd� Zd d � Zd d � Zd d!� ZdPd"d#�ZdQd$d%�Zd&d'� Zd(d)� Zd*d+� ZdRd,d-�ZdSd.d/�Zd0d1� Zd2d3� Zd4d5� Z d6d7� Z d8d9� Z d:d;� Z dTd<d=�Z dUd>d?�Z!d@dA� Z"dBdC� Z#dDdE� Z$dFdG� Z%dHdI� Z&dJdK� Z'dLdM� Z(dS )Vr c C s || _ | �� d S �N)�_fw�_FirewallDirect__init_vars)�self�fw� r �;/usr/lib/python3.9/site-packages/firewall/core/fw_direct.py�__init__' s zFirewallDirect.__init__c C s d| j | j| j| jf S )Nz%s(%r, %r, %r))� __class__�_chains�_rules�_rule_priority_positions�r r r r �__repr__+ s �zFirewallDirect.__repr__c C s" i | _ i | _i | _i | _d | _d S r )r r r � _passthroughs�_objr r r r Z __init_vars/ s zFirewallDirect.__init_varsc C s | � � d S r )r r r r r �cleanup6 s zFirewallDirect.cleanupc C s t | j�S r )r r r r r r �new_transaction; s z FirewallDirect.new_transactionc C s || _ d S r )r )r �objr r r �set_permanent_config@ s z#FirewallDirect.set_permanent_configc C s* t | j�t | j� t | j� dkr&dS dS )Nr TF)�lenr r r r r r r �has_runtime_configurationC s "z(FirewallDirect.has_runtime_configurationc C sB | � � r dS t| j�� �t| j�� � t| j�� � dkr>dS dS )NTr F)r r r �get_all_chains� get_all_rules�get_all_passthroughsr r r r �has_configurationH s � ��z FirewallDirect.has_configurationNc C sP |d u r| � � }n|}| �| j�� | j�� | j�� f|� |d u rL|�d� d S �NT)r � set_configr r r! r" �execute)r �use_transaction� transactionr r r � apply_directQ s ��zFirewallDirect.apply_directc C s i }i }i }| j D ]>}|\}}| j | D ]&}| j�|||�s(|�|g ��|� q(q| jD ]X}|\}}}| j| D ]>\} } | j�|||| | �sp||vr�t� ||< | || | | f< qpqX| jD ]@}| j| D ]0} | j� || �s�||vr�g ||< || �| � q�q�|||fS r ) r r � query_chain� setdefault�appendr � query_ruler r �query_passthrough) r Zchains�rulesZ passthroughs�table_id�ipv�table�chain�chain_id�priority�argsr r r �get_runtime_configb s, z!FirewallDirect.get_runtime_configc C s | j | j| jfS r )r r r r r r r � get_config� s zFirewallDirect.get_configc C s� |d u r| � � }n|}|\}}}|D ]r}|\}} || D ]\} | �|| | �s8z| j|| | |d� W q8 ty� } zt�t| �� W Y d } ~ q8d } ~ 0 0 q8q$|D ]�} | \}} } || D ]j\} }| �|| | | |�s�z| j|| | | ||d� W q� t�y } zt�t| �� W Y d } ~ q�d } ~ 0 0 q�q�|D ]n}|| D ]^}| � ||��s0z| j |||d� W n4 t�y� } zt�t| �� W Y d } ~ n d } ~ 0 0 �q0�q$|d u �r�|� d� d S )N)r' T) r r* � add_chainr r Zwarning�strr- �add_ruler. �add_passthroughr& )r Zconfr' r( r r r r0 r1 r2 r3 �errorr4 r5 r6 r r r r% � sF � ( � ( � , zFirewallDirect.set_configc C s( g d�}||vr$t tjd||f ��d S )N)�ipv4�ipv6Zeb�'%s' not in '%s')r r Z INVALID_IPV)r r1 Zipvsr r r � _check_ipv� s �zFirewallDirect._check_ipvc C sF | � |� |dv r tj�� ntj�� }||vrBttjd||f ��d S )N�r> r? r@ )rA r �BUILT_IN_CHAINS�keysr r r Z INVALID_TABLE)r r1 r2 Ztablesr r r �_check_ipv_table� s � �z FirewallDirect._check_ipv_tablec C s� |dv r4t j| }| jjr i }qH| j�|�j| }ntj| }tj| }||v r`tt j d| ��||v rxtt j d| ��|dv r�| jj � |�d ur�tt j d| ��d S )NrB z chain '%s' is built-in chainzchain '%s' is reservedzChain '%s' is reserved)r rC r �nftables_enabled�get_direct_backend_by_ipv� our_chainsr Z OUR_CHAINSr r Z BUILTIN_CHAIN�zoneZzone_from_chainZ INVALID_CHAIN)r r1 r2 r3 Zbuilt_in_chainsrH r r r �_check_builtin_chain� s( ���z#FirewallDirect._check_builtin_chainc C sH |r| j �|g ��|� n*| j | �|� t| j | �dkrD| j |= d S �Nr )r r+ r, �remover )r r0 r3 �addr r r �_register_chain� s z FirewallDirect._register_chainc C s� |d u r| � � }n|}| j�� r.|�| jj� | jjrZ| jj�� rZ|�| jjj| jj g� | � d||||� |d u r~|� d� d S r$ ) r r � may_skip_flush_direct_backends�add_pre�flush_direct_backends� ipset_enabled�ipset�omit_native_ipset� apply_ipsets� ipset_backend�_chainr& �r r1 r2 r3 r' r( r r r r9 � s zFirewallDirect.add_chainc C s> |d u r| � � }n|}| �d||||� |d u r:|�d� d S �NFT)r rW r& rX r r r � remove_chain� s zFirewallDirect.remove_chainc C s: | � ||� | �|||� ||f}|| jv o8|| j| v S r )rE rJ r )r r1 r2 r3 r0 r r r r* � s �zFirewallDirect.query_chainc C s, | � ||� ||f}|| jv r(| j| S g S r )rE r )r r1 r2 r0 r r r � get_chains� s zFirewallDirect.get_chainsc C s< g }| j D ],}|\}}| j | D ]}|�|||f� q q |S r )r r, )r �r�keyr1 r2 r3 r r r r s z FirewallDirect.get_all_chainsc C s� |d u r| � � }n|}| j�� r.|�| jj� | jjrZ| jj�� rZ|�| jjj| jj g� | � d||||||� |d u r�|� d� d S r$ ) r r rO rP rQ rR rS rT rU rV �_ruler& �r r1 r2 r3 r5 r6 r' r( r r r r; s zFirewallDirect.add_rulec C sB |d u r| � � }n|}| �d||||||� |d u r>|�d� d S rY )r r^ r& r_ r r r � remove_rule s zFirewallDirect.remove_rulec C s2 | � ||� |||f}|| jv o0||f| j| v S r )rE r )r r1 r2 r3 r5 r6 r4 r r r r- ) s �zFirewallDirect.query_rulec C s6 | � ||� |||f}|| jv r2t| j| �� �S g S r )rE r �listrD )r r1 r2 r3 r4 r r r � get_rules/ s zFirewallDirect.get_rulesc C sJ g }| j D ]:}|\}}}| j | D ] \}}|�||||t|�f� q"q |S r )r r, ra )r r\ r] r1 r2 r3 r5 r6 r r r r! 6 s z FirewallDirect.get_all_rulesc C s� |rr|| j vrt� | j |< || j | |< || jvr<i | j|< || j| v rb| j| | |7 < q�|| j| |< n<| j | |= t| j | �dkr�| j |= | j| | |8 < d S rK )r r r r )r �rule_idr4 r5 �enable�countr r r �_register_rule> s z FirewallDirect._register_rulec C sZ z| j �| j �|�j|�W S tyT } z"t�|� ttj |��W Y d }~n d }~0 0 d S r ) r �rulerG �name� Exceptionr Zdebug2r r ZCOMMAND_FAILED)r r1 r6 �msgr r r � passthroughR s zFirewallDirect.passthroughc C sX |r*|| j vrg | j |< | j | �|� n*| j | �|� t| j | �dkrT| j |= d S rK )r r, rL r )r r1 r6 rd r r r �_register_passthroughZ s z$FirewallDirect._register_passthroughc C s� |d u r| � � }n|}| j�� r.|�| jj� | jjrZ| jj�� rZ|�| jjj| jj g� | � d|t |�|� |d u r�|� d� d S r$ ) r r rO rP rQ rR rS rT rU rV � _passthroughra r& �r r1 r6 r' r( r r r r< d s z FirewallDirect.add_passthroughc C s@ |d u r| � � }n|}| �d|t|�|� |d u r<|�d� d S rY )r rm ra r& rn r r r �remove_passthroughu s z!FirewallDirect.remove_passthroughc C s || j v ot|�| j | v S r )r �tuple)r r1 r6 r r r r. � s �z FirewallDirect.query_passthroughc C s6 g }| j D ]&}| j | D ]}|�|t|�f� qq |S r �r r, ra )r r\ r1 r6 r r r r" � s z#FirewallDirect.get_all_passthroughsc C s0 g }|| j v r,| j | D ]}|�t|�� q|S r rq )r r1 r\ r6 r r r �get_passthroughs� s z FirewallDirect.get_passthroughsc C s� g }|D ]�}d}|D ]�}z|� |�}W n ty8 Y q0 t|�|krd||d v rd}||d �d�}|D ]&} |dd� } | | |d < |�| � qpq|s|�|� q|S )z5Split values combined with commas for options in optsF�,� TN)�index� ValueErrorr �splitr, ) r r/ ZoptsZ out_rulesrg Z processed�opt�i�items�itemr^ r r r � split_value� s$ zFirewallDirect.split_valuec C s | � ||� | jjs0|dv r0| jj�||||� |}| j�|�} | jjs`| �|||�r`d| }n:| jjr�|dd � dkr�| �|||d d� �r�|d d� }|||f} ||f} |r�| | jv r�| | j| v r�tt j d||||f ��n@| | jvs�| | j| v�rtt j d||||f ��| j| | }d} d} | | j v �r�t | j | �� �}d}|t|�k �r�||| k�r�| | j | || 7 } |d7 }�qLt|�g}| �|d d g�}| �|d d g�}|D ]4}|�| | �|||| t|��� | d7 } | d7 } �q�| �| | ||| � |�| j| | || | � d S ) NrB z %s_directi����Z_directz"rule '%s' already is in '%s:%s:%s'z rule '%s' is not in '%s:%s:%s'rt r z-sz--sourcez-dz --destination)rE r rF rI �create_zone_base_by_chainrG Zis_chain_builtinr r r �ALREADY_ENABLED� NOT_ENABLEDr �sortedrD r ra r| r; Z build_rulerp rf �add_fail)r rd r1 r2 r3 r5 r6 r( rW �backendr4 rc ru re Z positions�jZ args_list�_argsr r r r^ � sp �� � � � �� � ��( �zFirewallDirect._rulec C s� | � ||� | �|||� ||f}|rV|| jv r�|| j| v r�ttjd|||f ��n.|| jvsn|| j| vr�ttjd|||f ��| j�|�}|� ||� |||�� | � |||� |� | j ||| � d S )Nz chain '%s' already is in '%s:%s'z chain '%s' is not in '%s:%s') rE rJ r r r r~ r r rG Z add_rulesZbuild_chain_rulesrN r� )r rM r1 r2 r3 r( r0 r� r r r rW s0 ��� ��� zFirewallDirect._chainc C s� | � |� t|�}|rD|| jv rp|| j| v rpttjd||f ��n,|| jvs\|| j| vrpttjd||f ��| j�|�}|r�|� |� |dv r�|� |�\}}|r�|r�| jj � |||� |} n |� |�} |�|| � | �|||� |�| j||| � d S )Nzpassthrough '%s', '%s'rB )rA rp r r r r~ r r rG Zcheck_passthroughZ passthrough_parse_table_chainrI r} Zreverse_passthroughr; rl r� ) r rd r1 r6 r( Z tuple_argsr� r2 r3 r� r r r rm 0 s: � � � � �zFirewallDirect._passthrough)N)N)N)N)N)N)N)N))�__name__� __module__� __qualname__r r r r r r r r# r) r7 r8 r% rA rE rJ rN r9 rZ r* r[ r r; r` r- rb r! rf rk rl r< ro r. r" rr r| r^ rW rm r r r r r & sN ' � jN)�__all__Zfirewall.fw_typesr Z firewall.corer r Z firewall.core.fw_transactionr Zfirewall.core.loggerr Zfirewallr Zfirewall.errorsr �objectr r r r r �<module> s core/__pycache__/fw_transaction.cpython-39.opt-1.pyc 0000644 00000011172 15025011705 0016313 0 ustar 00 a ���g� � @ sJ d Z dgZddlZddlmZ ddlmZ ddlmZ G dd� de �Z dS )z!Transaction classes for firewalld�FirewallTransaction� N)�log)�errors)� FirewallErrorc @ s� e Zd Zdd� Zdd� Zdd� Zdd� Zd d � Zd d � Zd d� Z dd� Z dd� Z dd� Z dd� Z dd� Zdd� Zdd � Zd d � Zd d � Zd!d"� Zd#S )$r c C s( || _ i | _g | _g | _g | _g | _d S �N)�fw�rules� pre_funcs� post_funcs� fail_funcs�modules)�selfr � r �@/usr/lib/python3.9/site-packages/firewall/core/fw_transaction.py�__init__! s z FirewallTransaction.__init__c C s2 | j �� | jd d �= | jd d �= | jd d �= d S r )r �clearr r r )r r r r r ) s zFirewallTransaction.clearc C s | j �|jg ��|� d S r )r � setdefault�name�append�r �backend�ruler r r �add_rule/ s z FirewallTransaction.add_rulec C s |D ]}| � ||� qd S r )r )r r r r r r r � add_rules2 s z FirewallTransaction.add_rulesc C s |j | jv o|| j|j v S r )r r r r r r � query_rule6 s z FirewallTransaction.query_rulec C s2 |j | jv r.|| j|j v r.| j|j �|� d S r )r r �remover r r r � remove_rule9 s z FirewallTransaction.remove_rulec G s | j �||f� d S r )r r �r �func�argsr r r �add_pre= s zFirewallTransaction.add_prec G s | j �||f� d S r )r r r r r r �add_post@ s z FirewallTransaction.add_postc G s | j �||f� d S r )r r r r r r �add_failC s z FirewallTransaction.add_failc C s || j vr| j �|� d S r )r r �r �moduler r r � add_moduleF s z FirewallTransaction.add_modulec C s || j v r| j �|� d S r )r r r# r r r � remove_moduleJ s z!FirewallTransaction.remove_modulec C s |D ]}| � |� qd S r )r% �r r r$ r r r � add_modulesN s z FirewallTransaction.add_modulesc C s |D ]}| � |� qd S r )r& r' r r r �remove_modulesR s z"FirewallTransaction.remove_modulesc C s� t �dt| �|df � i }|sb| jD ]8}t| j| �D ]$}|�|g ��| j�|�� |�� q8q&n$| jD ] }|�|g �� | j| � qh|| j fS )Nz%s.prepare(%s, %s)z...) r �debug4�typer �reversedr r r �get_backend_by_name� reverse_rule�extendr )r �enabler � backend_namer r r r �prepareV s � zFirewallTransaction.preparec C s t �dt| �|f � | �|�\}}| �� d}d}g }|D ]j}z| j�||| � W nD ty� } z,d}|}t �t � � � t � |� W Y d }~q<d }~0 0 |� |� q<|s�| j� ||�} | r�| \} }| r�t �|� |�r�i } |D ]:}g | |< t|| �D ] } | | � | j�|��| �� q�q�| D ]\}z| j�|| | � W n> t�yz } z$t �t � � � t � |� W Y d }~n d }~0 0 �q"| jD ]`\} }z | |� W nH t�y� } z.t �t � � � t � d| ||f � W Y d }~n d }~0 0 �q�ttj|��| �� d S )Nz%s.execute(%s)F� Tz#Calling fail func %s(%s) failed: %s)r r* r+ r2 �prer r � ExceptionZdebug1� traceback� format_exc�errorr Zhandle_modulesr, r- r. r r r ZCOMMAND_FAILED�post)r r0 r r r8 ZerrorMsgZdoner1 �msgZ module_return�statusZ undo_rulesr r r r r r �executef sZ �$ � zFirewallTransaction.executec C s. t �dt| � � | jD ]\}}||� qd S )Nz%s.pre())r r* r+ r r r r r r4 � s zFirewallTransaction.prec C s. t �dt| � � | jD ]\}}||� qd S )Nz %s.post())r r* r+ r r r r r r9 � s zFirewallTransaction.postN)�__name__� __module__� __qualname__r r r r r r r r! r" r% r& r( r) r2 r< r4 r9 r r r r r s" @) �__doc__�__all__r6 Zfirewall.core.loggerr Zfirewallr Zfirewall.errorsr �objectr r r r r �<module> s core/__pycache__/fw_zone.cpython-39.opt-1.pyc 0000644 00000073477 15025011705 0014761 0 ustar 00 a ���gߩ � @ s� d dl Z d dlmZmZmZ d dlmZ d dlmZ d dl m Z d dl m Z m Z mZmZmZmZmZmZmZmZmZ d dlmZ d dlmZmZm Z d d l m Z d d l m Z G d d � d e!�Z"dS ) � N)� SHORTCUTS�DEFAULT_ZONE_TARGET�SOURCE_IPSET_TYPES)�FirewallTransaction)�Policy)�log) �Rich_ForwardPort�Rich_IcmpBlock� Rich_IcmpType� Rich_Mark�Rich_Masquerade� Rich_Port� Rich_Protocol� Rich_Rule� Rich_Service�Rich_SourcePort�Rich_Tcp_Mss_Clamp)�nm_get_bus_name)� checkIPnMask� checkIP6nMask� check_mac)�errors)� FirewallErrorc @ s& e Zd ZdZdd� Zdd� Zdd� Zdd � Zd d � Zd d � Z dd� Z dd� Z dd� Z dd� Z dd� Zdd� Zdd� Zd�d d �Zd d � Zd!d"� Zd#d$� Zd�d%d&�Zd'd(� Zd�d)d*�Zd�d+d,�Zd-d.� Zd/d0� Zd1d2� Zd3d4� Z d5d6� Z d�d8d9�Z d:d;� Z d�d<d=�Z d�d>d?�Z!d�d@dA�Z"dBdC� Z#dDdE� Z$dFdG� Z%d�dIdJ�Z&d�dKdL�Z'd�dMdN�Z(dOdP� Z)d�dQdR�Z*d�dSdT�Z+dUdV� Z,dWdX� Z-dYdZ� Z.d�d[d\�Z/d]d^� Z0d_d`� Z1dadb� Z2dcdd� Z3dedf� Z4dgdh� Z5d�didj�Z6dkdl� Z7dmdn� Z8dodp� Z9d�dqdr�Z:dsdt� Z;dudv� Z<dwdx� Z=d�dydz�Z>d{d|� Z?d}d~� Z@dd�� ZAd�d�� ZBd�d�d��ZCd�d�� ZDd�d�� ZEd�d�� ZFd�d�d��ZGd�d�� ZHd�d�� ZId�d�� ZJd�d�d��ZKd�d�� ZLd�d�� ZMd�d�d��ZNd�d�d��ZOd�d�d��ZPd�d�� ZQd�d�d��ZRd�d�� ZSd�d�� ZTd�d�� ZUd�d�d��ZVd�d�� ZWd�d�� ZXd�d�� ZYd�d�� ZZd�d�d��Z[d�d�� Z\d�d�d��Z]d�d�� Z^d�d�� Z_d S )�� FirewallZoner c C s || _ i | _i | _d S �N)�_fw�_zones�_zone_policies)�self�fw� r �9/usr/lib/python3.9/site-packages/firewall/core/fw_zone.py�__init__0 s zFirewallZone.__init__c C s d| j | jf S )Nz%s(%r))� __class__r �r r r r! �__repr__5 s zFirewallZone.__repr__c C s | j �� | j�� d S r )r �clearr r$ r r r! �cleanup8 s zFirewallZone.cleanupc C s t | j�}|�| jj� |S r )r r Zadd_pre�full_check_config)r �tr r r! �new_transaction< s z FirewallZone.new_transactionc C s dj ||d�S )Nzzone_{fromZone}_{toZone})�fromZone�toZone)�format)r r+ r, r r r! �policy_name_from_zonesA s z#FirewallZone.policy_name_from_zonesc C s t | j�� �S r )�sortedr �keysr$ r r r! � get_zonesF s zFirewallZone.get_zonesc C s4 g }| � � D ]"}| �|�s$| �|�r |�|� q |S r )r1 �list_interfaces� list_sources�append)r Z active_zones�zoner r r! �get_active_zonesI s z FirewallZone.get_active_zonesc C s2 | � |�}| jD ] }|| j| jv r| S qd S r )�_FirewallZone__interface_idr � interfaces)r � interface� interface_idr5 r r r! �get_zone_of_interfaceP s z"FirewallZone.get_zone_of_interfacec C s2 | � |�}| jD ] }|| j| jv r| S qd S r )�_FirewallZone__source_idr �sources)r �source� source_idr5 r r r! �get_zone_of_sourceX s z FirewallZone.get_zone_of_sourcec C s | j �|�}| j| S r )r � check_zoner )r r5 �zr r r! �get_zone` s zFirewallZone.get_zonec C sH t � }|j|_| �||�|_| j|_|j|_|g|_|g|_dD �] }||jkrz|dkrz|dv rzt ||t � t ||��� q@|dkr�||jkr�|dv r�t ||t � t ||��� q@||jkr�|dkr�|dv r�t ||t � t ||��� q@|dv r@g |_ g |_|j D ]D}| �||�}t|d�}|| �|j|�v r�|j �|� |j�|� q�q@|S ) N) �services�ports� masquerade� forward_ports� source_ports� icmp_blocks�icmp_block_inversion� rules_str� protocols�HOST)rD rE rH rI rJ rL �ANY)rF )rG )rK ��rule_str)r �nameZderived_from_zoner. �ZONE_POLICY_PRIORITY�priority�targetZ ingress_zonesZ egress_zones�setattr�copy�deepcopy�getattrrK �rulesr �_rich_rule_to_policiesr4 ) r �z_objr+ r, �p_objZsettingrP Zcurrent_policy�ruler r r! �policy_obj_from_zone_objd s8 �� z%FirewallZone.policy_obj_from_zone_objc C sr || j |j< g | j|j< |jdfd|jf|jdffD ]8\}}| �|||�}| jj�|� | j|j �|j� q4d S )NrM rN )r rQ r r^ r �policyZ add_policyr4 )r �objr+ r, r\ r r r! �add_zone� s � zFirewallZone.add_zonec C s. | j | }|jr| �|� | j |= | j|= d S r )r �applied�unapply_zone_settingsr )r r5 r` r r r! � remove_zone� s zFirewallZone.remove_zoneNc C sR | � � D ]D}| j| }t|j�dks2t|j�dkrt�d|� | j||d� qd S )Nr zApplying zone '%s'��use_transaction)r1 r �lenr8 r= r �debug1�apply_zone_settings)r rf r5 r[ r r r! � apply_zones� s zFirewallZone.apply_zonesc C s | j | }||_d S r )r rb )r r5 rb r` r r r! �set_zone_applied� s z FirewallZone.set_zone_appliedc C s� d|vr d S |� d�}t|�dk r&d S d }tD ]}|d t| kr.|}q.|d ur�|d | �� vrdd S t|�dks�t|�dkr�|d dv r�|d |fS d S )N�_� r � � )Zprer ZdenyZallowZpost)�splitrg r r1 )r �chainZsplits�_chain�xr r r! �zone_from_chain� s& � � z FirewallZone.zone_from_chainc C st | � |�}|d u rd S |\}}|dv r0|}d}n4|dv rB|}d}n"|dv rTd}|}nttjd| ��| �||�|fS )N)Z PREROUTINGZFORWARDrN )ZINPUTrM )Z POSTROUTINGz&chain '%s' can't be mapped to a policy)rt r r Z INVALID_CHAINr. )r rq rs r5 rr r+ r, r r r! �policy_from_chain� s z FirewallZone.policy_from_chainc C sj |dv rf| � |�}|d urf| � |�\}}|d u r:| �� }n|}| jj�|d|||� |d u rf|�d� d S )N)�ipv4�ipv6T)ru r* r r_ Zgen_chain_rules�execute) r �ipv�tablerq rf rs r_ rr � transactionr r r! �create_zone_base_by_chain� s �z&FirewallZone.create_zone_base_by_chainc C s� dD ]�}t | �|�|�}t|t�r(|g}|D ]j}|dkrJ| �||||� q,|dkrp| �|�}| �|||||� q,|dkr|q,q,|dkr�q,t�d|||� q,q|r�| � |||� d S )N)r8 r= �forwardrJ r8 r= rJ r} z3Zone '%s': Unknown setting '%s:%s', unable to apply) rX rC � isinstance�bool� _interface� check_source�_sourcer Zwarning�_icmp_block_inversion)r �enabler5 r{ �keyZ args_list�argsry r r r! �_zone_settings� s& �zFirewallZone._zone_settingsc C s� | j �|�}| j| }|jr d S d|_|d u r8| �� }n|}| j| D ]$}t�d||� | j jj ||d� qF| � d||� |d u r�|� d� d S )NTz+Applying policy (%s) derived from zone '%s're ) r rA r rb r* r r rh r_ �apply_policy_settingsr� rx �r r5 rf �_zoner` r{ r_ r r r! ri s z FirewallZone.apply_zone_settingsc C s| | j �|�}| j| }|js d S |d u r2| �� }n|}| j| D ]}| j jj||d� q@| �d||� |d u rx|� d� d S )Nre FT) r rA r rb r* r r_ �unapply_policy_settingsr� rx r� r r r! rc s z"FirewallZone.unapply_zone_settingsc C sz | � |�}| �|�}g }td�D ]P}|j| d |vrX|�t�t||j| d ��� q |�||j| d � q t|�S )�H :return: exported config updated with runtime settings � r ) rC � get_config_with_settings_dict�rangeZIMPORT_EXPORT_STRUCTUREr4 rV rW rX �tuple)r r5 r` Z conf_dictZ conf_list�ir r r! �get_config_with_settings1 s "z%FirewallZone.get_config_with_settingsc C s� | � |��� }|d tkr"d|d< | �|�| �|�| �|�| �|�| �|�| �|�| � |�| � |�| � |�| � |�| � |�| �|�d� }| j�||�S )r� rT �default� rD rE rI rF rG r8 r= rK rL rH rJ r} )rC Zexport_config_dictr � list_services� list_ports�list_icmp_blocks�query_masquerade�list_forward_portsr2 r3 � list_rules�list_protocols�list_source_ports�query_icmp_block_inversion� query_forwardr Z'combine_runtime_with_permanent_settings)r r5 Z permanentZruntimer r r! r� A s" � z*FirewallZone.get_config_with_settings_dictc s, d � fdd� }� fdd�}� j � jf� j� jf� j� jf� j� jf� j� j f� j � j f� j � j f||f� j� jf� j� jf� j� jf� j� jfd� }� �|�}t�|�}|�|� j�� � � j�d|gi� � � |�} � j� | |�\} } | D ]n} t | | t ��rJ| | D ]>} t | t ��r2|| d |g| �R � n|| d || � �qq�|| d |� q�| D ]�} t | | t ��r�| | D ]n} | d v �r�|| d || |d � nFt | t ��r�|| d |g| �R d|d �� n|| d || d|d � �q|n6| d v �r|| d ||d � n|| d |d|d � �q`d S )Nr c s � j | t|d�d|d� d S )NrO r ��timeout�sender)�add_ruler )r5 rP r� r� r$ r r! �add_rule_wrapperY s zDFirewallZone.set_config_with_settings_dict.<locals>.add_rule_wrapperc s � � | t|d�� d S )NrO )� remove_ruler )r5 rP r$ r r! �remove_rule_wrapper[ s zGFirewallZone.set_config_with_settings_dict.<locals>.remove_rule_wrapperr� Zzonesrn )r8 r= )r� r� )rJ )r N)!� add_service�remove_service�add_port� remove_port�add_icmp_block�remove_icmp_block�add_masquerade�remove_masquerade�add_forward_port�remove_forward_port� add_interface�remove_interface� add_source� remove_source� add_protocol�remove_protocol�add_source_port�remove_source_port�add_icmp_block_inversion�remove_icmp_block_inversion� add_forward�remove_forwardrC rV Zimport_config_dictr Zget_all_io_objects_dictr( r� Z get_added_and_removed_settingsr~ �listr� )r r5 Zsettingsr� r� r� Z setting_to_fnZold_objZ check_objZ old_settingsZ add_settingsZremove_settingsr� r� r r$ r! � set_config_with_settings_dictW sN � " z*FirewallZone.set_config_with_settings_dictc C s | j �|� d S r )r �check_interface�r r9 r r r! r� � s z FirewallZone.check_interfacec C s | � |� |S r )r� r� r r r! Z__interface_id� s zFirewallZone.__interface_idTc C s | j �� | j �|�}| j| }| �|�}||jv rHttjd||f ��| � |�} | d urnttj d|| f ��t � d||f � |d u r�| � � } n|} |js�|r�| j|| d� | �| j|d� |r�| �d||| � | �||||� | �| j||� |d u �r| �d� |S )N�'%s' already bound to '%s'z&Setting zone of interface '%s' to '%s're FT)r � check_panicrA r r7 r8 r r �ZONE_ALREADY_SETr; � ZONE_CONFLICTr rh r* rb ri �add_failrk r� �!_FirewallZone__register_interface�#_FirewallZone__unregister_interfacerx ) r r5 r9 r� rf � allow_applyr� �_objr: �zoir{ r r r! r� � sJ �� ��� � � zFirewallZone.add_interfacec C sB |j �|� |r|dkr&| jj�|� |t� kr>| jj�|� d S )N� )r8 r4 r �_default_zone_interfacesr �_nm_assigned_interfaces)r r� r: r5 r� r r r! Z__register_interface� s z!FirewallZone.__register_interfacec C sR | j �� | �|�}| j �|�}||kr,|S |d ur@| �||� | �|||�}|S r )r r� r; rA r� r� )r r5 r9 r� � _old_zone� _new_zoner� r r r! �change_zone_of_interface� s z%FirewallZone.change_zone_of_interfacec C sz | j �� |d u r | �� }n|}| �||� | jd|d|dd� |d urd|dkrd| jd|d|dd� |d u rv|�d� d S )NT�+)r4 r� F)r r� r* ri r� rx )r Zold_zoneZnew_zonerf r{ r r r! �change_default_zone� s z FirewallZone.change_default_zonec C s� | j �� | �|�}|d u r,ttjd| ��|dkr8|n | j �|�}||krbttjd|||f ��|d u rt| �� }n|}| j | }| � |�}|� | j ||� | � d|||� |d u r�|�d� |S )N�'%s' is not in any zoner� z"remove_interface(%s, %s): zoi='%s'FT)r r� r; r r ZUNKNOWN_INTERFACErA r� r* r r7 �add_postr� r� rx ) r r5 r9 rf r� r� r{ r� r: r r r! r� � s. ��� z FirewallZone.remove_interfacec C sN ||j v r|j �|� || jjv r0| jj�|� || jjv rJ| jj�|� d S r )r8 �remover r� r� )r r� r: r r r! Z__unregister_interface s z#FirewallZone.__unregister_interfacec C s | � |�| �|�jv S r )r7 rC r8 )r r5 r9 r r r! �query_interface s z FirewallZone.query_interfacec C s | � |�jS r )rC r8 �r r5 r r r! r2 s z FirewallZone.list_interfacesFc C sx t |�r dS t|�rdS t|�r$dS |�d�rh| �|dd � � |rV| �|dd � � | �|dd � �S ttj |��d S )Nrv rw r� zipset:� ) r r r � startswith� _check_ipset_type_for_source�_check_ipset_applied� _ipset_familyr r Z INVALID_ADDR�r r> rb r r r! r� s zFirewallZone.check_sourcec C s | j ||d� |S )N�rb )r� r� r r r! Z __source_id( s zFirewallZone.__source_idc C s | j �� | j �|�}| j| }t|�r0|�� }| j||d�}| j||d�} | |jv rjt t j d||f ��| � |�d ur�t t j d| ��|d u r�| �� } n|} |js�|r�| j|| d� | �| j|d� |r�| �d||| | � | �|| ||� | �| j|| � |d u �r| �d� |S )Nr� r� z '%s' already bound to a zonere FT)r r� rA r r �upperr� r< r= r r r� r@ r� r* rb ri r� rk r� � _FirewallZone__register_source� _FirewallZone__unregister_sourcerx ) r r5 r> r� rf r� r� r� ry r? r{ r r r! r� , s< �� � zFirewallZone.add_sourcec C s |j �|� d S r )r= r4 )r r� r? r5 r� r r r! Z__register_sourceT s z FirewallZone.__register_sourcec C sb | j �� | �|�}| j �|�}||kr,|S t|�r<|�� }|d urP| �||� | �|||�}|S r )r r� r@ rA r r� r� r� )r r5 r> r� r� r� r� r r r! �change_zone_of_sourceW s z"FirewallZone.change_zone_of_sourcec C s� | j �� t|�r|�� }| �|�}|d u r<ttjd| ��|dkrH|n | j �|�}||krrttj d|||f ��|d u r�| � � }n|}| j | }| � |�}| � |�} |�| j|| � | �d||| |� |d u r�|�d� |S )Nr� r� z remove_source(%s, %s): zos='%s'FT)r r� r r� r@ r r ZUNKNOWN_SOURCErA r� r* r r� r< r� r� r� rx ) r r5 r> rf Zzosr� r{ r� ry r? r r r! r� i s4 ��� zFirewallZone.remove_sourcec C s ||j v r|j �|� d S r )r= r� )r r� r? r r r! Z__unregister_source� s z FirewallZone.__unregister_sourcec C s& t |�r|�� }| �|�| �|�jv S r )r r� r< rC r= )r r5 r> r r r! � query_source� s zFirewallZone.query_sourcec C s | � |�jS r )rC r= r� r r r! r3 � s zFirewallZone.list_sourcesc sp � j �� D ]�}|jsq � j| D ]>}� j j�|�D ]*\}} |�|||||| |�} |�|| � q2q � �|d�}� � |�j r |dvr |j |||d|d�} |�|| � q � j j� � D ]�}|� j j� |�vr�|� j j�|�vr�q�|� j j�� v �rR� j j�|�j�rR|�s*t� �|��dk�r*� j jj||d� n&� j j�d||� |�� fdd �|� q�|r�|�� fd d �|� q�d S ) NrN )r� �*�filter�r9 rn re Fc s | � j j�� v o � j j�d| �S �NT�r r_ �)get_active_policies_not_derived_from_zoneZ!_ingress_egress_zones_transaction��pr$ r r! �<lambda>� s z)FirewallZone._interface.<locals>.<lambda>c s | � j j�� v o � j j�| �S r �r r_ r� r� r� r$ r r! r� � s )r �enabled_backends�policies_supportedr r_ �#_get_table_chains_for_zone_dispatchZ!build_zone_source_interface_rules� add_rulesr. rC r} �build_zone_forward_rules�"get_policies_not_derived_from_zone�list_ingress_zones�list_egress_zonesr� � get_policyrb rg r2 r� �_ingress_egress_zonesr� ) r r� r5 r9 r{ r4 �backendr_ rz rq rY r r$ r! r� � s: � �$��zFirewallZone._interfacec C s$ | � |�dkrd S | jjj|dd�S )Nzhash:macFr� )� _ipset_typer �ipsetZ get_family�r rQ r r r! r� � s zFirewallZone._ipset_familyc C s | j jj|dd�S )NFr� )r r� Zget_typer� r r r! r� � s zFirewallZone._ipset_typec C s d� |g| jj�|� �S )N�,)�joinr r� Z get_dimension)r rQ �flagr r r! �_ipset_match_flags� s z FirewallZone._ipset_match_flagsc C s | j j�|�S r )r r� Z check_appliedr� r r r! r� � s z!FirewallZone._check_ipset_appliedc C s* | � |�}|tvr&ttjd||f ��d S )Nz.ipset '%s' with type '%s' not usable as source)r� r r r Z INVALID_IPSET)r rQ Z_typer r r! r� � s ��z)FirewallZone._check_ipset_type_for_sourcec sx |r� j �|�gn� j �� D ]�}|js(q � j| D ]<}� j j�|�D ](\}} |�|||||| �} |�|| � qDq2� � |d�}� � |�j r |j |||d|d�} |�|| � q � j j� � D ]�}|� j j�|�vr�|� j j�|�vr�q�|� j j�� v �rZ� j j�|�j�rZ|�s2t� �|��dk�r2� j jj||d� n&� j j�d||� |�� fdd�|� q�|r�|�� fd d�|� q�d S ) NrN r� �r> rn re Fc s | � j j�� v o � j j�d| �S r� r� r� r$ r r! r� � s z&FirewallZone._source.<locals>.<lambda>c s | � j j�� v o � j j�| �S r r� r� r$ r r! r� � s )r �get_backend_by_ipvr� r� r r_ r� Z build_zone_source_address_rulesr� r. rC r} r� r� r� r� r� r� rb rg r3 r� r� r� ) r r� r5 ry r> r{ r� r_ rz rq rY r r$ r! r� � s: � �$��zFirewallZone._sourcec C s0 | j �|�}| �|d�}| j j�||||� |S �NrM )r rA r. r_ r� )r r5 �servicer� r� �p_namer r r! r� � s zFirewallZone.add_servicec C s, | j �|�}| �|d�}| j j�||� |S r )r rA r. r_ r� �r r5 r r r r r! r� s zFirewallZone.remove_servicec C s( | j �|�}| �|d�}| j j�||�S r )r rA r. r_ � query_servicer r r r! r s zFirewallZone.query_servicec C s& | j �|�}| �|d�}| j j�|�S r )r rA r. r_ r� �r r5 r r r r! r� s zFirewallZone.list_servicesc C s2 | j �|�}| �|d�}| j j�|||||� |S r )r rA r. r_ r� )r r5 �port�protocolr� r� r r r r! r� s zFirewallZone.add_portc C s. | j �|�}| �|d�}| j j�|||� |S r )r rA r. r_ r� �r r5 r r r r r r! r� s zFirewallZone.remove_portc C s* | j �|�}| �|d�}| j j�|||�S r )r rA r. r_ � query_portr r r r! r s zFirewallZone.query_portc C s& | j �|�}| �|d�}| j j�|�S r )r rA r. r_ r� r r r r! r� % s zFirewallZone.list_portsc C s2 | j �|�}| �|d�}| j j�|||||� |S r )r rA r. r_ r� )r r5 � source_portr r� r� r r r r! r� * s z FirewallZone.add_source_portc C s. | j �|�}| �|d�}| j j�|||� |S r )r rA r. r_ r� �r r5 r r r r r r! r� 0 s z FirewallZone.remove_source_portc C s* | j �|�}| �|d�}| j j�|||�S r )r rA r. r_ �query_source_portr r r r! r 6 s z FirewallZone.query_source_portc C s& | j �|�}| �|d�}| j j�|�S r )r rA r. r_ r� r r r r! r� ; s z FirewallZone.list_source_portsc C s� | j �|�}t|j�tkr(| �|d�gS t|j�ttt t t t fv rP| �|d�gS t|j�t fv rn| �|d�gS t|j�tfv r�| �d|�gS t|j�tfv r�| �|d�gS |jd u r�| �|d�gS ttjdt|j� ��d S )NrN rM z Rich rule type (%s) not handled.)r rA �type�actionr r. �elementr r r r r r r r r r r Z INVALID_RULE)r r5 r] r r r! rZ @ s � z#FirewallZone._rich_rule_to_policiesc C s* | � ||�D ]}| jj�||||� q |S r )rZ r r_ r� )r r5 r] r� r� r r r r! r� R s zFirewallZone.add_rulec C s& | � ||�D ]}| jj�||� q |S r )rZ r r_ r� )r r5 r] r r r r! r� W s zFirewallZone.remove_rulec C s. d}| � ||�D ]}|o&| jj�||�}q|S r� )rZ r r_ � query_rule)r r5 r] �retr r r r! r \ s zFirewallZone.query_rulec C sZ | j �|�}t� }| �|d�| �|d�| �d|�fD ] }|�t| j j�|��� q4t|�S )NrN rM )r rA �setr. �updater_ r� r� )r r5 r r r r r! r� b s �zFirewallZone.list_rulesc C s0 | j �|�}| �|d�}| j j�||||� |S r )r rA r. r_ r� )r r5 r r� r� r r r r! r� k s zFirewallZone.add_protocolc C s, | j �|�}| �|d�}| j j�||� |S r )r rA r. r_ r� �r r5 r r r r r! r� q s z FirewallZone.remove_protocolc C s( | j �|�}| �|d�}| j j�||�S r )r rA r. r_ �query_protocolr r r r! r w s zFirewallZone.query_protocolc C s& | j �|�}| �|d�}| j j�|�S r )r rA r. r_ r� r r r r! r� | s zFirewallZone.list_protocolsc C s. | j �|�}| �d|�}| j j�|||� |S �NrN )r rA r. r_ r� )r r5 r� r� r r r r! r� � s zFirewallZone.add_masqueradec C s* | j �|�}| �d|�}| j j�|� |S r )r rA r. r_ r� r r r r! r� � s z FirewallZone.remove_masqueradec C s& | j �|�}| �d|�}| j j�|�S r )r rA r. r_ r� r r r r! r� � s z FirewallZone.query_masqueradec C s6 | j �|�}| �|d�}| j j�|||||||� |S r )r rA r. r_ r� ) r r5 r r �toport�toaddrr� r� r r r r! r� � s �z FirewallZone.add_forward_portc C s2 | j �|�}| �|d�}| j j�|||||� |S r )r rA r. r_ r� �r r5 r r r r r r r r! r� � s z FirewallZone.remove_forward_portc C s. | j �|�}| �|d�}| j j�|||||�S r )r rA r. r_ �query_forward_portr r r r! r � s �z FirewallZone.query_forward_portc C s& | j �|�}| �|d�}| j j�|�S r )r rA r. r_ r� r r r r! r� � s z FirewallZone.list_forward_portsc C s0 | j �|�}| �|d�}| j j�||||� |S r )r rA r. r_ r� )r r5 �icmpr� r� r r r r! r� � s zFirewallZone.add_icmp_blockc C s, | j �|�}| �|d�}| j j�||� |S r )r rA r. r_ r� )r r5 r r r r r! r� � s z FirewallZone.remove_icmp_blockc C s( | j �|�}| �|d�}| j j�||�S r )r rA r. r_ �query_icmp_block)r r5 r � p_name_hostr r r! r � s z FirewallZone.query_icmp_blockc C s. | j �|�}| �|d�}tt| j j�|���S r )r rA r. r/ r r_ r� �r r5 r r r r! r� � s z FirewallZone.list_icmp_blocksc C s, | j �|�}| �|d�}| j j�||� |S r )r rA r. r_ r� )r r5 r� r r r r! r� � s z%FirewallZone.add_icmp_block_inversionc C s. | j �|�}| �|d�}| j j�|||� d S r )r rA r. r_ r� )r r� r5 r{ r r r r! r� � s z"FirewallZone._icmp_block_inversionc C s* | j �|�}| �|d�}| j j�|� |S r )r rA r. r_ r� r r r r! r� � s z(FirewallZone.remove_icmp_block_inversionc C s& | j �|�}| �|d�}| j j�|�S r )r rA r. r_ r� r r r r! r� � s z'FirewallZone.query_icmp_block_inversionc C s� | � |d�}| j| jD ]<}| j�� D ],}|js2q&|j|||d|d�}|�||� q&q| j| jD ]X}| � |�} | r�| j� | �gn| j�� D ],}|js�q�|j|||d|d�}|�||� q�qbd S )NrN r� r� r� ) r. r r8 r r� r� r� r� r= r� r ) r r� r5 r{ r r9 r� rY r> ry r r r! �_forward� s zFirewallZone._forwardc C s� | j �|�}| j �|� | j �� | j| }|jrBttjd| ��|d u rT| � � }n|}|j rl| � d||� | � |||� |� | j|� |d u r�|�d� |S )Nz forward already enabled in '%s'T)r rA Z check_timeoutr� r r} r r ZALREADY_ENABLEDr* rb r � _FirewallZone__register_forwardr� �!_FirewallZone__unregister_forwardrx )r r5 r� r� rf r� r� r{ r r r! r� � s$ � zFirewallZone.add_forwardc C s d|_ d S r� �r} )r r� r� r� r r r! Z__register_forward s z FirewallZone.__register_forwardc C s� | j �|�}| j �� | j| }|js6ttjd| ��|d u rH| �� }n|}|j r`| � d||� |� | j |� |d u r�|� d� |S )Nzforward not enabled in '%s'FT)r rA r� r r} r r Z NOT_ENABLEDr* rb r r� r" rx )r r5 rf r� r� r{ r r r! r� s � zFirewallZone.remove_forwardc C s d|_ d S )NFr# )r r� r r r! Z__unregister_forward% s z!FirewallZone.__unregister_forwardc C s | � |�jS r )rC r} r� r r r! r� ( s zFirewallZone.query_forward)N)N)N)N)NNT)N)N)N)F)F)NNT)N)N)F)r N)r N)r N)r N)r N)r N)NNr N)NN)NN)r N)N)r NN)N)`�__name__� __module__� __qualname__rR r" r% r' r* r. r1 r6 r; r@ rC r^ ra rd rj rk rt ru r| r� ri rc r� r� r� r� r7 r� r� r� r� r� r� r� r2 r� r< r� r� r� r� r� r� r3 r� r� r� r� r� r� r� r� r� r r� r� r� r r� r� r� r r� rZ r� r� r r� r� r� r r� r� r� r� r� r� r r� r� r� r r� r� r� r� r� r r� r! r� r" r� r r r r! r - s� * � > � + � � ( � ,( � � � � r )#rV Zfirewall.core.baser r r Z firewall.core.fw_transactionr Zfirewall.core.io.policyr Zfirewall.core.loggerr Zfirewall.core.richr r r r r r r r r r r Zfirewall.core.fw_nmr Zfirewall.functionsr r r Zfirewallr Zfirewall.errorsr �objectr r r r r! �<module> s 4 core/__pycache__/fw_policy.cpython-39.pyc 0000644 00000135473 15025011705 0014341 0 ustar 00 a ���gD# � @ s� d dl Z d dlmZ d dlmZmZmZmZmZm Z m Z m Z m Z m Z mZ d dlmZmZmZmZmZmZmZmZmZmZmZ d dlm Z d dl m Z d dl m Z d dl!m"Z" G d d � d e#�Z$dS ) � N)�log) �portStr� checkIPnMask� checkIP6nMask� checkProtocol�enable_ip_forwarding�check_single_address�portInPortRange�get_nf_conntrack_short_name�coalescePortRange�breakPortRange�checkTcpMssClamp) � Rich_Rule� Rich_Accept� Rich_Service� Rich_Port� Rich_Protocol�Rich_Masquerade�Rich_ForwardPort�Rich_SourcePort�Rich_IcmpBlock� Rich_IcmpType�Rich_Tcp_Mss_Clamp)�FirewallTransaction)�errors)� FirewallError)�SOURCE_IPSET_TYPESc @ sv e Zd Zdd� Zdd� Zdd� Zdd� Zd d � Zd d � Zd d� Z dd� Z dd� Z dd� Z d�dd�Z dd� Z�d dd�Z�dd d �Z�dd d �Zd d!� Zd"d#� Zd$d%� Zd&d'� Z�dd*d+�Zd,d-� Z�dd.d/�Zd0d1� Zd2d3� Zd4d5� Zd6d7� Z d8d9� Z �dd:d;�Z d<d=� Z �dd>d?�Z d@dA� Z!dBdC� Z"dDdE� Z#dFdG� Z$dHdI� Z%dJdK� Z&dLdM� Z'�ddNdO�Z(dPdQ� Z)�ddRdS�Z*dTdU� Z+dVdW� Z,dXdY� Z-dZd[� Z.d\d]� Z/�d d^d_�Z0d`da� Z1�d dbdc�Z2ddde� Z3dfdg� Z4dhdi� Z5djdk� Z6dldm� Z7dndo� Z8dpdq� Z9�d drds�Z:dtdu� Z;�d dvdw�Z<dxdy� Z=dzd{� Z>d|d}� Z?d~d� Z@d�d�� ZAd�d�� ZB�d d�d��ZCd�d�� ZD�dd�d��ZEd�d�� ZFd�d�� ZGd�d�� ZHd�d�� ZI�dd�d��ZJd�d�� ZK�dd�d��ZLd�d�� ZMd�d�� ZNd�d�� ZO�dd�d��ZPd�d�� ZQ�dd�d��ZRd�d�� ZSd�d�� ZT�dd�d��ZU�dd�d��ZV�dd�d��ZWd�d�� ZX�dd�d��ZYd�d�� ZZ�dd�d��Z[d�d�� Z\d�d�� Z]d�d�� Z^�dd�d��Z_d�d�� Z`�dd�d��Zad�dÄ Zbd�dń Zcd�dDŽ Zd�dd�dɄZed�d˄ Zfd�d̈́ Zg�dd�dτZhd�dф Zid�dӄ Zjd�dՄ Zkd�dׄ Zld�dل Zmd�dۄ Znd�d݄ Zod�d߄ Zpd�d� Zq�d d�d�Zr�d d�d�Zsd�d� Ztd�d� Zud�d� Zvd�d� Zw�d d�d�Zxd�d� Zyd�d� Zzd�d�� Z{d�d�� Z|d�d�� Z}d�d�� Z~�d d�d��ZdS ( �FirewallPolicyc C s || _ i | _i | _d S �N)�_fw�_chains� _policies)�self�fw� r$ �;/usr/lib/python3.9/site-packages/firewall/core/fw_policy.py�__init__ s zFirewallPolicy.__init__c C s d| j | j| jf S )Nz %s(%r, %r))� __class__r r! �r" r$ r$ r% �__repr__ s zFirewallPolicy.__repr__c C s | j �� | j�� d S r )r �clearr! r( r$ r$ r% �cleanup s zFirewallPolicy.cleanupc C s t | j�}|�| jj� |S r )r r Zadd_pre�full_check_config)r" �tr$ r$ r% �new_transaction$ s z FirewallPolicy.new_transactionc C s t | j�� �S r )�sortedr! �keysr( r$ r$ r% � get_policies+ s zFirewallPolicy.get_policiesc C s4 g }| � � D ] }| �|�}|js |�|� q t|�S r )r1 � get_policy�derived_from_zone�appendr/ )r" �policies�p�p_objr$ r$ r% �"get_policies_not_derived_from_zone. s z1FirewallPolicy.get_policies_not_derived_from_zonec C sv g }| � � D ]d}| �|�}t|j�t| jj�� �tddg�B @ r t|j�t| jj�� �tddg�B @ r |�|� q |S )N�HOST�ANY) r8 r2 �set� ingress_zonesr �zoneZget_active_zones� egress_zonesr4 )r" Zactive_policies�policyr7 r$ r$ r% �)get_active_policies_not_derived_from_zone6 s &$� z8FirewallPolicy.get_active_policies_not_derived_from_zonec C s | j �|�}| j| S r )r � check_policyr! )r" r? r6 r$ r$ r% r2 @ s zFirewallPolicy.get_policyc C s || j |j< d S r )r! �name)r" �objr$ r$ r% � add_policyD s zFirewallPolicy.add_policyc C s& | j | }|jr| �|� | j |= d S r )r! �applied�unapply_policy_settings)r" r? rC r$ r$ r% � remove_policyG s z FirewallPolicy.remove_policyNc C sJ | � � D ]<}| j| }|jr q|| �� v rt�d|� | j||d� qd S )NzApplying policy '%s'��use_transaction)r1 r! r3 r@ r Zdebug1�apply_policy_settings)r" rI r? r7 r$ r$ r% �apply_policiesM s z FirewallPolicy.apply_policiesc C s | j | }||_d S r )r! rE )r" r? rE rC r$ r$ r% �set_policy_appliedV s z!FirewallPolicy.set_policy_appliedc C sz | j �|�}| j| }|r |js*|s.|js.d S |r8d|_|d u rJ| �� }n|}|r�|jsb| �|�n| �|�D ]\}}| �|d|||� ql|js�| � |||� dD �]x} t | � |�| �} t | t �r�|r�| s�|s�| s�q�| g} | D �]:} | dkr�| �||| |� q�| dk�r q�q�| dk�r,| j|||g| �R � q�| dk�rH| �||| |� q�| dk�rn| �||| d | d |� q�| d k�r�| �||| |� q�| d k�r�| �||| d | d |� q�| d k�r�| �|||� q�| d k�r�| �||t| d�|� q�| dk�r�q�q�| dk�rq�q�t�d|| | � q�q�|�sb|j�s4| �|�n| �|�D ] \}}| �|d|||� �q>d|_|d u �rv|�|� d S )NT) �services�ports� masquerade� forward_ports� source_ports� icmp_blocks� rules_str� protocols�icmp_block_inversionr< r> rR rU rP rM rN r � rT rQ rO rS ��rule_strr< r> z5Policy '%s': Unknown setting '%s:%s', unable to applyF)r rA r! rE r. r3 �%_get_table_chains_for_policy_dispatch�#_get_table_chains_for_zone_dispatch�gen_chain_rules�_ingress_egress_zones�getattrr2 � isinstance�bool� _icmp_block� _forward_port�_service�_port� _protocol� _source_port� _masquerade�_FirewallPolicy__ruler r �warning�execute) r" �enabler? rI �_policyrC � transaction�table�chain�keyZ args_list�argsr$ r$ r% �_policy_settingsZ s� � � � � � �� z FirewallPolicy._policy_settingsc C s | j d||d� d S )NTrH �rq �r" r? rI r$ r$ r% rJ � s z$FirewallPolicy.apply_policy_settingsc C s | j d||d� d S )NFrH rr rs r$ r$ r% rF � s z&FirewallPolicy.unapply_policy_settingsc C s | � |��� S r )r2 Zexport_config_dict�r" r? r$ r$ r% � get_config_with_settings_dict� s z,FirewallPolicy.get_config_with_settings_dictc s� ddl m� d � �fdd� }� �fdd�}�j�jf�j�jf�j�jf�j�j f�j �j f||f�j �j f�j�jf�j�jf�j�jfd� }��|�}t�|�}|�|�j�� � �j�d|gi� ��|�} �j�| |�\} } | D ]n} t | | t ��rF| | D ]>} t | t ��r.|| d |g| �R � n|| d || � �qq�|| d |� q�| D ]�} t | | t ��r�| | D ]L} t | t ��r�|| d |g| �R d|d �� n|| d || d|d � �qxn|| d |d|d � �q\d S ) Nr )r c s �j | � |d�d|d� d S )NrW r ��timeout�sender)�add_rule)r? rX rw rx �r r" r$ r% �add_rule_wrapper� s zFFirewallPolicy.set_config_with_settings_dict.<locals>.add_rule_wrapperc s �� | � |d�� d S )NrW )� remove_rule)r? rX rz r$ r% �remove_rule_wrapper� s zIFirewallPolicy.set_config_with_settings_dict.<locals>.remove_rule_wrapper) rM rN rR rO rP Z rich_rulesrT rQ r< r> r5 rV rv )r N) �firewall.core.richr � add_service�remove_service�add_port� remove_port�add_icmp_block�remove_icmp_block�add_masquerade�remove_masquerade�add_forward_port�remove_forward_port� add_protocol�remove_protocol�add_source_port�remove_source_port�add_ingress_zone�remove_ingress_zone�add_egress_zone�remove_egress_zoner2 �copyZimport_config_dictr Zget_all_io_objects_dictr, ru Z get_added_and_removed_settingsr^ �list�tuple)r" r? Zsettingsrx r{ r} Z setting_to_fnZold_objZ check_objZ old_settingsZ add_settingsZremove_settingsro rp r$ rz r% � set_config_with_settings_dict� sD � " z,FirewallPolicy.set_config_with_settings_dictc C s& |st tj��|dvr"| j�|� d S �N)r9 r: �r r Z INVALID_ZONEr Z check_zone�r" r= r$ r$ r% �check_ingress_zone� s z!FirewallPolicy.check_ingress_zonec C s | � |� |S r )r� r� r$ r$ r% Z__ingress_zone_id� s z FirewallPolicy.__ingress_zone_idr Tc C s | j �|�}| j �|� | j �� | j| }| �|�} | |jv rTttj d||f ��|d u rf| � � } n|} |r�|j r�| � d|| � | � || ||� | �| j|| � |j s�|| �� v r�| j|| d� | �| j|d� n| � d|| � n | � || ||� | �| j|| � |d u �r| �d� d S �N�'%s' already in '%s'FrH T)r rA � check_timeout� check_panicr! � _FirewallPolicy__ingress_zone_idr< r r �ALREADY_ENABLEDr. rE r\ �&_FirewallPolicy__register_ingress_zone�add_fail�(_FirewallPolicy__unregister_ingress_zoner@ rJ rL ri � r" r? r= rw rx rI Z allow_applyrk �_obj�zone_idrl r$ r$ r% r� � s4 � z FirewallPolicy.add_ingress_zonec C s |j �|� d S r )r< r4 �r" r� r� rw rx r$ r$ r% Z__register_ingress_zone s z&FirewallPolicy.__register_ingress_zonec C s� | j �|�}| j �� | j| }| �|�}||jvrHttjd||f ��|d u rZ| � � }n|}|j r�t |j�dkr�| � ||� n| � d||� | �||� |�| j||d d � || �� v r�| � d||� n|�| j||� |d u r�|�d� |S �N�'%s' not in '%s'rV FT)r rA r� r! r� r< r r � NOT_ENABLEDr. rE �lenrF r\ r� r� r� r@ �add_postri �r" r? r= rI rk r� r� rl r$ r$ r% r� s. � z"FirewallPolicy.remove_ingress_zonec C s ||j v r|j �|� d S r )r< �remove�r" r� r� r$ r$ r% Z__unregister_ingress_zone4 s z(FirewallPolicy.__unregister_ingress_zonec C s | � |�| �|�jv S r )r� r2 r< �r" r? r= r$ r$ r% �query_ingress_zone8 s z!FirewallPolicy.query_ingress_zonec C s | � |�jS r )r2 r< rt r$ r$ r% �list_ingress_zones; s z!FirewallPolicy.list_ingress_zonesc C s& |st tj��|dvr"| j�|� d S r� r� r� r$ r$ r% �check_egress_zone@ s z FirewallPolicy.check_egress_zonec C s | � |� |S r )r� r� r$ r$ r% Z__egress_zone_idF s z FirewallPolicy.__egress_zone_idc C s | j �|�}| j �|� | j �� | j| }| �|�} | |jv rTttj d||f ��|d u rf| � � } n|} |r�|j r�| � d|| � | � || ||� | �| j|| � |j s�|| �� v r�| j|| d� | �| j|d� n| � d|| � n | � || ||� | �| j|| � |d u �r| �d� d S r� )r rA r� r� r! � _FirewallPolicy__egress_zone_idr> r r r� r. rE r\ �%_FirewallPolicy__register_egress_zoner� �'_FirewallPolicy__unregister_egress_zoner@ rJ rL ri r� r$ r$ r% r� J s4 � z FirewallPolicy.add_egress_zonec C s |j �|� d S r )r> r4 r� r$ r$ r% Z__register_egress_zonep s z%FirewallPolicy.__register_egress_zonec C s� | j �|�}| j �� | j| }| �|�}||jvrHttjd||f ��|d u rZ| � � }n|}|j r�t |j�dkr�| � ||� n| � d||� | �||� |�| j||d d � || �� v r�| � d||� n|�| j||� |d u r�|�d� |S r� )r rA r� r! r� r> r r r� r. rE r� rF r\ r� r� r� r@ r� ri r� r$ r$ r% r� s s. � z!FirewallPolicy.remove_egress_zonec C s ||j v r|j �|� d S r )r> r� r� r$ r$ r% Z__unregister_egress_zone� s z'FirewallPolicy.__unregister_egress_zonec C s | � |�| �|�jv S r )r� r2 r> r� r$ r$ r% �query_egress_zone� s z FirewallPolicy.query_egress_zonec C s | � |�jS r )r2 r> rt r$ r$ r% �list_egress_zones� s z FirewallPolicy.list_egress_zonesc C s |� � d S r )�check�r" �ruler$ r$ r% � check_rule� s zFirewallPolicy.check_rulec C s | � |� t|�S r )r� �strr� r$ r$ r% Z __rule_id� s zFirewallPolicy.__rule_idc C sx |sd S |j r,t|j �r dS t|j �rtdS nHt|d�r@|jr@dS t|d�rt|jrt| �|j� | �|j� | �|j�S d S )N�ipv4�ipv6�mac� �ipset) �addrr r �hasattrr� r� � _check_ipset_type_for_source�_check_ipset_applied� _ipset_family)r" �sourcer$ r$ r% �_rule_source_ipv� s z FirewallPolicy._rule_source_ipvc C s | � ||||� d S r )� _rule_prepare)r" rj r? r� rl r$ r$ r% Z__rule� s zFirewallPolicy.__rulec C s� | j �|�}| j �|� | j �� | j| }| �|�}||jv rd|jrL|jn|} tt j d|| f ��|d u rv| � � } n|} |j r�| � d||| � | �||||� | �| j||� |d u r�| �d� |S �Nr� T)r rA r� r� r! �_FirewallPolicy__rule_idrS r3 r r r� r. rE rg � _FirewallPolicy__register_ruler� � _FirewallPolicy__unregister_ruleri ) r" r? r� rw rx rI rk r� �rule_id�_namerl r$ r$ r% ry � s( � zFirewallPolicy.add_rulec C s |j �|� d S r )rS r4 )r" r� r� rw rx r$ r$ r% Z__register_rule� s z FirewallPolicy.__register_rulec C s� | j �|�}| j �� | j| }| �|�}||jvrX|jr@|jn|}ttj d||f ��|d u rj| � � }n|}|j r�| � d|||� |� | j||� |d u r�|�d� |S �Nr� FT)r rA r� r! r� rS r3 r r r� r. rE rg r� r� ri ) r" r? r� rI rk r� r� r� rl r$ r$ r% r| � s$ � zFirewallPolicy.remove_rulec C s ||j v r|j �|� d S r )rS r� )r" r� r� r$ r$ r% Z__unregister_rule� s z FirewallPolicy.__unregister_rulec C s | � |�| �|�jv S r )r� r2 rS )r" r? r� r$ r$ r% � query_rule� s zFirewallPolicy.query_rulec C s | � |�jS r )r2 rS rt r$ r$ r% � list_rules s zFirewallPolicy.list_rulesc C s | j �|� d S r )r � check_service�r" �servicer$ r$ r% r� s z FirewallPolicy.check_servicec C s | � |� |S r )r� r� r$ r$ r% Z __service_id s zFirewallPolicy.__service_idc C s� | j �|�}| j �|� | j �� | j| }| �|�}||jv rd|jrL|jn|} tt j d|| f ��|d u rv| � � } n|} |j r�| � d||| � | �||||� | �| j||� |d u r�| �d� |S r� )r rA r� r� r! �_FirewallPolicy__service_idrM r3 r r r� r. rE rb �!_FirewallPolicy__register_servicer� �#_FirewallPolicy__unregister_serviceri ) r" r? r� rw rx rI rk r� � service_idr� rl r$ r$ r% r s( � zFirewallPolicy.add_servicec C s |j �|� d S r )rM r4 )r" r� r� rw rx r$ r$ r% Z__register_service) s z!FirewallPolicy.__register_servicec C s� | j �|�}| j �� | j| }| �|�}||jvrX|jr@|jn|}ttj d||f ��|d u rj| � � }n|}|j r�| � d|||� |� | j||� |d u r�|�d� |S r� )r rA r� r! r� rM r3 r r r� r. rE rb r� r� ri ) r" r? r� rI rk r� r� r� rl r$ r$ r% r� , s$ � z FirewallPolicy.remove_servicec C s ||j v r|j �|� d S r )rM r� )r" r� r� r$ r$ r% Z__unregister_serviceG s z#FirewallPolicy.__unregister_servicec C s | � |�| �|�jv S r )r� r2 rM )r" r? r� r$ r$ r% � query_serviceK s z FirewallPolicy.query_servicec C s | � |�jS r )r2 rM rt r$ r$ r% � list_servicesN s z FirewallPolicy.list_servicesc C sN g }|D ]@}z| j j�|�}W n ty< ttj|��Y n0 |�|� q|S r )r �helper� get_helperr r �INVALID_HELPERr4 )r" �helpers�_helpersr� �_helperr$ r$ r% � get_helpers_for_service_helpersQ s z.FirewallPolicy.get_helpers_for_service_helpersc C s� g }|D ]�}z| j j�|�}W n ty< ttj|��Y n0 t|j�dk r�t|j �}z | j j�|�}|� |� W q� ty� |r�t � d| � Y qY q�0 q|� |� q|S )NrV z Helper '%s' is not available) r r� r� r r r� r� rN r �moduler4 r rh )r" �modulesrj r� r� r� �_module_short_namer� r$ r$ r% � get_helpers_for_service_modules[ s" z.FirewallPolicy.get_helpers_for_service_modulesc C s | j �|� | j �|� d S r )r � check_port� check_tcpudp�r" �port�protocolr$ r$ r% r� t s zFirewallPolicy.check_portc C s | � ||� t|d�|fS �N�-�r� r r� r$ r$ r% Z __port_idx s zFirewallPolicy.__port_idc sp | j �|�}| j �|� | j �� | j| }tt� fdd�|j��} | D ]8} t|| d �rH|j rf|j n|} t t j d|� | f ��qHt |dd� | D ��\} } |d u r�| �� }n|}|jr�| D ] }| �d|t|d�� |� q�| D ] }| �d |t|d�� |� q�| D ]0}| �|� �} | �|| ||� |�| j|| � q�| D ]"}| �|� �} |�| j|| � �q4|d u �rl|�d� |S ) Nc s | d � kS �NrV r$ ��x�r� r$ r% �<lambda>� � z)FirewallPolicy.add_port.<locals>.<lambda>r �'%s:%s' already in '%s'c S s g | ] \}}|�qS r$ r$ ��.0rc rd r$ r$ r% � <listcomp>� r� z+FirewallPolicy.add_port.<locals>.<listcomp>Tr� F)r rA r� r� r! r� �filterrN r r3 r r r� r r. rE rc r �_FirewallPolicy__port_id� _FirewallPolicy__register_portr� � _FirewallPolicy__unregister_portr� ri �r" r? r� r� rw rx rI rk r� �existing_port_ids�port_idr� � added_ranges�removed_rangesrl �ranger$ r� r% r� | s< � zFirewallPolicy.add_portc C s |j �|� d S r )rN r4 �r" r� r� rw rx r$ r$ r% Z__register_port� s z FirewallPolicy.__register_portc sh | j �|�}| j �� | j| }tt� fdd�|j��}|D ]}t||d �r< qzq<|jr`|jn|} t t j d|� | f ��t |dd� |D ��\} } |d u r�| � � } n|} |jr�| D ] } | �d|t| d�� | � q�| D ] } | �d |t| d�� | � q�| D ]0} | �| � �}| �||dd � | �| j||� q�| D ]"} | �| � �}| �| j||� �q,|d u �rd| �d� |S ) Nc s | d � kS r� r$ r� r� r$ r% r� � r� z,FirewallPolicy.remove_port.<locals>.<lambda>r �'%s:%s' not in '%s'c S s g | ] \}}|�qS r$ r$ r� r$ r$ r% r� � r� z.FirewallPolicy.remove_port.<locals>.<listcomp>Tr� F)r rA r� r! r� r� rN r r3 r r r� r r. rE rc r r� r� r� r� r� ri �r" r? r� r� rI rk r� r� r� r� r� r rl r r$ r� r% r� � s< � zFirewallPolicy.remove_portc C s ||j v r|j �|� d S r )rN r� �r" r� r� r$ r$ r% Z__unregister_port� s z FirewallPolicy.__unregister_portc C s2 | � |�jD ] \}}t||�r ||kr dS q dS �NTF)r2 rN r �r" r? r� r� rc rd r$ r$ r% � query_port� s zFirewallPolicy.query_portc C s | � |�jS r )r2 rN rt r$ r$ r% � list_ports� s zFirewallPolicy.list_portsc C s t |�sttj|��d S r )r r r ZINVALID_PROTOCOL�r" r� r$ r$ r% �check_protocol� s z FirewallPolicy.check_protocolc C s t |�sttjd| ��d S )Nzatcp-mss-clamp value must be greater than or equal to 536, or the value 'pmtu'. Invalid value '%s')r r r � INVALID_RULE)r" �tcp_mss_clamp_valuer$ r$ r% �check_tcp_mss_clamp� s z"FirewallPolicy.check_tcp_mss_clampc C s | � |� |S r )r r r$ r$ r% Z __protocol_id� s z FirewallPolicy.__protocol_idc C s� | j �|�}| j �|� | j �� | j| }| �|�}||jv rd|jrL|jn|} tt j d|| f ��|d u rv| � � } n|} |j r�| � d||| � | �||||� | �| j||� |d u r�| �d� |S r� )r rA r� r� r! � _FirewallPolicy__protocol_idrT r3 r r r� r. rE rd �"_FirewallPolicy__register_protocolr� �$_FirewallPolicy__unregister_protocolri ) r" r? r� rw rx rI rk r� � protocol_idr� rl r$ r$ r% r� � s( � zFirewallPolicy.add_protocolc C s |j �|� d S r )rT r4 )r" r� r rw rx r$ r$ r% Z__register_protocol s z"FirewallPolicy.__register_protocolc C s� | j �|�}| j �� | j| }| �|�}||jvrX|jr@|jn|}ttj d||f ��|d u rj| � � }n|}|j r�| � d|||� |� | j||� |d u r�|�d� |S r� )r rA r� r! r rT r3 r r r� r. rE rd r� r ri ) r" r? r� rI rk r� r r� rl r$ r$ r% r� s( � � z FirewallPolicy.remove_protocolc C s ||j v r|j �|� d S r )rT r� )r" r� r r$ r$ r% Z__unregister_protocol( s z$FirewallPolicy.__unregister_protocolc C s | � |�| �|�jv S r )r r2 rT )r" r? r� r$ r$ r% �query_protocol, s z FirewallPolicy.query_protocolc C s | � |�jS r )r2 rT rt r$ r$ r% �list_protocols/ s z FirewallPolicy.list_protocolsc C s | � ||� t|d�|fS r� r� r� r$ r$ r% Z__source_port_id4 s z FirewallPolicy.__source_port_idc sp | j �|�}| j �|� | j �� | j| }tt� fdd�|j��} | D ]8} t|| d �rH|j rf|j n|} t t j d|� | f ��qHt |dd� | D ��\} } |d u r�| �� }n|}|jr�| D ] }| �d|t|d�� |� q�| D ] }| �d |t|d�� |� q�| D ]0}| �|� �} | �|| ||� |�| j|| � q�| D ]"}| �|� �} |�| j|| � �q4|d u �rl|�d� |S ) Nc s | d � kS r� r$ r� r� r$ r% r� ? r� z0FirewallPolicy.add_source_port.<locals>.<lambda>r r� c S s g | ] \}}|�qS r$ r$ r� r$ r$ r% r� F r� z2FirewallPolicy.add_source_port.<locals>.<listcomp>Tr� F)r rA r� r� r! r� r� rQ r r3 r r r� r r. rE re r � _FirewallPolicy__source_port_id�%_FirewallPolicy__register_source_portr� �'_FirewallPolicy__unregister_source_portr� ri r� r$ r� r% r� 8 s< � z FirewallPolicy.add_source_portc C s |j �|� d S r )rQ r4 r r$ r$ r% Z__register_source_port` s z%FirewallPolicy.__register_source_portc sh | j �|�}| j �� | j| }tt� fdd�|j��}|D ]}t||d �r< qzq<|jr`|jn|} t t j d|� | f ��t |dd� |D ��\} } |d u r�| � � } n|} |jr�| D ] } | �d|t| d�� | � q�| D ] } | �d |t| d�� | � q�| D ]0} | �| � �}| �||dd � | �| j||� q�| D ]"} | �| � �}| �| j||� �q,|d u �rd| �d� |S ) Nc s | d � kS r� r$ r� r� r$ r% r� i r� z3FirewallPolicy.remove_source_port.<locals>.<lambda>r r c S s g | ] \}}|�qS r$ r$ r� r$ r$ r% r� r r� z5FirewallPolicy.remove_source_port.<locals>.<listcomp>Tr� F)r rA r� r! r� r� rQ r r3 r r r� r r. rE re r r r r� r r� ri r r$ r� r% r� c s< � z!FirewallPolicy.remove_source_portc C s ||j v r|j �|� d S r )rQ r� r r$ r$ r% Z__unregister_source_port� s z'FirewallPolicy.__unregister_source_portc C s2 | � |�jD ] \}}t||�r ||kr dS q dS r )r2 rQ r r r$ r$ r% �query_source_port� s z FirewallPolicy.query_source_portc C s | � |�jS r )r2 rQ rt r$ r$ r% �list_source_ports� s z FirewallPolicy.list_source_portsc C s� | j �|�}| j �|� | j �� | j| }|jrR|jr>|jn|}ttj d| ��|d u rd| � � }n|}|j r|| � d||� | � |||� |�| j|� |d u r�|�d� |S )Nz"masquerade already enabled in '%s'T)r rA r� r� r! rO r3 r r r� r. rE rf �$_FirewallPolicy__register_masquerader� �&_FirewallPolicy__unregister_masqueraderi ) r" r? rw rx rI rk r� r� rl r$ r$ r% r� � s& � z FirewallPolicy.add_masqueradec C s d|_ d S �NT�rO )r" r� rw rx r$ r$ r% Z__register_masquerade� s z$FirewallPolicy.__register_masqueradec C s� | j �|�}| j �� | j| }|jsF|jr2|jn|}ttjd| ��|d u rX| � � }n|}|j rp| � d||� |� | j |� |d u r�|�d� |S )Nz masquerade not enabled in '%s'FT)r rA r� r! rO r3 r r r� r. rE rf r� r ri )r" r? rI rk r� r� rl r$ r$ r% r� � s" � z FirewallPolicy.remove_masqueradec C s d|_ d S �NFr �r" r� r$ r$ r% Z__unregister_masquerade� s z&FirewallPolicy.__unregister_masqueradec C s | � |�jS r )r2 rO rt r$ r$ r% �query_masquerade� s z FirewallPolicy.query_masqueradec C sZ | j �|� | j �|� |r(| j �|� |rBt||�sBttj|��|sV|sVttjd��d S )Nz.port-forwarding is missing to-port AND to-addr)r r� r� r r r Z INVALID_ADDRZINVALID_FORWARD)r" �ipvr� r� �toport�toaddrr$ r$ r% �check_forward_port� s �z!FirewallPolicy.check_forward_portc C sL t d|�r | �d||||� n| �d||||� t|d�|t|d�t|�fS )Nr� r� r� )r r$ r r� )r" r� r� r" r# r$ r$ r% Z__forward_port_id� s �z FirewallPolicy.__forward_port_idc C s� | j �|�} | j �|� | j �� | j| } | �||||�} | | jv rp| jrR| jn| } tt j d||||| f ��|d u r�| � � } n|} | j r�| � d| | ||||� | �| | ||� | �| j| | � |d u r�| �d� | S )Nz '%s:%s:%s:%s' already in '%s'T)r rA r� r� r! � _FirewallPolicy__forward_port_idrP r3 r r r� r. rE ra �&_FirewallPolicy__register_forward_portr� �(_FirewallPolicy__unregister_forward_portri )r" r? r� r� r" r# rw rx rI rk r� � forward_idr� rl r$ r$ r% r� � s0 �� � z FirewallPolicy.add_forward_portc C s |j �|� d S r )rP r4 )r" r� r( rw rx r$ r$ r% Z__register_forward_port s z&FirewallPolicy.__register_forward_portc C s� | j �|�}| j �� | j| }| �||||�} | |jvrd|jrF|jn|} ttj d||||| f ��|d u rv| � � } n|} |j r�| � d|| ||||� | � | j|| � |d u r�| �d� |S )Nz'%s:%s:%s:%s' not in '%s'FT)r rA r� r! r% rP r3 r r r� r. rE ra r� r' ri ) r" r? r� r� r" r# rI rk r� r( r� rl r$ r$ r% r� s, �� � z"FirewallPolicy.remove_forward_portc C s ||j v r|j �|� d S r )rP r� )r" r� r( r$ r$ r% Z__unregister_forward_port1 s z(FirewallPolicy.__unregister_forward_portc C s | � ||||�}|| �|�jv S r )r% r2 rP )r" r? r� r� r" r# r( r$ r$ r% �query_forward_port5 s z!FirewallPolicy.query_forward_portc C s | � |�jS r )r2 rP rt r$ r$ r% �list_forward_ports: s z!FirewallPolicy.list_forward_portsc C s | j �|� d S r )r Zcheck_icmptype�r" �icmpr$ r$ r% �check_icmp_block? s z FirewallPolicy.check_icmp_blockc C s | � |� |S r )r- r+ r$ r$ r% Z__icmp_block_idB s z FirewallPolicy.__icmp_block_idc C s� | j �|�}| j �|� | j �� | j| }| �|�}||jv rd|jrL|jn|} tt j d|| f ��|d u rv| � � } n|} |j r�| � d||| � | �||||� | �| j||� |d u r�| �d� |S r� )r rA r� r� r! � _FirewallPolicy__icmp_block_idrR r3 r r r� r. rE r` �$_FirewallPolicy__register_icmp_blockr� �&_FirewallPolicy__unregister_icmp_blockri ) r" r? r, rw rx rI rk r� �icmp_idr� rl r$ r$ r% r� F s( � z FirewallPolicy.add_icmp_blockc C s |j �|� d S r )rR r4 )r" r� r1 rw rx r$ r$ r% Z__register_icmp_blockc s z$FirewallPolicy.__register_icmp_blockc C s� | j �|�}| j �� | j| }| �|�}||jvrX|jr@|jn|}ttj d||f ��|d u rj| � � }n|}|j r�| � d|||� |� | j||� |d u r�|�d� |S r� )r rA r� r! r. rR r3 r r r� r. rE r` r� r0 ri ) r" r? r, rI rk r� r1 r� rl r$ r$ r% r� f s$ � z FirewallPolicy.remove_icmp_blockc C s ||j v r|j �|� d S r )rR r� )r" r� r1 r$ r$ r% Z__unregister_icmp_block� s z&FirewallPolicy.__unregister_icmp_blockc C s | � |�| �|�jv S r )r. r2 rR )r" r? r, r$ r$ r% �query_icmp_block� s z FirewallPolicy.query_icmp_blockc C s | � |�jS r )r2 rR rt r$ r$ r% �list_icmp_blocks� s z FirewallPolicy.list_icmp_blocksc C s� | j �|�}| j �� | j| }|jrF|jr2|jn|}ttjd| ��|d u rX| � � }n|}|j r�|j D ]}| � d|||� qh| � d||� | �||� |�| j||� |j r�|j D ]}| � d|||� q�| � d||� |d u r�|�d� |S )Nz,icmp-block-inversion already enabled in '%s'FT)r rA r� r! rU r3 r r r� r. rE rR r` �_icmp_block_inversion�._FirewallPolicy__register_icmp_block_inversionr� �*_FirewallPolicy__undo_icmp_block_inversionri ) r" r? rx rI rk r� r� rl rp r$ r$ r% �add_icmp_block_inversion� s2 � z'FirewallPolicy.add_icmp_block_inversionc C s d|_ d S r �rU )r" r� rx r$ r$ r% Z __register_icmp_block_inversion� s z.FirewallPolicy.__register_icmp_block_inversionc C s` | � � }|jr*|jD ]}| �d|||� qd|_|jrR|jD ]}| �d|||� q<|�d� d S )NFT)r. rE rR r` rU ri )r" rk r� rl rp r$ r$ r% Z__undo_icmp_block_inversion� s z*FirewallPolicy.__undo_icmp_block_inversionc C s� | j �|�}| j �� | j| }|jsF|jr2|jn|}ttjd| ��|d u rX| � � }n|}|j r�|j D ]}| � d|||� qh| � d||� | �|� |�| j|d � |j r�|j D ]}| � d|||� q�| � d||� |d u r�|�d� |S )Nz(icmp-block-inversion not enabled in '%s'FT)r rA r� r! rU r3 r r r� r. rE rR r` r4 �0_FirewallPolicy__unregister_icmp_block_inversionr� r5 ri )r" r? rI rk r� r� rl rp r$ r$ r% �remove_icmp_block_inversion� s6 � � z*FirewallPolicy.remove_icmp_block_inversionc C s d|_ d S r r8 r r$ r$ r% Z!__unregister_icmp_block_inversion� s z0FirewallPolicy.__unregister_icmp_block_inversionc C s | � |�jS r )r2 rU rt r$ r$ r% �query_icmp_block_inversion� s z)FirewallPolicy.query_icmp_block_inversionc C s� | j j�|�}|jr*| j jj|j d }n|}|rT|| jv rt||f| j| v rtd S n || jvsp||f| j| vrtd S | j �� D ]2}|jr~||� � v r~|� ||||�} |� || � q~| � ||||fg� |� | j || ||fg� d S �Nr )r r? r2 r3 r= Z_zone_policiesr �enabled_backends�policies_supportedZget_available_tablesZbuild_policy_chain_rules� add_rules�_register_chainsr� ) r" r? �createrm rn rl rC Ztracking_policy�backend�rulesr$ r$ r% r[ � s* � � �z FirewallPolicy.gen_chain_rulesc C s^ |D ]T\}}|r*| j �|g ��||f� q| j | �||f� t| j | �dkr| j |= qd S r< )r � setdefaultr4 r� r� )r" r? rA Ztablesrm rn r$ r$ r% r@ s z FirewallPolicy._register_chainsc C s$ | j j�|�dkrd S | j j�|�S )Nzhash:mac)r r� �get_typeZ get_family�r" rB r$ r$ r% r� s z FirewallPolicy._ipset_familyc C s | j j�|�S r )r r� rE rF r$ r$ r% Z __ipset_type! s zFirewallPolicy.__ipset_typec C s d� |g| jj�|� �S )N�,)�joinr r� Z get_dimension)r" rB �flagr$ r$ r% �_ipset_match_flags$ s z!FirewallPolicy._ipset_match_flagsc C s | j j�|�S r )r r� Z check_appliedrF r$ r$ r% r� ' s z#FirewallPolicy._check_ipset_appliedc C s* | � |�}|tvr&ttjd||f ��d S )Nz.ipset '%s' with type '%s' not usable as source)�_FirewallPolicy__ipset_typer r r Z INVALID_IPSET)r" rB Z_typer$ r$ r% r� * s ��z+FirewallPolicy._check_ipset_type_for_sourcec s� t |j�tkr��jj�|jj�}|d u r2|jjg}|jD ]H}||v rFq8��|� |� |� t � |�}||j_�j |||||d� q8g } |j r�|j g} nH|jr�t|jt�s�t|jt�rވjj�|jj�� � jrއ fdd�dD �} ��|j�} | �r"|j �r |j | k�r"ttjd| |j f ��n| g} | �s0ddg} �fdd�| D �} | |_t�fd d�| D ��D �]2} t |j�tk�r��jj�|jj�}g } t|j�d k�r�|j�r�ttjd ��| D ].} | |jv �r�| � | ��r�| � |j| � �q�n | � d � | D �]�}t |j �t k�r�� |j |�}|��!|j"�7 }t#t|�d d � d�}g }|D ]�}|j$}t%|�}|�&dd�}|� |� |j dk�r�| � |j ��s��qBt|j'�dk �r�|� |� n6|j'D ].\}}| �(||||||j|�}|�)| |� �q��qB|�*|� |j'D ]*\}}| �+||||||�}|�)| |� �q�|j,D ]$}| �-|||||�}|�)| |� �q |j.D ]*\}}| �/||||||�}|�)| |� �qL�q�q^t |j�t0k�r�|jj1}|jj2}��3||� | �+||||d |�}|�)| |� �q^t |j�t4k�r|jj5}��6|� | �-|||d |�}|�)| |� �q^t |j�t7k�rX|jj5}��8|� | �9|||d |�}|�)| |� �q^t |j�t:k�r�|�r�| D ] } | � | ��rr|�;t<| � �qr| �=|||�}|�)| |� �q^t |j�t>k�rH|jj1}|jj2}|jj?}|jj@}| D ]<} | � | ��r��A| ||||� |�r�|�r�|�;t<| � �q�| �B|||||||�}|�)| |� �q^t |j�tCk�r�|jj1}|jj2}��3||� | �/||||d |�}|�)| |� n�t |j�tk�s�t |j�tk�rR�jj�|jj�� |j �r � j�r |j � jv�r ttjDd|j |jjf ��t |j�tk�r4|j �r4t |j �t k�r4ttjd��| �E||� |�}|�)| |� n>|jd u �rz| �F|||�}|�)| |� nttjdt |j� ���q^d S )N��included_servicesc s g | ]}|� j v r|�qS r$ )� destination�r� r! )�ictr$ r% r� G r� z0FirewallPolicy._rule_prepare.<locals>.<listcomp>�r� r� z;Source address family '%s' conflicts with rule family '%s'.r� r� c s g | ]}� j �|�r|�qS r$ )r �is_ipv_enabledrO r( r$ r% r� X r� c s g | ]}� j �|��qS r$ )r �get_backend_by_ipv)r� r� r( r$ r% r� ] r� r z"Destination conflict with service.c S s | j S r �rB r� r$ r$ r% r� u r� z.FirewallPolicy._rule_prepare.<locals>.<lambda>�ro � conntrack�natr� rV z3rich rule family '%s' conflicts with icmp type '%s'z'IcmpBlock not usable with accept actionzUnknown element %s)G�type�elementr r r� � get_servicerB �includesr� r4 r� �deepcopyr� �familyr^ r r �config� get_icmptyperN r� r� r r r �ipvsr; r� �is_ipv_supported�actionr r� r� r� r� r/ r� r �replacerN � build_policy_helper_ports_rulesr? Z add_modules�build_policy_ports_rulesrT �build_policy_protocol_rulesrQ � build_policy_source_ports_rulesr r� r� r� r �valuer r r Z build_policy_tcp_mss_clamp_rulesr r� r � build_policy_masquerade_rulesr Zto_portZ to_addressr$ � build_policy_forward_port_rulesr ZINVALID_ICMPTYPE� build_policy_icmp_block_rulesZ*build_policy_rich_source_destination_rules) r" rj r? r� rl rM �svc�includeZ_ruler` Z source_ipvrB Z destinationsr! rN r� r� r� r� r� � nat_moduler� �protorC r� r r" r# r$ )rP r" r% r� 2 sJ � � � � � � � � � � � � � � ��� �� ��z FirewallPolicy._rule_preparec C s> | j j�|�}| �|j|�}|| �|j�7 }tt|�dd� d�}|d u rN|g}|j D ]6}||v rbqT| � |� |� |� | j |||||d� qTg } dD ]f} | j � | �s�q�| j �| �} t|j�dkr�| |jv r�| � | |j| f� q�| d f| vr�| � | d f� q�| D �]6\} } |D ]�} | j}t|�}| j�dd�}|�|� | jd k�rV| �| j��sV�qt| j�d k �rr|�|� n6| jD ].\}}| �||||| | j|�}|�| |� �qx�q|jD ](\}}| �||||| �}|�| |� �q�|j D ]"}| � |||| �}|�| |� �q�|j D ](\}}| � ||||| �}|�| |� �q �q d S ) Nc S s | j S r rT r� r$ r$ r% r� � r� z)FirewallPolicy._service.<locals>.<lambda>rU rL rQ r rV rW r� rV ) r r� rZ r� r� r� r� r/ r; r[ r� r4 rb rR rS r� rN r� r rc Z add_moduler] ra rN rd rB r? re rT rf rQ rg )r" rj r? r� rl rM rl r� rm Z backends_ipvr! rB rN r� r� r� rn r� ro rC r� r$ r$ r% rb � sj � � � �zFirewallPolicy._servicec C s8 | j �� D ](}|jsq |�||||�}|�||� q d S r )r r= r> re r? �r" rj r? r� r� rl rB rC r$ r$ r% rc : s �zFirewallPolicy._portc C s6 | j �� D ]&}|jsq |�|||�}|�||� q d S r )r r= r> rf r? )r" rj r? r� rl rB rC r$ r$ r% rd C s zFirewallPolicy._protocolc C s8 | j �� D ](}|jsq |�||||�}|�||� q d S r )r r= r> rg r? rp r$ r$ r% re K s zFirewallPolicy._source_portc C s8 d}|� t|� | j�|�}|�||�}|�||� d S )Nr� )r� r r rS ri r? )r" rj r? rl r! rB rC r$ r$ r% rf S s zFirewallPolicy._masqueradec C sX t d|�rd}nd}|r(|r(|�t|� | j�|�} | �||||||�} |�| | � d S )Nr� r� )r r� r r rS rj r? ) r" rj r? rl r� r� r" r# r! rB rC r$ r$ r% ra [ s �z FirewallPolicy._forward_portc C sz | j j�|�}| j �� D ]\}|js$qd}|jrTdD ] }||jv r2|�|�s2d} qTq2|rZq|�|||�} |�|| � qd S )NFrQ T) r r^ r_ r= r> rN ra rk r? ) r" rj r? r, rl rP rB Z skip_backendr! rC r$ r$ r% r` j s zFirewallPolicy._icmp_blockc C sb | j | j}|dv rd S | �|�s.|dkr.d S | j�� D ]$}|jsDq8|�||�}|�||� q8d S )N)ZDROPz %%REJECT%%ZREJECTZACCEPT)r! �targetr; r r= r> Z'build_policy_icmp_block_inversion_rulesr? )r" rj r? rl rq rB rC r$ r$ r% r4 s z$FirewallPolicy._icmp_block_inversionc C s& t | j�}| �|||� |�d� d S r )r r r\ ri )r" rj r? rl r$ r$ r% �!_ingress_egress_zones_transaction� s z0FirewallPolicy._ingress_egress_zones_transactionc C s | j | }|j}|j}t� }t� }t� } t� } |D ]:} | dv r@q2|t| jj�| ��O }| t| jj�| ��O } q2|D ]:} | dv r�qr|t| jj�| ��O }| t| jj�| ��O } qr| j�� D ]D} | j s�q�| � |�D ],\} }| � ||| |||| | �}|� | |� q�q�d S )N)r: r9 ) r! r< r> r; r r= Zlist_interfacesZ list_sourcesr= r> rY Z!build_policy_ingress_egress_rulesr? )r" rj r? rl rC r< r> Zingress_interfacesZegress_interfacesZingress_sourcesZegress_sourcesr= rB rm rn rC r$ r$ r% r\ � s4 �z$FirewallPolicy._ingress_egress_zonesc C s | j | }d|jv r<d|jv r<g d�}| jjs8|�d� |S d|jv rbdg}| jjs^|�d� |S d|jv rtddgS d|jv r�d|jv r�g d�}| jjs�|�d� |S d|jv �rg d �}| jjs�|�d� | jjd kr�|�d � n,|jD ]}| jj�|�j r� �qq�|�d � |S d|jv �rzd d g}| jj�s<|�d� |jD ] }| jj�|�j �rB �qv�qB|�d � |�d� |S d g}| jj�s�|�d� | jjd k�r�|�d � n0|jD ] }| jj�|�j �r� �qސq�|�d � |jD ] }| jj�|�j �r� �q�q�|�d � |�d� |S dS )z:Create a list of (table, chain) needed for policy dispatchr: r9 )�r� ZINPUT�rW � PREROUTING��mangleru ��rawru rs )r� �OUTPUT)rW rz )�r� ZFORWARDrt �rW Z POSTROUTINGrv �r{ rt rv Znftablesr| r{ rt rv N) r! r< r> r �nftables_enabledr4 Z_firewall_backendr= Zget_zoneZ interfaces)r" r? rC �tcr= r$ r$ r% rY � sl z4FirewallPolicy._get_table_chains_for_policy_dispatchc C sf | j | }d|jv r0dg}| jjs,|�d� |S d|jv rBg d�S d|jv rRdgS ttjd| ��dS ) z8Create a list of (table, chain) needed for zone dispatchr9 rs rx r: r} r| zInvalid policy: %sN) r! r> r r~ r4 r< r r �INVALID_POLICY)r" r? rC r r$ r$ r% rZ s z2FirewallPolicy._get_table_chains_for_zone_dispatchFc C s� | j j�|�}|jr |j}n|| }d|jv rh|dkr>d| S |dkrNd| S |jsd|dv rdd| S �nd|jv r�|js�|dv r�d| S n�d |jv r�|dkr�d | S |d kr�|r�d | S d| S n|d v r�d| S n�d |jv �r.|dkr�d | S |d k�r|�rd | S d| S n|d v �r||j�s|d| S nN|j�s||dk�rHd | S |d k�rj|�r`d | S d| S n|d v �r|d| S ttjd|||f ��d S )Nr9 r� ZIN_ry ZPRE_)rw rW )r� rW ZOUT_r: ZFWD_rW ZPOST_)rw ry z.Can't convert policy to chain name: %s, %s, %s) r r? r2 r3 r> r< r r r� )r" r? rm Z policy_prefixZisSNATrC �suffixr$ r$ r% �policy_base_chain_name! sZ z%FirewallPolicy.policy_base_chain_name)N)N)N)N)r NNT)N)r NNT)N)r NN)N)r NN)N)r NN)N)r NN)N)r NN)N)r NN)N)NN)NN)NNr NN)NNN)NN)r NN)N)NN)N)N)N)NN)F)��__name__� __module__� __qualname__r& r) r+ r. r1 r8 r@ r2 rD rG rK rL rq rJ rF ru r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� rg ry r� r| r� r� r� r� r� r r� r� r� r� r� r� r� r� r� r� r� r� r� r r r r r r� r r� r r r r r� r r� r r r r� r r� r r r$ r% r� r& r� r' r) r* r- r. r� r/ r� r0 r2 r3 r7 r5 r6 r: r9 r; r[ r@ r� rK rJ r� r� r� rb rc rd re rf ra r` r4 rr r\ rY rZ r� r$ r$ r$ r% r s> F 5 � & # � & # � � � � � (� ) � � � (� ) � � � � � � ' ' I @ � Vr )%r� Zfirewall.core.loggerr Zfirewall.functionsr r r r r r r r r r r r~ r r r r r r r r r r r Z firewall.core.fw_transactionr Zfirewallr Zfirewall.errorsr Zfirewall.core.baser �objectr r$ r$ r$ r% �<module> s 44 core/__pycache__/modules.cpython-39.opt-1.pyc 0000644 00000005545 15025011705 0014751 0 ustar 00 a ���g� � @ sB d Z dgZddlmZ ddlmZ ddlmZ G dd� de�Z dS )zmodules backend�modules� )�runProg)�log)�COMMANDSc @ sL e Zd Zdd� Zdd� Zdd� Zdd� Zd d � Zd d � Zd d� Z dd� Z dS )r c C s t d | _t d | _d S )NZmodprobeZrmmod)r � _load_command�_unload_command��self� r �9/usr/lib/python3.9/site-packages/firewall/core/modules.py�__init__ s zmodules.__init__c C s d| j S )Nz%s)� __class__r r r r �__repr__$ s zmodules.__repr__c C s� g }i }z�t dd��x}|D ]b}|s& q~|�� }|�� }|�|d � |d dkrp|d �d�dd� ||d < qg ||d < qW d � n1 s�0 Y W n ty� Y n0 ||fS ) z6 get all loaded kernel modules and their dependencies z /proc/modules�rr � �-�,N���)�open�strip�split�append�FileNotFoundError)r �mods�deps�f�lineZsplitsr r r �loaded_modules' s 0 zmodules.loaded_modulesc C s" t �d| j| j|� t| j|g�S �Nz %s: %s %s)r �debug2r r r �r �moduler r r � load_module< s zmodules.load_modulec C s" t �d| j| j|� t| j|g�S r )r r r r r r r r r � unload_module@ s zmodules.unload_modulec C sP ||vr dS || D ]$}| � |||� ||vr|�|� q||vrL|�|� dS )z get all dependants of a module N)�get_depsr )r r! r �ret�modr r r r$ D s zmodules.get_depsc C s� g }| � � \}}| �d||� dD ]"}||v r"|�|� |�d|� q"|D ]V}|dv s�|�d�s�|�d�s�|�d�s�|�d�s�|�d �s�|�d �rJ| �|||� qJ|S ) z) get all loaded firewall-related modules Z nf_conntrack)Znf_conntrack_ipv4Znf_conntrack_ipv6r )Z ip_tablesZ ip6_tablesZebtablesZiptable_Z ip6table_Znf_Zxt_Zipt_Zip6t_)r r$ �remove�insert� startswith)r r Zmods2r Zbad_bad_moduler& r r r �get_firewall_modulesO s. ������z modules.get_firewall_modulesc C s: | � � D ],}| �|�\}}|dkrt�d||f � qdS )z% unload all firewall-related modules r z Failed to unload module '%s': %sN)r* r# r Zdebug1)r r! �statusr% r r r �unload_firewall_modulesd s z modules.unload_firewall_modulesN) �__name__� __module__� __qualname__r r r r" r# r$ r* r, r r r r r s N) �__doc__�__all__Zfirewall.core.progr Zfirewall.core.loggerr Zfirewall.configr �objectr r r r r �<module> s core/__pycache__/fw_config.cpython-39.opt-1.pyc 0000644 00000101463 15025011705 0015236 0 ustar 00 a ���g�� � @ s� d gZ ddlZddlZddlZddlZddlmZmZ ddlm Z ddl m Z ddl m Z ddlmZmZmZ ddlmZmZmZ dd lmZmZmZ dd lmZm Z m Z dd l m Z m Z m!Z! dd l"m#Z#m$Z$m%Z% dd lm&Z& ddl'm(Z( G dd � d e)�Z*dS )�FirewallConfig� N)�Dict�List)�config)�log)� IO_Object)�IcmpType�icmptype_reader�icmptype_writer)�Service�service_reader�service_writer)�Zone� zone_reader� zone_writer)�IPSet� ipset_reader� ipset_writer)�Helper� helper_reader� helper_writer)�Policy� policy_reader� policy_writer)�errors)� FirewallErrorc @ sR e Zd Zdd� Zdd� Zdd� Zdd� Zd d � Zi fee e e f d �d d �Z dd� Z dd� Zdd� Zdd� Zdd� Zdd� Zdd� Zd d � Zd d � Zd d!� Zd"d#� Zd$d%� Zd&d'� Zd(d)� Zd*d+� Zd,d-� Z d.d/� Z d0d1� Z d2d3� Z d4d5� Z d6d7� Z!d8d9� Z"d:d;� Z#d<d=� Z$d>d?� Z%d@dA� Z&dBdC� Z'dDdE� Z(dFdG� Z)dHdI� Z*dJdK� Z+dLdM� Z,dNdO� Z-dPdQ� Z.dRdS� Z/dTdU� Z0dVdW� Z1dXdY� Z2dZd[� Z3d\d]� Z4d^d_� Z5d`da� Z6dbdc� Z7ddde� Z8dfdg� Z9dhdi� Z:djdk� Z;dldm� Z<dndo� Z=dpdq� Z>drds� Z?dtdu� Z@dvdw� ZAdxdy� ZBdzd{� ZCd|d}� ZDd~d� ZEd�d�� ZFd�d�� ZGd�d�� ZHd�d�� ZId�d�� ZJd�d�� ZKd�d�� ZLd�d�� ZMd�d�� ZNd�d�� ZOd�d�� ZPd�d�� ZQd�d�� ZRd�d�� ZSd�d�� ZTd�d�� ZUd�d�� ZVd�d�� ZWd�d�� ZXd�d�� ZYd�d�� ZZd�d�� Z[d�d�� Z\d�d�� Z]d�d�� Z^d�d�� Z_d�d�� Z`d�d�� Zad�d�� Zbd�d�� Zcd�d�� Zdd�d�� Zed�d�� Zfd�dÄ Zgd�dń Zhd�dDŽ Zid�dɄ Zjd�d˄ Zkd�d̈́ Zld�S )�r c C s || _ | �� d S �N)�_fw�_FirewallConfig__init_vars)�self�fw� r! �;/usr/lib/python3.9/site-packages/firewall/core/fw_config.py�__init__* s zFirewallConfig.__init__c C sH d| j | j| j| j| j| j| j| j| j| j | j | j | j | j | j| jf S )Nz>%s(%r, %r, %r, %r, %r, %r, %r, %r, %r, %r, %r, %r, %r, %r, %r))� __class__�_ipsets� _icmptypes� _services�_zones�_helpersZpolicy_objects�_builtin_ipsets�_builtin_icmptypes�_builtin_services�_builtin_zones�_builtin_helpers�_builtin_policy_objects�_firewalld_conf� _policies�_direct�r r! r! r" �__repr__. s ��zFirewallConfig.__repr__c C s^ i | _ i | _i | _i | _i | _i | _i | _i | _i | _i | _ i | _ i | _ d | _ d | _ d | _d S r )r% r& r' r( r) �_policy_objectsr* r+ r, r- r. r/ r0 r1 r2 r3 r! r! r" Z __init_vars8 s zFirewallConfig.__init_varsc C s t | j�� �D ]}| j| �� | j|= qt | j�� �D ]}| j| �� | j|= q8t | j�� �D ]}| j| �� | j|= qbt | j�� �D ]}| j| �� | j|= q�t | j�� �D ]}| j| �� | j|= q�t | j�� �D ]}| j| �� | j|= q�t | j �� �D ] }| j | �� | j |= �q t | j �� �D ] }| j | �� | j |= �q6t | j �� �D ] }| j | �� | j |= �qbt | j �� �D ] }| j | �� | j |= �q�| j �r�| j �� | ` d | _ | j�r�| j�� | `d | _| j�r | j�� | `d | _| �� d S r )�listr* �keys�cleanupr% r+ r& r, r' r- r( r. r) r0 r1 r2 r )r �xr! r! r" r8 I sV zFirewallConfig.cleanupc s� i }� fdd�� � � D �|d< � fdd�� �� D �|d< � fdd�� �� D �|d< � fdd�� �� D �|d < � fd d�� �� D �|d < � fd d�� �� D �|d < i |d< � j�d�|d d< |S )zJ Returns a dict of dicts of all permanent config objects. c s i | ]}|� � |��qS r! )� get_ipset)�.0Zipsetr3 r! r" � <dictcomp>� � z:FirewallConfig.get_all_io_objects_dict.<locals>.<dictcomp>�ipsetsc s i | ]}|� � |��qS r! )� get_helper)r; �helperr3 r! r" r< � r= �helpersc s i | ]}|� � |��qS r! )� get_icmptype)r; Zicmptyper3 r! r" r< � r= � icmptypesc s i | ]}|� � |��qS r! )� get_service)r; Zservicer3 r! r" r< � r= �servicesc s i | ]}|� � |��qS r! )�get_zone)r; �zoner3 r! r" r< � r= �zonesc s i | ]}|� � |��qS r! )�get_policy_object)r; Zpolicyr3 r! r" r< � r= �policies�confZFirewallBackend)� get_ipsets� get_helpers� get_icmptypes� get_services� get_zones�get_policy_objectsr0 �get)r � conf_dictr! r3 r" �get_all_io_objects_dict~ s z&FirewallConfig.get_all_io_objects_dict)�extra_io_objectsc C sn | � � }|D ] }|| D ]}||| |j< qq g d�}|D ].}|| }|�� D ]\}} | �| �� |� qNq:d S )N)r> rA rC rE rH rJ )rT �name�itemsZcheck_config_dict�export_config_dict) r rU Zall_io_objectsZtype_key�obj�orderZ io_obj_typeZio_objsrV Zio_objr! r! r" �full_check_config� s z FirewallConfig.full_check_configc C s | j j�� S r )r rJ Zquery_lockdownr3 r! r! r" �lockdown_enabled� s z FirewallConfig.lockdown_enabledc C s | j j�||�S r )r rJ � access_check)r �key�valuer! r! r" r] � s zFirewallConfig.access_checkc C s || _ d S r �r0 )r rK r! r! r" �set_firewalld_conf� s z!FirewallConfig.set_firewalld_confc C s | j S r r` r3 r! r! r" �get_firewalld_conf� s z!FirewallConfig.get_firewalld_confc C s( t j�tj�s| j�� n | j�� d S r )�os�path�existsr ZFIREWALLD_CONFr0 �clear�readr3 r! r! r" �update_firewalld_conf� s z$FirewallConfig.update_firewalld_confc C s� | j | j| j| j| j| jg}|D ]�}t�|�}|D ]v}|| }tj� |j|j �}zt � |d| � W n< t y� } z$t�d||� t�|� W Y d }~n d }~0 0 ||= q2q | j�� | j�� d S )N�%s.old� Backup of file '%s' failed: %s)r( r5 r% r' r) r& �copyrc rd �join�filename�shutil�move� Exceptionr �error�remover0 � set_defaults�write)r rZ Z io_obj_dictZ dict_copyZobj_namerY rV �msgr! r! r" �reset_defaults� s � z FirewallConfig.reset_defaultsc C s || _ d S r �r1 )r rJ r! r! r" � set_policies� s zFirewallConfig.set_policiesc C s | j S r rw r3 r! r! r" � get_policies� s zFirewallConfig.get_policiesc C s, t j�tj�s | jj�� n | jj�� d S r ) rc rd re r ZLOCKDOWN_WHITELISTr1 Zlockdown_whitelistr8 rg r3 r! r! r" �update_lockdown_whitelist� s z(FirewallConfig.update_lockdown_whitelistc C s || _ d S r �r2 )r Zdirectr! r! r" � set_direct� s zFirewallConfig.set_directc C s | j S r r{ r3 r! r! r" � get_direct� s zFirewallConfig.get_directc C s( t j�tj�s| j�� n | j�� d S r )rc rd re r ZFIREWALLD_DIRECTr2 r8 rg r3 r! r! r" � update_direct� s z FirewallConfig.update_directc C s$ t tt| j�� �t| j�� � ��S r )�sorted�setr6 r% r7 r* r3 r! r! r" rL � s �zFirewallConfig.get_ipsetsc C s$ |j r|| j|j< n || j|j< d S r )�builtinr* rV r% �r rY r! r! r" � add_ipset� s zFirewallConfig.add_ipsetc C s8 || j v r| j | S || jv r(| j| S ttj|��d S r )r% r* r r � INVALID_IPSET�r rV r! r! r" r: � s zFirewallConfig.get_ipsetc C st |j | jvr ttj|j ��nB| j|j |kr@ttjd|j ��n |j | jvr^ttjd|j ��| �|� | j|j S )Nzself._ipsets[%s] != objz'%s' not a built-in ipset)rV r% r r � NO_DEFAULTSr* � _remove_ipsetr� r! r! r" �load_ipset_defaults� s � � z"FirewallConfig.load_ipset_defaultsc C s |� � S r �� export_configr� r! r! r" �get_ipset_config s z FirewallConfig.get_ipset_configc C sf t � |�}|jr0tj|_d|_|j|jkr0d|_|�|| �� � | �d|gi� | � |� t |� |S )NFr> ) rk r� r �ETC_FIREWALLD_IPSETSrd �default� import_configrT r[ r� r �r rY rK r9 r! r! r" �set_ipset_config s z FirewallConfig.set_ipset_configc C s� || j v s|| jv r$ttjd| ��t� }|�|� ||_d| |_t j |_ d|_ d|_ |�|| �� � | �d|gi� | �|� t|� |S )Nznew_ipset(): '%s'�%s.xmlFTr> )r% r* r r � NAME_CONFLICTr � check_namerV rm r r� rd r� r� r� rT r[ r� r �r rV rK r9 r! r! r" � new_ipset s � zFirewallConfig.new_ipsetc C s� t j�|�}t j�|�}t j�|�s�|tjkr�| j�� D ]L}| j| }|j |kr8| j|= |j | j v rxd| j |j f S d|f S q8nJ| j �� D ]>}| j | }|j |kr�| j |= |j | jvr�d|f S dS q�dS t � d|� zt||�}W n6 t�y& } z t �d||� W Y d }~dS d }~0 0 |j | j v�rV|j | jv�rV| �|� d|fS |tjk�r�|j | jv �r�| j|j j|_|| j|j < d|fS |j | j v �r�| j |j = || j |j < |j | jv�r�d|fS dS dS )N�updaterr �NNzLoading ipset file '%s'z"Failed to load ipset file '%s': %s�new)rc rd �basename�dirnamere r r� r% r7 rm rV r* r �debug1r rp rq r� r� �r rV rm rd r9 rY ru r! r! r" �update_ipset_from_path' sP z%FirewallConfig.update_ipset_from_pathc C s� |j | jvrttj|j ��|jtjkr>ttjd|jtjf ��d|j|j f }zt � |d| � W n< t y� } z$t � d||� t�|� W Y d }~n d }~0 0 | j|j = d S �Nz '%s' != '%s'� %s/%s.xmlri rj )rV r% r r r� rd r r� �INVALID_DIRECTORYrn ro rp r rq rc rr �r rY rV ru r! r! r" r� l s �� z FirewallConfig._remove_ipsetc C s" |j s |js ttjd|j ��d S )Nz'%s' is built-in ipset)r� r� r r Z BUILTIN_IPSETrV r� r! r! r" �check_builtin_ipset} s �z"FirewallConfig.check_builtin_ipsetc C s | � |� | �|� d S r )r� r� r� r! r! r" � remove_ipset� s zFirewallConfig.remove_ipsetc C s$ | � |� | �||�}| �|� |S r )r� � _copy_ipsetr� )r rY rV r� r! r! r" � rename_ipset� s zFirewallConfig.rename_ipsetc C s | � ||�� �S r )r� r� �r rY rV r! r! r" r� � s zFirewallConfig._copy_ipsetc C s$ t tt| j�� �t| j�� � ��S r )r r� r6 r& r7 r+ r3 r! r! r" rN � s �z FirewallConfig.get_icmptypesc C s$ |j r|| j|j< n || j|j< d S r )r� r+ rV r& r� r! r! r" � add_icmptype� s zFirewallConfig.add_icmptypec C s8 || j v r| j | S || jv r(| j| S ttj|��d S r )r& r+ r r �INVALID_ICMPTYPEr� r! r! r" rB � s zFirewallConfig.get_icmptypec C st |j | jvr ttj|j ��nB| j|j |kr@ttjd|j ��n |j | jvr^ttjd|j ��| �|� | j|j S )Nzself._icmptypes[%s] != objz '%s' not a built-in icmptype)rV r& r r r� r+ �_remove_icmptyper� r! r! r" �load_icmptype_defaults� s � � z%FirewallConfig.load_icmptype_defaultsc C s |� � S r r� r� r! r! r" �get_icmptype_config� s z"FirewallConfig.get_icmptype_configc C sf t � |�}|jr0tj|_d|_|j|jkr0d|_|�|| �� � | �d|gi� | � |� t |� |S )NFrC ) rk r� r �ETC_FIREWALLD_ICMPTYPESrd r� r� rT r[ r� r r� r! r! r" �set_icmptype_config� s z"FirewallConfig.set_icmptype_configc C s� || j v s|| jv r$ttjd| ��t� }|�|� ||_d| |_t j |_ d|_ d|_ |�|| �� � | �d|gi� | �|� t|� |S )Nznew_icmptype(): '%s'r� FTrC )r& r+ r r r� r r� rV rm r r� rd r� r� r� rT r[ r� r r� r! r! r" � new_icmptype� s � zFirewallConfig.new_icmptypec C s� t j�|�}t j�|�}t j�|�s�|tjkr�| j�� D ]L}| j| }|j |kr8| j|= |j | j v rxd| j |j f S d|f S q8nJ| j �� D ]>}| j | }|j |kr�| j |= |j | jvr�d|f S dS q�dS t � d|� zt||�}W n6 t�y& } z t �d||� W Y d }~dS d }~0 0 |j | j v�rV|j | jv�rV| �|� d|fS |tjk�r�|j | jv �r�| j|j j|_|| j|j < d|fS |j | j v �r�| j |j = || j |j < |j | jv�r�d|fS dS dS )Nr� rr r� zLoading icmptype file '%s'z%Failed to load icmptype file '%s': %sr� )rc rd r� r� re r r� r& r7 rm rV r+ r r� r rp rq r� r� r� r! r! r" �update_icmptype_from_path� sP z(FirewallConfig.update_icmptype_from_pathc C s� |j | jvrttj|j ��|jtjkr>ttjd|jtjf ��d|j|j f }zt � |d| � W n< t y� } z$t � d||� t�|� W Y d }~n d }~0 0 | j|j = d S r� )rV r& r r r� rd r r� r� rn ro rp r rq rc rr r� r! r! r" r� s �� z FirewallConfig._remove_icmptypec C s" |j s |js ttjd|j ��d S )Nz'%s' is built-in icmp type)r� r� r r ZBUILTIN_ICMPTYPErV r� r! r! r" �check_builtin_icmptype) s �z%FirewallConfig.check_builtin_icmptypec C s | � |� | �|� d S r )r� r� r� r! r! r" �remove_icmptype. s z FirewallConfig.remove_icmptypec C s$ | � |� | �||�}| �|� |S r )r� �_copy_icmptyper� )r rY rV r� r! r! r" �rename_icmptype2 s z FirewallConfig.rename_icmptypec C s | � ||�� �S r )r� r� r� r! r! r" r� 8 s z FirewallConfig._copy_icmptypec C s$ t tt| j�� �t| j�� � ��S r )r r� r6 r' r7 r, r3 r! r! r" rO = s �zFirewallConfig.get_servicesc C s$ |j r|| j|j< n || j|j< d S r )r� r, rV r' r� r! r! r" � add_serviceA s zFirewallConfig.add_servicec C s< || j v r| j | S || jv r(| j| S ttjd| ��d S )Nzget_service(): '%s')r' r, r r �INVALID_SERVICEr� r! r! r" rD G s zFirewallConfig.get_servicec C st |j | jvr ttj|j ��nB| j|j |kr@ttjd|j ��n |j | jvr^ttjd|j ��| �|� | j|j S )Nzself._services[%s] != objz'%s' not a built-in service)rV r' r r r� r, �_remove_servicer� r! r! r" �load_service_defaultsN s � � z$FirewallConfig.load_service_defaultsc C sn |� � }g }td�D ]P}|j| d |vrL|�t�t||j| d ��� q|�||j| d � qt|�S )N� r �rX �range�IMPORT_EXPORT_STRUCTURE�appendrk �deepcopy�getattr�tuple�r rY rS Z conf_list�ir! r! r" �get_service_configZ s "z!FirewallConfig.get_service_configc C s |� � S r �rX r� r! r! r" �get_service_config_dictf s z&FirewallConfig.get_service_config_dictc C s4 i }t |�D ]\}}|||j| d < q | �||�S �Nr )� enumerater� �set_service_config_dict�r rY rK rS r� r_ r! r! r" �set_service_configi s z!FirewallConfig.set_service_configc C sf t � |�}|jr0tj|_d|_|j|jkr0d|_|�|| �� � | �d|gi� | � |� t |� |S )NFrE ) rk r� r �ETC_FIREWALLD_SERVICESrd r� �import_config_dictrT r[ r� r r� r! r! r" r� p s z&FirewallConfig.set_service_config_dictc C sX || j v s|| jv r$ttjd| ��i }t|�D ]\}}||tj| d < q0| �||�S )N�new_service(): '%s'r ) r' r, r r r� r� r r� �new_service_dict�r rV rK rS r� r_ r! r! r" � new_service~ s �zFirewallConfig.new_servicec C s� || j v s|| jv r$ttjd| ��t� }|�|� ||_d| |_t j |_ d|_ d|_ |�|| �� � | �d|gi� | �|� t|� |S )Nr� r� FTrE )r' r, r r r� r r� rV rm r r� rd r� r� r� rT r[ r� r r� r! r! r" r� � s � z FirewallConfig.new_service_dictc C s� t j�|�}t j�|�}t j�|�s�|tjkr�| j�� D ]L}| j| }|j |kr8| j|= |j | j v rxd| j |j f S d|f S q8nJ| j �� D ]>}| j | }|j |kr�| j |= |j | jvr�d|f S dS q�dS t � d|� zt||�}W n6 t�y& } z t �d||� W Y d }~dS d }~0 0 |j | j v�rV|j | jv�rV| �|� d|fS |tjk�r�|j | jv �r�| j|j j|_|| j|j < d|fS |j | j v �r�| j |j = || j |j < |j | jv�r�d|fS dS dS )Nr� rr r� zLoading service file '%s'z$Failed to load service file '%s': %sr� )rc rd r� r� re r r� r' r7 rm rV r, r r� r rp rq r� r� r� r! r! r" �update_service_from_path� sP z'FirewallConfig.update_service_from_pathc C s� |j | jvrttj|j ��|jtjkr>ttjd|jtjf ��d|j|j f }zt � |d| � W n< t y� } z$t � d||� t�|� W Y d }~n d }~0 0 | j|j = d S r� )rV r' r r r� rd r r� r� rn ro rp r rq rc rr r� r! r! r" r� � s �� z FirewallConfig._remove_servicec C s" |j s |js ttjd|j ��d S )Nz'%s' is built-in service)r� r� r r ZBUILTIN_SERVICErV r� r! r! r" �check_builtin_service� s �z$FirewallConfig.check_builtin_servicec C s | � |� | �|� d S r )r� r� r� r! r! r" �remove_service� s z FirewallConfig.remove_servicec C s$ | � |� | �||�}| �|� |S r )r� � _copy_servicer� )r rY rV r� r! r! r" �rename_service� s z FirewallConfig.rename_servicec C s | � ||�� �S r )r� rX r� r! r! r" r� s z FirewallConfig._copy_servicec C s$ t tt| j�� �t| j�� � ��S r )r r� r6 r( r7 r- r3 r! r! r" rP s �zFirewallConfig.get_zonesc C s$ |j r|| j|j< n || j|j< d S r )r� r- rV r( r� r! r! r" �add_zone s zFirewallConfig.add_zonec C s( || j v r| j |= || jv r$| j|= d S r )r- r( r� r! r! r" � forget_zone s zFirewallConfig.forget_zonec C s< || j v r| j | S || jv r(| j| S ttjd| ��d S )Nzget_zone(): %s)r( r- r r � INVALID_ZONEr� r! r! r" rF s zFirewallConfig.get_zonec C st |j | jvr ttj|j ��nB| j|j |kr@ttjd|j ��n |j | jvr^ttjd|j ��| �|� | j|j S )Nzself._zones[%s] != objz'%s' not a built-in zone)rV r( r r r� r- � _remove_zoner� r! r! r" �load_zone_defaults s � � z!FirewallConfig.load_zone_defaultsc C sn |� � }g }td�D ]P}|j| d |vrL|�t�t||j| d ��� q|�||j| d � qt|�S )N� r r� r� r! r! r" �get_zone_config* s "z FirewallConfig.get_zone_configc C s |� � S r r� r� r! r! r" �get_zone_config_dict6 s z#FirewallConfig.get_zone_config_dictc C s4 i }t |�D ]\}}|||j| d < q | �||�S r� )r� r� �set_zone_config_dictr� r! r! r" �set_zone_config9 s z FirewallConfig.set_zone_configc C sf t � |�}|jr0tj|_d|_|j|jkr0d|_|�|| �� � | �d|gi� | � |� t |� |S )NFrH ) rk r� r �ETC_FIREWALLD_ZONESrd r� r� rT r[ r� r r� r! r! r" r� @ s z#FirewallConfig.set_zone_config_dictc C sX || j v s|| jv r$ttjd| ��i }t|�D ]\}}||tj| d < q0| �||�S )N�new_zone(): '%s'r ) r( r- r r r� r� r r� � new_zone_dictr� r! r! r" �new_zoneN s zFirewallConfig.new_zonec C s� || j v s|| jv r$ttjd| ��t� }|�|� ||_d| |_t j |_ d|_ d|_ |�|| �� � | �d|gi� | �|� t|� |S )Nr� r� FTrH )r( r- r r r� r r� rV rm r r� rd r� r� r� rT r[ r� r r� r! r! r" r� X s z FirewallConfig.new_zone_dictc C s" t j�|�}t j�|�}t j�|�s�|�tj�r�| j� � D ]L}| j| }|j |kr:| j|= |j | j v rzd| j |j f S d|f S q:nJ| j � � D ]>}| j | }|j |kr�| j |= |j | jvr�d|f S dS q�dS t �d|� zt||�}W n6 t�y( } z t �d||� W Y d }~dS d }~0 0 |�tj��rrt|�ttj�k�rrdt j�|�t j�|�dd� f |_ |j | j v�r�|j | jv�r�| �|� d |fS |�tj��r�|j | jv �r�| j|j j|_|| j|j < d|fS |j | j v �r | j |j = || j |j < |j | jv�rd|fS dS dS ) Nr� rr r� zLoading zone file '%s'z!Failed to load zone file '%s': %s�%s/%sr ���r� )rc rd r� r� re � startswithr r� r( r7 rm rV r- r r� r rp rq �lenr� r� r� r! r! r" �update_zone_from_pathk s\ � � z$FirewallConfig.update_zone_from_pathc C s� |j | jvrttj|j ��|j�tj�s@ttj d|jtjf ��d|j|j f }zt � |d| � W n< t y� } z$t �d||� t�|� W Y d }~n d }~0 0 | j|j = d S �Nz '%s' doesn't start with '%s'r� ri rj )rV r( r r r� rd r� r r� r� rn ro rp r rq rc rr r� r! r! r" r� � s �� zFirewallConfig._remove_zonec C s" |j s |js ttjd|j ��d S )Nz'%s' is built-in zone)r� r� r r Z BUILTIN_ZONErV r� r! r! r" �check_builtin_zone� s �z!FirewallConfig.check_builtin_zonec C s | � |� | �|� d S r )r� r� r� r! r! r" � remove_zone� s zFirewallConfig.remove_zonec C sN | � |� |�� }| �|� z| �||�}W n | �|j|� � Y n0 |S r )r� rX r� r� rV )r rY rV Zobj_confr� r! r! r" � rename_zone� s zFirewallConfig.rename_zonec C s$ t tt| j�� �t| j�� � ��S r )r r� r6 r5 r7 r/ r3 r! r! r" rQ � s �z!FirewallConfig.get_policy_objectsc C s$ |j r|| j|j< n || j|j< d S r )r� r/ rV r5 r� r! r! r" �add_policy_object� s z FirewallConfig.add_policy_objectc C s< || j v r| j | S || jv r(| j| S ttjd| ��d S )Nzget_policy_object(): %s)r5 r/ r r �INVALID_POLICYr� r! r! r" rI � s z FirewallConfig.get_policy_objectc C st |j | jvr ttj|j ��nB| j|j |kr@ttjd|j ��n |j | jvr^ttjd|j ��| �|� | j|j S )Nz self._policy_objects[%s] != objz'%s' not a built-in policy)rV r5 r r r� r/ �_remove_policy_objectr� r! r! r" �load_policy_object_defaults� s � � z*FirewallConfig.load_policy_object_defaultsc C s |� � S r r� r� r! r! r" � get_policy_object_config_dict� s z,FirewallConfig.get_policy_object_config_dictc C sf t � |�}|jr0tj|_d|_|j|jkr0d|_|�|| �� � | �d|gi� | � |� t |� |S )NFrJ ) rk r� r �ETC_FIREWALLD_POLICIESrd r� r� rT r[ r� r r� r! r! r" � set_policy_object_config_dict� s z,FirewallConfig.set_policy_object_config_dictc C s� || j v s|| jv r$ttjd| ��t� }|�|� ||_d| |_t j |_ d|_ d|_ |�|| �� � | �d|gi� | �|� t|� |S )Nznew_policy_object(): '%s'r� FTrJ )r5 r/ r r r� r r� rV rm r r� rd r� r� r� rT r[ r� r r� r! r! r" �new_policy_object_dict s z%FirewallConfig.new_policy_object_dictc C s" t j�|�}t j�|�}t j�|�s�|�tj�r�| j� � D ]L}| j| }|j |kr:| j|= |j | j v rzd| j |j f S d|f S q:nJ| j � � D ]>}| j | }|j |kr�| j |= |j | jvr�d|f S dS q�dS t �d|� zt||�}W n6 t�y( } z t �d||� W Y d }~dS d }~0 0 |�tj��rrt|�ttj�k�rrdt j�|�t j�|�dd� f |_ |j | j v�r�|j | jv�r�| �|� d |fS |�tj��r�|j | jv �r�| j|j j|_|| j|j < d|fS |j | j v �r | j |j = || j |j < |j | jv�rd|fS dS dS ) Nr� rr r� zLoading policy file '%s'z#Failed to load policy file '%s': %sr� r r� r� )rc rd r� r� re r� r r� r5 r7 rm rV r/ r r� r rp rq r� r� r� r� r! r! r" � update_policy_object_from_path s\ � � z-FirewallConfig.update_policy_object_from_pathc C s� |j | jvrttj|j ��|j�tj�s@ttj d|jtjf ��d|j|j f }zt � |d| � W n< t y� } z$t �d||� t�|� W Y d }~n d }~0 0 | j|j = d S r� )rV r5 r r r� rd r� r r� r� rn ro rp r rq rc rr r� r! r! r" r� j s �� z$FirewallConfig._remove_policy_objectc C s" |j s |js ttjd|j ��d S )Nz'%s' is built-in policy)r� r� r r ZBUILTIN_POLICYrV r� r! r! r" �check_builtin_policy_object{ s �z*FirewallConfig.check_builtin_policy_objectc C s | � |� | �|� d S r )r� r� r� r! r! r" �remove_policy_object� s z#FirewallConfig.remove_policy_objectc C s$ | � |� | �||�}| �|� |S r )r� �_copy_policy_objectr� )r rY rV Znew_policy_objectr! r! r" �rename_policy_object� s z#FirewallConfig.rename_policy_objectc C s | � ||�� �S r )r� rX r� r! r! r" r� � s z"FirewallConfig._copy_policy_objectc C s$ t tt| j�� �t| j�� � ��S r )r r� r6 r) r7 r. r3 r! r! r" rM � s �zFirewallConfig.get_helpersc C s$ |j r|| j|j< n || j|j< d S r )r� r. rV r) r� r! r! r" � add_helper� s zFirewallConfig.add_helperc C s8 || j v r| j | S || jv r(| j| S ttj|��d S r )r) r. r r �INVALID_HELPERr� r! r! r" r? � s zFirewallConfig.get_helperc C st |j | jvr ttj|j ��nB| j|j |kr@ttjd|j ��n |j | jvr^ttjd|j ��| �|� | j|j S )Nzself._helpers[%s] != objz'%s' not a built-in helper)rV r) r r r� r. �_remove_helperr� r! r! r" �load_helper_defaults� s � � z#FirewallConfig.load_helper_defaultsc C s |� � S r r� r� r! r! r" �get_helper_config� s z FirewallConfig.get_helper_configc C sf t � |�}|jr0tj|_d|_|j|jkr0d|_|�|| �� � | �d|gi� | � |� t |� |S )NFrA ) rk r� r �ETC_FIREWALLD_HELPERSrd r� r� rT r[ r� r r� r! r! r" �set_helper_config� s z FirewallConfig.set_helper_configc C s� || j v s|| jv r$ttjd| ��t� }|�|� ||_d| |_t j |_ d|_ d|_ |�|| �� � | �d|gi� | �|� t|� |S )Nznew_helper(): '%s'r� FTrA )r) r. r r r� r r� rV rm r r� rd r� r� r� rT r[ r� r r� r! r! r" � new_helper� s � zFirewallConfig.new_helperc C s� t j�|�}t j�|�}t j�|�s�|tjkr�| j�� D ]L}| j| }|j |kr8| j|= |j | j v rxd| j |j f S d|f S q8nJ| j �� D ]>}| j | }|j |kr�| j |= |j | jvr�d|f S dS q�dS t � d|� zt||�}W n6 t�y& } z t �d||� W Y d }~dS d }~0 0 |j | j v�rV|j | jv�rV| �|� d|fS |tjk�r�|j | jv �r�| j|j j|_|| j|j < d|fS |j | j v �r�| j |j = || j |j < |j | jv�r�d|fS dS dS )Nr� rr r� zLoading helper file '%s'z#Failed to load helper file '%s': %sr� )rc rd r� r� re r r� r) r7 rm rV r. r r� r rp rq r� r� r� r! r! r" �update_helper_from_path� sP z&FirewallConfig.update_helper_from_pathc C s� |j | jvrttj|j ��|jtjkr>ttjd|jtjf ��d|j|j f }zt � |d| � W n< t y� } z$t � d||� t�|� W Y d }~n d }~0 0 | j|j = d S r� )rV r) r r r� rd r r� r� rn ro rp r rq rc rr r� r! r! r" r� s �� z FirewallConfig._remove_helperc C s" |j s |js ttjd|j ��d S )Nz'%s' is built-in helper)r� r� r r ZBUILTIN_HELPERrV r� r! r! r" �check_builtin_helper' s �z#FirewallConfig.check_builtin_helperc C s | � |� | �|� d S r )r r� r� r! r! r" � remove_helper, s z FirewallConfig.remove_helperc C s$ | � |� | �||�}| �|� |S r )r � _copy_helperr� )r rY rV r r! r! r" � rename_helper0 s z FirewallConfig.rename_helperc C s | � ||�� �S r )r r� r� r! r! r" r 6 s zFirewallConfig._copy_helperN)m�__name__� __module__� __qualname__r# r4 r r8 rT r �strr r r[ r\ r] ra rb rh rv rx ry rz r| r} r~ rL r� r: r� r� r� r� r� r� r� r� r� r� rN r� rB r� r� r� r� r� r� r� r� r� r� rO r� rD r� r� r� r� r� r� r� r� r� r� r� r� r� rP r� r� rF r� r� r� r� r� r� r� r� r� r� r� r� rQ r� rI r� r� r� r� r� r� r� r� r� r� rM r� r? r� r� r� r r r� r r r r r! r! r! r" r ) s� 5 E E E K K E)+�__all__rk rc Zos.pathrn �typingr r Zfirewallr Zfirewall.core.loggerr Zfirewall.core.io.io_objectr Zfirewall.core.io.icmptyper r r Zfirewall.core.io.servicer r r Zfirewall.core.io.zoner r r Zfirewall.core.io.ipsetr r r Zfirewall.core.io.helperr r r Zfirewall.core.io.policyr r r r Zfirewall.errorsr �objectr r! r! r! r" �<module> s" core/__pycache__/fw_nm.cpython-39.opt-1.pyc 0000644 00000012051 15025011705 0014375 0 ustar 00 a ���g � @ s d Z g d�ZddlZddlmZ ze�dd� W n eyF dZY n60 zddlmZ d ZW n e eej fyz dZY n0 da dd l m Z dd lmZ dd lmZ ddlZd d� Zdd� Zdd� Zdd� Zdd� Zdd� Zdd� Zdd � Zd d � Zd d � Z d!d"� Z d#d$� Z dS )%z(Functions for NetworkManager interaction)�check_nm_imported�nm_is_imported�nm_get_zone_of_connection�nm_set_zone_of_connection�nm_get_connections� nm_get_connection_of_interface�nm_get_bus_name�nm_get_dbus_interface� N)�GLib�NMz1.0F)r T)�errors)� FirewallError)�logc C s t sttjd��dS )zNCheck function to raise a MISSING_IMPORT error if the import of NM failed zgi.repository.NM = 1.0N)� _nm_importedr r ZMISSING_IMPORT� r r �7/usr/lib/python3.9/site-packages/firewall/core/fw_nm.pyr 0 s r c C s t S )znReturns true if NM has been properly imported @return True if import was successful, False otherwirse )r r r r r r 6 s r c C s t stj�d�a t S )z�Returns the NM client object or None if the import of NM failed @return NM.Client instance if import was successful, None otherwise N)� _nm_clientr ZClient�newr r r r � nm_get_client< s r c C s� t � t� �| �}|du r dS |�� }|du r2dS z"|�� tjjtjjB @ rRW dS W n t yt |� � rpY dS Y n0 |� � }|du r�d}|S )z�Get zone of connection from NM @param connection name @return zone string setting of connection, empty string if not set, None if connection is unknown N� ) r r �get_connection_by_uuid�get_setting_connection� get_flagsr �SettingsConnectionFlags� NM_GENERATED� NM_VOLATILE�AttributeError� get_unsavedZget_zone)� connection�con� setting_con�zoner r r r E s& � r c C sV t � t� �|�}|du r dS |�� }|du r2dS | dkr>d} |�d| � |�dd�S )zSet the zone for a connection @param zone name @param connection name @return True if zone was set, else False NFr r! T)r r r r Z set_propertyZcommit_changes)r! r r r r r r r c s r c C sv | � � |� � t� t� �� }|D ]L}|�� r2q$|�� }|�� }|�� }|||< |D ]}|�� }|rV|| |< qVq$dS )znGet active connections from NM @param connections return dict @param connections_name return dict N) �clearr r �get_active_connections�get_vpnZget_id�get_uuid� get_devices� get_ip_iface) Z connectionsZconnections_nameZactive_connections� active_con�nameZuuidZdevices�dev�ip_ifacer r r r x s r c C s� t � g } t� �� D ]z}|�� r"qz(|�� }|�� tjjtjj B @ rHW qW n t yh |� � rdY qY n0 |� � D ]}|� � }|rr| �|� qrq| S )zGGet active interfaces from NM @returns list of interface names )r r r# r$ �get_connectionr r r r r r r r& r' �append)Zactive_interfacesr( r r* r+ r r r �nm_get_interfaces� s& � r. c C s2 g }t � D ]"}t|�}| t|�kr |�|� q |S )N)r. r r r- )r! Z interfaces� interfaceZconnr r r �nm_get_interfaces_in_zone� s r0 c C s< t � t� �� D ]&}|�� }|du r&q|| kr| S qdS )zzGet device from NM which has the given IP interface @param interface name @returns NM.Device instance or None N)r r r& r' )r/ �devicer+ r r r �nm_get_device_by_ip_iface� s r2 c C sz t � t| �}|du rdS |�� }|du r.dS z"|�� }|�� tjj@ rNW dS W n typ |� � rlY dS Y n0 |� � S )z�Get connection from NM that is using the interface @param interface name @returns connection that is using interface or None N) r r2 Zget_active_connectionr, r r r r r r r% )r/ r1 r( r r r r r � s r c C sR t sd S z(t�� } | �tjtj�}|j}~~ |W S tyL t � d� Y n0 d S )Nz(Failed to get bus name of NetworkManager) r �dbusZ SystemBusZ get_objectr �DBUS_INTERFACEZ DBUS_PATHZbus_name� Exceptionr Zdebug2)Zbus�objr) r r r r � s r c C s t sdS tjS )Nr )r r r4 r r r r r � s r ) �__doc__�__all__ZgiZ gi.repositoryr Zrequire_version� ValueErrorr r � ImportError�Errorr Zfirewallr Zfirewall.errorsr Zfirewall.core.loggerr r3 r r r r r r r. r0 r2 r r r r r r r �<module> s: core/fw_policies.py 0000644 00000005362 15025011705 0010353 0 ustar 00 # -*- coding: utf-8 -*- # # Copyright (C) 2011-2016 Red Hat, Inc. # # Authors: # Thomas Woerner <twoerner@redhat.com> # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see <http://www.gnu.org/licenses/>. # __all__ = [ "FirewallPolicies" ] from firewall import config from firewall.core.logger import log from firewall.core.io.lockdown_whitelist import LockdownWhitelist from firewall import errors from firewall.errors import FirewallError class FirewallPolicies(object): def __init__(self): self._lockdown = False self.lockdown_whitelist = LockdownWhitelist(config.LOCKDOWN_WHITELIST) def __repr__(self): return '%s(%r, %r)' % (self.__class__, self._lockdown, self.lockdown_whitelist) def cleanup(self): self._lockdown = False self.lockdown_whitelist.cleanup() # lockdown def access_check(self, key, value): if key == "context": log.debug2('Doing access check for context "%s"' % value) if self.lockdown_whitelist.match_context(value): log.debug3('context matches.') return True elif key == "uid": log.debug2('Doing access check for uid %d' % value) if self.lockdown_whitelist.match_uid(value): log.debug3('uid matches.') return True elif key == "user": log.debug2('Doing access check for user "%s"' % value) if self.lockdown_whitelist.match_user(value): log.debug3('user matches.') return True elif key == "command": log.debug2('Doing access check for command "%s"' % value) if self.lockdown_whitelist.match_command(value): log.debug3('command matches.') return True return False def enable_lockdown(self): if self._lockdown: raise FirewallError(errors.ALREADY_ENABLED, "enable_lockdown()") self._lockdown = True def disable_lockdown(self): if not self._lockdown: raise FirewallError(errors.NOT_ENABLED, "disable_lockdown()") self._lockdown = False def query_lockdown(self): return self._lockdown core/base.py 0000644 00000004027 15025011705 0006757 0 ustar 00 # -*- coding: utf-8 -*- # # Copyright (C) 2011-2016 Red Hat, Inc. # # Authors: # Thomas Woerner <twoerner@redhat.com> # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see <http://www.gnu.org/licenses/>. # """Base firewall settings""" DEFAULT_ZONE_TARGET = "{chain}_{zone}" DEFAULT_POLICY_TARGET = "CONTINUE" DEFAULT_POLICY_PRIORITY = -1 ZONE_TARGETS = [ "ACCEPT", "%%REJECT%%", "DROP", DEFAULT_ZONE_TARGET, "default" ] POLICY_TARGETS = [ "ACCEPT", "REJECT", "DROP", "CONTINUE" ] SHORTCUTS = { "PREROUTING": "PRE", "POSTROUTING": "POST", "INPUT": "IN", "FORWARD": "FWD", "OUTPUT": "OUT", } REJECT_TYPES = { "ipv4": [ "icmp-host-prohibited", "host-prohib", "icmp-net-unreachable", "net-unreach", "icmp-host-unreachable", "host-unreach", "icmp-port-unreachable", "port-unreach", "icmp-proto-unreachable", "proto-unreach", "icmp-net-prohibited", "net-prohib", "tcp-reset", "tcp-rst", "icmp-admin-prohibited", "admin-prohib" ], "ipv6": [ "icmp6-adm-prohibited", "adm-prohibited", "icmp6-no-route", "no-route", "icmp6-addr-unreachable", "addr-unreach", "icmp6-port-unreachable", "port-unreach", "tcp-reset" ] } # ipset types that can be used as a source in zones # The match-set option will be src or src,src according to the # dimension of the ipset. SOURCE_IPSET_TYPES = [ "hash:ip", "hash:ip,port", "hash:ip,mark", "hash:net", "hash:net,port", "hash:net,iface", "hash:mac" ] core/fw_config.py 0000644 00000140270 15025011705 0010007 0 ustar 00 # -*- coding: utf-8 -*- # # Copyright (C) 2011-2016 Red Hat, Inc. # # Authors: # Thomas Woerner <twoerner@redhat.com> # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see <http://www.gnu.org/licenses/>. # __all__ = [ "FirewallConfig" ] import copy import os import os.path import shutil from typing import Dict, List from firewall import config from firewall.core.logger import log from firewall.core.io.io_object import IO_Object from firewall.core.io.icmptype import IcmpType, icmptype_reader, icmptype_writer from firewall.core.io.service import Service, service_reader, service_writer from firewall.core.io.zone import Zone, zone_reader, zone_writer from firewall.core.io.ipset import IPSet, ipset_reader, ipset_writer from firewall.core.io.helper import Helper, helper_reader, helper_writer from firewall.core.io.policy import Policy, policy_reader, policy_writer from firewall import errors from firewall.errors import FirewallError class FirewallConfig(object): def __init__(self, fw): self._fw = fw self.__init_vars() def __repr__(self): return '%s(%r, %r, %r, %r, %r, %r, %r, %r, %r, %r, %r, %r, %r, %r, %r)' % \ (self.__class__, self._ipsets, self._icmptypes, self._services, self._zones, self._helpers, self.policy_objects, self._builtin_ipsets, self._builtin_icmptypes, self._builtin_services, self._builtin_zones, self._builtin_helpers, self._builtin_policy_objects, self._firewalld_conf, self._policies, self._direct) def __init_vars(self): self._ipsets = { } self._icmptypes = { } self._services = { } self._zones = { } self._helpers = { } self._policy_objects = { } self._builtin_ipsets = { } self._builtin_icmptypes = { } self._builtin_services = { } self._builtin_zones = { } self._builtin_helpers = { } self._builtin_policy_objects = { } self._firewalld_conf = None self._policies = None self._direct = None def cleanup(self): for x in list(self._builtin_ipsets.keys()): self._builtin_ipsets[x].cleanup() del self._builtin_ipsets[x] for x in list(self._ipsets.keys()): self._ipsets[x].cleanup() del self._ipsets[x] for x in list(self._builtin_icmptypes.keys()): self._builtin_icmptypes[x].cleanup() del self._builtin_icmptypes[x] for x in list(self._icmptypes.keys()): self._icmptypes[x].cleanup() del self._icmptypes[x] for x in list(self._builtin_services.keys()): self._builtin_services[x].cleanup() del self._builtin_services[x] for x in list(self._services.keys()): self._services[x].cleanup() del self._services[x] for x in list(self._builtin_zones.keys()): self._builtin_zones[x].cleanup() del self._builtin_zones[x] for x in list(self._zones.keys()): self._zones[x].cleanup() del self._zones[x] for x in list(self._builtin_helpers.keys()): self._builtin_helpers[x].cleanup() del self._builtin_helpers[x] for x in list(self._helpers.keys()): self._helpers[x].cleanup() del self._helpers[x] if self._firewalld_conf: self._firewalld_conf.cleanup() del self._firewalld_conf self._firewalld_conf = None if self._policies: self._policies.cleanup() del self._policies self._policies = None if self._direct: self._direct.cleanup() del self._direct self._direct = None self.__init_vars() def get_all_io_objects_dict(self): """ Returns a dict of dicts of all permanent config objects. """ conf_dict = {} conf_dict["ipsets"] = {ipset: self.get_ipset(ipset) for ipset in self.get_ipsets()} conf_dict["helpers"] = {helper: self.get_helper(helper) for helper in self.get_helpers()} conf_dict["icmptypes"] = {icmptype: self.get_icmptype(icmptype) for icmptype in self.get_icmptypes()} conf_dict["services"] = {service: self.get_service(service) for service in self.get_services()} conf_dict["zones"] = {zone: self.get_zone(zone) for zone in self.get_zones()} conf_dict["policies"] = {policy: self.get_policy_object(policy) for policy in self.get_policy_objects()} conf_dict["conf"] = {} conf_dict["conf"]["FirewallBackend"] = self._firewalld_conf.get("FirewallBackend") return conf_dict def full_check_config(self, extra_io_objects: Dict[str, List[IO_Object]] = {}): all_io_objects = self.get_all_io_objects_dict() # mix in the extra objects for type_key in extra_io_objects: for obj in extra_io_objects[type_key]: all_io_objects[type_key][obj.name] = obj # we need to check in a well defined order because some io_objects will # cross-check others order = ["ipsets", "helpers", "icmptypes", "services", "zones", "policies"] for io_obj_type in order: io_objs = all_io_objects[io_obj_type] for (name, io_obj) in io_objs.items(): io_obj.check_config_dict(io_obj.export_config_dict(), all_io_objects) # access check def lockdown_enabled(self): return self._fw.policies.query_lockdown() def access_check(self, key, value): return self._fw.policies.access_check(key, value) # firewalld_conf def set_firewalld_conf(self, conf): self._firewalld_conf = conf def get_firewalld_conf(self): return self._firewalld_conf def update_firewalld_conf(self): if not os.path.exists(config.FIREWALLD_CONF): self._firewalld_conf.clear() else: self._firewalld_conf.read() def reset_defaults(self): order = [ self._zones, self._policy_objects, self._ipsets, self._services, self._helpers, self._icmptypes ] for io_obj_dict in order: dict_copy = copy.copy(io_obj_dict) for obj_name in dict_copy: obj = dict_copy[obj_name] name = os.path.join(obj.path, obj.filename) try: shutil.move(name, "%s.old" % name) except Exception as msg: log.error("Backup of file '%s' failed: %s", name, msg) os.remove(name) del io_obj_dict[obj_name] self._firewalld_conf.set_defaults() self._firewalld_conf.write() # policies def set_policies(self, policies): self._policies = policies def get_policies(self): return self._policies def update_lockdown_whitelist(self): if not os.path.exists(config.LOCKDOWN_WHITELIST): self._policies.lockdown_whitelist.cleanup() else: self._policies.lockdown_whitelist.read() # direct def set_direct(self, direct): self._direct = direct def get_direct(self): return self._direct def update_direct(self): if not os.path.exists(config.FIREWALLD_DIRECT): self._direct.cleanup() else: self._direct.read() # ipset def get_ipsets(self): return sorted(set(list(self._ipsets.keys()) + \ list(self._builtin_ipsets.keys()))) def add_ipset(self, obj): if obj.builtin: self._builtin_ipsets[obj.name] = obj else: self._ipsets[obj.name] = obj def get_ipset(self, name): if name in self._ipsets: return self._ipsets[name] elif name in self._builtin_ipsets: return self._builtin_ipsets[name] raise FirewallError(errors.INVALID_IPSET, name) def load_ipset_defaults(self, obj): if obj.name not in self._ipsets: raise FirewallError(errors.NO_DEFAULTS, obj.name) elif self._ipsets[obj.name] != obj: raise FirewallError(errors.NO_DEFAULTS, "self._ipsets[%s] != obj" % obj.name) elif obj.name not in self._builtin_ipsets: raise FirewallError(errors.NO_DEFAULTS, "'%s' not a built-in ipset" % obj.name) self._remove_ipset(obj) return self._builtin_ipsets[obj.name] def get_ipset_config(self, obj): return obj.export_config() def set_ipset_config(self, obj, conf): x = copy.copy(obj) if obj.builtin: x.path = config.ETC_FIREWALLD_IPSETS x.builtin = False if obj.path != x.path: x.default = False x.import_config(conf, self.get_all_io_objects_dict()) self.full_check_config({"ipsets": [x]}) self.add_ipset(x) ipset_writer(x) return x def new_ipset(self, name, conf): if name in self._ipsets or name in self._builtin_ipsets: raise FirewallError(errors.NAME_CONFLICT, "new_ipset(): '%s'" % name) x = IPSet() x.check_name(name) x.name = name x.filename = "%s.xml" % name x.path = config.ETC_FIREWALLD_IPSETS # It is not possible to add a new one with a name of a buitin x.builtin = False x.default = True x.import_config(conf, self.get_all_io_objects_dict()) self.full_check_config({"ipsets": [x]}) self.add_ipset(x) ipset_writer(x) return x def update_ipset_from_path(self, name): filename = os.path.basename(name) path = os.path.dirname(name) if not os.path.exists(name): # removed file if path == config.ETC_FIREWALLD_IPSETS: # removed custom ipset for x in self._ipsets.keys(): obj = self._ipsets[x] if obj.filename == filename: del self._ipsets[x] if obj.name in self._builtin_ipsets: return ("update", self._builtin_ipsets[obj.name]) return ("remove", obj) else: # removed builtin ipset for x in self._builtin_ipsets.keys(): obj = self._builtin_ipsets[x] if obj.filename == filename: del self._builtin_ipsets[x] if obj.name not in self._ipsets: # update dbus ipset return ("remove", obj) else: # builtin hidden, no update needed return (None, None) # ipset not known to firewalld, yet (timeout, ..) return (None, None) # new or updated file log.debug1("Loading ipset file '%s'", name) try: obj = ipset_reader(filename, path) except Exception as msg: log.error("Failed to load ipset file '%s': %s", filename, msg) return (None, None) # new ipset if obj.name not in self._builtin_ipsets and obj.name not in self._ipsets: self.add_ipset(obj) return ("new", obj) # updated ipset if path == config.ETC_FIREWALLD_IPSETS: # custom ipset update if obj.name in self._ipsets: obj.default = self._ipsets[obj.name].default self._ipsets[obj.name] = obj return ("update", obj) else: if obj.name in self._builtin_ipsets: # builtin ipset update del self._builtin_ipsets[obj.name] self._builtin_ipsets[obj.name] = obj if obj.name not in self._ipsets: # update dbus ipset return ("update", obj) else: # builtin hidden, no update needed return (None, None) # ipset not known to firewalld, yet (timeout, ..) return (None, None) def _remove_ipset(self, obj): if obj.name not in self._ipsets: raise FirewallError(errors.INVALID_IPSET, obj.name) if obj.path != config.ETC_FIREWALLD_IPSETS: raise FirewallError(errors.INVALID_DIRECTORY, "'%s' != '%s'" % (obj.path, config.ETC_FIREWALLD_IPSETS)) name = "%s/%s.xml" % (obj.path, obj.name) try: shutil.move(name, "%s.old" % name) except Exception as msg: log.error("Backup of file '%s' failed: %s", name, msg) os.remove(name) del self._ipsets[obj.name] def check_builtin_ipset(self, obj): if obj.builtin or not obj.default: raise FirewallError(errors.BUILTIN_IPSET, "'%s' is built-in ipset" % obj.name) def remove_ipset(self, obj): self.check_builtin_ipset(obj) self._remove_ipset(obj) def rename_ipset(self, obj, name): self.check_builtin_ipset(obj) new_ipset = self._copy_ipset(obj, name) self._remove_ipset(obj) return new_ipset def _copy_ipset(self, obj, name): return self.new_ipset(name, obj.export_config()) # icmptypes def get_icmptypes(self): return sorted(set(list(self._icmptypes.keys()) + \ list(self._builtin_icmptypes.keys()))) def add_icmptype(self, obj): if obj.builtin: self._builtin_icmptypes[obj.name] = obj else: self._icmptypes[obj.name] = obj def get_icmptype(self, name): if name in self._icmptypes: return self._icmptypes[name] elif name in self._builtin_icmptypes: return self._builtin_icmptypes[name] raise FirewallError(errors.INVALID_ICMPTYPE, name) def load_icmptype_defaults(self, obj): if obj.name not in self._icmptypes: raise FirewallError(errors.NO_DEFAULTS, obj.name) elif self._icmptypes[obj.name] != obj: raise FirewallError(errors.NO_DEFAULTS, "self._icmptypes[%s] != obj" % obj.name) elif obj.name not in self._builtin_icmptypes: raise FirewallError(errors.NO_DEFAULTS, "'%s' not a built-in icmptype" % obj.name) self._remove_icmptype(obj) return self._builtin_icmptypes[obj.name] def get_icmptype_config(self, obj): return obj.export_config() def set_icmptype_config(self, obj, conf): x = copy.copy(obj) if obj.builtin: x.path = config.ETC_FIREWALLD_ICMPTYPES x.builtin = False if obj.path != x.path: x.default = False x.import_config(conf, self.get_all_io_objects_dict()) self.full_check_config({"icmptypes": [x]}) self.add_icmptype(x) icmptype_writer(x) return x def new_icmptype(self, name, conf): if name in self._icmptypes or name in self._builtin_icmptypes: raise FirewallError(errors.NAME_CONFLICT, "new_icmptype(): '%s'" % name) x = IcmpType() x.check_name(name) x.name = name x.filename = "%s.xml" % name x.path = config.ETC_FIREWALLD_ICMPTYPES # It is not possible to add a new one with a name of a buitin x.builtin = False x.default = True x.import_config(conf, self.get_all_io_objects_dict()) self.full_check_config({"icmptypes": [x]}) self.add_icmptype(x) icmptype_writer(x) return x def update_icmptype_from_path(self, name): filename = os.path.basename(name) path = os.path.dirname(name) if not os.path.exists(name): # removed file if path == config.ETC_FIREWALLD_ICMPTYPES: # removed custom icmptype for x in self._icmptypes.keys(): obj = self._icmptypes[x] if obj.filename == filename: del self._icmptypes[x] if obj.name in self._builtin_icmptypes: return ("update", self._builtin_icmptypes[obj.name]) return ("remove", obj) else: # removed builtin icmptype for x in self._builtin_icmptypes.keys(): obj = self._builtin_icmptypes[x] if obj.filename == filename: del self._builtin_icmptypes[x] if obj.name not in self._icmptypes: # update dbus icmptype return ("remove", obj) else: # builtin hidden, no update needed return (None, None) # icmptype not known to firewalld, yet (timeout, ..) return (None, None) # new or updated file log.debug1("Loading icmptype file '%s'", name) try: obj = icmptype_reader(filename, path) except Exception as msg: log.error("Failed to load icmptype file '%s': %s", filename, msg) return (None, None) # new icmptype if obj.name not in self._builtin_icmptypes and obj.name not in self._icmptypes: self.add_icmptype(obj) return ("new", obj) # updated icmptype if path == config.ETC_FIREWALLD_ICMPTYPES: # custom icmptype update if obj.name in self._icmptypes: obj.default = self._icmptypes[obj.name].default self._icmptypes[obj.name] = obj return ("update", obj) else: if obj.name in self._builtin_icmptypes: # builtin icmptype update del self._builtin_icmptypes[obj.name] self._builtin_icmptypes[obj.name] = obj if obj.name not in self._icmptypes: # update dbus icmptype return ("update", obj) else: # builtin hidden, no update needed return (None, None) # icmptype not known to firewalld, yet (timeout, ..) return (None, None) def _remove_icmptype(self, obj): if obj.name not in self._icmptypes: raise FirewallError(errors.INVALID_ICMPTYPE, obj.name) if obj.path != config.ETC_FIREWALLD_ICMPTYPES: raise FirewallError(errors.INVALID_DIRECTORY, "'%s' != '%s'" % \ (obj.path, config.ETC_FIREWALLD_ICMPTYPES)) name = "%s/%s.xml" % (obj.path, obj.name) try: shutil.move(name, "%s.old" % name) except Exception as msg: log.error("Backup of file '%s' failed: %s", name, msg) os.remove(name) del self._icmptypes[obj.name] def check_builtin_icmptype(self, obj): if obj.builtin or not obj.default: raise FirewallError(errors.BUILTIN_ICMPTYPE, "'%s' is built-in icmp type" % obj.name) def remove_icmptype(self, obj): self.check_builtin_icmptype(obj) self._remove_icmptype(obj) def rename_icmptype(self, obj, name): self.check_builtin_icmptype(obj) new_icmptype = self._copy_icmptype(obj, name) self._remove_icmptype(obj) return new_icmptype def _copy_icmptype(self, obj, name): return self.new_icmptype(name, obj.export_config()) # services def get_services(self): return sorted(set(list(self._services.keys()) + \ list(self._builtin_services.keys()))) def add_service(self, obj): if obj.builtin: self._builtin_services[obj.name] = obj else: self._services[obj.name] = obj def get_service(self, name): if name in self._services: return self._services[name] elif name in self._builtin_services: return self._builtin_services[name] raise FirewallError(errors.INVALID_SERVICE, "get_service(): '%s'" % name) def load_service_defaults(self, obj): if obj.name not in self._services: raise FirewallError(errors.NO_DEFAULTS, obj.name) elif self._services[obj.name] != obj: raise FirewallError(errors.NO_DEFAULTS, "self._services[%s] != obj" % obj.name) elif obj.name not in self._builtin_services: raise FirewallError(errors.NO_DEFAULTS, "'%s' not a built-in service" % obj.name) self._remove_service(obj) return self._builtin_services[obj.name] def get_service_config(self, obj): conf_dict = obj.export_config_dict() conf_list = [] for i in range(8): # tuple based dbus API has 8 elements if obj.IMPORT_EXPORT_STRUCTURE[i][0] not in conf_dict: # old API needs the empty elements as well. Grab it from the # object otherwise we don't know the type. conf_list.append(copy.deepcopy(getattr(obj, obj.IMPORT_EXPORT_STRUCTURE[i][0]))) else: conf_list.append(conf_dict[obj.IMPORT_EXPORT_STRUCTURE[i][0]]) return tuple(conf_list) def get_service_config_dict(self, obj): return obj.export_config_dict() def set_service_config(self, obj, conf): conf_dict = {} for i,value in enumerate(conf): conf_dict[obj.IMPORT_EXPORT_STRUCTURE[i][0]] = value return self.set_service_config_dict(obj, conf_dict) def set_service_config_dict(self, obj, conf): x = copy.copy(obj) if obj.builtin: x.path = config.ETC_FIREWALLD_SERVICES x.builtin = False if obj.path != x.path: x.default = False x.import_config_dict(conf, self.get_all_io_objects_dict()) self.full_check_config({"services": [x]}) self.add_service(x) service_writer(x) return x def new_service(self, name, conf): if name in self._services or name in self._builtin_services: raise FirewallError(errors.NAME_CONFLICT, "new_service(): '%s'" % name) conf_dict = {} for i,value in enumerate(conf): conf_dict[Service.IMPORT_EXPORT_STRUCTURE[i][0]] = value return self.new_service_dict(name, conf_dict) def new_service_dict(self, name, conf): if name in self._services or name in self._builtin_services: raise FirewallError(errors.NAME_CONFLICT, "new_service(): '%s'" % name) x = Service() x.check_name(name) x.name = name x.filename = "%s.xml" % name x.path = config.ETC_FIREWALLD_SERVICES # It is not possible to add a new one with a name of a buitin x.builtin = False x.default = True x.import_config_dict(conf, self.get_all_io_objects_dict()) self.full_check_config({"services": [x]}) self.add_service(x) service_writer(x) return x def update_service_from_path(self, name): filename = os.path.basename(name) path = os.path.dirname(name) if not os.path.exists(name): # removed file if path == config.ETC_FIREWALLD_SERVICES: # removed custom service for x in self._services.keys(): obj = self._services[x] if obj.filename == filename: del self._services[x] if obj.name in self._builtin_services: return ("update", self._builtin_services[obj.name]) return ("remove", obj) else: # removed builtin service for x in self._builtin_services.keys(): obj = self._builtin_services[x] if obj.filename == filename: del self._builtin_services[x] if obj.name not in self._services: # update dbus service return ("remove", obj) else: # builtin hidden, no update needed return (None, None) # service not known to firewalld, yet (timeout, ..) return (None, None) # new or updated file log.debug1("Loading service file '%s'", name) try: obj = service_reader(filename, path) except Exception as msg: log.error("Failed to load service file '%s': %s", filename, msg) return (None, None) # new service if obj.name not in self._builtin_services and obj.name not in self._services: self.add_service(obj) return ("new", obj) # updated service if path == config.ETC_FIREWALLD_SERVICES: # custom service update if obj.name in self._services: obj.default = self._services[obj.name].default self._services[obj.name] = obj return ("update", obj) else: if obj.name in self._builtin_services: # builtin service update del self._builtin_services[obj.name] self._builtin_services[obj.name] = obj if obj.name not in self._services: # update dbus service return ("update", obj) else: # builtin hidden, no update needed return (None, None) # service not known to firewalld, yet (timeout, ..) return (None, None) def _remove_service(self, obj): if obj.name not in self._services: raise FirewallError(errors.INVALID_SERVICE, obj.name) if obj.path != config.ETC_FIREWALLD_SERVICES: raise FirewallError(errors.INVALID_DIRECTORY, "'%s' != '%s'" % \ (obj.path, config.ETC_FIREWALLD_SERVICES)) name = "%s/%s.xml" % (obj.path, obj.name) try: shutil.move(name, "%s.old" % name) except Exception as msg: log.error("Backup of file '%s' failed: %s", name, msg) os.remove(name) del self._services[obj.name] def check_builtin_service(self, obj): if obj.builtin or not obj.default: raise FirewallError(errors.BUILTIN_SERVICE, "'%s' is built-in service" % obj.name) def remove_service(self, obj): self.check_builtin_service(obj) self._remove_service(obj) def rename_service(self, obj, name): self.check_builtin_service(obj) new_service = self._copy_service(obj, name) self._remove_service(obj) return new_service def _copy_service(self, obj, name): return self.new_service_dict(name, obj.export_config_dict()) # zones def get_zones(self): return sorted(set(list(self._zones.keys()) + \ list(self._builtin_zones.keys()))) def add_zone(self, obj): if obj.builtin: self._builtin_zones[obj.name] = obj else: self._zones[obj.name] = obj def forget_zone(self, name): if name in self._builtin_zones: del self._builtin_zones[name] if name in self._zones: del self._zones[name] def get_zone(self, name): if name in self._zones: return self._zones[name] elif name in self._builtin_zones: return self._builtin_zones[name] raise FirewallError(errors.INVALID_ZONE, "get_zone(): %s" % name) def load_zone_defaults(self, obj): if obj.name not in self._zones: raise FirewallError(errors.NO_DEFAULTS, obj.name) elif self._zones[obj.name] != obj: raise FirewallError(errors.NO_DEFAULTS, "self._zones[%s] != obj" % obj.name) elif obj.name not in self._builtin_zones: raise FirewallError(errors.NO_DEFAULTS, "'%s' not a built-in zone" % obj.name) self._remove_zone(obj) return self._builtin_zones[obj.name] def get_zone_config(self, obj): conf_dict = obj.export_config_dict() conf_list = [] for i in range(16): # tuple based dbus API has 16 elements if obj.IMPORT_EXPORT_STRUCTURE[i][0] not in conf_dict: # old API needs the empty elements as well. Grab it from the # object otherwise we don't know the type. conf_list.append(copy.deepcopy(getattr(obj, obj.IMPORT_EXPORT_STRUCTURE[i][0]))) else: conf_list.append(conf_dict[obj.IMPORT_EXPORT_STRUCTURE[i][0]]) return tuple(conf_list) def get_zone_config_dict(self, obj): return obj.export_config_dict() def set_zone_config(self, obj, conf): conf_dict = {} for i,value in enumerate(conf): conf_dict[obj.IMPORT_EXPORT_STRUCTURE[i][0]] = value return self.set_zone_config_dict(obj, conf_dict) def set_zone_config_dict(self, obj, conf): x = copy.copy(obj) if obj.builtin: x.path = config.ETC_FIREWALLD_ZONES x.builtin = False if obj.path != x.path: x.default = False x.import_config_dict(conf, self.get_all_io_objects_dict()) self.full_check_config({"zones": [x]}) self.add_zone(x) zone_writer(x) return x def new_zone(self, name, conf): if name in self._zones or name in self._builtin_zones: raise FirewallError(errors.NAME_CONFLICT, "new_zone(): '%s'" % name) conf_dict = {} for i,value in enumerate(conf): conf_dict[Zone.IMPORT_EXPORT_STRUCTURE[i][0]] = value return self.new_zone_dict(name, conf_dict) def new_zone_dict(self, name, conf): if name in self._zones or name in self._builtin_zones: raise FirewallError(errors.NAME_CONFLICT, "new_zone(): '%s'" % name) x = Zone() x.check_name(name) x.name = name x.filename = "%s.xml" % name x.path = config.ETC_FIREWALLD_ZONES # It is not possible to add a new one with a name of a buitin x.builtin = False x.default = True x.import_config_dict(conf, self.get_all_io_objects_dict()) self.full_check_config({"zones": [x]}) self.add_zone(x) zone_writer(x) return x def update_zone_from_path(self, name): filename = os.path.basename(name) path = os.path.dirname(name) if not os.path.exists(name): # removed file if path.startswith(config.ETC_FIREWALLD_ZONES): # removed custom zone for x in self._zones.keys(): obj = self._zones[x] if obj.filename == filename: del self._zones[x] if obj.name in self._builtin_zones: return ("update", self._builtin_zones[obj.name]) return ("remove", obj) else: # removed builtin zone for x in self._builtin_zones.keys(): obj = self._builtin_zones[x] if obj.filename == filename: del self._builtin_zones[x] if obj.name not in self._zones: # update dbus zone return ("remove", obj) else: # builtin hidden, no update needed return (None, None) # zone not known to firewalld, yet (timeout, ..) return (None, None) # new or updated file log.debug1("Loading zone file '%s'", name) try: obj = zone_reader(filename, path) except Exception as msg: log.error("Failed to load zone file '%s': %s", filename, msg) return (None, None) if path.startswith(config.ETC_FIREWALLD_ZONES) and \ len(path) > len(config.ETC_FIREWALLD_ZONES): # custom combined zone part obj.name = "%s/%s" % (os.path.basename(path), os.path.basename(filename)[0:-4]) # new zone if obj.name not in self._builtin_zones and obj.name not in self._zones: self.add_zone(obj) return ("new", obj) # updated zone if path.startswith(config.ETC_FIREWALLD_ZONES): # custom zone update if obj.name in self._zones: obj.default = self._zones[obj.name].default self._zones[obj.name] = obj return ("update", obj) else: if obj.name in self._builtin_zones: # builtin zone update del self._builtin_zones[obj.name] self._builtin_zones[obj.name] = obj if obj.name not in self._zones: # update dbus zone return ("update", obj) else: # builtin hidden, no update needed return (None, None) # zone not known to firewalld, yet (timeout, ..) return (None, None) def _remove_zone(self, obj): if obj.name not in self._zones: raise FirewallError(errors.INVALID_ZONE, obj.name) if not obj.path.startswith(config.ETC_FIREWALLD_ZONES): raise FirewallError(errors.INVALID_DIRECTORY, "'%s' doesn't start with '%s'" % \ (obj.path, config.ETC_FIREWALLD_ZONES)) name = "%s/%s.xml" % (obj.path, obj.name) try: shutil.move(name, "%s.old" % name) except Exception as msg: log.error("Backup of file '%s' failed: %s", name, msg) os.remove(name) del self._zones[obj.name] def check_builtin_zone(self, obj): if obj.builtin or not obj.default: raise FirewallError(errors.BUILTIN_ZONE, "'%s' is built-in zone" % obj.name) def remove_zone(self, obj): self.check_builtin_zone(obj) self._remove_zone(obj) def rename_zone(self, obj, name): self.check_builtin_zone(obj) obj_conf = obj.export_config_dict() self._remove_zone(obj) try: new_zone = self.new_zone_dict(name, obj_conf) except: # re-add original if rename failed self.new_zone_dict(obj.name, obj_conf) raise return new_zone # policy objects def get_policy_objects(self): return sorted(set(list(self._policy_objects.keys()) + \ list(self._builtin_policy_objects.keys()))) def add_policy_object(self, obj): if obj.builtin: self._builtin_policy_objects[obj.name] = obj else: self._policy_objects[obj.name] = obj def get_policy_object(self, name): if name in self._policy_objects: return self._policy_objects[name] elif name in self._builtin_policy_objects: return self._builtin_policy_objects[name] raise FirewallError(errors.INVALID_POLICY, "get_policy_object(): %s" % name) def load_policy_object_defaults(self, obj): if obj.name not in self._policy_objects: raise FirewallError(errors.NO_DEFAULTS, obj.name) elif self._policy_objects[obj.name] != obj: raise FirewallError(errors.NO_DEFAULTS, "self._policy_objects[%s] != obj" % obj.name) elif obj.name not in self._builtin_policy_objects: raise FirewallError(errors.NO_DEFAULTS, "'%s' not a built-in policy" % obj.name) self._remove_policy_object(obj) return self._builtin_policy_objects[obj.name] def get_policy_object_config_dict(self, obj): return obj.export_config_dict() def set_policy_object_config_dict(self, obj, conf): x = copy.copy(obj) if obj.builtin: x.path = config.ETC_FIREWALLD_POLICIES x.builtin = False if obj.path != x.path: x.default = False x.import_config_dict(conf, self.get_all_io_objects_dict()) self.full_check_config({"policies": [x]}) self.add_policy_object(x) policy_writer(x) return x def new_policy_object_dict(self, name, conf): if name in self._policy_objects or name in self._builtin_policy_objects: raise FirewallError(errors.NAME_CONFLICT, "new_policy_object(): '%s'" % name) x = Policy() x.check_name(name) x.name = name x.filename = "%s.xml" % name x.path = config.ETC_FIREWALLD_POLICIES # It is not possible to add a new one with a name of a buitin x.builtin = False x.default = True x.import_config_dict(conf, self.get_all_io_objects_dict()) self.full_check_config({"policies": [x]}) self.add_policy_object(x) policy_writer(x) return x def update_policy_object_from_path(self, name): filename = os.path.basename(name) path = os.path.dirname(name) if not os.path.exists(name): # removed file if path.startswith(config.ETC_FIREWALLD_POLICIES): # removed custom policy_object for x in self._policy_objects.keys(): obj = self._policy_objects[x] if obj.filename == filename: del self._policy_objects[x] if obj.name in self._builtin_policy_objects: return ("update", self._builtin_policy_objects[obj.name]) return ("remove", obj) else: # removed builtin policy_object for x in self._builtin_policy_objects.keys(): obj = self._builtin_policy_objects[x] if obj.filename == filename: del self._builtin_policy_objects[x] if obj.name not in self._policy_objects: # update dbus policy_object return ("remove", obj) else: # builtin hidden, no update needed return (None, None) # policy_object not known to firewalld, yet (timeout, ..) return (None, None) # new or updated file log.debug1("Loading policy file '%s'", name) try: obj = policy_reader(filename, path) except Exception as msg: log.error("Failed to load policy file '%s': %s", filename, msg) return (None, None) if path.startswith(config.ETC_FIREWALLD_POLICIES) and \ len(path) > len(config.ETC_FIREWALLD_POLICIES): # custom combined policy_object part obj.name = "%s/%s" % (os.path.basename(path), os.path.basename(filename)[0:-4]) # new policy_object if obj.name not in self._builtin_policy_objects and obj.name not in self._policy_objects: self.add_policy_object(obj) return ("new", obj) # updated policy_object if path.startswith(config.ETC_FIREWALLD_POLICIES): # custom policy_object update if obj.name in self._policy_objects: obj.default = self._policy_objects[obj.name].default self._policy_objects[obj.name] = obj return ("update", obj) else: if obj.name in self._builtin_policy_objects: # builtin policy_object update del self._builtin_policy_objects[obj.name] self._builtin_policy_objects[obj.name] = obj if obj.name not in self._policy_objects: # update dbus policy_object return ("update", obj) else: # builtin hidden, no update needed return (None, None) # policy_object not known to firewalld, yet (timeout, ..) return (None, None) def _remove_policy_object(self, obj): if obj.name not in self._policy_objects: raise FirewallError(errors.INVALID_POLICY, obj.name) if not obj.path.startswith(config.ETC_FIREWALLD_POLICIES): raise FirewallError(errors.INVALID_DIRECTORY, "'%s' doesn't start with '%s'" % \ (obj.path, config.ETC_FIREWALLD_POLICIES)) name = "%s/%s.xml" % (obj.path, obj.name) try: shutil.move(name, "%s.old" % name) except Exception as msg: log.error("Backup of file '%s' failed: %s", name, msg) os.remove(name) del self._policy_objects[obj.name] def check_builtin_policy_object(self, obj): if obj.builtin or not obj.default: raise FirewallError(errors.BUILTIN_POLICY, "'%s' is built-in policy" % obj.name) def remove_policy_object(self, obj): self.check_builtin_policy_object(obj) self._remove_policy_object(obj) def rename_policy_object(self, obj, name): self.check_builtin_policy_object(obj) new_policy_object = self._copy_policy_object(obj, name) self._remove_policy_object(obj) return new_policy_object def _copy_policy_object(self, obj, name): return self.new_policy_object_dict(name, obj.export_config_dict()) # helper def get_helpers(self): return sorted(set(list(self._helpers.keys()) + \ list(self._builtin_helpers.keys()))) def add_helper(self, obj): if obj.builtin: self._builtin_helpers[obj.name] = obj else: self._helpers[obj.name] = obj def get_helper(self, name): if name in self._helpers: return self._helpers[name] elif name in self._builtin_helpers: return self._builtin_helpers[name] raise FirewallError(errors.INVALID_HELPER, name) def load_helper_defaults(self, obj): if obj.name not in self._helpers: raise FirewallError(errors.NO_DEFAULTS, obj.name) elif self._helpers[obj.name] != obj: raise FirewallError(errors.NO_DEFAULTS, "self._helpers[%s] != obj" % obj.name) elif obj.name not in self._builtin_helpers: raise FirewallError(errors.NO_DEFAULTS, "'%s' not a built-in helper" % obj.name) self._remove_helper(obj) return self._builtin_helpers[obj.name] def get_helper_config(self, obj): return obj.export_config() def set_helper_config(self, obj, conf): x = copy.copy(obj) if obj.builtin: x.path = config.ETC_FIREWALLD_HELPERS x.builtin = False if obj.path != x.path: x.default = False x.import_config(conf, self.get_all_io_objects_dict()) self.full_check_config({"helpers": [x]}) self.add_helper(x) helper_writer(x) return x def new_helper(self, name, conf): if name in self._helpers or name in self._builtin_helpers: raise FirewallError(errors.NAME_CONFLICT, "new_helper(): '%s'" % name) x = Helper() x.check_name(name) x.name = name x.filename = "%s.xml" % name x.path = config.ETC_FIREWALLD_HELPERS # It is not possible to add a new one with a name of a buitin x.builtin = False x.default = True x.import_config(conf, self.get_all_io_objects_dict()) self.full_check_config({"helpers": [x]}) self.add_helper(x) helper_writer(x) return x def update_helper_from_path(self, name): filename = os.path.basename(name) path = os.path.dirname(name) if not os.path.exists(name): # removed file if path == config.ETC_FIREWALLD_HELPERS: # removed custom helper for x in self._helpers.keys(): obj = self._helpers[x] if obj.filename == filename: del self._helpers[x] if obj.name in self._builtin_helpers: return ("update", self._builtin_helpers[obj.name]) return ("remove", obj) else: # removed builtin helper for x in self._builtin_helpers.keys(): obj = self._builtin_helpers[x] if obj.filename == filename: del self._builtin_helpers[x] if obj.name not in self._helpers: # update dbus helper return ("remove", obj) else: # builtin hidden, no update needed return (None, None) # helper not known to firewalld, yet (timeout, ..) return (None, None) # new or updated file log.debug1("Loading helper file '%s'", name) try: obj = helper_reader(filename, path) except Exception as msg: log.error("Failed to load helper file '%s': %s", filename, msg) return (None, None) # new helper if obj.name not in self._builtin_helpers and obj.name not in self._helpers: self.add_helper(obj) return ("new", obj) # updated helper if path == config.ETC_FIREWALLD_HELPERS: # custom helper update if obj.name in self._helpers: obj.default = self._helpers[obj.name].default self._helpers[obj.name] = obj return ("update", obj) else: if obj.name in self._builtin_helpers: # builtin helper update del self._builtin_helpers[obj.name] self._builtin_helpers[obj.name] = obj if obj.name not in self._helpers: # update dbus helper return ("update", obj) else: # builtin hidden, no update needed return (None, None) # helper not known to firewalld, yet (timeout, ..) return (None, None) def _remove_helper(self, obj): if obj.name not in self._helpers: raise FirewallError(errors.INVALID_HELPER, obj.name) if obj.path != config.ETC_FIREWALLD_HELPERS: raise FirewallError(errors.INVALID_DIRECTORY, "'%s' != '%s'" % (obj.path, config.ETC_FIREWALLD_HELPERS)) name = "%s/%s.xml" % (obj.path, obj.name) try: shutil.move(name, "%s.old" % name) except Exception as msg: log.error("Backup of file '%s' failed: %s", name, msg) os.remove(name) del self._helpers[obj.name] def check_builtin_helper(self, obj): if obj.builtin or not obj.default: raise FirewallError(errors.BUILTIN_HELPER, "'%s' is built-in helper" % obj.name) def remove_helper(self, obj): self.check_builtin_helper(obj) self._remove_helper(obj) def rename_helper(self, obj, name): self.check_builtin_helper(obj) new_helper = self._copy_helper(obj, name) self._remove_helper(obj) return new_helper def _copy_helper(self, obj, name): return self.new_helper(name, obj.export_config()) core/fw_nm.py 0000644 00000016022 15025011705 0007151 0 ustar 00 # -*- coding: utf-8 -*- # # Copyright (C) 2010-2016 Red Hat, Inc. # # Authors: # Thomas Woerner <twoerner@redhat.com> # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see <http://www.gnu.org/licenses/>. # """Functions for NetworkManager interaction""" __all__ = [ "check_nm_imported", "nm_is_imported", "nm_get_zone_of_connection", "nm_set_zone_of_connection", "nm_get_connections", "nm_get_connection_of_interface", "nm_get_bus_name", "nm_get_dbus_interface" ] import gi from gi.repository import GLib try: gi.require_version('NM', '1.0') except ValueError: _nm_imported = False else: try: from gi.repository import NM _nm_imported = True except (ImportError, ValueError, GLib.Error): _nm_imported = False _nm_client = None from firewall import errors from firewall.errors import FirewallError from firewall.core.logger import log import dbus def check_nm_imported(): """Check function to raise a MISSING_IMPORT error if the import of NM failed """ if not _nm_imported: raise FirewallError(errors.MISSING_IMPORT, "gi.repository.NM = 1.0") def nm_is_imported(): """Returns true if NM has been properly imported @return True if import was successful, False otherwirse """ return _nm_imported def nm_get_client(): """Returns the NM client object or None if the import of NM failed @return NM.Client instance if import was successful, None otherwise """ global _nm_client if not _nm_client: _nm_client = NM.Client.new(None) return _nm_client def nm_get_zone_of_connection(connection): """Get zone of connection from NM @param connection name @return zone string setting of connection, empty string if not set, None if connection is unknown """ check_nm_imported() con = nm_get_client().get_connection_by_uuid(connection) if con is None: return None setting_con = con.get_setting_connection() if setting_con is None: return None try: if con.get_flags() & (NM.SettingsConnectionFlags.NM_GENERATED | NM.SettingsConnectionFlags.NM_VOLATILE): return "" except AttributeError: # Prior to NetworkManager 1.12, we can only guess # that a connection was generated/volatile. if con.get_unsaved(): return "" zone = setting_con.get_zone() if zone is None: zone = "" return zone def nm_set_zone_of_connection(zone, connection): """Set the zone for a connection @param zone name @param connection name @return True if zone was set, else False """ check_nm_imported() con = nm_get_client().get_connection_by_uuid(connection) if con is None: return False setting_con = con.get_setting_connection() if setting_con is None: return False if zone == "": zone = None setting_con.set_property("zone", zone) return con.commit_changes(True, None) def nm_get_connections(connections, connections_name): """Get active connections from NM @param connections return dict @param connections_name return dict """ connections.clear() connections_name.clear() check_nm_imported() active_connections = nm_get_client().get_active_connections() for active_con in active_connections: # ignore vpn devices for now if active_con.get_vpn(): continue name = active_con.get_id() uuid = active_con.get_uuid() devices = active_con.get_devices() connections_name[uuid] = name for dev in devices: ip_iface = dev.get_ip_iface() if ip_iface: connections[ip_iface] = uuid def nm_get_interfaces(): """Get active interfaces from NM @returns list of interface names """ check_nm_imported() active_interfaces = [] for active_con in nm_get_client().get_active_connections(): # ignore vpn devices for now if active_con.get_vpn(): continue try: con = active_con.get_connection() if con.get_flags() & (NM.SettingsConnectionFlags.NM_GENERATED | NM.SettingsConnectionFlags.NM_VOLATILE): continue except AttributeError: # Prior to NetworkManager 1.12, we can only guess # that a connection was generated/volatile. if con.get_unsaved(): continue for dev in active_con.get_devices(): ip_iface = dev.get_ip_iface() if ip_iface: active_interfaces.append(ip_iface) return active_interfaces def nm_get_interfaces_in_zone(zone): interfaces = [] for interface in nm_get_interfaces(): conn = nm_get_connection_of_interface(interface) if zone == nm_get_zone_of_connection(conn): interfaces.append(interface) return interfaces def nm_get_device_by_ip_iface(interface): """Get device from NM which has the given IP interface @param interface name @returns NM.Device instance or None """ check_nm_imported() for device in nm_get_client().get_devices(): ip_iface = device.get_ip_iface() if ip_iface is None: continue if ip_iface == interface: return device return None def nm_get_connection_of_interface(interface): """Get connection from NM that is using the interface @param interface name @returns connection that is using interface or None """ check_nm_imported() device = nm_get_device_by_ip_iface(interface) if device is None: return None active_con = device.get_active_connection() if active_con is None: return None try: con = active_con.get_connection() if con.get_flags() & NM.SettingsConnectionFlags.NM_GENERATED: return None except AttributeError: # Prior to NetworkManager 1.12, we can only guess # that a connection was generated. if con.get_unsaved(): return None return active_con.get_uuid() def nm_get_bus_name(): if not _nm_imported: return None try: bus = dbus.SystemBus() obj = bus.get_object(NM.DBUS_INTERFACE, NM.DBUS_PATH) name = obj.bus_name del obj, bus return name except Exception: log.debug2("Failed to get bus name of NetworkManager") return None def nm_get_dbus_interface(): if not _nm_imported: return "" return NM.DBUS_INTERFACE core/nftables.py 0000644 00000303311 15025011705 0007641 0 ustar 00 # -*- coding: utf-8 -*- # # Copyright (C) 2018 Red Hat, Inc. # # Authors: # Eric Garver <e@erig.me> # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see <http://www.gnu.org/licenses/>. # import copy import json import ipaddress from firewall.core.logger import log from firewall.functions import check_mac, getPortRange, normalizeIP6, \ check_single_address, check_address from firewall.errors import FirewallError, UNKNOWN_ERROR, INVALID_RULE, \ INVALID_ICMPTYPE, INVALID_TYPE, INVALID_ENTRY, \ INVALID_PORT from firewall.core.rich import Rich_Accept, Rich_Reject, Rich_Drop, Rich_Mark, \ Rich_Masquerade, Rich_ForwardPort, Rich_IcmpBlock, \ Rich_Tcp_Mss_Clamp, Rich_NFLog from firewall.core.base import DEFAULT_ZONE_TARGET from nftables.nftables import Nftables TABLE_NAME = "firewalld" TABLE_NAME_POLICY = TABLE_NAME + "_" + "policy_drop" TABLE_NAME_PROBE = TABLE_NAME + "_" + "probe" POLICY_CHAIN_PREFIX = "policy_" # Map iptables (table, chain) to hooks and priorities. # These are well defined by NF_IP_PRI_* defines in netfilter. # # This is analogous to ipXtables.BUILT_IN_CHAINS, but we omit the chains that # are only used for direct rules. # # Note: All hooks use their standard position + NFT_HOOK_OFFSET. This means # iptables will have DROP precedence. It also means that even if iptables # ACCEPTs a packet it may still be dropped later by firewalld's rules. # NFT_HOOK_OFFSET = 10 IPTABLES_TO_NFT_HOOK = { #"security": { # "INPUT": ("input", 50 + NFT_HOOK_OFFSET), # "OUTPUT": ("output", 50 + NFT_HOOK_OFFSET), # "FORWARD": ("forward", 50 + NFT_HOOK_OFFSET), #}, "raw": { # "PREROUTING": ("prerouting", -300 + NFT_HOOK_OFFSET), # "OUTPUT": ("output", -300 + NFT_HOOK_OFFSET), }, "mangle": { "PREROUTING": ("prerouting", -150 + NFT_HOOK_OFFSET), # "POSTROUTING": ("postrouting", -150 + NFT_HOOK_OFFSET), # "INPUT": ("input", -150 + NFT_HOOK_OFFSET), # "OUTPUT": ("output", -150 + NFT_HOOK_OFFSET), # "FORWARD": ("forward", -150 + NFT_HOOK_OFFSET), }, "nat": { "PREROUTING": ("prerouting", -100 + NFT_HOOK_OFFSET), "POSTROUTING": ("postrouting", 100 + NFT_HOOK_OFFSET), # "INPUT": ("input", 100 + NFT_HOOK_OFFSET), "OUTPUT": ("output", -100 + NFT_HOOK_OFFSET), }, "filter": { "PREROUTING": ("prerouting", 0 + NFT_HOOK_OFFSET), "INPUT": ("input", 0 + NFT_HOOK_OFFSET), "FORWARD": ("forward", 0 + NFT_HOOK_OFFSET), "OUTPUT": ("output", 0 + NFT_HOOK_OFFSET), }, } def _icmp_types_fragments(protocol, type, code=None): fragments = [{"match": {"left": {"payload": {"protocol": protocol, "field": "type"}}, "op": "==", "right": type}}] if code is not None: fragments.append({"match": {"left": {"payload": {"protocol": protocol, "field": "code"}}, "op": "==", "right": code}}) return fragments # Most ICMP types are provided by nft, but for the codes we have to use numeric # values. # ICMP_TYPES_FRAGMENTS = { "ipv4": { "communication-prohibited": _icmp_types_fragments("icmp", "destination-unreachable", 13), "destination-unreachable": _icmp_types_fragments("icmp", "destination-unreachable"), "echo-reply": _icmp_types_fragments("icmp", "echo-reply"), "echo-request": _icmp_types_fragments("icmp", "echo-request"), "fragmentation-needed": _icmp_types_fragments("icmp", "destination-unreachable", 4), "host-precedence-violation": _icmp_types_fragments("icmp", "destination-unreachable", 14), "host-prohibited": _icmp_types_fragments("icmp", "destination-unreachable", 10), "host-redirect": _icmp_types_fragments("icmp", "redirect", 1), "host-unknown": _icmp_types_fragments("icmp", "destination-unreachable", 7), "host-unreachable": _icmp_types_fragments("icmp", "destination-unreachable", 1), "ip-header-bad": _icmp_types_fragments("icmp", "parameter-problem", 1), "network-prohibited": _icmp_types_fragments("icmp", "destination-unreachable", 8), "network-redirect": _icmp_types_fragments("icmp", "redirect", 0), "network-unknown": _icmp_types_fragments("icmp", "destination-unreachable", 6), "network-unreachable": _icmp_types_fragments("icmp", "destination-unreachable", 0), "parameter-problem": _icmp_types_fragments("icmp", "parameter-problem"), "port-unreachable": _icmp_types_fragments("icmp", "destination-unreachable", 3), "precedence-cutoff": _icmp_types_fragments("icmp", "destination-unreachable", 15), "protocol-unreachable": _icmp_types_fragments("icmp", "destination-unreachable", 2), "redirect": _icmp_types_fragments("icmp", "redirect"), "required-option-missing": _icmp_types_fragments("icmp", "parameter-problem", 1), "router-advertisement": _icmp_types_fragments("icmp", "router-advertisement"), "router-solicitation": _icmp_types_fragments("icmp", "router-solicitation"), "source-quench": _icmp_types_fragments("icmp", "source-quench"), "source-route-failed": _icmp_types_fragments("icmp", "destination-unreachable", 5), "time-exceeded": _icmp_types_fragments("icmp", "time-exceeded"), "timestamp-reply": _icmp_types_fragments("icmp", "timestamp-reply"), "timestamp-request": _icmp_types_fragments("icmp", "timestamp-request"), "tos-host-redirect": _icmp_types_fragments("icmp", "redirect", 3), "tos-host-unreachable": _icmp_types_fragments("icmp", "destination-unreachable", 12), "tos-network-redirect": _icmp_types_fragments("icmp", "redirect", 2), "tos-network-unreachable": _icmp_types_fragments("icmp", "destination-unreachable", 11), "ttl-zero-during-reassembly": _icmp_types_fragments("icmp", "time-exceeded", 1), "ttl-zero-during-transit": _icmp_types_fragments("icmp", "time-exceeded", 0), }, "ipv6": { "address-unreachable": _icmp_types_fragments("icmpv6", "destination-unreachable", 3), "bad-header": _icmp_types_fragments("icmpv6", "parameter-problem", 0), "beyond-scope": _icmp_types_fragments("icmpv6", "destination-unreachable", 2), "communication-prohibited": _icmp_types_fragments("icmpv6", "destination-unreachable", 1), "destination-unreachable": _icmp_types_fragments("icmpv6", "destination-unreachable"), "echo-reply": _icmp_types_fragments("icmpv6", "echo-reply"), "echo-request": _icmp_types_fragments("icmpv6", "echo-request"), "failed-policy": _icmp_types_fragments("icmpv6", "destination-unreachable", 5), "mld-listener-done": _icmp_types_fragments("icmpv6", "mld-listener-done"), "mld-listener-query": _icmp_types_fragments("icmpv6", "mld-listener-query"), "mld-listener-report": _icmp_types_fragments("icmpv6", "mld-listener-report"), "mld2-listener-report": _icmp_types_fragments("icmpv6", "mld2-listener-report"), "neighbour-advertisement": _icmp_types_fragments("icmpv6", "nd-neighbor-advert"), "neighbour-solicitation": _icmp_types_fragments("icmpv6", "nd-neighbor-solicit"), "no-route": _icmp_types_fragments("icmpv6", "destination-unreachable", 0), "packet-too-big": _icmp_types_fragments("icmpv6", "packet-too-big"), "parameter-problem": _icmp_types_fragments("icmpv6", "parameter-problem"), "port-unreachable": _icmp_types_fragments("icmpv6", "destination-unreachable", 4), "redirect": _icmp_types_fragments("icmpv6", "nd-redirect"), "reject-route": _icmp_types_fragments("icmpv6", "destination-unreachable", 6), "router-advertisement": _icmp_types_fragments("icmpv6", "nd-router-advert"), "router-solicitation": _icmp_types_fragments("icmpv6", "nd-router-solicit"), "time-exceeded": _icmp_types_fragments("icmpv6", "time-exceeded"), "ttl-zero-during-reassembly": _icmp_types_fragments("icmpv6", "time-exceeded", 1), "ttl-zero-during-transit": _icmp_types_fragments("icmpv6", "time-exceeded", 0), "unknown-header-type": _icmp_types_fragments("icmpv6", "parameter-problem", 1), "unknown-option": _icmp_types_fragments("icmpv6", "parameter-problem", 2), } } class nftables(object): name = "nftables" policies_supported = True def __init__(self, fw): self._fw = fw self.restore_command_exists = True self.supports_table_owner = False self.available_tables = [] self.rule_to_handle = {} self.rule_ref_count = {} self.rich_rule_priority_counts = {} self.policy_priority_counts = {} self.zone_source_index_cache = {} self.nftables = Nftables() self.nftables.set_echo_output(True) self.nftables.set_handle_output(True) def _probe_support_table_owner(self): try: rules = { "nftables": [ {"metainfo": {"json_schema_version": 1}}, { "add": { "table": { "family": "inet", "name": TABLE_NAME_PROBE, "flags": ["owner", "persist"], } } }, ] } rc, output, _ = self.nftables.json_cmd(rules) if rc: raise ValueError("nftables probe table owner failed") # old nftables versions would ignore table flags in JSON, so we # must parse back and verify the flags are set. rules = { "nftables": [ {"metainfo": {"json_schema_version": 1}}, {"list": {"table": {"family": "inet", "name": TABLE_NAME_PROBE}}}, ] } self.nftables.set_echo_output(False) rc, output, _ = self.nftables.json_cmd(rules) self.nftables.set_echo_output(True) flags = output["nftables"][1]["table"]["flags"] self.set_rule( {"delete": {"table": {"family": "inet", "name": TABLE_NAME_PROBE}}}, self._fw.get_log_denied(), ) if "owner" not in flags or "persist" not in flags: raise ValueError("nftables probe table owner failed") log.debug2("nftables: probe_support(): owner flag is supported.") self.supports_table_owner = True except: log.debug2("nftables: probe_support(): owner flag is NOT supported.") self.supports_table_owner = False def probe_support(self): self._probe_support_table_owner() def _run_replace_zone_source(self, rule, zone_source_index_cache): for verb in ["add", "insert", "delete"]: if verb in rule: break if "%%ZONE_SOURCE%%" in rule[verb]["rule"]: zone_source = (rule[verb]["rule"]["%%ZONE_SOURCE%%"]["zone"], rule[verb]["rule"]["%%ZONE_SOURCE%%"]["address"]) del rule[verb]["rule"]["%%ZONE_SOURCE%%"] elif "%%ZONE_INTERFACE%%" in rule[verb]["rule"]: zone_source = None del rule[verb]["rule"]["%%ZONE_INTERFACE%%"] else: return family = rule[verb]["rule"]["family"] if zone_source and verb == "delete": if family in zone_source_index_cache and \ zone_source in zone_source_index_cache[family]: zone_source_index_cache[family].remove(zone_source) elif verb != "delete": if family not in zone_source_index_cache: zone_source_index_cache[family] = [] if zone_source: # order source based dispatch by zone name if zone_source not in zone_source_index_cache[family]: zone_source_index_cache[family].append(zone_source) zone_source_index_cache[family].sort(key=lambda x: x[0]) index = zone_source_index_cache[family].index(zone_source) else: index = len(zone_source_index_cache[family]) _verb_snippet = rule[verb] del rule[verb] if index == 0: rule["insert"] = _verb_snippet else: index -= 1 # point to the rule before insertion point rule["add"] = _verb_snippet rule["add"]["rule"]["index"] = index def reverse_rule(self, dict): if "insert" in dict: return {"delete": copy.deepcopy(dict["insert"])} elif "add" in dict: return {"delete": copy.deepcopy(dict["add"])} else: raise FirewallError(UNKNOWN_ERROR, "Failed to reverse rule") def _set_rule_replace_priority(self, rule, priority_counts, token): for verb in ["add", "insert", "delete"]: if verb in rule: break if token in rule[verb]["rule"]: priority = rule[verb]["rule"][token] del rule[verb]["rule"][token] if type(priority) != int: raise FirewallError(INVALID_RULE, "priority must be followed by a number") chain = (rule[verb]["rule"]["family"], rule[verb]["rule"]["chain"]) # family, chain # Add the rule to the priority counts. We don't need to store the # rule, just bump the ref count for the priority value. if verb == "delete": if chain not in priority_counts or \ priority not in priority_counts[chain] or \ priority_counts[chain][priority] <= 0: raise FirewallError(UNKNOWN_ERROR, "nonexistent or underflow of priority count") priority_counts[chain][priority] -= 1 else: if chain not in priority_counts: priority_counts[chain] = {} if priority not in priority_counts[chain]: priority_counts[chain][priority] = 0 # calculate index of new rule index = 0 for p in sorted(priority_counts[chain].keys()): if p == priority and verb == "insert": break index += priority_counts[chain][p] if p == priority and verb == "add": break priority_counts[chain][priority] += 1 _verb_snippet = rule[verb] del rule[verb] if index == 0: rule["insert"] = _verb_snippet else: index -= 1 # point to the rule before insertion point rule["add"] = _verb_snippet rule["add"]["rule"]["index"] = index def _get_rule_key(self, rule): for verb in ["add", "insert", "delete"]: if verb in rule and "rule" in rule[verb]: rule_key = copy.deepcopy(rule[verb]["rule"]) for non_key in ["index", "handle", "position"]: if non_key in rule_key: del rule_key[non_key] # str(rule_key) is insufficient because dictionary order is # not stable.. so abuse the JSON library rule_key = json.dumps(rule_key, sort_keys=True) return rule_key # Not a rule (it's a table, chain, etc) return None def set_rules(self, rules, log_denied): _valid_verbs = ["add", "insert", "delete", "flush", "replace"] _valid_add_verbs = ["add", "insert", "replace"] _deduplicated_rules = [] _executed_rules = [] rich_rule_priority_counts = copy.deepcopy(self.rich_rule_priority_counts) policy_priority_counts = copy.deepcopy(self.policy_priority_counts) zone_source_index_cache = copy.deepcopy(self.zone_source_index_cache) rule_ref_count = self.rule_ref_count.copy() for rule in rules: if type(rule) != dict: raise FirewallError(UNKNOWN_ERROR, "rule must be a dictionary, rule: %s" % (rule)) for verb in _valid_verbs: if verb in rule: break if verb not in rule: raise FirewallError(INVALID_RULE, "no valid verb found, rule: %s" % (rule)) rule_key = self._get_rule_key(rule) # rule deduplication if rule_key in rule_ref_count: log.debug2("%s: prev rule ref cnt %d, %s", self.__class__, rule_ref_count[rule_key], rule_key) if verb != "delete": rule_ref_count[rule_key] += 1 continue elif rule_ref_count[rule_key] > 1: rule_ref_count[rule_key] -= 1 continue elif rule_ref_count[rule_key] == 1: rule_ref_count[rule_key] -= 1 else: raise FirewallError(UNKNOWN_ERROR, "rule ref count bug: rule_key '%s', cnt %d" % (rule_key, rule_ref_count[rule_key])) elif rule_key and verb != "delete": rule_ref_count[rule_key] = 1 _deduplicated_rules.append(rule) _rule = copy.deepcopy(rule) if rule_key: # filter empty rule expressions. Rich rules add quite a bit of # them, but it makes the rest of the code simpler. libnftables # does not tolerate them. _rule[verb]["rule"]["expr"] = list(filter(None, _rule[verb]["rule"]["expr"])) self._set_rule_replace_priority(_rule, rich_rule_priority_counts, "%%RICH_RULE_PRIORITY%%") self._set_rule_replace_priority(_rule, policy_priority_counts, "%%POLICY_PRIORITY%%") self._run_replace_zone_source(_rule, zone_source_index_cache) # delete using rule handle if verb == "delete": _rule = {"delete": {"rule": {"family": _rule["delete"]["rule"]["family"], "table": _rule["delete"]["rule"]["table"], "chain": _rule["delete"]["rule"]["chain"], "handle": self.rule_to_handle[rule_key]}}} _executed_rules.append(_rule) json_blob = {"nftables": [{"metainfo": {"json_schema_version": 1}}] + _executed_rules} if log.getDebugLogLevel() >= 3: # guarded with if statement because json.dumps() is expensive. log.debug3("%s: calling python-nftables with JSON blob: %s", self.__class__, json.dumps(json_blob)) rc, output, error = self.nftables.json_cmd(json_blob) if rc != 0: raise ValueError("'%s' failed: %s\nJSON blob:\n%s" % ("python-nftables", error, json.dumps(json_blob))) self.rich_rule_priority_counts = rich_rule_priority_counts self.policy_priority_counts = policy_priority_counts self.zone_source_index_cache = zone_source_index_cache self.rule_ref_count = rule_ref_count index = 0 for rule in _deduplicated_rules: index += 1 # +1 due to metainfo rule_key = self._get_rule_key(rule) if not rule_key: continue if "delete" in rule: del self.rule_to_handle[rule_key] del self.rule_ref_count[rule_key] continue for verb in _valid_add_verbs: if verb in output["nftables"][index]: break if verb not in output["nftables"][index]: continue # don't bother tracking handles for the policy table as we simply # delete the entire table. if TABLE_NAME_POLICY == output["nftables"][index][verb]["rule"]["table"]: continue self.rule_to_handle[rule_key] = output["nftables"][index][verb]["rule"]["handle"] def set_rule(self, rule, log_denied): self.set_rules([rule], log_denied) return "" def get_available_tables(self, table=None): # Tables always exist in nftables return [table] if table else IPTABLES_TO_NFT_HOOK.keys() def _build_add_table_rules(self, table): rule = {"add": {"table": {"family": "inet", "name": table}}} if ( table == TABLE_NAME and self._fw._nftables_table_owner and self.supports_table_owner ): rule["add"]["table"]["flags"] = ["owner", "persist"] return [rule] def _build_delete_table_rules(self, table): # To avoid nftables returning ENOENT we always add the table before # deleting to guarantee it will exist. # # In the future, this add+delete should be replaced with "destroy", but # that verb is too new to rely upon. return self._build_add_table_rules(table) + [ {"delete": {"table": {"family": "inet", "name": table}}}, ] def build_flush_rules(self): self.rule_to_handle = {} self.rule_ref_count = {} self.rich_rule_priority_counts = {} self.policy_priority_counts = {} self.zone_source_index_cache = {} return self._build_delete_table_rules(TABLE_NAME) def _build_set_policy_rules_ct_rule(self, enable, hook): add_del = { True: "add", False: "delete" }[enable] return {add_del: {"rule": {"family": "inet", "table": TABLE_NAME_POLICY, "chain": "%s_%s" % ("filter", hook), "expr": [{"match": {"left": {"ct": {"key": "state"}}, "op": "in", "right": {"set": ["established", "related"]}}}, {"accept": None}]}}} def build_set_policy_rules(self, policy, policy_details): # Policy is not exposed to the user. It's only to make sure we DROP # packets while reloading and for panic mode. As such, using hooks with # a higher priority than our base chains is sufficient. rules = [] if policy == "PANIC": rules.extend(self._build_add_table_rules(TABLE_NAME_POLICY)) # Use "raw" priority for panic mode. This occurs before # conntrack, mangle, nat, etc for hook in ["prerouting", "output"]: rules.append({"add": {"chain": {"family": "inet", "table": TABLE_NAME_POLICY, "name": "%s_%s" % ("raw", hook), "type": "filter", "hook": hook, "prio": -300 + NFT_HOOK_OFFSET - 1, "policy": "drop"}}}) elif policy == "DROP": rules.extend(self._build_add_table_rules(TABLE_NAME_POLICY)) # To drop everything except existing connections we use # "filter" because it occurs _after_ conntrack. for hook in ("INPUT", "FORWARD", "OUTPUT"): d_policy = policy_details[hook] assert d_policy in ("ACCEPT", "REJECT", "DROP") hook = hook.lower() chain_name = f"filter_{hook}" rules.append({"add": {"chain": {"family": "inet", "table": TABLE_NAME_POLICY, "name": chain_name, "type": "filter", "hook": hook, "prio": 0 + NFT_HOOK_OFFSET - 1, "policy": "drop"}}}) rules.append(self._build_set_policy_rules_ct_rule(True, hook)) if d_policy == "ACCEPT": expr_fragment = {"accept": None} elif d_policy == "DROP": expr_fragment = {"drop": None} else: expr_fragment = { "reject": {"type": "icmpx", "expr": "admin-prohibited"} } rules.append( { "add": { "rule": { "family": "inet", "table": TABLE_NAME_POLICY, "chain": chain_name, "expr": [expr_fragment], } } } ) elif policy == "ACCEPT": rules += self._build_delete_table_rules(TABLE_NAME_POLICY) else: raise FirewallError(UNKNOWN_ERROR, "not implemented") return rules def supported_icmp_types(self, ipv=None): # nftables supports any icmp_type via arbitrary type/code matching. # We just need a translation for it in ICMP_TYPES_FRAGMENTS. supported = set() for _ipv in [ipv] if ipv else ICMP_TYPES_FRAGMENTS.keys(): supported.update(ICMP_TYPES_FRAGMENTS[_ipv].keys()) return list(supported) def build_default_tables(self): return self._build_add_table_rules(TABLE_NAME) def build_default_rules(self, log_denied="off"): default_rules = [] for chain in IPTABLES_TO_NFT_HOOK["mangle"].keys(): default_rules.append({"add": {"chain": {"family": "inet", "table": TABLE_NAME, "name": "mangle_%s" % chain, "type": "filter", "hook": "%s" % IPTABLES_TO_NFT_HOOK["mangle"][chain][0], "prio": IPTABLES_TO_NFT_HOOK["mangle"][chain][1]}}}) for dispatch_suffix in ["POLICIES_pre", "ZONES", "POLICIES_post"]: default_rules.append({"add": {"chain": {"family": "inet", "table": TABLE_NAME, "name": "mangle_%s_%s" % (chain, dispatch_suffix)}}}) for dispatch_suffix in ["ZONES"]: default_rules.append({"add": {"rule": {"family": "inet", "table": TABLE_NAME, "chain": "mangle_%s" % chain, "expr": [{"jump": {"target": "mangle_%s_%s" % (chain, dispatch_suffix)}}]}}}) for chain in IPTABLES_TO_NFT_HOOK["nat"].keys(): default_rules.append({"add": {"chain": {"family": "inet", "table": TABLE_NAME, "name": "nat_%s" % chain, "type": "nat", "hook": "%s" % IPTABLES_TO_NFT_HOOK["nat"][chain][0], "prio": IPTABLES_TO_NFT_HOOK["nat"][chain][1]}}}) if chain in ["OUTPUT"]: # nat, output does not have zone dispatch for dispatch_suffix in ["POLICIES_pre", "POLICIES_post"]: default_rules.append({"add": {"chain": {"family": "inet", "table": TABLE_NAME, "name": "nat_%s_%s" % (chain, dispatch_suffix)}}}) default_rules.append({"add": {"rule": {"family": "inet", "table": TABLE_NAME, "chain": "nat_%s" % chain, "expr": [{"jump": {"target": "nat_%s_%s" % (chain, dispatch_suffix)}}]}}}) else: for dispatch_suffix in ["POLICIES_pre", "ZONES", "POLICIES_post"]: default_rules.append({"add": {"chain": {"family": "inet", "table": TABLE_NAME, "name": "nat_%s_%s" % (chain, dispatch_suffix)}}}) for dispatch_suffix in ["ZONES"]: default_rules.append({"add": {"rule": {"family": "inet", "table": TABLE_NAME, "chain": "nat_%s" % chain, "expr": [{"jump": {"target": "nat_%s_%s" % (chain, dispatch_suffix)}}]}}}) for chain in IPTABLES_TO_NFT_HOOK["filter"].keys(): default_rules.append({"add": {"chain": {"family": "inet", "table": TABLE_NAME, "name": "filter_%s" % chain, "type": "filter", "hook": "%s" % IPTABLES_TO_NFT_HOOK["filter"][chain][0], "prio": IPTABLES_TO_NFT_HOOK["filter"][chain][1]}}}) # filter, INPUT default_rules.append({"add": {"rule": {"family": "inet", "table": TABLE_NAME, "chain": "filter_%s" % "INPUT", "expr": [{"match": {"left": {"ct": {"key": "state"}}, "op": "in", "right": {"set": ["established", "related"]}}}, {"accept": None}]}}}) default_rules.append({"add": {"rule": {"family": "inet", "table": TABLE_NAME, "chain": "filter_%s" % "INPUT", "expr": [{"match": {"left": {"ct": {"key": "status"}}, "op": "in", "right": "dnat"}}, {"accept": None}]}}}) default_rules.append({"add": {"rule": {"family": "inet", "table": TABLE_NAME, "chain": "filter_%s" % "INPUT", "expr": [{"match": {"left": {"meta": {"key": "iifname"}}, "op": "==", "right": "lo"}}, {"accept": None}]}}}) if log_denied != "off": default_rules.append({"add": {"rule": {"family": "inet", "table": TABLE_NAME, "chain": "filter_%s" % "INPUT", "expr": [{"match": {"left": {"ct": {"key": "state"}}, "op": "in", "right": {"set": ["invalid"]}}}, self._pkttype_match_fragment(log_denied), {"log": {"prefix": "STATE_INVALID_DROP: "}}]}}}) default_rules.append({"add": {"rule": {"family": "inet", "table": TABLE_NAME, "chain": "filter_%s" % "INPUT", "expr": [{"match": {"left": {"ct": {"key": "state"}}, "op": "in", "right": {"set": ["invalid"]}}}, {"drop": None}]}}}) for dispatch_suffix in ["POLICIES_pre", "ZONES", "POLICIES_post"]: default_rules.append({"add": {"chain": {"family": "inet", "table": TABLE_NAME, "name": "filter_%s_%s" % ("INPUT", dispatch_suffix)}}}) for dispatch_suffix in ["ZONES"]: default_rules.append({"add": {"rule": {"family": "inet", "table": TABLE_NAME, "chain": "filter_%s" % "INPUT", "expr": [{"jump": {"target": "filter_%s_%s" % ("INPUT", dispatch_suffix)}}]}}}) if log_denied != "off": default_rules.append({"add": {"rule": {"family": "inet", "table": TABLE_NAME, "chain": "filter_%s" % "INPUT", "expr": [self._pkttype_match_fragment(log_denied), {"log": {"prefix": "FINAL_REJECT: "}}]}}}) default_rules.append({"add": {"rule": {"family": "inet", "table": TABLE_NAME, "chain": "filter_%s" % "INPUT", "expr": [{"reject": {"type": "icmpx", "expr": "admin-prohibited"}}]}}}) # filter, FORWARD default_rules.append({"add": {"rule": {"family": "inet", "table": TABLE_NAME, "chain": "filter_%s" % "FORWARD", "expr": [{"match": {"left": {"ct": {"key": "state"}}, "op": "in", "right": {"set": ["established", "related"]}}}, {"accept": None}]}}}) default_rules.append({"add": {"rule": {"family": "inet", "table": TABLE_NAME, "chain": "filter_%s" % "FORWARD", "expr": [{"match": {"left": {"ct": {"key": "status"}}, "op": "in", "right": "dnat"}}, {"accept": None}]}}}) default_rules.append({"add": {"rule": {"family": "inet", "table": TABLE_NAME, "chain": "filter_%s" % "FORWARD", "expr": [{"match": {"left": {"meta": {"key": "iifname"}}, "op": "==", "right": "lo"}}, {"accept": None}]}}}) if log_denied != "off": default_rules.append({"add": {"rule": {"family": "inet", "table": TABLE_NAME, "chain": "filter_%s" % "FORWARD", "expr": [{"match": {"left": {"ct": {"key": "state"}}, "op": "in", "right": {"set": ["invalid"]}}}, self._pkttype_match_fragment(log_denied), {"log": {"prefix": "STATE_INVALID_DROP: "}}]}}}) default_rules.append({"add": {"rule": {"family": "inet", "table": TABLE_NAME, "chain": "filter_%s" % "FORWARD", "expr": [{"match": {"left": {"ct": {"key": "state"}}, "op": "in", "right": {"set": ["invalid"]}}}, {"drop": None}]}}}) for dispatch_suffix in ["POLICIES_pre"]: default_rules.append({"add": {"chain": {"family": "inet", "table": TABLE_NAME, "name": "filter_%s_%s" % ("FORWARD", dispatch_suffix)}}}) for dispatch_suffix in ["ZONES"]: default_rules.append({"add": {"chain": {"family": "inet", "table": TABLE_NAME, "name": "filter_%s_%s" % ("FORWARD", dispatch_suffix)}}}) default_rules.append({"add": {"rule": {"family": "inet", "table": TABLE_NAME, "chain": "filter_%s" % "FORWARD", "expr": [{"jump": {"target": "filter_%s_%s" % ("FORWARD", dispatch_suffix)}}]}}}) for dispatch_suffix in ["POLICIES_post"]: default_rules.append({"add": {"chain": {"family": "inet", "table": TABLE_NAME, "name": "filter_%s_%s" % ("FORWARD", dispatch_suffix)}}}) if log_denied != "off": default_rules.append({"add": {"rule": {"family": "inet", "table": TABLE_NAME, "chain": "filter_%s" % "FORWARD", "expr": [self._pkttype_match_fragment(log_denied), {"log": {"prefix": "FINAL_REJECT: "}}]}}}) default_rules.append({"add": {"rule": {"family": "inet", "table": TABLE_NAME, "chain": "filter_%s" % "FORWARD", "expr": [{"reject": {"type": "icmpx", "expr": "admin-prohibited"}}]}}}) # filter, OUTPUT default_rules.append({"add": {"rule": {"family": "inet", "table": TABLE_NAME, "chain": "filter_%s" % "OUTPUT", "expr": [{"match": {"left": {"ct": {"key": "state"}}, "op": "in", "right": {"set": ["established", "related"]}}}, {"accept": None}]}}}) default_rules.append({"add": {"rule": {"family": "inet", "table": TABLE_NAME, "chain": "filter_OUTPUT", "expr": [{"match": {"left": {"meta": {"key": "oifname"}}, "op": "==", "right": "lo"}}, {"accept": None}]}}}) for dispatch_suffix in ["POLICIES_pre"]: default_rules.append({"add": {"chain": {"family": "inet", "table": TABLE_NAME, "name": "filter_%s_%s" % ("OUTPUT", dispatch_suffix)}}}) default_rules.append({"add": {"rule": {"family": "inet", "table": TABLE_NAME, "chain": "filter_%s" % "OUTPUT", "expr": [{"jump": {"target": "filter_%s_%s" % ("OUTPUT", dispatch_suffix)}}]}}}) for dispatch_suffix in ["POLICIES_post"]: default_rules.append({"add": {"chain": {"family": "inet", "table": TABLE_NAME, "name": "filter_%s_%s" % ("OUTPUT", dispatch_suffix)}}}) default_rules.append({"add": {"rule": {"family": "inet", "table": TABLE_NAME, "chain": "filter_%s" % "OUTPUT", "expr": [{"jump": {"target": "filter_%s_%s" % ("OUTPUT", dispatch_suffix)}}]}}}) return default_rules def get_zone_table_chains(self, table): if table == "filter": return ["INPUT", "FORWARD"] if table == "mangle": return ["PREROUTING"] if table == "nat": return ["PREROUTING", "POSTROUTING"] return [] def build_policy_ingress_egress_rules(self, enable, policy, table, chain, ingress_interfaces, egress_interfaces, ingress_sources, egress_sources): p_obj = self._fw.policy.get_policy(policy) chain_suffix = "pre" if p_obj.priority < 0 else "post" isSNAT = True if (table == "nat" and chain == "POSTROUTING") else False _policy = self._fw.policy.policy_base_chain_name(policy, table, POLICY_CHAIN_PREFIX, isSNAT) ingress_fragments = [] egress_fragments = [] ingress_interfaces_without_wildcards = [] egress_interfaces_without_wildcards = [] # wildcard interfaces must be handled individually because the nftables # backend does not allow them inside of an anonymous set for ingress_interface in ingress_interfaces: if ingress_interface[len(ingress_interface)-1] == "+": ingress_fragments.append({"match": {"left": {"meta": {"key": "iifname"}}, "op": "==", "right": ingress_interface[:len(ingress_interface)-1] + "*"}}) else: ingress_interfaces_without_wildcards.append(ingress_interface) for egress_interface in egress_interfaces: if egress_interface[len(egress_interface)-1] == "+": egress_fragments.append({"match": {"left": {"meta": {"key": "oifname"}}, "op": "==", "right": egress_interface[:len(egress_interface)-1] + "*"}}) else: egress_interfaces_without_wildcards.append(egress_interface) if ingress_interfaces_without_wildcards: ingress_fragments.append({"match": {"left": {"meta": {"key": "iifname"}}, "op": "==", "right": {"set": ingress_interfaces_without_wildcards}}}) if egress_interfaces_without_wildcards: egress_fragments.append({"match": {"left": {"meta": {"key": "oifname"}}, "op": "==", "right": {"set": egress_interfaces_without_wildcards}}}) if ingress_sources: for src in ingress_sources: ingress_fragments.append(self._rule_addr_fragment("saddr", src)) if egress_sources: for dst in egress_sources: egress_fragments.append(self._rule_addr_fragment("daddr", dst)) def _generate_policy_dispatch_rule(ingress_fragment, egress_fragment): if ingress_fragment and egress_fragment: # The IP families must be the same # if "payload" in ingress_fragment["match"]["left"] and \ "payload" in egress_fragment["match"]["left"] and \ ingress_fragment["match"]["left"]["payload"]["protocol"] != \ egress_fragment["match"]["left"]["payload"]["protocol"]: return None expr_fragments = [] if ingress_fragment: expr_fragments.append(ingress_fragment) if egress_fragment: expr_fragments.append(egress_fragment) expr_fragments.append({"jump": {"target": "%s_%s" % (table, _policy)}}) rule = {"family": "inet", "table": TABLE_NAME, "chain": "%s_%s_POLICIES_%s" % (table, chain, chain_suffix), "expr": expr_fragments} rule.update(self._policy_priority_fragment(p_obj)) if enable: return {"add": {"rule": rule}} else: return {"delete": {"rule": rule}} rules = [] if ingress_fragments: # zone --> [zone, ANY, HOST] for ingress_fragment in ingress_fragments: if egress_fragments: # zone --> zone for egress_fragment in egress_fragments: rules.append(_generate_policy_dispatch_rule(ingress_fragment, egress_fragment)) else: # zone --> [ANY, HOST] rules.append(_generate_policy_dispatch_rule(ingress_fragment, None)) else: # [ANY, HOST] --> [zone, ANY, HOST] if egress_fragments: # [ANY, HOST] --> zone for egress_fragment in egress_fragments: rules.append(_generate_policy_dispatch_rule(None, egress_fragment)) else: # [ANY, HOST] --> [ANY, HOST] rules.append(_generate_policy_dispatch_rule(None, None)) return rules def build_zone_source_interface_rules(self, enable, zone, policy, interface, table, chain, append=False): isSNAT = True if (table == "nat" and chain == "POSTROUTING") else False _policy = self._fw.policy.policy_base_chain_name(policy, table, POLICY_CHAIN_PREFIX, isSNAT=isSNAT) opt = { "PREROUTING": "iifname", "POSTROUTING": "oifname", "INPUT": "iifname", "FORWARD": "iifname", "OUTPUT": "oifname", }[chain] if interface[len(interface)-1] == "+": interface = interface[:len(interface)-1] + "*" action = "goto" if interface == "*": expr_fragments = [{action: {"target": "%s_%s" % (table, _policy)}}] else: expr_fragments = [{"match": {"left": {"meta": {"key": opt}}, "op": "==", "right": interface}}, {action: {"target": "%s_%s" % (table, _policy)}}] if enable and not append: verb = "insert" rule = {"family": "inet", "table": TABLE_NAME, "chain": "%s_%s_ZONES" % (table, chain), "expr": expr_fragments} rule.update(self._zone_interface_fragment()) elif enable: verb = "add" rule = {"family": "inet", "table": TABLE_NAME, "chain": "%s_%s_ZONES" % (table, chain), "expr": expr_fragments} else: verb = "delete" rule = {"family": "inet", "table": TABLE_NAME, "chain": "%s_%s_ZONES" % (table, chain), "expr": expr_fragments} if not append: rule.update(self._zone_interface_fragment()) return [{verb: {"rule": rule}}] def build_zone_source_address_rules(self, enable, zone, policy, address, table, chain): isSNAT = True if (table == "nat" and chain == "POSTROUTING") else False _policy = self._fw.policy.policy_base_chain_name(policy, table, POLICY_CHAIN_PREFIX, isSNAT=isSNAT) add_del = { True: "insert", False: "delete" }[enable] opt = { "PREROUTING": "saddr", "POSTROUTING": "daddr", "INPUT": "saddr", "FORWARD": "saddr", "OUTPUT": "daddr", }[chain] action = "goto" rule = {"family": "inet", "table": TABLE_NAME, "chain": "%s_%s_ZONES" % (table, chain), "expr": [self._rule_addr_fragment(opt, address), {action: {"target": "%s_%s" % (table, _policy)}}]} rule.update(self._zone_source_fragment(zone, address)) return [{add_del: {"rule": rule}}] def build_policy_chain_rules(self, enable, policy, table, chain): add_del = { True: "add", False: "delete" }[enable] isSNAT = True if (table == "nat" and chain == "POSTROUTING") else False _policy = self._fw.policy.policy_base_chain_name(policy, table, POLICY_CHAIN_PREFIX, isSNAT=isSNAT) p_obj = self._fw.policy.get_policy(policy) rules = [] rules.append({add_del: {"chain": {"family": "inet", "table": TABLE_NAME, "name": "%s_%s" % (table, _policy)}}}) for chain_suffix in ["pre", "log", "deny", "allow", "post"]: rules.append({add_del: {"chain": {"family": "inet", "table": TABLE_NAME, "name": "%s_%s_%s" % (table, _policy, chain_suffix)}}}) # policy dispatch if p_obj.derived_from_zone: rules.append({"add": {"rule": {"family": "inet", "table": TABLE_NAME, "chain": "%s_%s" % (table, _policy), "expr": [{"jump": {"target": "%s_%s_%s" % (table, chain, "POLICIES_pre")}}]}}}) for chain_suffix in ["pre", "log", "deny", "allow", "post"]: rules.append({add_del: {"rule": {"family": "inet", "table": TABLE_NAME, "chain": "%s_%s" % (table, _policy), "expr": [{"jump": {"target": "%s_%s_%s" % (table, _policy, chain_suffix)}}]}}}) # since zones are always terminal we need to jump to the policy # dispatch just before the catch-all accept/drop if p_obj.derived_from_zone: rules.append({"add": {"rule": {"family": "inet", "table": TABLE_NAME, "chain": "%s_%s" % (table, _policy), "expr": [{"jump": {"target": "%s_%s_%s" % (table, chain, "POLICIES_post")}}]}}}) target = self._fw.policy._policies[policy].target if self._fw.get_log_denied() != "off": if table == "filter": if target in [DEFAULT_ZONE_TARGET, "REJECT", "%%REJECT%%", "DROP"]: log_suffix = target if target in [DEFAULT_ZONE_TARGET, "%%REJECT%%"]: log_suffix = "REJECT" rules.append({add_del: {"rule": {"family": "inet", "table": TABLE_NAME, "chain": "%s_%s" % (table, _policy), "expr": [self._pkttype_match_fragment(self._fw.get_log_denied()), {"log": {"prefix": "filter_%s_%s: " % (_policy, log_suffix)}}]}}}) if table == "filter" and \ target in [DEFAULT_ZONE_TARGET, "ACCEPT", "REJECT", "%%REJECT%%", "DROP"]: if target in [DEFAULT_ZONE_TARGET, "%%REJECT%%", "REJECT"]: target_fragment = self._reject_fragment() else: target_fragment = {target.lower(): None} rules.append({add_del: {"rule": {"family": "inet", "table": TABLE_NAME, "chain": "%s_%s" % (table, _policy), "expr": [target_fragment]}}}) if not enable: rules.reverse() return rules def _pkttype_match_fragment(self, pkttype): if pkttype == "all": return {} elif pkttype in ["unicast", "broadcast", "multicast"]: return {"match": {"left": {"meta": {"key": "pkttype"}}, "op": "==", "right": pkttype}} raise FirewallError(INVALID_RULE, "Invalid pkttype \"%s\"", pkttype) def _reject_types_fragment(self, reject_type): frags = { # REJECT_TYPES : <nft reject rule fragment> "icmp-host-prohibited" : {"reject": {"type": "icmp", "expr": "host-prohibited"}}, "host-prohib" : {"reject": {"type": "icmp", "expr": "host-prohibited"}}, "icmp-net-prohibited" : {"reject": {"type": "icmp", "expr": "net-prohibited"}}, "net-prohib" : {"reject": {"type": "icmp", "expr": "net-prohibited"}}, "icmp-admin-prohibited" : {"reject": {"type": "icmp", "expr": "admin-prohibited"}}, "admin-prohib" : {"reject": {"type": "icmp", "expr": "admin-prohibited"}}, "icmp6-adm-prohibited" : {"reject": {"type": "icmpv6", "expr": "admin-prohibited"}}, "adm-prohibited" : {"reject": {"type": "icmpv6", "expr": "admin-prohibited"}}, "icmp-net-unreachable" : {"reject": {"type": "icmp", "expr": "net-unreachable"}}, "net-unreach" : {"reject": {"type": "icmp", "expr": "net-unreachable"}}, "icmp-host-unreachable" : {"reject": {"type": "icmp", "expr": "host-unreachable"}}, "host-unreach" : {"reject": {"type": "icmp", "expr": "host-unreachable"}}, "icmp-port-unreachable" : {"reject": {"type": "icmp", "expr": "port-unreachable"}}, "icmp6-port-unreachable" : {"reject": {"type": "icmpv6", "expr": "port-unreachable"}}, "port-unreach" : {"reject": {"type": "icmpx", "expr": "port-unreachable"}}, "icmp-proto-unreachable" : {"reject": {"type": "icmp", "expr": "prot-unreachable"}}, "proto-unreach" : {"reject": {"type": "icmp", "expr": "prot-unreachable"}}, "icmp6-addr-unreachable" : {"reject": {"type": "icmpv6", "expr": "addr-unreachable"}}, "addr-unreach" : {"reject": {"type": "icmpv6", "expr": "addr-unreachable"}}, "icmp6-no-route" : {"reject": {"type": "icmpv6", "expr": "no-route"}}, "no-route" : {"reject": {"type": "icmpv6", "expr": "no-route"}}, "tcp-reset" : {"reject": {"type": "tcp reset"}}, "tcp-rst" : {"reject": {"type": "tcp reset"}}, } return frags[reject_type] def _reject_fragment(self): return {"reject": {"type": "icmpx", "expr": "admin-prohibited"}} def _icmp_match_fragment(self): return {"match": {"left": {"meta": {"key": "l4proto"}}, "op": "==", "right": {"set": ["icmp", "icmpv6"]}}} def _rich_rule_limit_fragment(self, limit): if not limit: return {} rich_to_nft = { "s" : "second", "m" : "minute", "h" : "hour", "d" : "day", } try: i = limit.value.index("/") except ValueError: raise FirewallError(INVALID_RULE, "Expected '/' in limit") return {"limit": {"rate": int(limit.value[0:i]), "per": rich_to_nft[limit.value[i+1]]}} def _rich_rule_chain_suffix(self, rich_rule): if type(rich_rule.element) in [Rich_Masquerade, Rich_ForwardPort, Rich_IcmpBlock, Rich_Tcp_Mss_Clamp]: # These are special and don't have an explicit action pass elif rich_rule.action: if type(rich_rule.action) not in [Rich_Accept, Rich_Reject, Rich_Drop, Rich_Mark]: raise FirewallError(INVALID_RULE, "Unknown action %s" % type(rich_rule.action)) else: raise FirewallError(INVALID_RULE, "No rule action specified.") if rich_rule.priority == 0: if type(rich_rule.element) in [Rich_Masquerade, Rich_ForwardPort, Rich_Tcp_Mss_Clamp] or \ type(rich_rule.action) in [Rich_Accept, Rich_Mark]: return "allow" elif type(rich_rule.element) in [Rich_IcmpBlock] or \ type(rich_rule.action) in [Rich_Reject, Rich_Drop]: return "deny" elif rich_rule.priority < 0: return "pre" else: return "post" def _rich_rule_chain_suffix_from_log(self, rich_rule): if not rich_rule.log and not rich_rule.audit: raise FirewallError(INVALID_RULE, "Not log or audit") if rich_rule.priority == 0: return "log" elif rich_rule.priority < 0: return "pre" else: return "post" def _zone_interface_fragment(self): return {"%%ZONE_INTERFACE%%": None} def _zone_source_fragment(self, zone, address): if check_single_address("ipv6", address): address = normalizeIP6(address) elif check_address("ipv6", address): addr_split = address.split("/") address = normalizeIP6(addr_split[0]) + "/" + addr_split[1] return {"%%ZONE_SOURCE%%": {"zone": zone, "address": address}} def _policy_priority_fragment(self, policy): return {"%%POLICY_PRIORITY%%": policy.priority} def _rich_rule_priority_fragment(self, rich_rule): if not rich_rule or rich_rule.priority == 0: return {} return {"%%RICH_RULE_PRIORITY%%": rich_rule.priority} def _rich_rule_log(self, policy, rich_rule, enable, table, expr_fragments): if not rich_rule.log: return {} _policy = self._fw.policy.policy_base_chain_name(policy, table, POLICY_CHAIN_PREFIX) add_del = { True: "add", False: "delete" }[enable] chain_suffix = self._rich_rule_chain_suffix_from_log(rich_rule) log_options = {} if type(rich_rule.log) == Rich_NFLog: log_options["group"] = int(rich_rule.log.group) if rich_rule.log.group else 0 if rich_rule.log.threshold: log_options["queue-threshold"] = int(rich_rule.log.threshold) else: if rich_rule.log.level: level = "warn" if "warning" == rich_rule.log.level else rich_rule.log.level log_options["level"] = "%s" % level if rich_rule.log.prefix: log_options["prefix"] = "%s" % rich_rule.log.prefix rule = {"family": "inet", "table": TABLE_NAME, "chain": "%s_%s_%s" % (table, _policy, chain_suffix), "expr": expr_fragments + [self._rich_rule_limit_fragment(rich_rule.log.limit), {"log": log_options}]} rule.update(self._rich_rule_priority_fragment(rich_rule)) return {add_del: {"rule": rule}} def _rich_rule_audit(self, policy, rich_rule, enable, table, expr_fragments): if not rich_rule.audit: return {} _policy = self._fw.policy.policy_base_chain_name(policy, table, POLICY_CHAIN_PREFIX) add_del = { True: "add", False: "delete" }[enable] chain_suffix = self._rich_rule_chain_suffix_from_log(rich_rule) rule = {"family": "inet", "table": TABLE_NAME, "chain": "%s_%s_%s" % (table, _policy, chain_suffix), "expr": expr_fragments + [self._rich_rule_limit_fragment(rich_rule.audit.limit), {"log": {"level": "audit"}}]} rule.update(self._rich_rule_priority_fragment(rich_rule)) return {add_del: {"rule": rule}} def _rich_rule_action(self, policy, rich_rule, enable, table, expr_fragments): if not rich_rule.action: return {} _policy = self._fw.policy.policy_base_chain_name(policy, table, POLICY_CHAIN_PREFIX) add_del = { True: "add", False: "delete" }[enable] chain_suffix = self._rich_rule_chain_suffix(rich_rule) chain = "%s_%s_%s" % (table, _policy, chain_suffix) if type(rich_rule.action) == Rich_Accept: rule_action = {"accept": None} elif type(rich_rule.action) == Rich_Reject: if rich_rule.action.type: rule_action = self._reject_types_fragment(rich_rule.action.type) else: rule_action = {"reject": None} elif type(rich_rule.action) == Rich_Drop: rule_action = {"drop": None} elif type(rich_rule.action) == Rich_Mark: table = "mangle" _policy = self._fw.policy.policy_base_chain_name(policy, table, POLICY_CHAIN_PREFIX) chain = "%s_%s_%s" % (table, _policy, chain_suffix) value = rich_rule.action.set.split("/") if len(value) > 1: rule_action = {"mangle": {"key": {"meta": {"key": "mark"}}, "value": {"^": [{"&": [{"meta": {"key": "mark"}}, value[1]]}, value[0]]}}} else: rule_action = {"mangle": {"key": {"meta": {"key": "mark"}}, "value": value[0]}} else: raise FirewallError(INVALID_RULE, "Unknown action %s" % type(rich_rule.action)) rule = {"family": "inet", "table": TABLE_NAME, "chain": chain, "expr": expr_fragments + [self._rich_rule_limit_fragment(rich_rule.action.limit), rule_action]} rule.update(self._rich_rule_priority_fragment(rich_rule)) return {add_del: {"rule": rule}} def _rule_addr_fragment(self, addr_field, address, invert=False): if address.startswith("ipset:"): return self._set_match_fragment(address[len("ipset:"):], True if "daddr" == addr_field else False, invert) else: if check_mac(address): family = "ether" elif check_single_address("ipv4", address): family = "ip" elif check_address("ipv4", address): family = "ip" normalized_address = ipaddress.IPv4Network(address, strict=False) address = {"prefix": {"addr": normalized_address.network_address.compressed, "len": normalized_address.prefixlen}} elif check_single_address("ipv6", address): family = "ip6" address = normalizeIP6(address) else: family = "ip6" addr_len = address.split("/") address = {"prefix": {"addr": normalizeIP6(addr_len[0]), "len": int(addr_len[1])}} return {"match": {"left": {"payload": {"protocol": family, "field": addr_field}}, "op": "!=" if invert else "==", "right": address}} def _rich_rule_family_fragment(self, rich_family): if not rich_family: return {} if rich_family not in ["ipv4", "ipv6"]: raise FirewallError(INVALID_RULE, "Invalid family" % rich_family) return {"match": {"left": {"meta": {"key": "nfproto"}}, "op": "==", "right": rich_family}} def _rich_rule_destination_fragment(self, rich_dest): if not rich_dest: return {} if rich_dest.addr: address = rich_dest.addr elif rich_dest.ipset: address = "ipset:" + rich_dest.ipset return self._rule_addr_fragment("daddr", address, invert=rich_dest.invert) def _rich_rule_source_fragment(self, rich_source): if not rich_source: return {} if rich_source.addr: address = rich_source.addr elif hasattr(rich_source, "mac") and rich_source.mac: address = rich_source.mac elif hasattr(rich_source, "ipset") and rich_source.ipset: address = "ipset:" + rich_source.ipset return self._rule_addr_fragment("saddr", address, invert=rich_source.invert) def _port_fragment(self, port): range = getPortRange(port) if isinstance(range, int) and range < 0: raise FirewallError(INVALID_PORT) elif len(range) == 1: return range[0] else: return {"range": [range[0], range[1]]} def build_policy_ports_rules(self, enable, policy, proto, port, destination=None, rich_rule=None): add_del = { True: "add", False: "delete" }[enable] table = "filter" _policy = self._fw.policy.policy_base_chain_name(policy, table, POLICY_CHAIN_PREFIX) expr_fragments = [] if rich_rule: expr_fragments.append(self._rich_rule_family_fragment(rich_rule.family)) if destination: expr_fragments.append(self._rule_addr_fragment("daddr", destination)) if rich_rule: expr_fragments.append(self._rich_rule_destination_fragment(rich_rule.destination)) expr_fragments.append(self._rich_rule_source_fragment(rich_rule.source)) expr_fragments.append({"match": {"left": {"payload": {"protocol": proto, "field": "dport"}}, "op": "==", "right": self._port_fragment(port)}}) rules = [] if rich_rule: rules.append(self._rich_rule_log(policy, rich_rule, enable, table, expr_fragments)) rules.append(self._rich_rule_audit(policy, rich_rule, enable, table, expr_fragments)) rules.append(self._rich_rule_action(policy, rich_rule, enable, table, expr_fragments)) else: rules.append({add_del: {"rule": {"family": "inet", "table": TABLE_NAME, "chain": "%s_%s_allow" % (table, _policy), "expr": expr_fragments + [{"accept": None}]}}}) return rules def build_policy_protocol_rules(self, enable, policy, protocol, destination=None, rich_rule=None): add_del = { True: "add", False: "delete" }[enable] table = "filter" _policy = self._fw.policy.policy_base_chain_name(policy, table, POLICY_CHAIN_PREFIX) expr_fragments = [] if rich_rule: expr_fragments.append(self._rich_rule_family_fragment(rich_rule.family)) if destination: expr_fragments.append(self._rule_addr_fragment("daddr", destination)) if rich_rule: expr_fragments.append(self._rich_rule_destination_fragment(rich_rule.destination)) expr_fragments.append(self._rich_rule_source_fragment(rich_rule.source)) expr_fragments.append({"match": {"left": {"meta": {"key": "l4proto"}}, "op": "==", "right": protocol}}) rules = [] if rich_rule: rules.append(self._rich_rule_log(policy, rich_rule, enable, table, expr_fragments)) rules.append(self._rich_rule_audit(policy, rich_rule, enable, table, expr_fragments)) rules.append(self._rich_rule_action(policy, rich_rule, enable, table, expr_fragments)) else: rules.append({add_del: {"rule": {"family": "inet", "table": TABLE_NAME, "chain": "%s_%s_allow" % (table, _policy), "expr": expr_fragments + [{"accept": None}]}}}) return rules def build_policy_tcp_mss_clamp_rules(self, enable, policy, tcp_mss_clamp_value, destination=None, rich_rule=None): chain_suffix = "allow" table = "filter" _policy = self._fw.policy.policy_base_chain_name(policy, table, POLICY_CHAIN_PREFIX) add_del = { True: "add", False: "delete" }[enable] expr_fragments = [] if rich_rule: expr_fragments.append(self._rich_rule_destination_fragment(rich_rule.destination)) expr_fragments.append(self._rich_rule_source_fragment(rich_rule.source)) chain_suffix = self._rich_rule_chain_suffix(rich_rule) expr_fragments.append({"match": {"op": "in", "left": {"payload": {"protocol": "tcp","field": "flags"}}, "right": "syn"}}) if tcp_mss_clamp_value == "pmtu" or tcp_mss_clamp_value is None: expr_fragments.append({"mangle": {"key": {"tcp option": {"name": "maxseg","field": "size"}}, "value": {"rt": {"key": "mtu" }}}}) else: expr_fragments.append({"mangle": {"key": {"tcp option": {"name": "maxseg","field": "size"}}, "value": tcp_mss_clamp_value}}) return [{add_del: {"rule": {"family": "inet", "table": TABLE_NAME, "chain": "filter_%s_%s" % (_policy, chain_suffix), "expr": expr_fragments}}}] def build_policy_source_ports_rules(self, enable, policy, proto, port, destination=None, rich_rule=None): add_del = { True: "add", False: "delete" }[enable] table = "filter" _policy = self._fw.policy.policy_base_chain_name(policy, table, POLICY_CHAIN_PREFIX) expr_fragments = [] if rich_rule: expr_fragments.append(self._rich_rule_family_fragment(rich_rule.family)) if destination: expr_fragments.append(self._rule_addr_fragment("daddr", destination)) if rich_rule: expr_fragments.append(self._rich_rule_destination_fragment(rich_rule.destination)) expr_fragments.append(self._rich_rule_source_fragment(rich_rule.source)) expr_fragments.append({"match": {"left": {"payload": {"protocol": proto, "field": "sport"}}, "op": "==", "right": self._port_fragment(port)}}) rules = [] if rich_rule: rules.append(self._rich_rule_log(policy, rich_rule, enable, table, expr_fragments)) rules.append(self._rich_rule_audit(policy, rich_rule, enable, table, expr_fragments)) rules.append(self._rich_rule_action(policy, rich_rule, enable, table, expr_fragments)) else: rules.append({add_del: {"rule": {"family": "inet", "table": TABLE_NAME, "chain": "%s_%s_allow" % (table, _policy), "expr": expr_fragments + [{"accept": None}]}}}) return rules def build_policy_helper_ports_rules(self, enable, policy, proto, port, destination, helper_name, module_short_name): table = "filter" _policy = self._fw.policy.policy_base_chain_name(policy, table, POLICY_CHAIN_PREFIX) add_del = { True: "add", False: "delete" }[enable] rules = [] if enable: rules.append({"add": {"ct helper": {"family": "inet", "table": TABLE_NAME, "name": "helper-%s-%s" % (helper_name, proto), "type": module_short_name, "protocol": proto}}}) expr_fragments = [] if destination: expr_fragments.append(self._rule_addr_fragment("daddr", destination)) expr_fragments.append({"match": {"left": {"payload": {"protocol": proto, "field": "dport"}}, "op": "==", "right": self._port_fragment(port)}}) expr_fragments.append({"ct helper": "helper-%s-%s" % (helper_name, proto)}) rules.append({add_del: {"rule": {"family": "inet", "table": TABLE_NAME, "chain": "filter_%s_allow" % (_policy), "expr": expr_fragments}}}) return rules def build_zone_forward_rules(self, enable, zone, policy, table, interface=None, source=None): add_del = { True: "add", False: "delete" }[enable] _policy = self._fw.policy.policy_base_chain_name(policy, table, POLICY_CHAIN_PREFIX) rules = [] if interface: if interface[len(interface)-1] == "+": interface = interface[:len(interface)-1] + "*" expr = [{"match": {"left": {"meta": {"key": "oifname"}}, "op": "==", "right": interface}}, {"accept": None}] else: # source expr = [self._rule_addr_fragment("daddr", source), {"accept": None}] rule = {"family": "inet", "table": TABLE_NAME, "chain": "filter_%s_allow" % (_policy), "expr": expr} rules.append({add_del: {"rule": rule}}) return rules def build_policy_masquerade_rules(self, enable, policy, rich_rule=None): add_del = { True: "add", False: "delete" }[enable] rules = [] expr_fragments = [] if rich_rule: expr_fragments.append(self._rich_rule_family_fragment(rich_rule.family)) expr_fragments.append(self._rich_rule_destination_fragment(rich_rule.destination)) expr_fragments.append(self._rich_rule_source_fragment(rich_rule.source)) chain_suffix = self._rich_rule_chain_suffix(rich_rule) else: expr_fragments.append({"match": {"left": {"meta": {"key": "nfproto"}}, "op": "==", "right": "ipv4"}}) chain_suffix = "allow" table = "nat" _policy = self._fw.policy.policy_base_chain_name(policy, table, POLICY_CHAIN_PREFIX, isSNAT=True) rule = {"family": "inet", "table": TABLE_NAME, "chain": "nat_%s_%s" % (_policy, chain_suffix), "expr": expr_fragments + [{"match": {"left": {"meta": {"key": "oifname"}}, "op": "!=", "right": "lo"}}, {"masquerade": None}]} rule.update(self._rich_rule_priority_fragment(rich_rule)) rules.append({add_del: {"rule": rule}}) return rules def build_policy_forward_port_rules(self, enable, policy, port, protocol, toport, toaddr, rich_rule=None): table = "nat" _policy = self._fw.policy.policy_base_chain_name(policy, table, POLICY_CHAIN_PREFIX) add_del = { True: "add", False: "delete" }[enable] expr_fragments = [] if rich_rule: expr_fragments.append(self._rich_rule_family_fragment(rich_rule.family)) expr_fragments.append(self._rich_rule_destination_fragment(rich_rule.destination)) expr_fragments.append(self._rich_rule_source_fragment(rich_rule.source)) chain_suffix = self._rich_rule_chain_suffix(rich_rule) else: nfproto = "ipv4" if toaddr and check_single_address("ipv6", toaddr): nfproto = "ipv6" expr_fragments.append({"match": {"left": {"meta": {"key": "nfproto"}}, "op": "==", "right": nfproto}}) chain_suffix = "allow" expr_fragments.append({"match": {"left": {"payload": {"protocol": protocol, "field": "dport"}}, "op": "==", "right": self._port_fragment(port)}}) if toaddr: if check_single_address("ipv6", toaddr): toaddr = normalizeIP6(toaddr) if toport and toport != "": expr_fragments.append({"dnat": {"addr": toaddr, "port": self._port_fragment(toport)}}) else: expr_fragments.append({"dnat": {"addr": toaddr}}) else: expr_fragments.append({"redirect": {"port": self._port_fragment(toport)}}) rule = {"family": "inet", "table": TABLE_NAME, "chain": "nat_%s_%s" % (_policy, chain_suffix), "expr": expr_fragments} rule.update(self._rich_rule_priority_fragment(rich_rule)) return [{add_del: {"rule": rule}}] def _icmp_types_to_nft_fragments(self, ipv, icmp_type): if icmp_type in ICMP_TYPES_FRAGMENTS[ipv]: return ICMP_TYPES_FRAGMENTS[ipv][icmp_type] else: raise FirewallError(INVALID_ICMPTYPE, "ICMP type '%s' not supported by %s for %s" % (icmp_type, self.name, ipv)) def build_policy_icmp_block_rules(self, enable, policy, ict, rich_rule=None): table = "filter" _policy = self._fw.policy.policy_base_chain_name(policy, table, POLICY_CHAIN_PREFIX) add_del = { True: "add", False: "delete" }[enable] if rich_rule and rich_rule.ipvs: ipvs = rich_rule.ipvs elif ict.destination: ipvs = [] if "ipv4" in ict.destination: ipvs.append("ipv4") if "ipv6" in ict.destination: ipvs.append("ipv6") else: ipvs = ["ipv4", "ipv6"] rules = [] for ipv in ipvs: if self._fw.policy.query_icmp_block_inversion(policy): final_chain = "%s_%s_allow" % (table, _policy) target_fragment = {"accept": None} else: final_chain = "%s_%s_deny" % (table, _policy) target_fragment = self._reject_fragment() expr_fragments = [] if rich_rule: expr_fragments.append(self._rich_rule_family_fragment(rich_rule.family)) expr_fragments.append(self._rich_rule_destination_fragment(rich_rule.destination)) expr_fragments.append(self._rich_rule_source_fragment(rich_rule.source)) expr_fragments.extend(self._icmp_types_to_nft_fragments(ipv, ict.name)) if rich_rule: rules.append(self._rich_rule_log(policy, rich_rule, enable, table, expr_fragments)) rules.append(self._rich_rule_audit(policy, rich_rule, enable, table, expr_fragments)) if rich_rule.action: rules.append(self._rich_rule_action(policy, rich_rule, enable, table, expr_fragments)) else: chain_suffix = self._rich_rule_chain_suffix(rich_rule) rule = {"family": "inet", "table": TABLE_NAME, "chain": "%s_%s_%s" % (table, _policy, chain_suffix), "expr": expr_fragments + [self._reject_fragment()]} rule.update(self._rich_rule_priority_fragment(rich_rule)) rules.append({add_del: {"rule": rule}}) else: if self._fw.get_log_denied() != "off" and not self._fw.policy.query_icmp_block_inversion(policy): rules.append({add_del: {"rule": {"family": "inet", "table": TABLE_NAME, "chain": final_chain, "expr": (expr_fragments + [self._pkttype_match_fragment(self._fw.get_log_denied()), {"log": {"prefix": "%s_%s_ICMP_BLOCK: " % (table, policy)}}])}}}) rules.append({add_del: {"rule": {"family": "inet", "table": TABLE_NAME, "chain": final_chain, "expr": expr_fragments + [target_fragment]}}}) return rules def build_policy_icmp_block_inversion_rules(self, enable, policy): table = "filter" _policy = self._fw.policy.policy_base_chain_name(policy, table, POLICY_CHAIN_PREFIX) rules = [] add_del = { True: "add", False: "delete" }[enable] if self._fw.policy.query_icmp_block_inversion(policy): target_fragment = self._reject_fragment() else: target_fragment = {"accept": None} # WARN: The "index" used here must be kept in sync with # build_policy_chain_rules() # rules.append({add_del: {"rule": {"family": "inet", "table": TABLE_NAME, "chain": "%s_%s" % (table, _policy), "index": 6, "expr": [self._icmp_match_fragment(), target_fragment]}}}) if self._fw.get_log_denied() != "off" and self._fw.policy.query_icmp_block_inversion(policy): rules.append({add_del: {"rule": {"family": "inet", "table": TABLE_NAME, "chain": "%s_%s" % (table, _policy), "index": 6, "expr": [self._icmp_match_fragment(), self._pkttype_match_fragment(self._fw.get_log_denied()), {"log": {"prefix": "%s_%s_ICMP_BLOCK: " % (table, policy)}}]}}}) return rules def build_rpfilter_rules(self, log_denied=False): rules = [] rpfilter_chain = "filter_PREROUTING" if self._fw._ipv6_rpfilter == "loose": fib_flags = ["saddr", "mark"] elif self._fw._ipv6_rpfilter == "loose-forward": fib_flags = ["saddr", "mark"] rpfilter_chain = "filter_FORWARD" elif self._fw._ipv6_rpfilter == "strict-forward": fib_flags = ["saddr", "mark", "iif"] rpfilter_chain = "filter_FORWARD" else: fib_flags = ["saddr", "mark", "iif"] expr_fragments = [{"match": {"left": {"meta": {"key": "nfproto"}}, "op": "==", "right": "ipv6"}}, {"match": {"left": {"fib": {"flags": fib_flags, "result": "oif"}}, "op": "==", "right": False}}] if log_denied != "off": expr_fragments.append({"log": {"prefix": "rpfilter_DROP: "}}) expr_fragments.append({"drop": None}) rules.append({"insert": {"rule": {"family": "inet", "table": TABLE_NAME, "chain": rpfilter_chain, "expr": expr_fragments}}}) # RHBZ#1058505, RHBZ#1575431 (bug in kernel 4.16-4.17) if self._fw._ipv6_rpfilter not in ("loose-forward", "strict-forward"): # this rule doesn't make sense for forwarded packets rules.append({"insert": {"rule": {"family": "inet", "table": TABLE_NAME, "chain": rpfilter_chain, "expr": [{"match": {"left": {"payload": {"protocol": "icmpv6", "field": "type"}}, "op": "==", "right": {"set": ["nd-router-advert", "nd-neighbor-solicit"]}}}, {"accept": None}]}}}) return rules def build_rfc3964_ipv4_rules(self): daddr_set = ["::0.0.0.0/96", # IPv4 compatible "::ffff:0.0.0.0/96", # IPv4 mapped "2002:0000::/24", # 0.0.0.0/8 (the system has no address assigned yet) "2002:0a00::/24", # 10.0.0.0/8 (private) "2002:7f00::/24", # 127.0.0.0/8 (loopback) "2002:ac10::/28", # 172.16.0.0/12 (private) "2002:c0a8::/32", # 192.168.0.0/16 (private) "2002:a9fe::/32", # 169.254.0.0/16 (IANA Assigned DHCP link-local) "2002:e000::/19", # 224.0.0.0/4 (multicast), 240.0.0.0/4 (reserved and broadcast) ] daddr_set = [{"prefix": {"addr": x.split("/")[0], "len": int(x.split("/")[1])}} for x in daddr_set] expr_fragments = [{"match": {"left": {"payload": {"protocol": "ip6", "field": "daddr"}}, "op": "==", "right": {"set": daddr_set}}}] if self._fw._log_denied in ["unicast", "all"]: expr_fragments.append({"log": {"prefix": "RFC3964_IPv4_REJECT: "}}) expr_fragments.append(self._reject_types_fragment("addr-unreach")) rules = [] # WARN: index must be kept in sync with build_default_rules() rules.append({"add": {"rule": {"family": "inet", "table": TABLE_NAME, "chain": "filter_OUTPUT", "index": 1, "expr": expr_fragments}}}) forward_index = 3 if self._fw.get_log_denied() != "off": forward_index += 1 if self._fw._ipv6_rpfilter in ("loose-forward", "strict-forward"): forward_index += 1 rules.append({"add": {"rule": {"family": "inet", "table": TABLE_NAME, "chain": "filter_FORWARD", "index": forward_index, "expr": expr_fragments}}}) return rules def build_policy_rich_source_destination_rules(self, enable, policy, rich_rule): table = "filter" expr_fragments = [] expr_fragments.append(self._rich_rule_family_fragment(rich_rule.family)) expr_fragments.append(self._rich_rule_destination_fragment(rich_rule.destination)) expr_fragments.append(self._rich_rule_source_fragment(rich_rule.source)) rules = [] rules.append(self._rich_rule_log(policy, rich_rule, enable, table, expr_fragments)) rules.append(self._rich_rule_audit(policy, rich_rule, enable, table, expr_fragments)) rules.append(self._rich_rule_action(policy, rich_rule, enable, table, expr_fragments)) return rules def is_ipv_supported(self, ipv): if ipv in ["ipv4", "ipv6", "eb"]: return True return False def _set_type_list(self, ipv, type): ipv_addr = { "ipv4" : "ipv4_addr", "ipv6" : "ipv6_addr", } types = { "hash:ip" : ipv_addr[ipv], "hash:ip,port" : [ipv_addr[ipv], "inet_proto", "inet_service"], "hash:ip,port,ip" : [ipv_addr[ipv], "inet_proto", "inet_service", ipv_addr[ipv]], "hash:ip,port,net" : [ipv_addr[ipv], "inet_proto", "inet_service", ipv_addr[ipv]], "hash:ip,mark" : [ipv_addr[ipv], "mark"], "hash:net" : ipv_addr[ipv], "hash:net,net" : [ipv_addr[ipv], ipv_addr[ipv]], "hash:net,port" : [ipv_addr[ipv], "inet_proto", "inet_service"], "hash:net,port,net" : [ipv_addr[ipv], "inet_proto", "inet_service", ipv_addr[ipv]], "hash:net,iface" : [ipv_addr[ipv], "ifname"], "hash:mac" : "ether_addr", } if type in types: return types[type] else: raise FirewallError(INVALID_TYPE, "ipset type name '%s' is not valid" % type) def build_set_create_rules(self, name, type, options=None): if options and "family" in options and options["family"] == "inet6": ipv = "ipv6" else: ipv = "ipv4" set_dict = {"family": "inet", "table": TABLE_NAME, "name": name, "type": self._set_type_list(ipv, type)} # Some types need the interval flag for t in type.split(":")[1].split(","): if t in ["ip", "net", "port"]: set_dict["flags"] = ["interval"] break if options: if "timeout" in options: set_dict["timeout"] = int(options["timeout"]) if "maxelem" in options: set_dict["size"] = int(options["maxelem"]) return [{"add": {"set": set_dict}}] def set_create(self, name, type, options=None): rules = self.build_set_create_rules(name, type, options) self.set_rules(rules, self._fw.get_log_denied()) def set_destroy(self, name): rule = {"delete": {"set": {"family": "inet", "table": TABLE_NAME, "name": name}}} self.set_rule(rule, self._fw.get_log_denied()) def _set_match_fragment(self, name, match_dest, invert=False): type_format = self._fw.ipset.get_ipset(name).type.split(":")[1].split(",") fragments = [] for format in type_format: if format == "port": fragments.append({"meta": {"key": "l4proto"}}) fragments.append({"payload": {"protocol": "th", "field": "dport" if match_dest else "sport"}}) elif format in ["ip", "net", "mac"]: fragments.append({"payload": {"protocol": self._set_get_family(name), "field": "daddr" if match_dest else "saddr"}}) elif format == "iface": fragments.append({"meta": {"key": "iifname" if match_dest else "oifname"}}) elif format == "mark": fragments.append({"meta": {"key": "mark"}}) else: raise FirewallError(INVALID_TYPE, "Unsupported ipset type for match fragment: %s" % (format)) return {"match": {"left": {"concat": fragments} if len(type_format) > 1 else fragments[0], "op": "!=" if invert else "==", "right": "@" + name}} def _set_entry_fragment(self, name, entry): # convert something like # 1.2.3.4,sctp:8080 (type hash:ip,port) # to # ["1.2.3.4", "sctp", "8080"] obj = self._fw.ipset.get_ipset(name) type_format = obj.type.split(":")[1].split(",") entry_tokens = entry.split(",") if len(type_format) != len(entry_tokens): raise FirewallError(INVALID_ENTRY, "Number of values does not match ipset type.") fragment = [] for i, format in enumerate(type_format): if format == "port": try: index = entry_tokens[i].index(":") except ValueError: # no protocol means default tcp fragment.append("tcp") port_str = entry_tokens[i] else: fragment.append(entry_tokens[i][:index]) port_str = entry_tokens[i][index+1:] try: index = port_str.index("-") except ValueError: fragment.append(port_str) else: fragment.append({"range": [port_str[:index], port_str[index+1:]]}) elif format in ["ip", "net"]: if '-' in entry_tokens[i]: fragment.append({"range": entry_tokens[i].split('-') }) else: try: index = entry_tokens[i].index("/") except ValueError: addr = entry_tokens[i] if "family" in obj.options and obj.options["family"] == "inet6": addr = normalizeIP6(addr) fragment.append(addr) else: addr = entry_tokens[i][:index] if "family" in obj.options and obj.options["family"] == "inet6": addr = normalizeIP6(addr) fragment.append({"prefix": {"addr": addr, "len": int(entry_tokens[i][index+1:])}}) else: fragment.append(entry_tokens[i]) return [{"concat": fragment}] if len(type_format) > 1 else fragment def build_set_add_rules(self, name, entry): rules = [] element = self._set_entry_fragment(name, entry) rules.append({"add": {"element": {"family": "inet", "table": TABLE_NAME, "name": name, "elem": element}}}) return rules def set_add(self, name, entry): rules = self.build_set_add_rules(name, entry) self.set_rules(rules, self._fw.get_log_denied()) def set_delete(self, name, entry): element = self._set_entry_fragment(name, entry) rule = {"delete": {"element": {"family": "inet", "table": TABLE_NAME, "name": name, "elem": element}}} self.set_rule(rule, self._fw.get_log_denied()) def build_set_flush_rules(self, name): return [{"flush": {"set": {"family": "inet", "table": TABLE_NAME, "name": name}}}] def set_flush(self, name): rules = self.build_set_flush_rules(name) self.set_rules(rules, self._fw.get_log_denied()) def _set_get_family(self, name): ipset = self._fw.ipset.get_ipset(name) if ipset.type == "hash:mac": family = "ether" elif ipset.options and "family" in ipset.options \ and ipset.options["family"] == "inet6": family = "ip6" else: family = "ip" return family def set_restore(self, set_name, type_name, entries, create_options=None, entry_options=None): rules = [] rules.extend(self.build_set_create_rules(set_name, type_name, create_options)) rules.extend(self.build_set_flush_rules(set_name)) # avoid large memory usage by chunking the entries chunk = 0 for entry in entries: rules.extend(self.build_set_add_rules(set_name, entry)) chunk += 1 if chunk >= 1000: self.set_rules(rules, self._fw.get_log_denied()) rules.clear() chunk = 0 else: self.set_rules(rules, self._fw.get_log_denied()) core/modules.py 0000644 00000007356 15025011705 0007525 0 ustar 00 # -*- coding: utf-8 -*- # # Copyright (C) 2010-2016 Red Hat, Inc. # # Authors: # Thomas Woerner <twoerner@redhat.com> # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see <http://www.gnu.org/licenses/>. # """modules backend""" __all__ = [ "modules" ] from firewall.core.prog import runProg from firewall.core.logger import log from firewall.config import COMMANDS class modules(object): def __init__(self): self._load_command = COMMANDS["modprobe"] # Use rmmod instead of modprobe -r (RHBZ#1031102) self._unload_command = COMMANDS["rmmod"] def __repr__(self): return '%s' % (self.__class__) def loaded_modules(self): """ get all loaded kernel modules and their dependencies """ mods = [ ] deps = { } try: with open("/proc/modules", "r") as f: for line in f: if not line: break line = line.strip() splits = line.split() mods.append(splits[0]) if splits[3] != "-": deps[splits[0]] = splits[3].split(",")[:-1] else: deps[splits[0]] = [ ] except FileNotFoundError: pass return mods, deps # [loaded modules], {module:[dependants]} def load_module(self, module): log.debug2("%s: %s %s", self.__class__, self._load_command, module) return runProg(self._load_command, [ module ]) def unload_module(self, module): log.debug2("%s: %s %s", self.__class__, self._unload_command, module) return runProg(self._unload_command, [ module ]) def get_deps(self, module, deps, ret): """ get all dependants of a module """ if module not in deps: return for mod in deps[module]: self.get_deps(mod, deps, ret) if mod not in ret: ret.append(mod) if module not in ret: ret.append(module) def get_firewall_modules(self): """ get all loaded firewall-related modules """ mods = [ ] (mods2, deps) = self.loaded_modules() self.get_deps("nf_conntrack", deps, mods) # these modules don't have dependants listed in /proc/modules for bad_bad_module in ["nf_conntrack_ipv4", "nf_conntrack_ipv6"]: if bad_bad_module in mods: # move them to end of list, so we'll remove them later mods.remove(bad_bad_module) mods.insert(-1, bad_bad_module) for mod in mods2: if mod in [ "ip_tables", "ip6_tables", "ebtables" ] or \ mod.startswith("iptable_") or mod.startswith("ip6table_") or \ mod.startswith("nf_") or mod.startswith("xt_") or \ mod.startswith("ipt_") or mod.startswith("ip6t_") : self.get_deps(mod, deps, mods) return mods def unload_firewall_modules(self): """ unload all firewall-related modules """ for module in self.get_firewall_modules(): (status, ret) = self.unload_module(module) if status != 0: log.debug1("Failed to unload module '%s': %s" %(module, ret)) core/fw_transaction.py 0000644 00000013353 15025011705 0011070 0 ustar 00 # -*- coding: utf-8 -*- # # Copyright (C) 2016 Red Hat, Inc. # # Authors: # Thomas Woerner <twoerner@redhat.com> # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see <http://www.gnu.org/licenses/>. # """Transaction classes for firewalld""" __all__ = [ "FirewallTransaction" ] import traceback from firewall.core.logger import log from firewall import errors from firewall.errors import FirewallError class FirewallTransaction(object): def __init__(self, fw): self.fw = fw self.rules = { } # [ ( backend.name, [ rule,.. ] ),.. ] self.pre_funcs = [ ] # [ (func, args),.. ] self.post_funcs = [ ] # [ (func, args),.. ] self.fail_funcs = [ ] # [ (func, args),.. ] self.modules = [ ] # [ module,.. ] def clear(self): self.rules.clear() del self.pre_funcs[:] del self.post_funcs[:] del self.fail_funcs[:] def add_rule(self, backend, rule): self.rules.setdefault(backend.name, [ ]).append(rule) def add_rules(self, backend, rules): for rule in rules: self.add_rule(backend, rule) def query_rule(self, backend, rule): return backend.name in self.rules and rule in self.rules[backend.name] def remove_rule(self, backend, rule): if backend.name in self.rules and rule in self.rules[backend.name]: self.rules[backend.name].remove(rule) def add_pre(self, func, *args): self.pre_funcs.append((func, args)) def add_post(self, func, *args): self.post_funcs.append((func, args)) def add_fail(self, func, *args): self.fail_funcs.append((func, args)) def add_module(self, module): if module not in self.modules: self.modules.append(module) def remove_module(self, module): if module in self.modules: self.modules.remove(module) def add_modules(self, modules): for module in modules: self.add_module(module) def remove_modules(self, modules): for module in modules: self.remove_module(module) def prepare(self, enable): log.debug4("%s.prepare(%s, %s)" % (type(self), enable, "...")) rules = { } if not enable: # reverse rule order for cleanup for backend_name in self.rules: for rule in reversed(self.rules[backend_name]): rules.setdefault(backend_name, [ ]).append( self.fw.get_backend_by_name(backend_name).reverse_rule(rule)) else: for backend_name in self.rules: rules.setdefault(backend_name, [ ]).extend(self.rules[backend_name]) return rules, self.modules def execute(self, enable): log.debug4("%s.execute(%s)" % (type(self), enable)) rules, modules = self.prepare(enable) # pre self.pre() # stage 1: apply rules error = False errorMsg = "" done = [ ] for backend_name in rules: try: self.fw.rules(backend_name, rules[backend_name]) except Exception as msg: error = True errorMsg = msg log.debug1(traceback.format_exc()) log.error(msg) else: done.append(backend_name) # stage 2: load modules if not error: module_return = self.fw.handle_modules(modules, enable) if module_return: # Debug log about issues loading modules, but don't error. The # modules may be builtin or CONFIG_MODULES=n, in which case # modprobe will fail. Or we may be running inside a container # that doesn't have sufficient privileges. Unfortunately there # is no way for us to know. (status, msg) = module_return if status: log.debug1(msg) # error case: revert rules if error: undo_rules = { } for backend_name in done: undo_rules[backend_name] = [ ] for rule in reversed(rules[backend_name]): undo_rules[backend_name].append( self.fw.get_backend_by_name(backend_name).reverse_rule(rule)) for backend_name in undo_rules: try: self.fw.rules(backend_name, undo_rules[backend_name]) except Exception as msg: log.debug1(traceback.format_exc()) log.error(msg) # call failure functions for (func, args) in self.fail_funcs: try: func(*args) except Exception as msg: log.debug1(traceback.format_exc()) log.error("Calling fail func %s(%s) failed: %s" % \ (func, args, msg)) raise FirewallError(errors.COMMAND_FAILED, errorMsg) # post self.post() def pre(self): log.debug4("%s.pre()" % type(self)) for (func, args) in self.pre_funcs: func(*args) def post(self): log.debug4("%s.post()" % type(self)) for (func, args) in self.post_funcs: func(*args) core/fw_ifcfg.py 0000644 00000005002 15025011705 0007611 0 ustar 00 # -*- coding: utf-8 -*- # # Copyright (C) 2010-2016 Red Hat, Inc. # # Authors: # Thomas Woerner <twoerner@redhat.com> # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see <http://www.gnu.org/licenses/>. # """Functions to search for and change ifcfg files""" __all__ = [ "search_ifcfg_of_interface", "ifcfg_set_zone_of_interface" ] import os import os.path from firewall import config from firewall.core.logger import log from firewall.core.io.ifcfg import ifcfg def search_ifcfg_of_interface(interface): """search ifcfg file for the interface in config.IFCFGDIR""" # Return quickly if config.IFCFGDIR does not exist if not os.path.exists(config.IFCFGDIR): return None for filename in sorted(os.listdir(config.IFCFGDIR)): if not filename.startswith("ifcfg-"): continue for ignored in [ ".bak", ".orig", ".rpmnew", ".rpmorig", ".rpmsave", "-range" ]: if filename.endswith(ignored): continue if "." in filename: continue ifcfg_file = ifcfg("%s/%s" % (config.IFCFGDIR, filename)) ifcfg_file.read() if ifcfg_file.get("DEVICE") == interface: return ifcfg_file # Wasn't found above, so assume filename matches the device we want filename = "%s/ifcfg-%s" % (config.IFCFGDIR, interface) if os.path.exists(filename): ifcfg_file = ifcfg(filename) ifcfg_file.read() return ifcfg_file return None def ifcfg_set_zone_of_interface(zone, interface): """Set zone (ZONE=<zone>) in the ifcfg file that uses the interface (DEVICE=<interface>)""" if zone is None: zone = "" ifcfg_file = search_ifcfg_of_interface(interface) if ifcfg_file is not None and ifcfg_file.get("ZONE") != zone and not \ (ifcfg_file.get("ZONE") is None and zone == ""): log.debug1("Setting ZONE=%s in '%s'" % (zone, ifcfg_file.filename)) ifcfg_file.set("ZONE", zone) ifcfg_file.write() core/ipXtables.py 0000644 00000173150 15025011705 0010004 0 ustar 00 # -*- coding: utf-8 -*- # # Copyright (C) 2010-2016 Red Hat, Inc. # # Authors: # Thomas Woerner <twoerner@redhat.com> # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see <http://www.gnu.org/licenses/>. # import os.path import copy from firewall.core.prog import runProg from firewall.core.logger import log from firewall.functions import tempFile, readfile, splitArgs, check_mac, portStr, \ check_single_address, check_address, normalizeIP6 from firewall import config from firewall.errors import FirewallError, INVALID_PASSTHROUGH, INVALID_RULE, UNKNOWN_ERROR, INVALID_ADDR from firewall.core.rich import Rich_Accept, Rich_Reject, Rich_Drop, Rich_Mark, Rich_NFLog, \ Rich_Masquerade, Rich_ForwardPort, Rich_IcmpBlock, Rich_Tcp_Mss_Clamp from firewall.core.base import DEFAULT_ZONE_TARGET import string POLICY_CHAIN_PREFIX = "" BUILT_IN_CHAINS = { "security": [ "INPUT", "OUTPUT", "FORWARD" ], "raw": [ "PREROUTING", "OUTPUT" ], "mangle": [ "PREROUTING", "POSTROUTING", "INPUT", "OUTPUT", "FORWARD" ], "nat": [ "PREROUTING", "POSTROUTING", "OUTPUT" ], "filter": [ "INPUT", "OUTPUT", "FORWARD" ], } DEFAULT_REJECT_TYPE = { "ipv4": "icmp-host-prohibited", "ipv6": "icmp6-adm-prohibited", } ICMP = { "ipv4": "icmp", "ipv6": "ipv6-icmp", } # ipv ebtables also uses this # def common_reverse_rule(args): """ Inverse valid rule """ replace_args = { # Append "-A": "-D", "--append": "--delete", # Insert "-I": "-D", "--insert": "--delete", # New chain "-N": "-X", "--new-chain": "--delete-chain", } ret_args = args[:] for arg in replace_args: try: idx = ret_args.index(arg) except Exception: continue if arg in [ "-I", "--insert" ]: # With insert rulenum, then remove it if it is a number # Opt at position idx, chain at position idx+1, [rulenum] at # position idx+2 try: int(ret_args[idx+2]) except Exception: pass else: ret_args.pop(idx+2) ret_args[idx] = replace_args[arg] return ret_args def common_reverse_passthrough(args): """ Reverse valid passthough rule """ replace_args = { # Append "-A": "-D", "--append": "--delete", # Insert "-I": "-D", "--insert": "--delete", # New chain "-N": "-X", "--new-chain": "--delete-chain", } ret_args = args[:] for x in replace_args: try: idx = ret_args.index(x) except ValueError: continue if x in [ "-I", "--insert" ]: # With insert rulenum, then remove it if it is a number # Opt at position idx, chain at position idx+1, [rulenum] at # position idx+2 try: int(ret_args[idx+2]) except ValueError: pass else: ret_args.pop(idx+2) ret_args[idx] = replace_args[x] return ret_args raise FirewallError(INVALID_PASSTHROUGH, "no '-A', '-I' or '-N' arg") # ipv ebtables also uses this # def common_check_passthrough(args): """ Check if passthough rule is valid (only add, insert and new chain rules are allowed) """ args = set(args) not_allowed = set(["-C", "--check", # check rule "-D", "--delete", # delete rule "-R", "--replace", # replace rule "-L", "--list", # list rule "-S", "--list-rules", # print rules "-F", "--flush", # flush rules "-Z", "--zero", # zero rules "-X", "--delete-chain", # delete chain "-P", "--policy", # policy "-E", "--rename-chain"]) # rename chain) # intersection of args and not_allowed is not empty, i.e. # something from args is not allowed if len(args & not_allowed) > 0: raise FirewallError(INVALID_PASSTHROUGH, "arg '%s' is not allowed" % list(args & not_allowed)[0]) # args need to contain one of -A, -I, -N needed = set(["-A", "--append", "-I", "--insert", "-N", "--new-chain"]) # empty intersection of args and needed, i.e. # none from args contains any needed command if len(args & needed) == 0: raise FirewallError(INVALID_PASSTHROUGH, "no '-A', '-I' or '-N' arg") class ip4tables(object): ipv = "ipv4" name = "ip4tables" policies_supported = True def __init__(self, fw): self._fw = fw self._command = config.COMMANDS[self.ipv] self._restore_command = config.COMMANDS["%s-restore" % self.ipv] self.wait_option = self._detect_wait_option() self.restore_wait_option = self._detect_restore_wait_option() self.fill_exists() self.available_tables = [] self.rich_rule_priority_counts = {} self.policy_priority_counts = {} self.zone_source_index_cache = [] self.our_chains = {} # chains created by firewalld def fill_exists(self): self.command_exists = os.path.exists(self._command) self.restore_command_exists = os.path.exists(self._restore_command) def __run(self, args): # convert to string list if self.wait_option and self.wait_option not in args: _args = [self.wait_option] + ["%s" % item for item in args] else: _args = ["%s" % item for item in args] log.debug2("%s: %s %s", self.__class__, self._command, " ".join(_args)) (status, ret) = runProg(self._command, _args) if status != 0: raise ValueError("'%s %s' failed: %s" % (self._command, " ".join(_args), ret)) return ret def _rule_replace(self, rule, pattern, replacement): try: i = rule.index(pattern) except ValueError: return False else: rule[i:i+1] = replacement return True def is_chain_builtin(self, ipv, table, chain): return table in BUILT_IN_CHAINS and \ chain in BUILT_IN_CHAINS[table] def build_chain_rules(self, add, table, chain): rule = [ "-t", table ] if add: rule.append("-N") else: rule.append("-X") rule.append(chain) return [rule] def build_rule(self, add, table, chain, index, args): rule = [ "-t", table ] if add: rule += [ "-I", chain, str(index) ] else: rule += [ "-D", chain ] rule += args return rule def reverse_rule(self, args): return common_reverse_rule(args) def check_passthrough(self, args): common_check_passthrough(args) def reverse_passthrough(self, args): return common_reverse_passthrough(args) def passthrough_parse_table_chain(self, args): table = "filter" try: i = args.index("-t") except ValueError: pass else: if len(args) >= i+1: table = args[i+1] chain = None for opt in [ "-A", "--append", "-I", "--insert", "-N", "--new-chain" ]: try: i = args.index(opt) except ValueError: pass else: if len(args) >= i+1: chain = args[i+1] return (table, chain) def _run_replace_zone_source(self, rule, zone_source_index_cache): try: i = rule.index("%%ZONE_SOURCE%%") rule.pop(i) zone = rule.pop(i) if "-m" == rule[4]: # ipset/mac zone_source = (zone, rule[7]) # (zone, address) else: zone_source = (zone, rule[5]) # (zone, address) except ValueError: try: i = rule.index("%%ZONE_INTERFACE%%") rule.pop(i) zone_source = None except ValueError: return rule_add = True if rule[0] in ["-D", "--delete"]: rule_add = False if zone_source and not rule_add: if zone_source in zone_source_index_cache: zone_source_index_cache.remove(zone_source) elif rule_add: if zone_source: # order source based dispatch by zone name if zone_source not in zone_source_index_cache: zone_source_index_cache.append(zone_source) zone_source_index_cache.sort(key=lambda x: x[0]) index = zone_source_index_cache.index(zone_source) else: index = len(zone_source_index_cache) rule[0] = "-I" rule.insert(2, "%d" % (index + 1)) def _set_rule_replace_priority(self, rule, priority_counts, token): """ Change something like -t filter -I public_IN %%RICH_RULE_PRIORITY%% 123 or -t filter -A public_IN %%RICH_RULE_PRIORITY%% 321 into -t filter -I public_IN 4 or -t filter -I public_IN """ try: i = rule.index(token) except ValueError: pass else: rule_add = True insert = False insert_add_index = -1 rule.pop(i) priority = rule.pop(i) if type(priority) != int: raise FirewallError(INVALID_RULE, "priority must be followed by a number") table = "filter" for opt in [ "-t", "--table" ]: try: j = rule.index(opt) except ValueError: pass else: if len(rule) >= j+1: table = rule[j+1] for opt in [ "-A", "--append", "-I", "--insert", "-D", "--delete" ]: try: insert_add_index = rule.index(opt) except ValueError: pass else: if len(rule) >= insert_add_index+1: chain = rule[insert_add_index+1] if opt in [ "-I", "--insert" ]: insert = True if opt in [ "-D", "--delete" ]: rule_add = False chain = (table, chain) # Add the rule to the priority counts. We don't need to store the # rule, just bump the ref count for the priority value. if not rule_add: if chain not in priority_counts or \ priority not in priority_counts[chain] or \ priority_counts[chain][priority] <= 0: raise FirewallError(UNKNOWN_ERROR, "nonexistent or underflow of priority count") priority_counts[chain][priority] -= 1 else: if chain not in priority_counts: priority_counts[chain] = {} if priority not in priority_counts[chain]: priority_counts[chain][priority] = 0 # calculate index of new rule index = 1 for p in sorted(priority_counts[chain].keys()): if p == priority and insert: break index += priority_counts[chain][p] if p == priority: break priority_counts[chain][priority] += 1 rule[insert_add_index] = "-I" rule.insert(insert_add_index+2, "%d" % index) def set_rules(self, rules, log_denied): temp_file = tempFile() table_rules = { } rich_rule_priority_counts = copy.deepcopy(self.rich_rule_priority_counts) policy_priority_counts = copy.deepcopy(self.policy_priority_counts) zone_source_index_cache = copy.deepcopy(self.zone_source_index_cache) for _rule in rules: rule = _rule[:] # replace %%REJECT%% self._rule_replace(rule, "%%REJECT%%", \ ["REJECT", "--reject-with", DEFAULT_REJECT_TYPE[self.ipv]]) # replace %%ICMP%% self._rule_replace(rule, "%%ICMP%%", [ICMP[self.ipv]]) # replace %%LOGTYPE%% try: i = rule.index("%%LOGTYPE%%") except ValueError: pass else: if log_denied == "off": continue if log_denied in [ "unicast", "broadcast", "multicast" ]: rule[i:i+1] = [ "-m", "pkttype", "--pkt-type", log_denied ] else: rule.pop(i) self._set_rule_replace_priority(rule, rich_rule_priority_counts, "%%RICH_RULE_PRIORITY%%") self._set_rule_replace_priority(rule, policy_priority_counts, "%%POLICY_PRIORITY%%") self._run_replace_zone_source(rule, zone_source_index_cache) table = "filter" # get table form rule for opt in [ "-t", "--table" ]: try: i = rule.index(opt) except ValueError: pass else: if len(rule) >= i+1: rule.pop(i) table = rule.pop(i) # we can not use joinArgs here, because it would use "'" instead # of '"' for the start and end of the string, this breaks # iptables-restore for i, element in enumerate(rule): for c in string.whitespace: if c in element and not (element.startswith('"') and element.endswith('"')): rule[i] = '"%s"' % element table_rules.setdefault(table, []).append(rule) for table in table_rules: rules = table_rules[table] temp_file.write("*%s\n" % table) for rule in rules: temp_file.write(" ".join(rule) + "\n") temp_file.write("COMMIT\n") temp_file.close() stat = os.stat(temp_file.name) log.debug2("%s: %s %s", self.__class__, self._restore_command, "%s: %d" % (temp_file.name, stat.st_size)) args = [ ] if self.restore_wait_option: args.append(self.restore_wait_option) args.append("-n") (status, ret) = runProg(self._restore_command, args, stdin=temp_file.name) if log.getDebugLogLevel() > 2: lines = readfile(temp_file.name) if lines is not None: i = 1 for line in lines: log.debug3("%8d: %s" % (i, line), nofmt=1, nl=0) if not line.endswith("\n"): log.debug3("", nofmt=1) i += 1 os.unlink(temp_file.name) if status != 0: raise ValueError("'%s %s' failed: %s" % (self._restore_command, " ".join(args), ret)) self.rich_rule_priority_counts = rich_rule_priority_counts self.policy_priority_counts = policy_priority_counts self.zone_source_index_cache = zone_source_index_cache def set_rule(self, rule, log_denied): # replace %%REJECT%% self._rule_replace(rule, "%%REJECT%%", \ ["REJECT", "--reject-with", DEFAULT_REJECT_TYPE[self.ipv]]) # replace %%ICMP%% self._rule_replace(rule, "%%ICMP%%", [ICMP[self.ipv]]) # replace %%LOGTYPE%% try: i = rule.index("%%LOGTYPE%%") except ValueError: pass else: if log_denied == "off": return "" if log_denied in [ "unicast", "broadcast", "multicast" ]: rule[i:i+1] = [ "-m", "pkttype", "--pkt-type", log_denied ] else: rule.pop(i) rich_rule_priority_counts = copy.deepcopy(self.rich_rule_priority_counts) policy_priority_counts = copy.deepcopy(self.policy_priority_counts) zone_source_index_cache = copy.deepcopy(self.zone_source_index_cache) self._set_rule_replace_priority(rule, rich_rule_priority_counts, "%%RICH_RULE_PRIORITY%%") self._set_rule_replace_priority(rule, policy_priority_counts, "%%POLICY_PRIORITY%%") self._run_replace_zone_source(rule, zone_source_index_cache) output = self.__run(rule) self.rich_rule_priority_counts = rich_rule_priority_counts self.policy_priority_counts = policy_priority_counts self.zone_source_index_cache = zone_source_index_cache return output def get_available_tables(self, table=None): ret = [] tables = [ table ] if table else BUILT_IN_CHAINS.keys() for table in tables: if table in self.available_tables: ret.append(table) else: try: self.__run(["-t", table, "-L", "-n"]) self.available_tables.append(table) ret.append(table) except ValueError: log.debug1("%s table '%s' does not exist (or not enough permission to check)." % (self.ipv, table)) return ret def _detect_wait_option(self): wait_option = "" ret = runProg(self._command, ["-w", "-L", "-n"]) # since iptables-1.4.20 log.debug3("%s: %s: probe for wait option (%s): ret=%u, output=\"%s\"", self.__class__, self._command, "-w", ret[0], ret[1]) if ret[0] == 0: wait_option = "-w" # wait for xtables lock ret = runProg(self._command, ["-w10", "-L", "-n"]) # since iptables > 1.4.21 log.debug3("%s: %s: probe for wait option (%s): ret=%u, output=\"%s\"", self.__class__, self._command, "-w10", ret[0], ret[1]) if ret[0] == 0: wait_option = "-w10" # wait max 10 seconds log.debug2("%s: %s will be using %s option.", self.__class__, self._command, wait_option) return wait_option def _detect_restore_wait_option(self): temp_file = tempFile() temp_file.write("#foo") temp_file.close() wait_option = "" for test_option in ["-w", "--wait=2"]: ret = runProg(self._restore_command, [test_option], stdin=temp_file.name) log.debug3("%s: %s: probe for wait option (%s): ret=%u, output=\"%s\"", self.__class__, self._command, test_option, ret[0], ret[1]) if ret[0] == 0 and "invalid option" not in ret[1] \ and "unrecognized option" not in ret[1]: wait_option = test_option break log.debug2("%s: %s will be using %s option.", self.__class__, self._restore_command, wait_option) os.unlink(temp_file.name) return wait_option def build_flush_rules(self): self.rich_rule_priority_counts = {} self.policy_priority_counts = {} self.zone_source_index_cache = [] rules = [] for table in BUILT_IN_CHAINS.keys(): if not self.get_available_tables(table): continue # Flush firewall rules: -F # Delete firewall chains: -X # Set counter to zero: -Z for flag in [ "-F", "-X", "-Z" ]: rules.append(["-t", table, flag]) return rules def build_set_policy_rules(self, policy, policy_details): rules = [] _policy = "DROP" if policy == "PANIC" else policy for table in BUILT_IN_CHAINS.keys(): if not self.get_available_tables(table): continue if table == "nat": continue for chain in BUILT_IN_CHAINS[table]: if table == "filter": p = policy_details[chain] if p == "REJECT": rules.append(["-t", table, "-A", chain, "-j", "REJECT"]) p = "DROP" else: p = _policy rules.append(["-t", table, "-P", chain, p]) return rules def supported_icmp_types(self, ipv=None): """Return ICMP types that are supported by the iptables/ip6tables command and kernel""" ret = [ ] output = "" try: output = self.__run(["-p", "icmp" if self.ipv == "ipv4" else "ipv6-icmp", "--help"]) except ValueError as ex: if self.ipv == "ipv4": log.debug1("iptables error: %s" % ex) else: log.debug1("ip6tables error: %s" % ex) lines = output.splitlines() in_types = False for line in lines: #print(line) if in_types: line = line.strip().lower() splits = line.split() for split in splits: if split.startswith("(") and split.endswith(")"): x = split[1:-1] else: x = split if x not in ret: ret.append(x) if self.ipv == "ipv4" and line.startswith("Valid ICMP Types:") or \ self.ipv == "ipv6" and line.startswith("Valid ICMPv6 Types:"): in_types = True return ret def build_default_tables(self): # nothing to do, they always exist return [] def build_default_rules(self, log_denied="off"): default_rules = {} if self.get_available_tables("security"): default_rules["security"] = [ ] self.our_chains["security"] = set() for chain in BUILT_IN_CHAINS["security"]: default_rules["security"].append("-N %s_direct" % chain) default_rules["security"].append("-A %s -j %s_direct" % (chain, chain)) self.our_chains["security"].add("%s_direct" % chain) if self.get_available_tables("raw"): default_rules["raw"] = [ ] self.our_chains["raw"] = set() for chain in BUILT_IN_CHAINS["raw"]: default_rules["raw"].append("-N %s_direct" % chain) default_rules["raw"].append("-A %s -j %s_direct" % (chain, chain)) self.our_chains["raw"].add("%s_direct" % chain) if chain == "PREROUTING": for dispatch_suffix in ["POLICIES_pre", "ZONES", "POLICIES_post"]: default_rules["raw"].append("-N %s_%s" % (chain, dispatch_suffix)) self.our_chains["raw"].update(set(["%s_%s" % (chain, dispatch_suffix)])) for dispatch_suffix in ["ZONES"]: default_rules["raw"].append("-A %s -j %s_%s" % (chain, chain, dispatch_suffix)) if self.get_available_tables("mangle"): default_rules["mangle"] = [ ] self.our_chains["mangle"] = set() for chain in BUILT_IN_CHAINS["mangle"]: default_rules["mangle"].append("-N %s_direct" % chain) default_rules["mangle"].append("-A %s -j %s_direct" % (chain, chain)) self.our_chains["mangle"].add("%s_direct" % chain) if chain == "PREROUTING": for dispatch_suffix in ["POLICIES_pre", "ZONES", "POLICIES_post"]: default_rules["mangle"].append("-N %s_%s" % (chain, dispatch_suffix)) self.our_chains["mangle"].update(set(["%s_%s" % (chain, dispatch_suffix)])) for dispatch_suffix in ["ZONES"]: default_rules["mangle"].append("-A %s -j %s_%s" % (chain, chain, dispatch_suffix)) if self.get_available_tables("nat"): default_rules["nat"] = [ ] self.our_chains["nat"] = set() for chain in BUILT_IN_CHAINS["nat"]: default_rules["nat"].append("-N %s_direct" % chain) default_rules["nat"].append("-A %s -j %s_direct" % (chain, chain)) self.our_chains["nat"].add("%s_direct" % chain) if chain in ["OUTPUT"]: # nat, output does not have zone dispatch for dispatch_suffix in ["POLICIES_pre", "POLICIES_post"]: default_rules["nat"].append("-N %s_%s" % (chain, dispatch_suffix)) self.our_chains["nat"].update(set(["%s_%s" % (chain, dispatch_suffix)])) default_rules["nat"].append("-A %s -j %s_%s" % (chain, chain, dispatch_suffix)) else: for dispatch_suffix in ["POLICIES_pre", "ZONES", "POLICIES_post"]: default_rules["nat"].append("-N %s_%s" % (chain, dispatch_suffix)) self.our_chains["nat"].update(set(["%s_%s" % (chain, dispatch_suffix)])) for dispatch_suffix in ["ZONES"]: default_rules["nat"].append("-A %s -j %s_%s" % (chain, chain, dispatch_suffix)) default_rules["filter"] = [] self.our_chains["filter"] = set() default_rules["filter"].append("-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED,DNAT -j ACCEPT") default_rules["filter"].append("-A INPUT -i lo -j ACCEPT") if log_denied != "off": default_rules["filter"].append("-A INPUT -m conntrack --ctstate INVALID %%LOGTYPE%% -j LOG --log-prefix 'STATE_INVALID_DROP: '") default_rules["filter"].append("-A INPUT -m conntrack --ctstate INVALID -j DROP") default_rules["filter"].append("-N INPUT_direct") default_rules["filter"].append("-A INPUT -j INPUT_direct") self.our_chains["filter"].update(set("INPUT_direct")) for dispatch_suffix in ["POLICIES_pre", "ZONES", "POLICIES_post"]: default_rules["filter"].append("-N INPUT_%s" % (dispatch_suffix)) self.our_chains["filter"].update(set("INPUT_%s" % (dispatch_suffix))) for dispatch_suffix in ["ZONES"]: default_rules["filter"].append("-A INPUT -j INPUT_%s" % (dispatch_suffix)) if log_denied != "off": default_rules["filter"].append("-A INPUT %%LOGTYPE%% -j LOG --log-prefix 'FINAL_REJECT: '") default_rules["filter"].append("-A INPUT -j %%REJECT%%") default_rules["filter"].append("-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED,DNAT -j ACCEPT") default_rules["filter"].append("-A FORWARD -i lo -j ACCEPT") if log_denied != "off": default_rules["filter"].append("-A FORWARD -m conntrack --ctstate INVALID %%LOGTYPE%% -j LOG --log-prefix 'STATE_INVALID_DROP: '") default_rules["filter"].append("-A FORWARD -m conntrack --ctstate INVALID -j DROP") default_rules["filter"].append("-N FORWARD_direct") default_rules["filter"].append("-A FORWARD -j FORWARD_direct") self.our_chains["filter"].update(set("FORWARD_direct")) for dispatch_suffix in ["POLICIES_pre"]: default_rules["filter"].append("-N FORWARD_%s" % (dispatch_suffix)) self.our_chains["filter"].update(set("FORWARD_%s" % (dispatch_suffix))) for dispatch_suffix in ["ZONES"]: default_rules["filter"].append("-N FORWARD_%s" % (dispatch_suffix)) default_rules["filter"].append("-A FORWARD -j FORWARD_%s" % (dispatch_suffix)) self.our_chains["filter"].update(set("FORWARD_%s" % (dispatch_suffix))) for dispatch_suffix in ["POLICIES_post"]: default_rules["filter"].append("-N FORWARD_%s" % (dispatch_suffix)) self.our_chains["filter"].update(set("FORWARD_%s" % (dispatch_suffix))) if log_denied != "off": default_rules["filter"].append("-A FORWARD %%LOGTYPE%% -j LOG --log-prefix 'FINAL_REJECT: '") default_rules["filter"].append("-A FORWARD -j %%REJECT%%") default_rules["filter"] += [ "-N OUTPUT_direct", "-A OUTPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT", "-A OUTPUT -o lo -j ACCEPT", "-A OUTPUT -j OUTPUT_direct", ] self.our_chains["filter"].update(set("OUTPUT_direct")) for dispatch_suffix in ["POLICIES_pre"]: default_rules["filter"].append("-N OUTPUT_%s" % (dispatch_suffix)) default_rules["filter"].append("-A OUTPUT -j OUTPUT_%s" % (dispatch_suffix)) self.our_chains["filter"].update(set("OUTPUT_%s" % (dispatch_suffix))) for dispatch_suffix in ["POLICIES_post"]: default_rules["filter"].append("-N OUTPUT_%s" % (dispatch_suffix)) default_rules["filter"].append("-A OUTPUT -j OUTPUT_%s" % (dispatch_suffix)) self.our_chains["filter"].update(set("OUTPUT_%s" % (dispatch_suffix))) final_default_rules = [] for table in default_rules: if table not in self.get_available_tables(): continue for rule in default_rules[table]: final_default_rules.append(["-t", table] + splitArgs(rule)) return final_default_rules def get_zone_table_chains(self, table): if table == "filter": return { "INPUT", "FORWARD" } if table == "mangle": if "mangle" in self.get_available_tables(): return { "PREROUTING" } if table == "nat": if "nat" in self.get_available_tables(): return { "PREROUTING", "POSTROUTING" } if table == "raw": if "raw" in self.get_available_tables(): return { "PREROUTING" } return {} def build_policy_ingress_egress_rules(self, enable, policy, table, chain, ingress_interfaces, egress_interfaces, ingress_sources, egress_sources): p_obj = self._fw.policy.get_policy(policy) chain_suffix = "pre" if p_obj.priority < 0 else "post" isSNAT = True if (table == "nat" and chain == "POSTROUTING") else False _policy = self._fw.policy.policy_base_chain_name(policy, table, POLICY_CHAIN_PREFIX, isSNAT) ingress_fragments = [] egress_fragments = [] for interface in ingress_interfaces: ingress_fragments.append(["-i", interface]) for interface in egress_interfaces: egress_fragments.append(["-o", interface]) for addr in ingress_sources: ipv = self._fw.zone.check_source(addr) if ipv in ["ipv4", "ipv6"] and not self.is_ipv_supported(ipv): continue ingress_fragments.append(self._rule_addr_fragment("-s", addr)) for addr in egress_sources: ipv = self._fw.zone.check_source(addr) if ipv in ["ipv4", "ipv6"] and not self.is_ipv_supported(ipv): continue # iptables can not match destination MAC if check_mac(addr) and chain in ["POSTROUTING", "FORWARD", "OUTPUT"]: continue egress_fragments.append(self._rule_addr_fragment("-d", addr)) def _generate_policy_dispatch_rule(ingress_fragment, egress_fragment): add_del = {True: "-A", False: "-D" }[enable] rule = ["-t", table, add_del, "%s_POLICIES_%s" % (chain, chain_suffix), "%%POLICY_PRIORITY%%", p_obj.priority] if ingress_fragment: rule.extend(ingress_fragment) if egress_fragment: rule.extend(egress_fragment) rule.extend(["-j", _policy]) return rule rules = [] if ingress_fragments: # zone --> [zone, ANY, HOST] for ingress_fragment in ingress_fragments: # zone --> zone if egress_fragments: for egress_fragment in egress_fragments: rules.append(_generate_policy_dispatch_rule(ingress_fragment, egress_fragment)) elif egress_sources: # if the egress source is not for the current family (there # are no egress fragments), then avoid creating an invalid # catch all rule. pass else: rules.append(_generate_policy_dispatch_rule(ingress_fragment, None)) elif ingress_sources: # if the ingress source is not for the current family (there are no # ingress fragments), then avoid creating an invalid catch all # rule. pass else: # [ANY, HOST] --> [zone, ANY, HOST] # [ANY, HOST] --> zone if egress_fragments: for egress_fragment in egress_fragments: rules.append(_generate_policy_dispatch_rule(None, egress_fragment)) elif egress_sources: # if the egress source is not for the current family (there # are no egress fragments), then avoid creating an invalid # catch all rule. pass else: # [ANY, HOST] --> [ANY, HOST] rules.append(_generate_policy_dispatch_rule(None, None)) return rules def build_zone_source_interface_rules(self, enable, zone, policy, interface, table, chain, append=False): isSNAT = True if (table == "nat" and chain == "POSTROUTING") else False _policy = self._fw.policy.policy_base_chain_name(policy, table, POLICY_CHAIN_PREFIX, isSNAT=isSNAT) opt = { "PREROUTING": "-i", "POSTROUTING": "-o", "INPUT": "-i", "FORWARD": "-i", "OUTPUT": "-o", }[chain] action = "-g" if enable and not append: rule = [ "-I", "%s_ZONES" % chain, "%%ZONE_INTERFACE%%" ] elif enable: rule = [ "-A", "%s_ZONES" % chain ] else: rule = [ "-D", "%s_ZONES" % chain ] if not append: rule += ["%%ZONE_INTERFACE%%"] rule += [ "-t", table, opt, interface, action, _policy ] return [rule] def _rule_addr_fragment(self, opt, address, invert=False): if address.startswith("ipset:"): name = address[6:] if opt == "-d": opt = "dst" else: opt = "src" flags = ",".join([opt] * self._fw.ipset.get_dimension(name)) return ["-m", "set", "--match-set", name, flags] elif check_mac(address): # outgoing can not be set if opt == "-d": raise FirewallError(INVALID_ADDR, "Can't match a destination MAC.") return ["-m", "mac", "--mac-source", address.upper()] else: if check_single_address("ipv6", address): address = normalizeIP6(address) elif check_address("ipv6", address): addr_split = address.split("/") address = normalizeIP6(addr_split[0]) + "/" + addr_split[1] return [opt, address] def build_zone_source_address_rules(self, enable, zone, policy, address, table, chain): add_del = { True: "-I", False: "-D" }[enable] isSNAT = True if (table == "nat" and chain == "POSTROUTING") else False _policy = self._fw.policy.policy_base_chain_name(policy, table, POLICY_CHAIN_PREFIX, isSNAT=isSNAT) opt = { "PREROUTING": "-s", "POSTROUTING": "-d", "INPUT": "-s", "FORWARD": "-s", "OUTPUT": "-d", }[chain] # iptables can not match destination MAC if check_mac(address) and chain in ["POSTROUTING", "FORWARD", "OUTPUT"]: return [] rule = [add_del, "%s_ZONES" % (chain), "%%ZONE_SOURCE%%", zone, "-t", table] rule.extend(self._rule_addr_fragment(opt, address)) rule.extend(["-g", _policy]) return [rule] def build_policy_chain_rules(self, enable, policy, table, chain): add_del_chain = { True: "-N", False: "-X" }[enable] add_del_rule = { True: "-A", False: "-D" }[enable] isSNAT = True if (table == "nat" and chain == "POSTROUTING") else False _policy = self._fw.policy.policy_base_chain_name(policy, table, POLICY_CHAIN_PREFIX, isSNAT=isSNAT) p_obj = self._fw.policy.get_policy(policy) self.our_chains[table].update(set([_policy, "%s_log" % _policy, "%s_deny" % _policy, "%s_pre" % _policy, "%s_post" % _policy, "%s_allow" % _policy])) rules = [] rules.append([ add_del_chain, _policy, "-t", table ]) rules.append([ add_del_chain, "%s_pre" % _policy, "-t", table ]) rules.append([ add_del_chain, "%s_log" % _policy, "-t", table ]) rules.append([ add_del_chain, "%s_deny" % _policy, "-t", table ]) rules.append([ add_del_chain, "%s_allow" % _policy, "-t", table ]) rules.append([ add_del_chain, "%s_post" % _policy, "-t", table ]) if p_obj.derived_from_zone: rules.append([ add_del_rule, _policy, "-t", table, "-j", "%s_%s" % (chain, "POLICIES_pre") ]) rules.append([ add_del_rule, _policy, "-t", table, "-j", "%s_pre" % _policy ]) rules.append([ add_del_rule, _policy, "-t", table, "-j", "%s_log" % _policy ]) rules.append([ add_del_rule, _policy, "-t", table, "-j", "%s_deny" % _policy ]) rules.append([ add_del_rule, _policy, "-t", table, "-j", "%s_allow" % _policy ]) rules.append([ add_del_rule, _policy, "-t", table, "-j", "%s_post" % _policy ]) if p_obj.derived_from_zone: rules.append([ add_del_rule, _policy, "-t", table, "-j", "%s_%s" % (chain, "POLICIES_post") ]) target = self._fw.policy._policies[policy].target if self._fw.get_log_denied() != "off": if table == "filter": if target in [DEFAULT_ZONE_TARGET, "REJECT", "%%REJECT%%" ]: rules.append([ add_del_rule, _policy, "-t", table, "%%LOGTYPE%%", "-j", "LOG", "--log-prefix", "%s_REJECT: " % _policy ]) if target == "DROP": rules.append([ add_del_rule, _policy, "-t", table, "%%LOGTYPE%%", "-j", "LOG", "--log-prefix", "%s_DROP: " % _policy ]) if table == "filter" and \ target in [DEFAULT_ZONE_TARGET, "ACCEPT", "REJECT", "%%REJECT%%", "DROP" ]: if target in [DEFAULT_ZONE_TARGET]: _target = "REJECT" else: _target = target rules.append([ add_del_rule, _policy, "-t", table, "-j", _target ]) if not enable: rules.reverse() return rules def _rule_limit(self, limit): if limit: return [ "-m", "limit", "--limit", limit.value ] return [] def _rich_rule_chain_suffix(self, rich_rule): if type(rich_rule.element) in [Rich_Masquerade, Rich_ForwardPort, Rich_IcmpBlock, Rich_Tcp_Mss_Clamp]: # These are special and don't have an explicit action pass elif rich_rule.action: if type(rich_rule.action) not in [Rich_Accept, Rich_Reject, Rich_Drop, Rich_Mark]: raise FirewallError(INVALID_RULE, "Unknown action %s" % type(rich_rule.action)) else: raise FirewallError(INVALID_RULE, "No rule action specified.") if rich_rule.priority == 0: if type(rich_rule.element) in [Rich_Masquerade, Rich_ForwardPort, Rich_Tcp_Mss_Clamp] or \ type(rich_rule.action) in [Rich_Accept, Rich_Mark]: return "allow" elif type(rich_rule.element) in [Rich_IcmpBlock] or \ type(rich_rule.action) in [Rich_Reject, Rich_Drop]: return "deny" elif rich_rule.priority < 0: return "pre" else: return "post" def _rich_rule_chain_suffix_from_log(self, rich_rule): if not rich_rule.log and not rich_rule.audit: raise FirewallError(INVALID_RULE, "Not log or audit") if rich_rule.priority == 0: return "log" elif rich_rule.priority < 0: return "pre" else: return "post" def _rich_rule_priority_fragment(self, rich_rule): if rich_rule.priority == 0: return [] return ["%%RICH_RULE_PRIORITY%%", rich_rule.priority] def _rich_rule_log(self, policy, rich_rule, enable, table, rule_fragment): if not rich_rule.log: return [] _policy = self._fw.policy.policy_base_chain_name(policy, table, POLICY_CHAIN_PREFIX) add_del = { True: "-A", False: "-D" }[enable] chain_suffix = self._rich_rule_chain_suffix_from_log(rich_rule) rule = ["-t", table, add_del, "%s_%s" % (_policy, chain_suffix)] rule += self._rich_rule_priority_fragment(rich_rule) if type(rich_rule.log) == Rich_NFLog: rule += rule_fragment + [ "-j", "NFLOG" ] if rich_rule.log.group: rule += [ "--nflog-group", rich_rule.log.group ] if rich_rule.log.prefix: rule += [ "--nflog-prefix", "%s" % rich_rule.log.prefix ] if rich_rule.log.threshold: rule += [ "--nflog-threshold", rich_rule.log.threshold ] else: rule += rule_fragment + [ "-j", "LOG" ] if rich_rule.log.prefix: rule += [ "--log-prefix", "%s" % rich_rule.log.prefix ] if rich_rule.log.level: rule += [ "--log-level", "%s" % rich_rule.log.level ] rule += self._rule_limit(rich_rule.log.limit) return rule def _rich_rule_audit(self, policy, rich_rule, enable, table, rule_fragment): if not rich_rule.audit: return [] add_del = { True: "-A", False: "-D" }[enable] _policy = self._fw.policy.policy_base_chain_name(policy, table, POLICY_CHAIN_PREFIX) chain_suffix = self._rich_rule_chain_suffix_from_log(rich_rule) rule = ["-t", table, add_del, "%s_%s" % (_policy, chain_suffix)] rule += self._rich_rule_priority_fragment(rich_rule) rule += rule_fragment if type(rich_rule.action) == Rich_Accept: _type = "accept" elif type(rich_rule.action) == Rich_Reject: _type = "reject" elif type(rich_rule.action) == Rich_Drop: _type = "drop" else: _type = "unknown" rule += [ "-j", "AUDIT", "--type", _type ] rule += self._rule_limit(rich_rule.audit.limit) return rule def _rich_rule_action(self, policy, rich_rule, enable, table, rule_fragment): if not rich_rule.action: return [] add_del = { True: "-A", False: "-D" }[enable] _policy = self._fw.policy.policy_base_chain_name(policy, table, POLICY_CHAIN_PREFIX) chain_suffix = self._rich_rule_chain_suffix(rich_rule) chain = "%s_%s" % (_policy, chain_suffix) if type(rich_rule.action) == Rich_Accept: rule_action = [ "-j", "ACCEPT" ] elif type(rich_rule.action) == Rich_Reject: rule_action = [ "-j", "REJECT" ] if rich_rule.action.type: rule_action += [ "--reject-with", rich_rule.action.type ] elif type(rich_rule.action) == Rich_Drop: rule_action = [ "-j", "DROP" ] elif type(rich_rule.action) == Rich_Mark: table = "mangle" _policy = self._fw.policy.policy_base_chain_name(policy, table, POLICY_CHAIN_PREFIX) chain = "%s_%s" % (_policy, chain_suffix) rule_action = [ "-j", "MARK", "--set-xmark", rich_rule.action.set ] else: raise FirewallError(INVALID_RULE, "Unknown action %s" % type(rich_rule.action)) rule = ["-t", table, add_del, chain] rule += self._rich_rule_priority_fragment(rich_rule) rule += rule_fragment + rule_action rule += self._rule_limit(rich_rule.action.limit) return rule def _rich_rule_destination_fragment(self, rich_dest): if not rich_dest: return [] rule_fragment = [] if rich_dest.addr: if rich_dest.invert: rule_fragment.append("!") if check_single_address("ipv6", rich_dest.addr): rule_fragment += [ "-d", normalizeIP6(rich_dest.addr) ] elif check_address("ipv6", rich_dest.addr): addr_split = rich_dest.addr.split("/") rule_fragment += [ "-d", normalizeIP6(addr_split[0]) + "/" + addr_split[1] ] else: rule_fragment += [ "-d", rich_dest.addr ] elif rich_dest.ipset: rule_fragment += [ "-m", "set" ] if rich_dest.invert: rule_fragment.append("!") flags = self._fw.zone._ipset_match_flags(rich_dest.ipset, "dst") rule_fragment += [ "--match-set", rich_dest.ipset, flags ] return rule_fragment def _rich_rule_source_fragment(self, rich_source): if not rich_source: return [] rule_fragment = [] if rich_source.addr: if rich_source.invert: rule_fragment.append("!") if check_single_address("ipv6", rich_source.addr): rule_fragment += [ "-s", normalizeIP6(rich_source.addr) ] elif check_address("ipv6", rich_source.addr): addr_split = rich_source.addr.split("/") rule_fragment += [ "-s", normalizeIP6(addr_split[0]) + "/" + addr_split[1] ] else: rule_fragment += [ "-s", rich_source.addr ] elif hasattr(rich_source, "mac") and rich_source.mac: rule_fragment += [ "-m", "mac" ] if rich_source.invert: rule_fragment.append("!") rule_fragment += [ "--mac-source", rich_source.mac ] elif hasattr(rich_source, "ipset") and rich_source.ipset: rule_fragment += [ "-m", "set" ] if rich_source.invert: rule_fragment.append("!") flags = self._fw.zone._ipset_match_flags(rich_source.ipset, "src") rule_fragment += [ "--match-set", rich_source.ipset, flags ] return rule_fragment def build_policy_ports_rules(self, enable, policy, proto, port, destination=None, rich_rule=None): add_del = { True: "-A", False: "-D" }[enable] table = "filter" _policy = self._fw.policy.policy_base_chain_name(policy, table, POLICY_CHAIN_PREFIX) rule_fragment = [ "-p", proto ] if port: rule_fragment += [ "--dport", "%s" % portStr(port) ] if destination: rule_fragment += [ "-d", destination ] if rich_rule: rule_fragment += self._rich_rule_destination_fragment(rich_rule.destination) rule_fragment += self._rich_rule_source_fragment(rich_rule.source) rules = [] if rich_rule: rules.append(self._rich_rule_log(policy, rich_rule, enable, table, rule_fragment)) rules.append(self._rich_rule_audit(policy, rich_rule, enable, table, rule_fragment)) rules.append(self._rich_rule_action(policy, rich_rule, enable, table, rule_fragment)) else: rules.append([add_del, "%s_allow" % (_policy), "-t", table] + rule_fragment + [ "-j", "ACCEPT" ]) return rules def build_policy_protocol_rules(self, enable, policy, protocol, destination=None, rich_rule=None): add_del = { True: "-A", False: "-D" }[enable] table = "filter" _policy = self._fw.policy.policy_base_chain_name(policy, table, POLICY_CHAIN_PREFIX) rule_fragment = [ "-p", protocol ] if destination: rule_fragment += [ "-d", destination ] if rich_rule: rule_fragment += self._rich_rule_destination_fragment(rich_rule.destination) rule_fragment += self._rich_rule_source_fragment(rich_rule.source) rules = [] if rich_rule: rules.append(self._rich_rule_log(policy, rich_rule, enable, table, rule_fragment)) rules.append(self._rich_rule_audit(policy, rich_rule, enable, table, rule_fragment)) rules.append(self._rich_rule_action(policy, rich_rule, enable, table, rule_fragment)) else: rules.append([add_del, "%s_allow" % (_policy), "-t", table] + rule_fragment + [ "-j", "ACCEPT" ]) return rules def build_policy_tcp_mss_clamp_rules(self, enable, policy, tcp_mss_clamp_value, destination=None, rich_rule=None): chain_suffix = "allow" table = "filter" _policy = self._fw.policy.policy_base_chain_name(policy, table, POLICY_CHAIN_PREFIX) add_del = { True: "-A", False: "-D" }[enable] rule_fragment = ["-p", "tcp", "--tcp-flags", "SYN,RST", "SYN"] if rich_rule: chain_suffix = self._rich_rule_chain_suffix(rich_rule) rule_fragment += self._rich_rule_priority_fragment(rich_rule) rule_fragment += self._rich_rule_destination_fragment(rich_rule.destination) rule_fragment += self._rich_rule_source_fragment(rich_rule.source) if tcp_mss_clamp_value == "pmtu" or tcp_mss_clamp_value is None: rule_fragment += ["-j", "TCPMSS", "--clamp-mss-to-pmtu"] else: rule_fragment += ["-j", "TCPMSS", "--set-mss", tcp_mss_clamp_value] return [["-t", "filter", add_del, "%s_%s" % (_policy, chain_suffix)] + rule_fragment] def build_policy_source_ports_rules(self, enable, policy, proto, port, destination=None, rich_rule=None): add_del = { True: "-A", False: "-D" }[enable] table = "filter" _policy = self._fw.policy.policy_base_chain_name(policy, table, POLICY_CHAIN_PREFIX) rule_fragment = [ "-p", proto ] if port: rule_fragment += [ "--sport", "%s" % portStr(port) ] if destination: rule_fragment += [ "-d", destination ] if rich_rule: rule_fragment += self._rich_rule_destination_fragment(rich_rule.destination) rule_fragment += self._rich_rule_source_fragment(rich_rule.source) rules = [] if rich_rule: rules.append(self._rich_rule_log(policy, rich_rule, enable, table, rule_fragment)) rules.append(self._rich_rule_audit(policy, rich_rule, enable, table, rule_fragment)) rules.append(self._rich_rule_action(policy, rich_rule, enable, table, rule_fragment)) else: rules.append([add_del, "%s_allow" % (_policy), "-t", table] + rule_fragment + [ "-j", "ACCEPT" ]) return rules def build_policy_helper_ports_rules(self, enable, policy, proto, port, destination, helper_name, module_short_name): table = "raw" _policy = self._fw.policy.policy_base_chain_name(policy, table, POLICY_CHAIN_PREFIX) add_del = { True: "-A", False: "-D" }[enable] rule = [ add_del, "%s_allow" % (_policy), "-t", "raw", "-p", proto ] if port: rule += [ "--dport", "%s" % portStr(port) ] if destination: rule += [ "-d", destination ] rule += [ "-j", "CT", "--helper", module_short_name ] return [rule] def build_zone_forward_rules(self, enable, zone, policy, table, interface=None, source=None): add_del = { True: "-A", False: "-D" }[enable] _policy = self._fw.policy.policy_base_chain_name(policy, table, POLICY_CHAIN_PREFIX) rules = [] if interface: rules.append(["-t", "filter", add_del, "%s_allow" % _policy, "-o", interface, "-j", "ACCEPT"]) else: # source # iptables can not match destination MAC if check_mac(source): return [] rules.append(["-t", "filter", add_del, "%s_allow" % _policy] + self._rule_addr_fragment("-d", source) + ["-j", "ACCEPT"]) return rules def build_policy_masquerade_rules(self, enable, policy, rich_rule=None): table = "nat" _policy = self._fw.policy.policy_base_chain_name(policy, table, POLICY_CHAIN_PREFIX, isSNAT=True) add_del = { True: "-A", False: "-D" }[enable] rule_fragment = [] if rich_rule: chain_suffix = self._rich_rule_chain_suffix(rich_rule) rule_fragment += self._rich_rule_priority_fragment(rich_rule) rule_fragment += self._rich_rule_destination_fragment(rich_rule.destination) rule_fragment += self._rich_rule_source_fragment(rich_rule.source) else: chain_suffix = "allow" rules = [] rules.append(["-t", "nat", add_del, "%s_%s" % (_policy, chain_suffix)] + rule_fragment + [ "!", "-o", "lo", "-j", "MASQUERADE" ]) return rules def build_policy_forward_port_rules(self, enable, policy, port, protocol, toport, toaddr, rich_rule=None): table = "nat" _policy = self._fw.policy.policy_base_chain_name(policy, table, POLICY_CHAIN_PREFIX) add_del = { True: "-A", False: "-D" }[enable] to = "" if toaddr: if check_single_address("ipv6", toaddr): to += "[%s]" % normalizeIP6(toaddr) else: to += toaddr if toport and toport != "": to += ":%s" % portStr(toport, "-") rule_fragment = [] if rich_rule: chain_suffix = self._rich_rule_chain_suffix(rich_rule) rule_fragment = self._rich_rule_priority_fragment(rich_rule) rule_fragment += self._rich_rule_destination_fragment(rich_rule.destination) rule_fragment += self._rich_rule_source_fragment(rich_rule.source) else: chain_suffix = "allow" rules = [] if rich_rule: rules.append(self._rich_rule_log(policy, rich_rule, enable, "nat", rule_fragment)) rules.append(["-t", "nat", add_del, "%s_%s" % (_policy, chain_suffix)] + rule_fragment + ["-p", protocol, "--dport", portStr(port), "-j", "DNAT", "--to-destination", to]) return rules def build_policy_icmp_block_rules(self, enable, policy, ict, rich_rule=None): table = "filter" _policy = self._fw.policy.policy_base_chain_name(policy, table, POLICY_CHAIN_PREFIX) add_del = { True: "-A", False: "-D" }[enable] if self.ipv == "ipv4": proto = [ "-p", "icmp" ] match = [ "-m", "icmp", "--icmp-type", ict.name ] else: proto = [ "-p", "ipv6-icmp" ] match = [ "-m", "icmp6", "--icmpv6-type", ict.name ] rules = [] if self._fw.policy.query_icmp_block_inversion(policy): final_chain = "%s_allow" % (_policy) final_target = "ACCEPT" else: final_chain = "%s_deny" % (_policy) final_target = "%%REJECT%%" rule_fragment = [] if rich_rule: rule_fragment += self._rich_rule_destination_fragment(rich_rule.destination) rule_fragment += self._rich_rule_source_fragment(rich_rule.source) rule_fragment += proto + match if rich_rule: rules.append(self._rich_rule_log(policy, rich_rule, enable, table, rule_fragment)) rules.append(self._rich_rule_audit(policy, rich_rule, enable, table, rule_fragment)) if rich_rule.action: rules.append(self._rich_rule_action(policy, rich_rule, enable, table, rule_fragment)) else: chain_suffix = self._rich_rule_chain_suffix(rich_rule) rules.append(["-t", table, add_del, "%s_%s" % (_policy, chain_suffix)] + self._rich_rule_priority_fragment(rich_rule) + rule_fragment + [ "-j", "%%REJECT%%" ]) else: if self._fw.get_log_denied() != "off" and final_target != "ACCEPT": rules.append([ add_del, final_chain, "-t", table ] + rule_fragment + [ "%%LOGTYPE%%", "-j", "LOG", "--log-prefix", "%s_ICMP_BLOCK: " % policy ]) rules.append([ add_del, final_chain, "-t", table ] + rule_fragment + [ "-j", final_target ]) return rules def build_policy_icmp_block_inversion_rules(self, enable, policy): table = "filter" _policy = self._fw.policy.policy_base_chain_name(policy, table, POLICY_CHAIN_PREFIX) rules = [] rule_idx = 8 if self._fw.policy.query_icmp_block_inversion(policy): ibi_target = "%%REJECT%%" if self._fw.get_log_denied() != "off": if enable: rule = [ "-I", _policy, str(rule_idx) ] else: rule = [ "-D", _policy ] rule = rule + [ "-t", table, "-p", "%%ICMP%%", "%%LOGTYPE%%", "-j", "LOG", "--log-prefix", "%s_ICMP_BLOCK: " % _policy ] rules.append(rule) rule_idx += 1 else: ibi_target = "ACCEPT" if enable: rule = [ "-I", _policy, str(rule_idx) ] else: rule = [ "-D", _policy ] rule = rule + [ "-t", table, "-p", "%%ICMP%%", "-j", ibi_target ] rules.append(rule) return rules def build_policy_rich_source_destination_rules(self, enable, policy, rich_rule): table = "filter" rule_fragment = [] rule_fragment += self._rich_rule_destination_fragment(rich_rule.destination) rule_fragment += self._rich_rule_source_fragment(rich_rule.source) rules = [] rules.append(self._rich_rule_log(policy, rich_rule, enable, table, rule_fragment)) rules.append(self._rich_rule_audit(policy, rich_rule, enable, table, rule_fragment)) rules.append(self._rich_rule_action(policy, rich_rule, enable, table, rule_fragment)) return rules def is_ipv_supported(self, ipv): return ipv == self.ipv class ip6tables(ip4tables): ipv = "ipv6" name = "ip6tables" def build_rpfilter_rules(self, log_denied=False): rules = [] rpfilter_fragment = ["-m", "rpfilter", "--invert", "--validmark"] if self._fw._ipv6_rpfilter == "loose": rpfilter_fragment += ["--loose"] rules.append([ "-I", "PREROUTING", "-t", "mangle" ] + rpfilter_fragment + [ "-j", "DROP" ]) if log_denied != "off": rules.append([ "-I", "PREROUTING", "-t", "mangle" ] + rpfilter_fragment + [ "-j", "LOG", "--log-prefix", "rpfilter_DROP: " ]) rules.append([ "-I", "PREROUTING", "-t", "mangle", "-p", "ipv6-icmp", "--icmpv6-type=neighbour-solicitation", "-j", "ACCEPT" ]) # RHBZ#1575431, kernel bug in 4.16-4.17 rules.append([ "-I", "PREROUTING", "-t", "mangle", "-p", "ipv6-icmp", "--icmpv6-type=router-advertisement", "-j", "ACCEPT" ]) # RHBZ#1058505 return rules def build_rfc3964_ipv4_rules(self): daddr_list = [ "::0.0.0.0/96", # IPv4 compatible "::ffff:0.0.0.0/96", # IPv4 mapped "2002:0000::/24", # 0.0.0.0/8 (the system has no address assigned yet) "2002:0a00::/24", # 10.0.0.0/8 (private) "2002:7f00::/24", # 127.0.0.0/8 (loopback) "2002:ac10::/28", # 172.16.0.0/12 (private) "2002:c0a8::/32", # 192.168.0.0/16 (private) "2002:a9fe::/32", # 169.254.0.0/16 (IANA Assigned DHCP link-local) "2002:e000::/19", # 224.0.0.0/4 (multicast), 240.0.0.0/4 (reserved and broadcast) ] chain_name = "RFC3964_IPv4" self.our_chains["filter"].add(chain_name) rules = [] rules.append(["-t", "filter", "-N", chain_name]) for daddr in daddr_list: rules.append(["-t", "filter", "-I", chain_name, "-d", daddr, "-j", "REJECT", "--reject-with", "addr-unreach"]) if self._fw._log_denied in ["unicast", "all"]: rules.append(["-t", "filter", "-I", chain_name, "-d", daddr, "-j", "LOG", "--log-prefix", "RFC3964_IPv4_REJECT: "]) # Inject into FORWARD and OUTPUT chains rules.append(["-t", "filter", "-I", "OUTPUT", "4", "-j", chain_name]) rules.append(["-t", "filter", "-I", "FORWARD", "6" if self._fw.get_log_denied() != "off" else "5", "-j", chain_name]) return rules core/fw.py 0000644 00000161163 15025011705 0006466 0 ustar 00 # -*- coding: utf-8 -*- # # Copyright (C) 2010-2016 Red Hat, Inc. # # Authors: # Thomas Woerner <twoerner@redhat.com> # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see <http://www.gnu.org/licenses/>. # __all__ = [ "Firewall" ] import os import sys import copy import time import traceback from typing import Dict, List from firewall import config from firewall import functions from firewall.core import ipXtables from firewall.core import ebtables from firewall.core import nftables from firewall.core import ipset from firewall.core import modules from firewall.core.fw_icmptype import FirewallIcmpType from firewall.core.fw_service import FirewallService from firewall.core.fw_zone import FirewallZone from firewall.core.fw_direct import FirewallDirect from firewall.core.fw_config import FirewallConfig from firewall.core.fw_policies import FirewallPolicies from firewall.core.fw_ipset import FirewallIPSet from firewall.core.fw_transaction import FirewallTransaction from firewall.core.fw_helper import FirewallHelper from firewall.core.fw_policy import FirewallPolicy from firewall.core.fw_nm import nm_get_bus_name, nm_get_interfaces_in_zone from firewall.core.logger import log from firewall.core.io.io_object import IO_Object from firewall.core.io.firewalld_conf import firewalld_conf from firewall.core.io.direct import Direct from firewall.core.io.service import service_reader from firewall.core.io.icmptype import icmptype_reader from firewall.core.io.zone import zone_reader, Zone from firewall.core.io.ipset import ipset_reader from firewall.core.ipset import IPSET_TYPES from firewall.core.io.helper import helper_reader from firewall.core.io.policy import policy_reader from firewall.core.io.functions import check_on_disk_config from firewall.core.rich import Rich_Rule from firewall import errors from firewall.errors import FirewallError ############################################################################ # # class Firewall # ############################################################################ class Firewall(object): def __init__(self, offline=False): self._firewalld_conf = firewalld_conf(config.FIREWALLD_CONF) self._offline = offline if not offline: self.ip4tables_backend = ipXtables.ip4tables(self) self.ip6tables_backend = ipXtables.ip6tables(self) self.ebtables_backend = ebtables.ebtables() self.ipset_backend = ipset.ipset() self.nftables_backend = nftables.nftables(self) self.modules_backend = modules.modules() self.icmptype = FirewallIcmpType(self) self.service = FirewallService(self) self.zone = FirewallZone(self) self.direct = FirewallDirect(self) self.config = FirewallConfig(self) self.policies = FirewallPolicies() self.ipset = FirewallIPSet(self) self.helper = FirewallHelper(self) self.policy = FirewallPolicy(self) self.__init_vars() def __repr__(self): return '%s(%r, %r, %r, %r, %r, %r, %r, %r, %r, %r, %r, %r, %r, %r)' % \ (self.__class__, self.ip4tables_enabled, self.ip6tables_enabled, self.ebtables_enabled, self._state, self._panic, self._default_zone, self._module_refcount, self._marks, self.cleanup_on_exit, self.cleanup_modules_on_exit, self._ipv6_rpfilter, self.ipset_enabled, self._individual_calls, self._log_denied) def __init_vars(self): self._state = "INIT" self._panic = False self._default_zone = config.FALLBACK_ZONE self._default_zone_interfaces = [] self._nm_assigned_interfaces = [] self._module_refcount = { } self._marks = [ ] # fallback settings will be overloaded by firewalld.conf self.cleanup_on_exit = config.FALLBACK_CLEANUP_ON_EXIT self.cleanup_modules_on_exit = config.FALLBACK_CLEANUP_MODULES_ON_EXIT self._ipv6_rpfilter = config.FALLBACK_IPV6_RPFILTER self._individual_calls = config.FALLBACK_INDIVIDUAL_CALLS self._log_denied = config.FALLBACK_LOG_DENIED self._firewall_backend = config.FALLBACK_FIREWALL_BACKEND self._flush_all_on_reload = config.FALLBACK_FLUSH_ALL_ON_RELOAD self._rfc3964_ipv4 = config.FALLBACK_RFC3964_IPV4 self._allow_zone_drifting = config.FALLBACK_ALLOW_ZONE_DRIFTING self._nftables_table_owner = config.FALLBACK_NFTABLES_TABLE_OWNER if self._offline: self.ip4tables_enabled = False self.ip6tables_enabled = False self.ebtables_enabled = False self.ipset_enabled = False self.ipset_supported_types = IPSET_TYPES self.nftables_enabled = False else: self.ip4tables_enabled = True self.ipv4_supported_icmp_types = [ ] self.ip6tables_enabled = True self.ipv6_supported_icmp_types = [ ] self.ebtables_enabled = True self.ipset_enabled = True self.ipset_supported_types = IPSET_TYPES self.nftables_enabled = True def get_all_io_objects_dict(self): """ Returns a dict of dicts of all runtime config objects. """ conf_dict = {} conf_dict["ipsets"] = {_ipset: self.ipset.get_ipset(_ipset) for _ipset in self.ipset.get_ipsets()} conf_dict["helpers"] = {helper: self.helper.get_helper(helper) for helper in self.helper.get_helpers()} conf_dict["icmptypes"] = {icmptype: self.icmptype.get_icmptype(icmptype) for icmptype in self.icmptype.get_icmptypes()} conf_dict["services"] = {service: self.service.get_service(service) for service in self.service.get_services()} conf_dict["zones"] = {zone: self.zone.get_zone(zone) for zone in self.zone.get_zones()} conf_dict["policies"] = {policy: self.policy.get_policy(policy) for policy in self.policy.get_policies_not_derived_from_zone()} conf_dict["conf"] = {} conf_dict["conf"]["FirewallBackend"] = self._firewalld_conf.get("FirewallBackend") # The runtime might not actually support all the defined icmptypes. # This is the case if ipv6 (ip6tables) is disabled. Unfortunately users # disable IPv6 and also expect the IPv6 stuff to be silently ignored. # This is problematic for defaults that include IPv6 stuff, e.g. policy # 'allow-host-ipv6'. Use this to make a better decision about errors vs # warnings. # conf_dict["runtime"] = {} conf_dict["runtime"]["icmptypes_unsupported"] = {} for icmptype in (set(self.config.get_icmptypes()).difference( set(self.icmptype.get_icmptypes()))): conf_dict["runtime"]["icmptypes_unsupported"][icmptype] = self.config.get_icmptype(icmptype) # Some icmptypes support multiple families. Add those that are missing # support for a subset of families. for icmptype in (set(self.config.get_icmptypes()).intersection( set(self.icmptype.get_icmptypes()))): if icmptype not in self.ipv4_supported_icmp_types or \ icmptype not in self.ipv6_supported_icmp_types: conf_dict["runtime"]["icmptypes_unsupported"][icmptype] = copy.copy(self.config.get_icmptype(icmptype)) conf_dict["runtime"]["icmptypes_unsupported"][icmptype].destination = [] if icmptype not in self.ipv4_supported_icmp_types: conf_dict["runtime"]["icmptypes_unsupported"][icmptype].destination.append("ipv4") if icmptype not in self.ipv6_supported_icmp_types: conf_dict["runtime"]["icmptypes_unsupported"][icmptype].destination.append("ipv6") return conf_dict def full_check_config(self, extra_io_objects: Dict[str, List[IO_Object]] = {}): all_io_objects = self.get_all_io_objects_dict() # mix in the extra objects for type_key in extra_io_objects: for obj in extra_io_objects[type_key]: all_io_objects[type_key][obj.name] = obj # we need to check in a well defined order because some io_objects will # cross-check others order = ["ipsets", "helpers", "icmptypes", "services", "zones", "policies"] for io_obj_type in order: io_objs = all_io_objects[io_obj_type] for (name, io_obj) in io_objs.items(): io_obj.check_config_dict(io_obj.export_config_dict(), all_io_objects) def _start_check_tables(self): # check if iptables, ip6tables and ebtables are usable, else disable if self.ip4tables_enabled and \ "filter" not in self.ip4tables_backend.get_available_tables(): log.info1("iptables is not usable.") self.ip4tables_enabled = False if self.ip6tables_enabled and \ "filter" not in self.ip6tables_backend.get_available_tables(): log.info1("ip6tables is not usable.") self.ip6tables_enabled = False if self.ebtables_enabled and \ "filter" not in self.ebtables_backend.get_available_tables(): log.info1("ebtables is not usable.") self.ebtables_enabled = False # is there at least support for ipv4 or ipv6 if not self.ip4tables_enabled and not self.ip6tables_enabled \ and not self.nftables_enabled: raise FirewallError(errors.UNKNOWN_ERROR, "No IPv4 and IPv6 firewall.") def _start_probe_backends(self): try: self.ipset_backend.set_list() except ValueError: if self.nftables_enabled: log.info1("ipset not usable, disabling ipset usage in firewall. Other set backends (nftables) remain usable.") else: log.warning("ipset not usable, disabling ipset usage in firewall.") self.ipset_supported_types = [ ] # ipset is not usable self.ipset_enabled = False else: # ipset is usable, get all supported types self.ipset_supported_types = self.ipset_backend.set_supported_types() self.ip4tables_backend.fill_exists() if not self.ip4tables_backend.restore_command_exists: if self.ip4tables_backend.command_exists: log.warning("iptables-restore is missing, using " "individual calls for IPv4 firewall.") else: if self.nftables_enabled: log.info1("iptables-restore and iptables are missing, " "IPv4 direct rules won't be usable.") else: log.warning("iptables-restore and iptables are missing, " "disabling IPv4 firewall.") self.ip4tables_enabled = False if self.nftables_enabled: self.ipv4_supported_icmp_types = self.nftables_backend.supported_icmp_types("ipv4") else: if self.ip4tables_enabled: self.ipv4_supported_icmp_types = self.ip4tables_backend.supported_icmp_types() else: self.ipv4_supported_icmp_types = [ ] self.ip6tables_backend.fill_exists() if not self.ip6tables_backend.restore_command_exists: if self.ip6tables_backend.command_exists: log.warning("ip6tables-restore is missing, using " "individual calls for IPv6 firewall.") else: if self.nftables_enabled: log.info1("ip6tables-restore and ip6tables are missing, " "IPv6 direct rules won't be usable.") else: log.warning("ip6tables-restore and ip6tables are missing, " "disabling IPv6 firewall.") self.ip6tables_enabled = False if self.nftables_enabled: self.ipv6_supported_icmp_types = self.nftables_backend.supported_icmp_types("ipv6") else: if self.ip6tables_enabled: self.ipv6_supported_icmp_types = self.ip6tables_backend.supported_icmp_types() else: self.ipv6_supported_icmp_types = [ ] self.ebtables_backend.fill_exists() if not self.ebtables_backend.restore_command_exists: if self.ebtables_backend.command_exists: log.warning("ebtables-restore is missing, using " "individual calls for bridge firewall.") else: if self.nftables_enabled: log.info1("ebtables-restore and ebtables are missing, " "eb direct rules won't be usable.") else: log.warning("ebtables-restore and ebtables are missing, " "disabling bridge firewall.") self.ebtables_enabled = False if self.ebtables_enabled and not self._individual_calls and \ not self.ebtables_backend.restore_noflush_option: log.debug1("ebtables-restore is not supporting the --noflush " "option, will therefore not be used") self.nftables_backend.probe_support() if ( self._nftables_table_owner and not self.nftables_backend.supports_table_owner ): log.info1( "Configuration has NftablesTableOwner=True, but it's " "not supported by nftables. Table ownership will be disabled." ) def _start_load_firewalld_conf(self): # load firewalld config log.debug1("Loading firewalld config file '%s'", config.FIREWALLD_CONF) try: self._firewalld_conf.read() except Exception as msg: log.warning(msg) log.warning("Using fallback firewalld configuration settings.") else: if self._firewalld_conf.get("DefaultZone"): self._default_zone = self._firewalld_conf.get("DefaultZone") if self._firewalld_conf.get("CleanupOnExit"): value = self._firewalld_conf.get("CleanupOnExit") if value is not None and value.lower() in [ "no", "false" ]: self.cleanup_on_exit = False log.debug1("CleanupOnExit is set to '%s'", self.cleanup_on_exit) if self._firewalld_conf.get("CleanupModulesOnExit"): value = self._firewalld_conf.get("CleanupModulesOnExit") if value is not None and value.lower() in [ "yes", "true" ]: self.cleanup_modules_on_exit = True log.debug1("CleanupModulesOnExit is set to '%s'", self.cleanup_modules_on_exit) if self._firewalld_conf.get("Lockdown"): value = self._firewalld_conf.get("Lockdown") if value is not None and value.lower() in [ "yes", "true" ]: log.debug1("Lockdown is enabled") try: self.policies.enable_lockdown() except FirewallError: # already enabled, this is probably reload pass if self._firewalld_conf.get("IPv6_rpfilter"): value = self._firewalld_conf.get("IPv6_rpfilter") if value is not None: if value.lower() in ["no", "false"]: self._ipv6_rpfilter = "no" elif value.lower() in ["yes", "true", "strict"]: self._ipv6_rpfilter = "strict" elif value.lower() in ["loose"]: self._ipv6_rpfilter = "loose" elif value.lower() in ["loose-forward"]: self._ipv6_rpfilter = "loose-forward" elif value.lower() in ["strict-forward"]: self._ipv6_rpfilter = "strict-forward" log.debug1(f"IPv6_rpfilter is set to '{self._ipv6_rpfilter}'") if self._firewalld_conf.get("IndividualCalls"): value = self._firewalld_conf.get("IndividualCalls") if value is not None and value.lower() in [ "yes", "true" ]: log.debug1("IndividualCalls is enabled") self._individual_calls = True if self._firewalld_conf.get("LogDenied"): value = self._firewalld_conf.get("LogDenied") if value is None or value.lower() == "no": self._log_denied = "off" else: self._log_denied = value.lower() log.debug1("LogDenied is set to '%s'", self._log_denied) if self._firewalld_conf.get("FirewallBackend"): self._firewall_backend = self._firewalld_conf.get("FirewallBackend") log.debug1("FirewallBackend is set to '%s'", self._firewall_backend) if self._firewalld_conf.get("FlushAllOnReload"): value = self._firewalld_conf.get("FlushAllOnReload") if value.lower() in [ "no", "false" ]: self._flush_all_on_reload = False else: self._flush_all_on_reload = True log.debug1("FlushAllOnReload is set to '%s'", self._flush_all_on_reload) if self._firewalld_conf.get("RFC3964_IPv4"): value = self._firewalld_conf.get("RFC3964_IPv4") if value.lower() in [ "no", "false" ]: self._rfc3964_ipv4 = False else: self._rfc3964_ipv4 = True log.debug1("RFC3964_IPv4 is set to '%s'", self._rfc3964_ipv4) if self._firewalld_conf.get("NftablesTableOwner"): value = self._firewalld_conf.get("NftablesTableOwner") if value.lower() in ["no", "false"]: self._nftables_table_owner = False else: self._nftables_table_owner = True log.debug1( "NftablesTableOwner is set to '%s'", self._nftables_table_owner ) self.config.set_firewalld_conf(copy.deepcopy(self._firewalld_conf)) def _start_load_lockdown_whitelist(self): # load lockdown whitelist log.debug1("Loading lockdown whitelist") try: self.policies.lockdown_whitelist.read() except Exception as msg: if self.policies.query_lockdown(): log.error("Failed to load lockdown whitelist '%s': %s", self.policies.lockdown_whitelist.filename, msg) else: log.debug1("Failed to load lockdown whitelist '%s': %s", self.policies.lockdown_whitelist.filename, msg) # copy policies to config interface self.config.set_policies(copy.deepcopy(self.policies)) def _start_load_stock_config(self): self._loader_ipsets(config.FIREWALLD_IPSETS) self._loader_icmptypes(config.FIREWALLD_ICMPTYPES) self._loader_helpers(config.FIREWALLD_HELPERS) self._loader_services(config.FIREWALLD_SERVICES) self._loader_zones(config.FIREWALLD_ZONES) self._loader_policies(config.FIREWALLD_POLICIES) def _start_load_user_config(self): self._loader_ipsets(config.ETC_FIREWALLD_IPSETS) self._loader_icmptypes(config.ETC_FIREWALLD_ICMPTYPES) self._loader_helpers(config.ETC_FIREWALLD_HELPERS) self._loader_services(config.ETC_FIREWALLD_SERVICES) self._loader_zones(config.ETC_FIREWALLD_ZONES) self._loader_policies(config.ETC_FIREWALLD_POLICIES) def _start_copy_config_to_runtime(self): for _ipset in self.config.get_ipsets(): self.ipset.add_ipset( copy.deepcopy(self.config.get_ipset(_ipset))) for icmptype in self.config.get_icmptypes(): self.icmptype.add_icmptype( copy.deepcopy(self.config.get_icmptype(icmptype))) for helper in self.config.get_helpers(): self.helper.add_helper( copy.deepcopy(self.config.get_helper(helper))) for service in self.config.get_services(): self.service.add_service( copy.deepcopy(self.config.get_service(service))) for policy in self.config.get_policy_objects(): self.policy.add_policy( copy.deepcopy(self.config.get_policy_object(policy))) self.direct.set_permanent_config( copy.deepcopy(self.config.get_direct())) # copy combined permanent zones to runtime # zones with a '/' in the name will be combined into one runtime zone combined_zones = {} for zone in self.config.get_zones(): z_obj = self.config.get_zone(zone) if '/' not in z_obj.name: self.zone.add_zone( copy.deepcopy(self.config.get_zone(zone))) continue combined_name = os.path.basename(z_obj.path) if combined_name not in combined_zones: combined_zone = Zone() combined_zone.name = combined_name combined_zone.check_name(combined_zone.name) combined_zone.path = z_obj.path combined_zone.default = False combined_zone.forward = False # see note in zone_reader() combined_zones[combined_name] = combined_zone log.debug1("Combining zone '%s' using '%s%s%s'", combined_name, z_obj.path, os.sep, z_obj.filename) combined_zones[combined_name].combine(z_obj) for zone in combined_zones: self.zone.add_zone(combined_zones[zone]) def _start_load_direct_rules(self): # load direct rules obj = Direct(config.FIREWALLD_DIRECT) if os.path.exists(config.FIREWALLD_DIRECT): log.debug1("Loading direct rules file '%s'" % \ config.FIREWALLD_DIRECT) try: obj.read() except Exception as msg: log.error("Failed to load direct rules file '%s': %s", config.FIREWALLD_DIRECT, msg) self.config.set_direct(obj) def _start_apply_objects(self, reload=False, complete_reload=False): transaction = FirewallTransaction(self) if not reload: self.flush(use_transaction=transaction) # If modules need to be unloaded in complete reload or if there are # ipsets to get applied, limit the transaction to flush. # # Future optimization for the ipset case in reload: The transaction # only needs to be split here if there are conflicting ipset types in # exsting ipsets and the configuration in firewalld. if (reload and complete_reload) or \ (self.ipset.backends() and self.ipset.has_ipsets()): transaction.execute(True) transaction.clear() # complete reload: unload modules also if reload and complete_reload: log.debug1("Unloading firewall modules") self.modules_backend.unload_firewall_modules() self.apply_default_tables(use_transaction=transaction) transaction.execute(True) transaction.clear() # apply settings for loaded ipsets while reloading here if (self.ipset.backends()) and self.ipset.has_ipsets(): log.debug1("Applying ipsets") self.ipset.apply_ipsets() log.debug1("Applying default rule set") self.apply_default_rules(use_transaction=transaction) log.debug1("Applying used zones") self.zone.apply_zones(use_transaction=transaction) self.zone.change_default_zone(None, self._default_zone, use_transaction=transaction) log.debug1("Applying used policies") self.policy.apply_policies(use_transaction=transaction) transaction.execute(True) transaction.clear() def _start_apply_direct_rules(self): transaction = FirewallTransaction(self) # apply direct chains, rules and passthrough rules if self.direct.has_configuration(): log.debug1("Applying direct chains rules and passthrough rules") self.direct.apply_direct(transaction) # since direct rules are easy to make syntax errors lets highlight # the cause if the transaction fails. try: transaction.execute(True) transaction.clear() except FirewallError as e: raise FirewallError(e.code, "Direct: %s" % (e.msg if e.msg else "")) except Exception: raise transaction.execute(True) transaction.clear() def _start_check(self): # check minimum required zones for z in [ "block", "drop", "trusted" ]: if z not in self.zone.get_zones(): raise FirewallError(errors.INVALID_ZONE, "Zone '{}' is not available.".format(z)) # check if default_zone is a valid zone if self._default_zone not in self.zone.get_zones(): if "public" in self.zone.get_zones(): zone = "public" elif "external" in self.zone.get_zones(): zone = "external" else: zone = "block" # block is a base zone, therefore it has to exist log.error("Default zone '%s' is not valid. Using '%s'.", self._default_zone, zone) self._default_zone = zone else: log.debug1("Using default zone '%s'", self._default_zone) if not self._offline: self.full_check_config() self._start_check_tables() # check our desired backend is actually available if self._firewall_backend == "iptables": backend_to_check = "ip4tables" # ip6tables is always optional else: backend_to_check = self._firewall_backend if not self.is_backend_enabled(backend_to_check): raise FirewallError(errors.UNKNOWN_ERROR, "Firewall backend '{}' is not available.".format( self._firewall_backend)) def _start(self, reload=False, complete_reload=False): self._start_load_firewalld_conf() self._start_load_lockdown_whitelist() self._select_firewall_backend(self._firewall_backend) if not self._offline: self._start_probe_backends() self._start_load_stock_config() self._start_load_user_config() self._start_load_direct_rules() self._start_copy_config_to_runtime() self._start_check() if self._offline: return if log.getDebugLogLevel() > 0: # get time before flushing and applying tm1 = time.time() self._start_apply_objects(reload=reload, complete_reload=complete_reload) self._start_apply_direct_rules() if log.getDebugLogLevel() > 1: # get time after flushing and applying tm2 = time.time() log.debug2("Flushing and applying took %f seconds" % (tm2 - tm1)) def _start_failsafe(self, reload=False, complete_reload=False): """ This is basically _start() with at least the following differences: - built-in defaults for firewalld.conf - no lockdown list - no user config (/etc/firewalld) - no direct rules """ self.cleanup() self._firewalld_conf.set_defaults() self.config.set_firewalld_conf(copy.deepcopy(self._firewalld_conf)) self._select_firewall_backend(self._firewall_backend) if not self._offline: self._start_probe_backends() self._start_load_stock_config() self._start_copy_config_to_runtime() self._start_check() if self._offline: return self._start_apply_objects(reload=reload, complete_reload=complete_reload) def start(self): try: self._start() except Exception as original_ex: log.error("Failed to load user configuration. Falling back to " "full stock configuration.") try: self._start_failsafe() self._state = "FAILED" self.set_policy("ACCEPT") except Exception as new_ex: log.error(original_ex) log.exception() log.error(new_ex) log.error("Failed to load full stock configuration. This likely " "indicates a system level issue, e.g. the firewall " "backend (nftables, iptables) is broken. " "All hope is lost. Exiting.") try: self.flush() except Exception: pass sys.exit(errors.UNKNOWN_ERROR) # propagate the original exception that caused us to enter failed # state. raise original_ex else: self._state = "RUNNING" self.set_policy("ACCEPT") def _loader_config_file_generator(self, path): if not os.path.isdir(path): return for filename in sorted(os.listdir(path)): if not filename.endswith(".xml"): continue yield filename def _loader_services(self, path): for filename in self._loader_config_file_generator(path): log.debug1("Loading service file '%s%s%s'", path, os.sep, filename) obj = service_reader(filename, path) if obj.name in self.config.get_services(): orig_obj = self.config.get_service(obj.name) log.debug1("Overrides '%s%s%s'", orig_obj.path, os.sep, orig_obj.filename) elif obj.path.startswith(config.ETC_FIREWALLD): obj.default = True self.config.add_service(obj) def _loader_ipsets(self, path): for filename in self._loader_config_file_generator(path): log.debug1("Loading ipset file '%s%s%s'", path, os.sep, filename) obj = ipset_reader(filename, path) if obj.name in self.config.get_ipsets(): orig_obj = self.config.get_ipset(obj.name) log.debug1("Overrides '%s%s%s'", orig_obj.path, os.sep, orig_obj.filename) elif obj.path.startswith(config.ETC_FIREWALLD): obj.default = True self.config.add_ipset(obj) def _loader_helpers(self, path): for filename in self._loader_config_file_generator(path): log.debug1("Loading helper file '%s%s%s'", path, os.sep, filename) obj = helper_reader(filename, path) if obj.name in self.config.get_helpers(): orig_obj = self.config.get_helper(obj.name) log.debug1("Overrides '%s%s%s'", orig_obj.path, os.sep, orig_obj.filename) elif obj.path.startswith(config.ETC_FIREWALLD): obj.default = True self.config.add_helper(obj) def _loader_policies(self, path): for filename in self._loader_config_file_generator(path): log.debug1("Loading policy file '%s%s%s'", path, os.sep, filename) obj = policy_reader(filename, path) if obj.name in self.config.get_policy_objects(): orig_obj = self.config.get_policy_object(obj.name) log.debug1("Overrides '%s%s%s'", orig_obj.path, os.sep, orig_obj.filename) elif obj.path.startswith(config.ETC_FIREWALLD): obj.default = True self.config.add_policy_object(obj) def _loader_icmptypes(self, path): for filename in self._loader_config_file_generator(path): log.debug1("Loading icmptype file '%s%s%s'", path, os.sep, filename) obj = icmptype_reader(filename, path) if obj.name in self.config.get_icmptypes(): orig_obj = self.config.get_icmptype(obj.name) log.debug1("Overrides '%s%s%s'", orig_obj.path, os.sep, orig_obj.filename) elif obj.path.startswith(config.ETC_FIREWALLD): obj.default = True self.config.add_icmptype(obj) def _loader_zones(self, path, combine=False): if not os.path.isdir(path): return for filename in sorted(os.listdir(path)): if not filename.endswith(".xml"): if path.startswith(config.ETC_FIREWALLD) and \ os.path.isdir("%s/%s" % (path, filename)): # Combined zones are added to permanent config # individually. They're coalesced into one object when # added to the runtime self._loader_zones("%s/%s" % (path, filename), combine=True) continue name = "%s/%s" % (path, filename) log.debug1("Loading zone file '%s'", name) obj = zone_reader(filename, path, no_check_name=combine) if combine: # Change name for permanent configuration obj.name = "%s/%s" % ( os.path.basename(path), os.path.basename(filename)[0:-4]) obj.check_name(obj.name) if obj.name in self.config.get_zones(): orig_obj = self.config.get_zone(obj.name) log.debug1("Overrides '%s%s%s'", orig_obj.path, os.sep, orig_obj.filename) elif obj.path.startswith(config.ETC_FIREWALLD): obj.default = True self.config.add_zone(obj) def cleanup(self): self.icmptype.cleanup() self.service.cleanup() self.zone.cleanup() self.ipset.cleanup() self.helper.cleanup() self.config.cleanup() self.direct.cleanup() self.policies.cleanup() self.policy.cleanup() self._firewalld_conf.cleanup() self.__init_vars() def stop(self): if not self._offline: if self.cleanup_on_exit: self.flush() self.ipset.flush() self.set_policy("ACCEPT") if self.cleanup_modules_on_exit: log.debug1('Unloading firewall kernel modules') self.modules_backend.unload_firewall_modules() self.cleanup() # handle modules def handle_modules(self, _modules, enable): num_failed = 0 error_msgs = "" for i,module in enumerate(_modules): if enable: (status, msg) = self.modules_backend.load_module(module) else: if self._module_refcount[module] > 1: status = 0 # module referenced more then one, do not unload else: (status, msg) = self.modules_backend.unload_module(module) if status != 0: num_failed += 1 error_msgs += msg continue if enable: self._module_refcount.setdefault(module, 0) self._module_refcount[module] += 1 else: if module in self._module_refcount: self._module_refcount[module] -= 1 if self._module_refcount[module] == 0: del self._module_refcount[module] return (num_failed, error_msgs) def _select_firewall_backend(self, backend): if backend != "nftables": self.nftables_enabled = False # even if using nftables, the other backends are enabled for use with # the direct interface. nftables is used for the firewalld primitives. def get_backend_by_name(self, name): for backend in self.all_backends(): if backend.name == name: return backend raise FirewallError(errors.UNKNOWN_ERROR, "'%s' backend does not exist" % name) def get_backend_by_ipv(self, ipv): if self.nftables_enabled: return self.nftables_backend if ipv == "ipv4" and self.ip4tables_enabled: return self.ip4tables_backend elif ipv == "ipv6" and self.ip6tables_enabled: return self.ip6tables_backend elif ipv == "eb" and self.ebtables_enabled: return self.ebtables_backend raise FirewallError(errors.INVALID_IPV, "'%s' is not a valid backend or is unavailable" % ipv) def get_direct_backend_by_ipv(self, ipv): if ipv == "ipv4" and self.ip4tables_enabled: return self.ip4tables_backend elif ipv == "ipv6" and self.ip6tables_enabled: return self.ip6tables_backend elif ipv == "eb" and self.ebtables_enabled: return self.ebtables_backend raise FirewallError(errors.INVALID_IPV, "'%s' is not a valid backend or is unavailable" % ipv) def is_backend_enabled(self, name): if name == "ip4tables": return self.ip4tables_enabled elif name == "ip6tables": return self.ip6tables_enabled elif name == "ebtables": return self.ebtables_enabled elif name == "nftables": return self.nftables_enabled return False def is_ipv_enabled(self, ipv): if self.nftables_enabled: return True if ipv == "ipv4": return self.ip4tables_enabled elif ipv == "ipv6": return self.ip6tables_enabled elif ipv == "eb": return self.ebtables_enabled return False def enabled_backends(self): backends = [] if self.nftables_enabled: backends.append(self.nftables_backend) else: if self.ip4tables_enabled: backends.append(self.ip4tables_backend) if self.ip6tables_enabled: backends.append(self.ip6tables_backend) if self.ebtables_enabled: backends.append(self.ebtables_backend) return backends def all_backends(self): backends = [] if self.ip4tables_enabled: backends.append(self.ip4tables_backend) if self.ip6tables_enabled: backends.append(self.ip6tables_backend) if self.ebtables_enabled: backends.append(self.ebtables_backend) if self.nftables_enabled: backends.append(self.nftables_backend) return backends def apply_default_tables(self, use_transaction=None): if use_transaction is None: transaction = FirewallTransaction(self) else: transaction = use_transaction for backend in self.enabled_backends(): transaction.add_rules(backend, backend.build_default_tables()) if use_transaction is None: transaction.execute(True) def apply_default_rules(self, use_transaction=None): if use_transaction is None: transaction = FirewallTransaction(self) else: transaction = use_transaction for backend in self.enabled_backends(): rules = backend.build_default_rules(self._log_denied) transaction.add_rules(backend, rules) if self.is_ipv_enabled("ipv6"): ipv6_backend = self.get_backend_by_ipv("ipv6") if "raw" in ipv6_backend.get_available_tables(): if self._ipv6_rpfilter != "no": rules = ipv6_backend.build_rpfilter_rules(self._log_denied) transaction.add_rules(ipv6_backend, rules) if self.is_ipv_enabled("ipv6") and self._rfc3964_ipv4: rules = ipv6_backend.build_rfc3964_ipv4_rules() transaction.add_rules(ipv6_backend, rules) if use_transaction is None: transaction.execute(True) def may_skip_flush_direct_backends(self): if self.nftables_enabled and not self.direct.has_runtime_configuration(): return True return False def flush_direct_backends(self, use_transaction=None): if use_transaction is None: transaction = FirewallTransaction(self) else: transaction = use_transaction for backend in self.all_backends(): if backend in self.enabled_backends(): continue rules = backend.build_flush_rules() transaction.add_rules(backend, rules) if use_transaction is None: transaction.execute(True) def flush(self, use_transaction=None): if use_transaction is None: transaction = FirewallTransaction(self) else: transaction = use_transaction log.debug1("Flushing rule set") if not self.may_skip_flush_direct_backends(): self.flush_direct_backends(use_transaction=transaction) for backend in self.enabled_backends(): rules = backend.build_flush_rules() transaction.add_rules(backend, rules) if use_transaction is None: transaction.execute(True) def _set_policy_build_rules(self, backend, policy, policy_details=None): assert policy in ("ACCEPT", "DROP", "PANIC") if policy_details is None: dp = "ACCEPT" if policy == "ACCEPT" else "DROP" policy_details = { "INPUT": dp, "OUTPUT": dp, "FORWARD": dp, } return backend.build_set_policy_rules(policy, policy_details) def set_policy(self, policy, policy_details=None, use_transaction=None): if use_transaction is None: transaction = FirewallTransaction(self) else: transaction = use_transaction log.debug1( "Setting policy to '%s'%s", policy, f" (ReloadPolicy={firewalld_conf._unparse_reload_policy(policy_details)})" if policy == "DROP" else "", ) for backend in self.enabled_backends(): rules = self._set_policy_build_rules(backend, policy, policy_details) transaction.add_rules(backend, rules) if use_transaction is None: transaction.execute(True) # rule function used in handle_ functions def rule(self, backend_name, rule): if not rule: return "" backend = self.get_backend_by_name(backend_name) if not backend: raise FirewallError(errors.INVALID_IPV, "'%s' is not a valid backend" % backend_name) if not self.is_backend_enabled(backend_name): return "" return backend.set_rule(rule, self._log_denied) def rules(self, backend_name, rules): _rules = list(filter(None, rules)) backend = self.get_backend_by_name(backend_name) if not backend: raise FirewallError(errors.INVALID_IPV, "'%s' is not a valid backend" % backend_name) if not self.is_backend_enabled(backend_name): return if self._individual_calls or \ not backend.restore_command_exists or \ (backend_name == "ebtables" and not self.ebtables_backend.restore_noflush_option): for i,rule in enumerate(_rules): try: backend.set_rule(rule, self._log_denied) except Exception as msg: log.debug1(traceback.format_exc()) log.error(msg) for rrule in reversed(_rules[:i]): try: backend.set_rule(backend.reverse_rule(rrule), self._log_denied) except Exception: # ignore errors here pass raise msg else: backend.set_rules(_rules, self._log_denied) # check functions def check_panic(self): if self._panic: raise FirewallError(errors.PANIC_MODE) def check_policy(self, policy): _policy = policy if _policy not in self.policy.get_policies(): raise FirewallError(errors.INVALID_POLICY, _policy) return _policy def check_zone(self, zone): _zone = zone if not _zone or _zone == "": _zone = self.get_default_zone() if _zone not in self.zone.get_zones(): raise FirewallError(errors.INVALID_ZONE, _zone) return _zone def check_interface(self, interface): if not functions.checkInterface(interface): raise FirewallError(errors.INVALID_INTERFACE, interface) def check_service(self, service): self.service.check_service(service) def check_port(self, port): if not functions.check_port(port): raise FirewallError(errors.INVALID_PORT, port) def check_tcpudp(self, protocol): if not protocol: raise FirewallError(errors.MISSING_PROTOCOL) if protocol not in [ "tcp", "udp", "sctp", "dccp" ]: raise FirewallError(errors.INVALID_PROTOCOL, "'%s' not in {'tcp'|'udp'|'sctp'|'dccp'}" % \ protocol) def check_ip(self, ip): if not functions.checkIP(ip): raise FirewallError(errors.INVALID_ADDR, ip) def check_address(self, ipv, source): if ipv == "ipv4": if not functions.checkIPnMask(source): raise FirewallError(errors.INVALID_ADDR, source) elif ipv == "ipv6": if not functions.checkIP6nMask(source): raise FirewallError(errors.INVALID_ADDR, source) else: raise FirewallError(errors.INVALID_IPV, "'%s' not in {'ipv4'|'ipv6'}") def check_icmptype(self, icmp): self.icmptype.check_icmptype(icmp) def check_timeout(self, timeout): if not isinstance(timeout, int): raise TypeError("%s is %s, expected int" % (timeout, type(timeout))) if int(timeout) < 0: raise FirewallError(errors.INVALID_VALUE, "timeout '%d' is not positive number" % timeout) # RELOAD def reload(self, stop=False): # we're about to load the on-disk config, so verify it's sane. check_on_disk_config(self) _panic = self._panic _omit_native_ipset = self.ipset.omit_native_ipset() # must stash this. The value may change after _start() old_firewall_backend = self._firewall_backend flush_all = self._flush_all_on_reload if not flush_all: # save zone interfaces _zone_interfaces = { } for zone in self.zone.get_zones(): _zone_interfaces[zone] = self.zone.get_zone(zone).interfaces # save direct config _direct_config = self.direct.get_runtime_config() _old_dz = self.get_default_zone() _ipset_objs = [] for _name in self.ipset.get_ipsets(): _ipset_objs.append(self.ipset.get_ipset(_name)) if not _panic: reload_policy = firewalld_conf._parse_reload_policy( self._firewalld_conf.get("ReloadPolicy") ) self.set_policy("DROP", policy_details=reload_policy) self.flush() self.cleanup() start_exception = None try: self._start(reload=True, complete_reload=stop) except Exception as e: # save the exception for later, but continue restoring interfaces, # etc. We'll re-raise it at the end. start_exception = e # destroy ipsets no longer in the permanent configuration if flush_all: for obj in _ipset_objs: if not self.ipset.query_ipset(obj.name): # nftables sets are part of the normal firewall ruleset and # thus do not need flushed here. if self.ipset_enabled and not _omit_native_ipset: self.ipset_backend.set_destroy(obj.name) if not flush_all: # handle interfaces in the default zone and move them to the new # default zone if it changed _new_dz = self.get_default_zone() if _new_dz != _old_dz: # if_new_dz has been introduced with the reload, we need to add it # https://github.com/firewalld/firewalld/issues/53 if _new_dz not in _zone_interfaces: _zone_interfaces[_new_dz] = { } # default zone changed. Move interfaces from old default zone to # the new one. for iface in _zone_interfaces[_old_dz]: if iface in self._default_zone_interfaces: # move only those that were added to default zone # (not those that were added to specific zone same as # default) _zone_interfaces[_new_dz][iface] = \ _zone_interfaces[_old_dz][iface] del _zone_interfaces[_old_dz][iface] # add interfaces to zones again for zone in self.zone.get_zones(): if zone in _zone_interfaces: for interface_id in _zone_interfaces[zone]: self.zone.change_zone_of_interface(zone, interface_id) del _zone_interfaces[zone] else: log.info1("New zone '%s'.", zone) if len(_zone_interfaces) > 0: for zone in list(_zone_interfaces.keys()): log.info1("Lost zone '%s', zone interfaces dropped.", zone) del _zone_interfaces[zone] del _zone_interfaces # restore runtime-only ipsets for obj in _ipset_objs: if self.ipset.query_ipset(obj.name): for entry in obj.entries: try: self.ipset.add_entry(obj.name, entry) except FirewallError as msg: if msg.code != errors.ALREADY_ENABLED: raise msg else: self.ipset.add_ipset(obj) self.ipset.apply_ipset(obj.name) # restore direct config self.direct.set_config(_direct_config) # Restore permanent interfaces from NetworkManager nm_bus_name = nm_get_bus_name() if nm_bus_name: for zone in self.zone.get_zones() + [""]: for interface in nm_get_interfaces_in_zone(zone): self.zone.change_zone_of_interface(zone, interface, sender=nm_bus_name) self._panic = _panic if not self._panic: self.set_policy("ACCEPT") # If the FirewallBackend changed, then we must also cleanup the policy # for the old backend that was set to DROP above. if not self._panic and old_firewall_backend != self._firewall_backend: if old_firewall_backend == "nftables": for rule in self._set_policy_build_rules( self.nftables_backend, "ACCEPT" ): self.nftables_backend.set_rule(rule, self._log_denied) else: for rule in self._set_policy_build_rules( self.ip4tables_backend, "ACCEPT" ): self.ip4tables_backend.set_rule(rule, self._log_denied) if self.ip6tables_enabled: for rule in self._set_policy_build_rules( self.ip6tables_backend, "ACCEPT" ): self.ip6tables_backend.set_rule(rule, self._log_denied) if start_exception: self._state = "FAILED" raise start_exception else: self._state = "RUNNING" # STATE def get_state(self): return self._state # PANIC MODE def enable_panic_mode(self): if self._panic: raise FirewallError(errors.ALREADY_ENABLED, "panic mode already enabled") try: self.set_policy("PANIC") except Exception as msg: raise FirewallError(errors.COMMAND_FAILED, msg) self._panic = True def disable_panic_mode(self): if not self._panic: raise FirewallError(errors.NOT_ENABLED, "panic mode is not enabled") try: self.set_policy("ACCEPT") except Exception as msg: raise FirewallError(errors.COMMAND_FAILED, msg) self._panic = False def query_panic_mode(self): return self._panic # LOG DENIED def get_log_denied(self): return self._log_denied def set_log_denied(self, value): if value not in config.LOG_DENIED_VALUES: raise FirewallError(errors.INVALID_VALUE, "'%s', choose from '%s'" % \ (value, "','".join(config.LOG_DENIED_VALUES))) if value != self.get_log_denied(): self._log_denied = value self._firewalld_conf.set("LogDenied", value) self._firewalld_conf.write() else: raise FirewallError(errors.ALREADY_SET, value) # DEFAULT ZONE def get_default_zone(self): return self._default_zone def set_default_zone(self, zone): _zone = self.check_zone(zone) if _zone != self._default_zone: _old_dz = self._default_zone self._default_zone = _zone self._firewalld_conf.set("DefaultZone", _zone) self._firewalld_conf.write() if self._offline: return # remove old default zone from ZONES and add new default zone self.zone.change_default_zone(_old_dz, _zone) # Move interfaces from old default zone to the new one. for iface in self.zone.get_zone(_old_dz).interfaces: if iface in self._default_zone_interfaces: # move only those that were added to default zone # (not those that were added to specific zone same as default) self.zone.change_zone_of_interface("", iface) else: raise FirewallError(errors.ZONE_ALREADY_SET, _zone) def combine_runtime_with_permanent_settings(self, permanent, runtime): combined = permanent.copy() for key,value in runtime.items(): # omit empty entries if value or isinstance(value, bool): combined[key] = value # make sure to remove values that were in permanent, but no # longer in runtime. elif key in combined: del combined[key] return combined def get_added_and_removed_settings(self, old_settings, new_settings): # normalize rich rules, zones and policies use a different key for rich_key in ["rich_rules", "rules_str"]: if rich_key in new_settings: new_settings[rich_key] = [str(Rich_Rule(rule_str=rule_str)) for rule_str in new_settings[rich_key]] add_settings = {} remove_settings = {} for key in (set(old_settings.keys()) | set(new_settings.keys())): if key in new_settings: if isinstance(new_settings[key], list): old = set(old_settings[key] if key in old_settings else []) add_settings[key] = list(set(new_settings[key]) - old) remove_settings[key] = list((old ^ set(new_settings[key])) & old) # check for bool or int because dbus.Boolean is a subclass of # int (because bool can't be subclassed). elif isinstance(new_settings[key], bool) or isinstance(new_settings[key], int): if not old_settings[key] and new_settings[key]: add_settings[key] = True elif old_settings[key] and not new_settings[key]: remove_settings[key] = False else: raise FirewallError(errors.INVALID_SETTING, "Unhandled setting type {} key {}".format(type(new_settings[key]), key)) return (add_settings, remove_settings) core/fw_icmptype.py 0000644 00000004665 15025011705 0010403 0 ustar 00 # -*- coding: utf-8 -*- # # Copyright (C) 2011-2016 Red Hat, Inc. # # Authors: # Thomas Woerner <twoerner@redhat.com> # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see <http://www.gnu.org/licenses/>. # __all__ = [ "FirewallIcmpType" ] from firewall.core.logger import log from firewall import errors from firewall.errors import FirewallError class FirewallIcmpType(object): def __init__(self, fw): self._fw = fw self._icmptypes = { } def __repr__(self): return '%s(%r)' % (self.__class__, self._icmptypes) def cleanup(self): self._icmptypes.clear() # zones def get_icmptypes(self): return sorted(self._icmptypes.keys()) def check_icmptype(self, icmptype): if icmptype not in self._icmptypes: raise FirewallError(errors.INVALID_ICMPTYPE, icmptype) def get_icmptype(self, icmptype): self.check_icmptype(icmptype) return self._icmptypes[icmptype] def add_icmptype(self, obj): orig_ipvs = obj.destination if len(orig_ipvs) == 0: orig_ipvs = [ "ipv4", "ipv6" ] for ipv in orig_ipvs: if ipv == "ipv4": if not self._fw.ip4tables_enabled and not self._fw.nftables_enabled: continue supported_icmps = self._fw.ipv4_supported_icmp_types elif ipv == "ipv6": if not self._fw.ip6tables_enabled and not self._fw.nftables_enabled: continue supported_icmps = self._fw.ipv6_supported_icmp_types else: supported_icmps = [ ] if obj.name.lower() not in supported_icmps: log.info1("ICMP type '%s' is not supported by the kernel for %s." % (obj.name, ipv)) self._icmptypes[obj.name] = obj def remove_icmptype(self, icmptype): self.check_icmptype(icmptype) del self._icmptypes[icmptype] core/logger.py 0000644 00000074477 15025011705 0007344 0 ustar 00 # -*- coding: utf-8 -*- # # Copyright (C) 2005-2007,2012 Red Hat, Inc. # # Authors: # Thomas Woerner <twoerner@redhat.com> # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see <http://www.gnu.org/licenses/>. # __all__ = [ "LogTarget", "FileLog", "Logger", "log" ] import sys import types import time import inspect import fnmatch import syslog import traceback import fcntl import os.path import os # --------------------------------------------------------------------------- # abstract class for logging targets class LogTarget(object): """ Abstract class for logging targets. """ def __init__(self): self.fd = None def write(self, data, level, logger, is_debug=0): raise NotImplementedError("LogTarget.write is an abstract method") def flush(self): raise NotImplementedError("LogTarget.flush is an abstract method") def close(self): raise NotImplementedError("LogTarget.close is an abstract method") # --------------------------------------------------------------------------- # private class for stdout class _StdoutLog(LogTarget): def __init__(self): LogTarget.__init__(self) self.fd = sys.stdout def write(self, data, level, logger, is_debug=0): # ignore level self.fd.write(data) self.flush() def close(self): self.flush() def flush(self): self.fd.flush() # --------------------------------------------------------------------------- # private class for stderr class _StderrLog(_StdoutLog): def __init__(self): _StdoutLog.__init__(self) self.fd = sys.stderr # --------------------------------------------------------------------------- # private class for syslog class _SyslogLog(LogTarget): def __init__(self): # Only initialize LogTarget here as fs should be None LogTarget.__init__(self) # # Derived from: https://github.com/canvon/firewalld/commit/af0edfee1cc1891b7b13f302ca5911b24e9b0f13 # # Work around Python issue 27875, "Syslogs /usr/sbin/foo as /foo # instead of as foo" # (but using openlog explicitly might be better anyway) # # Set ident to basename, log PID as well, and log to facility "daemon". syslog.openlog(os.path.basename(sys.argv[0]), syslog.LOG_PID, syslog.LOG_DAEMON) def write(self, data, level, logger, is_debug=0): priority = None if is_debug: priority = syslog.LOG_DEBUG else: if level >= logger.INFO1: priority = syslog.LOG_INFO elif level == logger.WARNING: priority = syslog.LOG_WARNING elif level == logger.ERROR: priority = syslog.LOG_ERR elif level == logger.FATAL: priority = syslog.LOG_CRIT if data.endswith("\n"): data = data[:len(data)-1] if len(data) > 0: if priority is None: syslog.syslog(data) else: syslog.syslog(priority, data) def close(self): syslog.closelog() def flush(self): pass # --------------------------------------------------------------------------- class FileLog(LogTarget): """ FileLog class. File will be opened on the first write. """ def __init__(self, filename, mode="w"): LogTarget.__init__(self) self.filename = filename self.mode = mode def open(self): if self.fd: return flags = os.O_CREAT | os.O_WRONLY if self.mode.startswith('a'): flags |= os.O_APPEND self.fd = os.open(self.filename, flags, 0o640) # Make sure that existing file has correct perms os.fchmod(self.fd, 0o640) # Make it an object self.fd = os.fdopen(self.fd, self.mode) fcntl.fcntl(self.fd, fcntl.F_SETFD, fcntl.FD_CLOEXEC) def write(self, data, level, logger, is_debug=0): if not self.fd: self.open() self.fd.write(data) self.fd.flush() def close(self): if not self.fd: return self.fd.close() self.fd = None def flush(self): if not self.fd: return self.fd.flush() # --------------------------------------------------------------------------- class Logger(object): r""" Format string: %(class)s Calling class the function belongs to, else empty %(date)s Date using Logger.date_format, see time module %(domain)s Full Domain: %(module)s.%(class)s.%(function)s %(file)s Filename of the module %(function)s Function name, empty in __main__ %(label)s Label according to log function call from Logger.label %(level)d Internal logging level %(line)d Line number in module %(module)s Module name %(message)s Log message Standard levels: FATAL Fatal error messages ERROR Error messages WARNING Warning messages INFOx, x in [1..5] Information DEBUGy, y in [1..10] Debug messages NO_INFO No info output NO_DEBUG No debug output INFO_MAX Maximum info level DEBUG_MAX Maximum debug level x and y depend on info_max and debug_max from Logger class initialization. See __init__ function. Default logging targets: stdout Logs to stdout stderr Logs to stderr syslog Logs to syslog Additional arguments for logging functions (fatal, error, warning, info and debug): nl Disable newline at the end with nl=0, default is nl=1. fmt Format string for this logging entry, overloads global format string. Example: fmt="%(file)s:%(line)d %(message)s" nofmt Only output message with nofmt=1. The nofmt argument wins over the fmt argument. Example: from logger import log log.setInfoLogLevel(log.INFO1) log.setDebugLogLevel(log.DEBUG1) for i in range(1, log.INFO_MAX+1): log.setInfoLogLabel(i, "INFO%d: " % i) log.setFormat("%(date)s %(module)s:%(line)d [%(domain)s] %(label)s: " "%(level)d %(message)s") log.setDateFormat("%Y-%m-%d %H:%M:%S") fl = FileLog("/tmp/log", "a") log.addInfoLogging("*", fl) log.addDebugLogging("*", fl) log.addInfoLogging("*", log.syslog, fmt="%(label)s%(message)s") log.debug3("debug3") log.debug2("debug2") log.debug1("debug1") log.info2("info2") log.info1("info1") log.warning("warning\n", nl=0) log.error("error\n", nl=0) log.fatal("fatal") log.info(log.INFO1, "nofmt info", nofmt=1) """ ALL = -5 NOTHING = -4 FATAL = -3 TRACEBACK = -2 ERROR = -1 WARNING = 0 # Additional levels are generated in class initilization stdout = _StdoutLog() stderr = _StderrLog() syslog = _SyslogLog() def __init__(self, info_max=5, debug_max=10): """ Logger class initialization """ self._level = { } self._debug_level = { } self._format = "" self._date_format = "" self._label = { } self._debug_label = { } self._logging = { } self._debug_logging = { } self._domains = { } self._debug_domains = { } # INFO1 is required for standard log level if info_max < 1: raise ValueError("Logger: info_max %d is too low" % info_max) if debug_max < 0: raise ValueError("Logger: debug_max %d is too low" % debug_max) self.NO_INFO = self.WARNING # = 0 self.INFO_MAX = info_max self.NO_DEBUG = 0 self.DEBUG_MAX = debug_max self.setInfoLogLabel(self.FATAL, "FATAL ERROR: ") self.setInfoLogLabel(self.TRACEBACK, "") self.setInfoLogLabel(self.ERROR, "ERROR: ") self.setInfoLogLabel(self.WARNING, "WARNING: ") # generate info levels and infox functions for _level in range(1, self.INFO_MAX+1): setattr(self, "INFO%d" % _level, _level) self.setInfoLogLabel(_level, "") setattr(self, "info%d" % (_level), (lambda self, x: lambda message, *args, **kwargs: self.info(x, message, *args, **kwargs))(self, _level)) # pylint: disable=E0602 # generate debug levels and debugx functions for _level in range(1, self.DEBUG_MAX+1): setattr(self, "DEBUG%d" % _level, _level) self.setDebugLogLabel(_level, "DEBUG%d: " % _level) setattr(self, "debug%d" % (_level), (lambda self, x: lambda message, *args, **kwargs: self.debug(x, message, *args, **kwargs))(self, _level)) # pylint: disable=E0602 # set initial log levels, formats and targets self.setInfoLogLevel(self.INFO1) self.setDebugLogLevel(self.NO_DEBUG) self.setFormat("%(label)s%(message)s") self.setDateFormat("%d %b %Y %H:%M:%S") self.setInfoLogging("*", self.stderr, [ self.FATAL, self.ERROR, self.WARNING ]) self.setInfoLogging("*", self.stdout, [ i for i in range(self.INFO1, self.INFO_MAX+1) ]) self.setDebugLogging("*", self.stdout, [ i for i in range(1, self.DEBUG_MAX+1) ]) def close(self): """ Close all logging targets """ for level in range(self.FATAL, self.DEBUG_MAX+1): if level not in self._logging: continue for (dummy, target, dummy) in self._logging[level]: target.close() def getInfoLogLevel(self, domain="*"): """ Get info log level. """ self._checkDomain(domain) if domain in self._level: return self._level[domain] return self.NOTHING def setInfoLogLevel(self, level, domain="*"): """ Set log level [NOTHING .. INFO_MAX] """ self._checkDomain(domain) if level < self.NOTHING: level = self.NOTHING if level > self.INFO_MAX: level = self.INFO_MAX self._level[domain] = level def getDebugLogLevel(self, domain="*"): """ Get debug log level. """ self._checkDomain(domain) if domain in self._debug_level: return self._debug_level[domain] + self.NO_DEBUG return self.NO_DEBUG def setDebugLogLevel(self, level, domain="*"): """ Set debug log level [NO_DEBUG .. DEBUG_MAX] """ self._checkDomain(domain) if level < 0: level = 0 if level > self.DEBUG_MAX: level = self.DEBUG_MAX self._debug_level[domain] = level - self.NO_DEBUG def getFormat(self): return self._format def setFormat(self, _format): self._format = _format def getDateFormat(self): return self._date_format def setDateFormat(self, _format): self._date_format = _format def setInfoLogLabel(self, level, label): """ Set log label for level. Level can be a single level or an array of levels. """ levels = self._getLevels(level) for level in levels: self._checkLogLevel(level, min_level=self.FATAL, max_level=self.INFO_MAX) self._label[level] = label def setDebugLogLabel(self, level, label): """ Set log label for level. Level can be a single level or an array of levels. """ levels = self._getLevels(level, is_debug=1) for level in levels: self._checkLogLevel(level, min_level=self.INFO1, max_level=self.DEBUG_MAX) self._debug_label[level] = label def setInfoLogging(self, domain, target, level=ALL, fmt=None): """ Set info log target for domain and level. Level can be a single level or an array of levels. Use level ALL to set for all levels. If no format is specified, the default format will be used. """ self._setLogging(domain, target, level, fmt, is_debug=0) def setDebugLogging(self, domain, target, level=ALL, fmt=None): """ Set debug log target for domain and level. Level can be a single level or an array of levels. Use level ALL to set for all levels. If no format is specified, the default format will be used. """ self._setLogging(domain, target, level, fmt, is_debug=1) def addInfoLogging(self, domain, target, level=ALL, fmt=None): """ Add info log target for domain and level. Level can be a single level or an array of levels. Use level ALL to set for all levels. If no format is specified, the default format will be used. """ self._addLogging(domain, target, level, fmt, is_debug=0) def addDebugLogging(self, domain, target, level=ALL, fmt=None): """ Add debg log target for domain and level. Level can be a single level or an array of levels. Use level ALL to set for all levels. If no format is specified, the default format will be used. """ self._addLogging(domain, target, level, fmt, is_debug=1) def delInfoLogging(self, domain, target, level=ALL, fmt=None): """ Delete info log target for domain and level. Level can be a single level or an array of levels. Use level ALL to set for all levels. If no format is specified, the default format will be used. """ self._delLogging(domain, target, level, fmt, is_debug=0) def delDebugLogging(self, domain, target, level=ALL, fmt=None): """ Delete debug log target for domain and level. Level can be a single level or an array of levels. Use level ALL to set for all levels. If no format is specified, the default format will be used. """ self._delLogging(domain, target, level, fmt, is_debug=1) def isInfoLoggingHere(self, level): """ Is there currently any info logging for this log level (and domain)? """ return self._isLoggingHere(level, is_debug=0) def isDebugLoggingHere(self, level): """ Is there currently any debug logging for this log level (and domain)? """ return self._isLoggingHere(level, is_debug=1) ### log functions def fatal(self, _format, *args, **kwargs): """ Fatal error log. """ self._checkKWargs(kwargs) kwargs["is_debug"] = 0 self._log(self.FATAL, _format, *args, **kwargs) def error(self, _format, *args, **kwargs): """ Error log. """ self._checkKWargs(kwargs) kwargs["is_debug"] = 0 self._log(self.ERROR, _format, *args, **kwargs) def warning(self, _format, *args, **kwargs): """ Warning log. """ self._checkKWargs(kwargs) kwargs["is_debug"] = 0 self._log(self.WARNING, _format, *args, **kwargs) def info(self, level, _format, *args, **kwargs): """ Information log using info level [1..info_max]. There are additional infox functions according to info_max from __init__""" self._checkLogLevel(level, min_level=1, max_level=self.INFO_MAX) self._checkKWargs(kwargs) kwargs["is_debug"] = 0 self._log(level+self.NO_INFO, _format, *args, **kwargs) def debug(self, level, _format, *args, **kwargs): """ Debug log using debug level [1..debug_max]. There are additional debugx functions according to debug_max from __init__""" self._checkLogLevel(level, min_level=1, max_level=self.DEBUG_MAX) self._checkKWargs(kwargs) kwargs["is_debug"] = 1 self._log(level, _format, *args, **kwargs) def exception(self): self._log(self.TRACEBACK, traceback.format_exc(), args=[], kwargs={}) ### internal functions def _checkLogLevel(self, level, min_level, max_level): if level < min_level or level > max_level: raise ValueError("Level %d out of range, should be [%d..%d]." % \ (level, min_level, max_level)) def _checkKWargs(self, kwargs): if not kwargs: return for key in kwargs.keys(): if key not in [ "nl", "fmt", "nofmt" ]: raise ValueError("Key '%s' is not allowed as argument for logging." % key) def _checkDomain(self, domain): if not domain or domain == "": raise ValueError("Domain '%s' is not valid." % domain) def _getLevels(self, level, is_debug=0): """ Generate log level array. """ if level != self.ALL: if isinstance(level, list) or isinstance(level, tuple): levels = level else: levels = [ level ] for level in levels: if is_debug: self._checkLogLevel(level, min_level=1, max_level=self.DEBUG_MAX) else: self._checkLogLevel(level, min_level=self.FATAL, max_level=self.INFO_MAX) else: if is_debug: levels = [ i for i in range(self.DEBUG1, self.DEBUG_MAX) ] else: levels = [ i for i in range(self.FATAL, self.INFO_MAX) ] return levels def _getTargets(self, target): """ Generate target array. """ if isinstance(target, list) or isinstance(target, tuple): targets = target else: targets = [ target ] for _target in targets: if not issubclass(_target.__class__, LogTarget): raise ValueError("'%s' is no valid logging target." % \ _target.__class__.__name__) return targets def _genDomains(self, is_debug=0): # private method for self._domains array creation, speeds up """ Generate dict with domain by level. """ if is_debug: _domains = self._debug_domains _logging = self._debug_logging _range = ( 1, self.DEBUG_MAX+1 ) else: _domains = self._domains _logging = self._logging _range = ( self.FATAL, self.INFO_MAX+1 ) if len(_domains) > 0: _domains.clear() for level in range(_range[0], _range[1]): if level not in _logging: continue for (domain, dummy, dummy) in _logging[level]: if domain not in _domains: _domains.setdefault(level, [ ]).append(domain) def _setLogging(self, domain, target, level=ALL, fmt=None, is_debug=0): self._checkDomain(domain) levels = self._getLevels(level, is_debug) targets = self._getTargets(target) if is_debug: _logging = self._debug_logging else: _logging = self._logging for level in levels: for target in targets: _logging[level] = [ (domain, target, fmt) ] self._genDomains(is_debug) def _addLogging(self, domain, target, level=ALL, fmt=None, is_debug=0): self._checkDomain(domain) levels = self._getLevels(level, is_debug) targets = self._getTargets(target) if is_debug: _logging = self._debug_logging else: _logging = self._logging for level in levels: for target in targets: _logging.setdefault(level, [ ]).append((domain, target, fmt)) self._genDomains(is_debug) def _delLogging(self, domain, target, level=ALL, fmt=None, is_debug=0): self._checkDomain(domain) levels = self._getLevels(level, is_debug) targets = self._getTargets(target) if is_debug: _logging = self._debug_logging else: _logging = self._logging for _level in levels: for target in targets: if _level not in _logging: continue if (domain, target, fmt) in _logging[_level]: _logging[_level].remove( (domain, target, fmt) ) if len(_logging[_level]) == 0: del _logging[_level] continue if level != self.ALL: raise ValueError("No matching logging for " \ "level %d, domain %s, target %s and format %s." % \ (_level, domain, target.__class__.__name__, fmt)) self._genDomains(is_debug) def _isLoggingHere(self, level, is_debug=0): _dict = self._genDict(level, is_debug) if not _dict: return False point_domain = _dict["domain"] + "." if is_debug: _logging = self._debug_logging else: _logging = self._logging # do we need to log? for (domain, dummy, dummy) in _logging[level]: if domain == "*" or \ point_domain.startswith(domain) or \ fnmatch.fnmatchcase(_dict["domain"], domain): return True return False def _getClass(self, frame): """ Function to get calling class. Returns class or None. """ # get class by first function argument, if there are any if frame.f_code.co_argcount > 0: selfname = frame.f_code.co_varnames[0] if selfname in frame.f_locals: _self = frame.f_locals[selfname] obj = self._getClass2(_self.__class__, frame.f_code) if obj: return obj module = inspect.getmodule(frame.f_code) code = frame.f_code # function in module? if code.co_name in module.__dict__: if hasattr(module.__dict__[code.co_name], "func_code") and \ module.__dict__[code.co_name].__code__ == code: return None # class in module for (dummy, obj) in module.__dict__.items(): if isinstance(obj, types.ClassType): if hasattr(obj, code.co_name): value = getattr(obj, code.co_name) if isinstance(value, types.FunctionType): if value.__code__ == code: return obj # nothing found return None def _getClass2(self, obj, code): """ Internal function to get calling class. Returns class or None. """ for value in obj.__dict__.values(): if isinstance(value, types.FunctionType): if value.__code__ == code: return obj for base in obj.__bases__: _obj = self._getClass2(base, code) if _obj: return _obj return None # internal log class def _log(self, level, _format, *args, **kwargs): is_debug = 0 if "is_debug" in kwargs: is_debug = kwargs["is_debug"] nl = 1 if "nl" in kwargs: nl = kwargs["nl"] nofmt = 0 if "nofmt" in kwargs: nofmt = kwargs["nofmt"] _dict = self._genDict(level, is_debug) if not _dict: return if len(args) > 1: _dict['message'] = _format % args elif len(args) == 1: # needed for _format % _dict _dict['message'] = _format % args[0] else: _dict['message'] = _format point_domain = _dict["domain"] + "." if is_debug: _logging = self._debug_logging else: _logging = self._logging used_targets = [ ] # log to target(s) for (domain, target, _format) in _logging[level]: if target in used_targets: continue if domain == "*" \ or point_domain.startswith(domain+".") \ or fnmatch.fnmatchcase(_dict["domain"], domain): if not _format: _format = self._format if "fmt" in kwargs: _format = kwargs["fmt"] if nofmt: target.write(_dict["message"], level, self, is_debug) else: target.write(_format % _dict, level, self, is_debug) if nl: # newline target.write("\n", level, self, is_debug) used_targets.append(target) # internal function to generate the dict, needed for logging def _genDict(self, level, is_debug=0): """ Internal function. """ check_domains = [ ] simple_match = False if is_debug: _dict = self._debug_level _domains = self._debug_domains _label = self._debug_label else: _dict = self._level _domains = self._domains _label = self._label # no debug for domain in _dict: if domain == "*": # '*' matches everything: simple match if _dict[domain] >= level: simple_match = True if len(check_domains) > 0: check_domains = [ ] break else: if _dict[domain] >= level: check_domains.append(domain) if not simple_match and len(check_domains) < 1: return None if level not in _domains: return None f = inspect.currentframe() # go outside of logger module as long as there is a lower frame while f and f.f_back and f.f_globals["__name__"] == self.__module__: f = f.f_back if not f: raise ValueError("Frame information not available.") # get module name module_name = f.f_globals["__name__"] # simple module match test for all entries of check_domain point_module = module_name + "." for domain in check_domains: if point_module.startswith(domain): # found domain in module name check_domains = [ ] break # get code co = f.f_code # optimization: bail out early if domain can not match at all _len = len(module_name) for domain in _domains[level]: i = domain.find("*") if i == 0: continue elif i > 0: d = domain[:i] else: d = domain if _len >= len(d): if not module_name.startswith(d): return None else: if not d.startswith(module_name): return None # generate _dict for format output level_str = "" if level in _label: level_str = _label[level] _dict = { 'file': co.co_filename, 'line': f.f_lineno, 'module': module_name, 'class': '', 'function': co.co_name, 'domain': '', 'label' : level_str, 'level' : level, 'date' : time.strftime(self._date_format, time.localtime()) } if _dict["function"] == "?": _dict["function"] = "" # domain match needed? domain_needed = False for domain in _domains[level]: # standard domain, matches everything if domain == "*": continue # domain is needed domain_needed = True break # do we need to get the class object? if self._format.find("%(domain)") >= 0 or \ self._format.find("%(class)") >= 0 or \ domain_needed or \ len(check_domains) > 0: obj = self._getClass(f) if obj: _dict["class"] = obj.__name__ # build domain string _dict["domain"] = "" + _dict["module"] if _dict["class"] != "": _dict["domain"] += "." + _dict["class"] if _dict["function"] != "": _dict["domain"] += "." + _dict["function"] if len(check_domains) < 1: return _dict point_domain = _dict["domain"] + "." for domain in check_domains: if point_domain.startswith(domain) or \ fnmatch.fnmatchcase(_dict["domain"], domain): return _dict return None # --------------------------------------------------------------------------- # Global logging object. log = Logger() # --------------------------------------------------------------------------- """ # Example if __name__ == '__main__': log.setInfoLogLevel(log.INFO2) log.setDebugLogLevel(log.DEBUG5) for i in range(log.INFO1, log.INFO_MAX+1): log.setInfoLogLabel(i, "INFO%d: " % i) for i in range(log.DEBUG1, log.DEBUG_MAX+1): log.setDebugLogLabel(i, "DEBUG%d: " % i) log.setFormat("%(date)s %(module)s:%(line)d %(label)s" "%(message)s") log.setDateFormat("%Y-%m-%d %H:%M:%S") fl = FileLog("/tmp/log", "a") log.addInfoLogging("*", fl) log.delDebugLogging("*", log.stdout) log.setDebugLogging("*", log.stdout, [ log.DEBUG1, log.DEBUG2 ] ) log.addDebugLogging("*", fl) # log.addInfoLogging("*", log.syslog, fmt="%(label)s%(message)s") # log.addDebugLogging("*", log.syslog, fmt="%(label)s%(message)s") log.debug10("debug10") log.debug9("debug9") log.debug8("debug8") log.debug7("debug7") log.debug6("debug6") log.debug5("debug5") log.debug4("debug4") log.debug3("debug3") log.debug2("debug2", fmt="%(file)s:%(line)d %(message)s") log.debug1("debug1", nofmt=1) log.info5("info5") log.info4("info4") log.info3("info3") log.info2("info2") log.info1("info1") log.warning("warning\n", nl=0) log.error("error ", nl=0) log.error("error", nofmt=1) log.fatal("fatal") log.info(log.INFO1, "nofmt info", nofmt=1) log.info(log.INFO2, "info2 fmt", fmt="%(file)s:%(line)d %(message)s") try: a = b except Exception as e: log.exception() """ # vim:ts=4:sw=4:showmatch:expandtab core/helper.py 0000644 00000001444 15025011705 0007324 0 ustar 00 # -*- coding: utf-8 -*- # # Copyright (C) 2016 Red Hat, Inc. # # Authors: # Thomas Woerner <twoerner@redhat.com> # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see <http://www.gnu.org/licenses/>. # """The helper maxnamelen""" HELPER_MAXNAMELEN = 32 core/watcher.py 0000644 00000006224 15025011705 0007503 0 ustar 00 # -*- coding: utf-8 -*- # # Copyright (C) 2012-2016 Red Hat, Inc. # # Authors: # Thomas Woerner <twoerner@redhat.com> # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see <http://www.gnu.org/licenses/>. # __all__ = [ "Watcher" ] from gi.repository import Gio, GLib class Watcher(object): def __init__(self, callback, timeout): self._callback = callback self._timeout = timeout self._monitors = { } self._timeouts = { } self._blocked = [ ] def add_watch_dir(self, directory): gfile = Gio.File.new_for_path(directory) self._monitors[directory] = gfile.monitor_directory(\ Gio.FileMonitorFlags.NONE, None) self._monitors[directory].connect("changed", self._file_changed_cb) def add_watch_file(self, filename): gfile = Gio.File.new_for_path(filename) self._monitors[filename] = gfile.monitor_file(\ Gio.FileMonitorFlags.NONE, None) self._monitors[filename].connect("changed", self._file_changed_cb) def get_watches(self): return self._monitors.keys() def has_watch(self, filename): return filename in self._monitors def remove_watch(self, filename): del self._monitors[filename] def block_source(self, filename): if filename not in self._blocked: self._blocked.append(filename) def unblock_source(self, filename): if filename in self._blocked: self._blocked.remove(filename) def clear_timeouts(self): for filename in list(self._timeouts.keys()): GLib.source_remove(self._timeouts[filename]) del self._timeouts[filename] def _call_callback(self, filename): if filename not in self._blocked: self._callback(filename) del self._timeouts[filename] def _file_changed_cb(self, monitor, gio_file, gio_other_file, event): filename = gio_file.get_parse_name() if filename in self._blocked: if filename in self._timeouts: GLib.source_remove(self._timeouts[filename]) del self._timeouts[filename] return if event == Gio.FileMonitorEvent.CHANGED or \ event == Gio.FileMonitorEvent.CREATED or \ event == Gio.FileMonitorEvent.DELETED or \ event == Gio.FileMonitorEvent.ATTRIBUTE_CHANGED: if filename in self._timeouts: GLib.source_remove(self._timeouts[filename]) del self._timeouts[filename] self._timeouts[filename] = GLib.timeout_add_seconds(\ self._timeout, self._call_callback, filename) core/ebtables.py 0000644 00000022306 15025011705 0007626 0 ustar 00 # -*- coding: utf-8 -*- # # Copyright (C) 2010-2016 Red Hat, Inc. # # Authors: # Thomas Woerner <twoerner@redhat.com> # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see <http://www.gnu.org/licenses/>. # __all__ = [ "ebtables" ] import os.path from firewall.core.prog import runProg from firewall.core.logger import log from firewall.functions import tempFile, readfile, splitArgs from firewall.config import COMMANDS from firewall.core import ipXtables # some common stuff lives there from firewall.errors import FirewallError, INVALID_IPV import string BUILT_IN_CHAINS = { "broute": [ "BROUTING" ], "nat": [ "PREROUTING", "POSTROUTING", "OUTPUT" ], "filter": [ "INPUT", "OUTPUT", "FORWARD" ], } DEFAULT_RULES = { } LOG_RULES = { } OUR_CHAINS = {} # chains created by firewalld for table in BUILT_IN_CHAINS.keys(): DEFAULT_RULES[table] = [ ] OUR_CHAINS[table] = set() for chain in BUILT_IN_CHAINS[table]: DEFAULT_RULES[table].append("-N %s_direct" % chain) DEFAULT_RULES[table].append("-I %s 1 -j %s_direct" % (chain, chain)) DEFAULT_RULES[table].append("-I %s_direct 1 -j RETURN" % chain) OUR_CHAINS[table].add("%s_direct" % chain) class ebtables(object): ipv = "eb" name = "ebtables" policies_supported = False # ebtables only supported with direct interface def __init__(self): self._command = COMMANDS[self.ipv] self._restore_command = COMMANDS["%s-restore" % self.ipv] self.restore_noflush_option = self._detect_restore_noflush_option() self.concurrent_option = self._detect_concurrent_option() self.fill_exists() self.available_tables = [] def fill_exists(self): self.command_exists = os.path.exists(self._command) self.restore_command_exists = os.path.exists(self._restore_command) def _detect_concurrent_option(self): # Do not change any rules, just try to use the --concurrent option # with -L concurrent_option = "" ret = runProg(self._command, ["--concurrent", "-L"]) if ret[0] == 0: concurrent_option = "--concurrent" # concurrent for ebtables lock return concurrent_option def _detect_restore_noflush_option(self): # Do not change any rules, just try to use the restore command # with --noflush rules = [ ] try: self.set_rules(rules, "off") except ValueError: return False return True def __run(self, args): # convert to string list _args = [ ] if self.concurrent_option and self.concurrent_option not in args: _args.append(self.concurrent_option) _args += ["%s" % item for item in args] log.debug2("%s: %s %s", self.__class__, self._command, " ".join(_args)) (status, ret) = runProg(self._command, _args) if status != 0: raise ValueError("'%s %s' failed: %s" % (self._command, " ".join(args), ret)) return ret def _rule_validate(self, rule): for str in ["%%REJECT%%", "%%ICMP%%", "%%LOGTYPE%%"]: if str in rule: raise FirewallError(INVALID_IPV, "'%s' invalid for ebtables" % str) def is_chain_builtin(self, ipv, table, chain): return table in BUILT_IN_CHAINS and \ chain in BUILT_IN_CHAINS[table] def build_chain_rules(self, add, table, chain): rules = [] if add: rules.append([ "-t", table, "-N", chain ]) rules.append([ "-t", table, "-I", chain, "1", "-j", "RETURN" ]) else: rules.append([ "-t", table, "-X", chain ]) return rules def build_rule(self, add, table, chain, index, args): rule = [ "-t", table ] if add: rule += [ "-I", chain, str(index) ] else: rule += [ "-D", chain ] rule += args return rule def reverse_rule(self, args): return ipXtables.common_reverse_rule(args) def check_passthrough(self, args): ipXtables.common_check_passthrough(args) def reverse_passthrough(self, args): return ipXtables.common_reverse_passthrough(args) def set_rules(self, rules, log_denied): temp_file = tempFile() table = "filter" table_rules = { } for _rule in rules: rule = _rule[:] self._rule_validate(rule) # get table form rule for opt in [ "-t", "--table" ]: try: i = rule.index(opt) except ValueError: pass else: if len(rule) >= i+1: rule.pop(i) table = rule.pop(i) # we can not use joinArgs here, because it would use "'" instead # of '"' for the start and end of the string, this breaks # iptables-restore for i, element in enumerate(rule): for c in string.whitespace: if c in element and not (element.startswith('"') and element.endswith('"')): rule[i] = '"%s"' % element table_rules.setdefault(table, []).append(rule) for table in table_rules: temp_file.write("*%s\n" % table) for rule in table_rules[table]: temp_file.write(" ".join(rule) + "\n") temp_file.close() stat = os.stat(temp_file.name) log.debug2("%s: %s %s", self.__class__, self._restore_command, "%s: %d" % (temp_file.name, stat.st_size)) args = [ ] args.append("--noflush") (status, ret) = runProg(self._restore_command, args, stdin=temp_file.name) if log.getDebugLogLevel() > 2: lines = readfile(temp_file.name) if lines is not None: i = 1 for line in lines: log.debug3("%8d: %s" % (i, line), nofmt=1, nl=0) if not line.endswith("\n"): log.debug3("", nofmt=1) i += 1 os.unlink(temp_file.name) if status != 0: raise ValueError("'%s %s' failed: %s" % (self._restore_command, " ".join(args), ret)) def set_rule(self, rule, log_denied): self._rule_validate(rule) return self.__run(rule) def get_available_tables(self, table=None): ret = [] tables = [ table ] if table else BUILT_IN_CHAINS.keys() for table in tables: if table in self.available_tables: ret.append(table) else: try: self.__run(["-t", table, "-L"]) self.available_tables.append(table) ret.append(table) except ValueError: log.debug1("ebtables table '%s' does not exist." % table) return ret def get_zone_table_chains(self, table): return {} def build_flush_rules(self): rules = [] for table in BUILT_IN_CHAINS.keys(): if table not in self.get_available_tables(): continue # Flush firewall rules: -F # Delete firewall chains: -X # Set counter to zero: -Z for flag in [ "-F", "-X", "-Z" ]: rules.append(["-t", table, flag]) return rules def build_set_policy_rules(self, policy, policy_details): rules = [] _policy = "DROP" if policy == "PANIC" else policy for table in BUILT_IN_CHAINS.keys(): if table not in self.get_available_tables(): continue for chain in BUILT_IN_CHAINS[table]: rules.append(["-t", table, "-P", chain, _policy]) return rules def build_default_tables(self): # nothing to do, they always exist return [] def build_default_rules(self, log_denied="off"): default_rules = [] for table in DEFAULT_RULES: if table not in self.get_available_tables(): continue _default_rules = DEFAULT_RULES[table][:] if log_denied != "off" and table in LOG_RULES: _default_rules.extend(LOG_RULES[table]) prefix = [ "-t", table ] for rule in _default_rules: if type(rule) == list: default_rules.append(prefix + rule) else: default_rules.append(prefix + splitArgs(rule)) return default_rules def is_ipv_supported(self, ipv): return ipv == self.ipv core/fw_ipset.py 0000644 00000023542 15025011705 0007670 0 ustar 00 # -*- coding: utf-8 -*- # # Copyright (C) 2015-2016 Red Hat, Inc. # # Authors: # Thomas Woerner <twoerner@redhat.com> # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see <http://www.gnu.org/licenses/>. # """ipset backend""" __all__ = [ "FirewallIPSet" ] from firewall.core.logger import log from firewall.core.ipset import remove_default_create_options as rm_def_cr_opts, \ normalize_ipset_entry, check_entry_overlaps_existing, \ check_for_overlapping_entries from firewall.core.io.ipset import IPSet from firewall import errors from firewall.errors import FirewallError class FirewallIPSet(object): def __init__(self, fw): self._fw = fw self._ipsets = { } def __repr__(self): return '%s(%r)' % (self.__class__, self._ipsets) # ipsets def cleanup(self): self._ipsets.clear() def check_ipset(self, name): if name not in self.get_ipsets(): raise FirewallError(errors.INVALID_IPSET, name) def query_ipset(self, name): return name in self.get_ipsets() def get_ipsets(self): return sorted(self._ipsets.keys()) def has_ipsets(self): return len(self._ipsets) > 0 def get_ipset(self, name, applied=False): self.check_ipset(name) obj = self._ipsets[name] if applied: self.check_applied_obj(obj) return obj def omit_native_ipset(self): # if using nftables, we can avoid creating ipsets in the native ipset # backend. But only if there aren't any direct rules. if not self._fw.nftables_enabled or self._fw.direct.has_runtime_configuration(): return False return True def backends(self): backends = [] if self._fw.nftables_enabled: backends.append(self._fw.nftables_backend) if self._fw.ipset_enabled and not self.omit_native_ipset(): backends.append(self._fw.ipset_backend) return backends def add_ipset(self, obj): if obj.type not in self._fw.ipset_supported_types: raise FirewallError(errors.INVALID_TYPE, "'%s' is not supported by ipset." % obj.type) self._ipsets[obj.name] = obj def remove_ipset(self, name, keep=False): obj = self._ipsets[name] if obj.applied and not keep: try: for backend in self.backends(): backend.set_destroy(name) except Exception as msg: raise FirewallError(errors.COMMAND_FAILED, msg) else: log.debug1("Keeping ipset '%s' because of timeout option", name) del self._ipsets[name] def apply_ipset(self, name, backends=None): obj = self._ipsets[name] for backend in backends if backends else self.backends(): if backend.name == "ipset": active = backend.set_get_active_terse() if name in active and ("timeout" not in obj.options or \ obj.options["timeout"] == "0" or \ obj.type != active[name][0] or \ rm_def_cr_opts(obj.options) != \ active[name][1]): try: backend.set_destroy(name) except Exception as msg: raise FirewallError(errors.COMMAND_FAILED, msg) if self._fw._individual_calls: try: backend.set_create(obj.name, obj.type, obj.options) except Exception as msg: raise FirewallError(errors.COMMAND_FAILED, msg) else: obj.applied = True if "timeout" in obj.options and \ obj.options["timeout"] != "0": # no entries visible for ipsets with timeout continue try: backend.set_flush(obj.name) except Exception as msg: raise FirewallError(errors.COMMAND_FAILED, msg) for entry in obj.entries: try: backend.set_add(obj.name, entry) except Exception as msg: raise FirewallError(errors.COMMAND_FAILED, msg) else: try: backend.set_restore(obj.name, obj.type, obj.entries, obj.options, None) except Exception as msg: raise FirewallError(errors.COMMAND_FAILED, msg) else: obj.applied = True def apply_ipsets(self, backends=None): for name in self.get_ipsets(): obj = self._ipsets[name] obj.applied = False log.debug1("Applying ipset '%s'" % name) self.apply_ipset(name, backends) def flush(self): for backend in self.backends(): # nftables sets are part of the normal firewall ruleset. if backend.name == "nftables": continue for ipset in self.get_ipsets(): try: self.check_applied(ipset) backend.set_destroy(ipset) except FirewallError as msg: if msg.code != errors.NOT_APPLIED: raise msg # TYPE def get_type(self, name, applied=True): return self.get_ipset(name, applied=applied).type # DIMENSION def get_dimension(self, name): return len(self.get_ipset(name, applied=True).type.split(",")) def check_applied(self, name): obj = self.get_ipset(name) self.check_applied_obj(obj) def check_applied_obj(self, obj): if not obj.applied: raise FirewallError( errors.NOT_APPLIED, obj.name) # OPTIONS def get_family(self, name, applied=True): obj = self.get_ipset(name, applied=applied) if "family" in obj.options: if obj.options["family"] == "inet6": return "ipv6" return "ipv4" # ENTRIES def add_entry(self, name, entry): obj = self.get_ipset(name, applied=True) entry = normalize_ipset_entry(entry) IPSet.check_entry(entry, obj.options, obj.type) if entry in obj.entries: raise FirewallError(errors.ALREADY_ENABLED, "'%s' already is in '%s'" % (entry, name)) check_entry_overlaps_existing(entry, obj.entries) try: for backend in self.backends(): backend.set_add(obj.name, entry) except Exception as msg: raise FirewallError(errors.COMMAND_FAILED, msg) else: if "timeout" not in obj.options or obj.options["timeout"] == "0": # no entries visible for ipsets with timeout obj.entries.append(entry) def remove_entry(self, name, entry): obj = self.get_ipset(name, applied=True) entry = normalize_ipset_entry(entry) # no entry check for removal if entry not in obj.entries: raise FirewallError(errors.NOT_ENABLED, "'%s' not in '%s'" % (entry, name)) try: for backend in self.backends(): backend.set_delete(obj.name, entry) except Exception as msg: raise FirewallError(errors.COMMAND_FAILED, msg) else: if "timeout" not in obj.options or obj.options["timeout"] == "0": # no entries visible for ipsets with timeout obj.entries.remove(entry) def query_entry(self, name, entry): obj = self.get_ipset(name, applied=True) entry = normalize_ipset_entry(entry) if "timeout" in obj.options and obj.options["timeout"] != "0": # no entries visible for ipsets with timeout raise FirewallError(errors.IPSET_WITH_TIMEOUT, name) return entry in obj.entries def get_entries(self, name): obj = self.get_ipset(name, applied=True) return obj.entries def set_entries(self, name, entries): obj = self.get_ipset(name, applied=True) check_for_overlapping_entries(entries) for entry in entries: IPSet.check_entry(entry, obj.options, obj.type) if "timeout" not in obj.options or obj.options["timeout"] == "0": # no entries visible for ipsets with timeout obj.entries = entries try: for backend in self.backends(): backend.set_flush(obj.name) except Exception as msg: raise FirewallError(errors.COMMAND_FAILED, msg) else: obj.applied = True try: for backend in self.backends(): if self._fw._individual_calls: for entry in obj.entries: backend.set_add(obj.name, entry) else: backend.set_restore(obj.name, obj.type, obj.entries, obj.options, None) except Exception as msg: raise FirewallError(errors.COMMAND_FAILED, msg) else: obj.applied = True return core/prog.py 0000644 00000002746 15025011705 0007022 0 ustar 00 # -*- coding: utf-8 -*- # # Copyright (C) 2010-2016 Red Hat, Inc. # # Authors: # Thomas Woerner <twoerner@redhat.com> # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see <http://www.gnu.org/licenses/>. # import subprocess __all__ = ["runProg"] def runProg(prog, argv=None, stdin=None): if argv is None: argv = [] args = [prog] + argv input_string = None if stdin: with open(stdin, 'r') as handle: input_string = handle.read().encode() env = {'LANG': 'C'} try: process = subprocess.Popen(args, stdin=subprocess.PIPE, stderr=subprocess.STDOUT, stdout=subprocess.PIPE, close_fds=True, env=env) except OSError: return (255, '') (output, err_output) = process.communicate(input_string) output = output.decode('utf-8', 'replace') return (process.returncode, output) core/fw_service.py 0000644 00000003147 15025011705 0010203 0 ustar 00 # -*- coding: utf-8 -*- # # Copyright (C) 2011-2016 Red Hat, Inc. # # Authors: # Thomas Woerner <twoerner@redhat.com> # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see <http://www.gnu.org/licenses/>. # __all__ = [ "FirewallService" ] from firewall import errors from firewall.errors import FirewallError class FirewallService(object): def __init__(self, fw): self._fw = fw self._services = { } def __repr__(self): return '%s(%r)' % (self.__class__, self._services) def cleanup(self): self._services.clear() # zones def get_services(self): return sorted(self._services.keys()) def check_service(self, service): if service not in self._services: raise FirewallError(errors.INVALID_SERVICE, service) def get_service(self, service): self.check_service(service) return self._services[service] def add_service(self, obj): self._services[obj.name] = obj def remove_service(self, service): self.check_service(service) del self._services[service] core/io/__pycache__/io_object.cpython-39.pyc 0000644 00000023516 15025011705 0014704 0 ustar 00 a ���g�- � @ s� d Z g d�ZddlmZ ddlm mZ ddlZddlmZ ddl m Z ddl m Z ddl m Z G dd � d e�ZG d d � d e�ZG d d � d e�ZG dd� de�ZG dd� dejj�ZG dd� dej�Zdd� Zdd� Zdd� Zdd� Z dS ) z5Generic io_object handler, io specific check methods.)� IO_Object�IO_Object_ContentHandler�IO_Object_XMLGenerator� check_port� check_tcpudp�check_protocol� check_address� N)� OrderedDict)� functions)�errors)� FirewallErrorc @ s� e Zd ZdZdZdZg Zi Zi Zdd� Z dd� Z dd � Z d d � Z d d � Z dd� Zi fdd�Zdd� Zdd� Zdd� Zdd� ZdS )r z; Abstract IO_Object as base for icmptype, service and zone � z()c C s" d| _ d| _d| _d| _d| _d S )N� F)�filename�path�name�defaultZbuiltin��selfr r �>/usr/lib/python3.9/site-packages/firewall/core/io/io_object.py�__init__- s zIO_Object.__init__c C s2 g }| j D ] }|�t�t| |d ��� q t|�S )Nr )�IMPORT_EXPORT_STRUCTURE�append�copy�deepcopy�getattr�tuple)r �ret�xr r r � export_config4 s zIO_Object.export_configc C sT i }t dd� | jD ��}|D ]2}t| |�s:tt| |�t�r t�t| |��||< q |S )Nc S s g | ]}|d |d f�qS �r � r ��.0r r r r � <listcomp>< � z0IO_Object.export_config_dict.<locals>.<listcomp>)�dictr r � isinstance�boolr r )r �conf� type_formats�keyr r r �export_config_dict: s z IO_Object.export_config_dictc C s� | � ||� t| j�D ]z\}\}}t|| t�rzg }t� }|| D ] }||vrB|�|� |�|� qB~t| |t � |�� qt| |t � || �� qd S �N) � check_config� enumerater r' �list�setr �add�setattrr r ) r r) �all_io_objects�i�elementZdummyZ_confZ_setr r r r � import_configB s zIO_Object.import_configc C s| | � ||� |D ]f}t| |�s0ttjd�|���t|| t�r`t| |tt � t � || ���� qt| |t � || �� qd S )Nz-Internal error. '{}' is not a valid attribute) �check_config_dict�hasattrr r Z UNKNOWN_ERROR�formatr' r0 r3 r �fromkeysr r )r r) r4 r+ r r r �import_config_dictR s "z IO_Object.import_config_dictc C st t |t�s(ttjd|td�t|�f ��t|�dk r@ttjd��|D ]*}|�� sD|| j vrDttjd||f ��qDd S )N�'%s' not of type %s, but %sr r! zname can't be emptyz'%s' is not allowed in '%s') r' �strr r � INVALID_TYPE�type�lenZ INVALID_NAME�isalnum�ADDITIONAL_ALNUM_CHARS)r r �charr r r � check_name^ s �� �zIO_Object.check_namec C sh t |�t | j�kr0ttjdt |�t | j�f ��i }t| j�D ]\}\}}|| ||< q>| �||� d S )Nz structure size mismatch %d != %d)rA r r r r? r/ r8 )r r) r4 Z conf_dictr5 r �yr r r r. k s ��zIO_Object.check_configc C sp t dd� | jD ��}|D ]R}|dd� | jD �vrBttjd�|���| �|| || � | �|| |||� qd S )Nc S s g | ]}|d |d f�qS r r r" r r r r$ w r% z/IO_Object.check_config_dict.<locals>.<listcomp>c S s g | ] \}}|�qS r r )r# r rF r r r r$ y r% zoption '{}' is not valid)r& r r r ZINVALID_OPTIONr: �_check_config_structure� _check_config)r r) r4 r* r+ r r r r8 v s zIO_Object.check_config_dictc C s d S r- r )r Zdummy1Zdummy2Zdummy3Zdummy4r r r rH ~ s zIO_Object._check_configc C sT t |t|��s,ttjd|t|�t|�f ��t |t�rnt|�dkrRttjd| ��|D ]}| �||d � qVn�t |t�r�t|�t|�kr�ttjd|t|�f ��t |�D ]\}}| �|| |� q�n�t |t ��rPt|� � �d \}}|� � D ]b\}}t |t|���s"ttjd|t|�t|�f ��t |t|��s�ttjd|t|�t|�f ��q�d S )Nr= r! zlen('%s') != 1r zlen('%s') != %d) r' r@ r r r? r0 rA rG r r/ r& �items) r r) Z structurer r5 �valueZskeyZsvaluer+ r r r rG � sJ �� � �� ����z!IO_Object._check_config_structurec C s� |� � }d}|| jv r`d}| j| d ur`| j| D ],}||v rJ|�|� q2ttjd||f ��q2|| jv r�d}| j| D ]}||v rx|�|� qx|s�ttjd| ��|D ]}ttjd||f ��q�d S )NFTzMissing attribute %s for %szUnexpected element %sz%s: Unexpected attribute %s)ZgetNames� PARSER_REQUIRED_ELEMENT_ATTRS�remover r Z PARSE_ERROR� PARSER_OPTIONAL_ELEMENT_ATTRS)r r �attrsZ_attrs�foundr r r r �parser_check_element_attrs� s2 � � �z$IO_Object.parser_check_element_attrsN)�__name__� __module__� __qualname__�__doc__r ZDBUS_SIGNATURErC rK rM r r r, r7 r< rE r. r8 rH rG rP r r r r r $ s" !r c s$ e Zd Z� fdd�Zdd� Z� ZS )�UnexpectedElementErrorc s t t| ��� || _d S r- )�superrU r r �r r �� __class__r r r � s z UnexpectedElementError.__init__c C s d| j S )NzUnexpected element '%s')r r r r r �__str__� s z UnexpectedElementError.__str__�rQ rR rS r rZ � __classcell__r r rX r rU � s rU c s$ e Zd Z� fdd�Zdd� Z� ZS )�MissingAttributeErrorc s t t| ��� || _|| _d S r- )rV r] r r � attribute�r r r^ rX r r r � s z MissingAttributeError.__init__c C s d| j | jf S )Nz$Element '%s': missing '%s' attribute�r r^ r r r r rZ � s �z MissingAttributeError.__str__r[ r r rX r r] � s r] c s$ e Zd Z� fdd�Zdd� Z� ZS )�UnexpectedAttributeErrorc s t t| ��� || _|| _d S r- )rV ra r r r^ r_ rX r r r � s z!UnexpectedAttributeError.__init__c C s d| j | jf S )Nz'Element '%s': unexpected attribute '%s'r` r r r r rZ � s �z UnexpectedAttributeError.__str__r[ r r rX r ra � s ra c @ s4 e Zd Zdd� Zdd� Zdd� Zdd� Zd d � Zd S ) r c C s || _ d| _d S �Nr )�item�_element)r rc r r r r � s z!IO_Object_ContentHandler.__init__c C s d| _ d S rb �rd r r r r � startDocument� s z&IO_Object_ContentHandler.startDocumentc C s d| _ d S rb re )r r rN r r r � startElement� s z%IO_Object_ContentHandler.startElementc C s* |dkr| j | j_n|dkr&| j | j_d S )N�short� description)rd rc rh ri rW r r r � endElement� s z#IO_Object_ContentHandler.endElementc C s | j |�dd�7 _ d S )N� � )rd �replace)r Zcontentr r r � characters� s z#IO_Object_ContentHandler.charactersN)rQ rR rS r rf rg rj rn r r r r r � s r c @ s e Zd Zdd� Zdd� ZdS )r c C sN t jj�| � |j| _|j| _i g| _| jd | _ g | _ d| _ d| _ d| _ d S )N���zutf-8F)�sax�handler�ContentHandlerr �write�_write�flushZ_flushZ _ns_contextsZ_current_contextZ_undeclared_ns_maps� _encodingZ_pending_start_elementZ_short_empty_elements)r �outr r r r � s z IO_Object_XMLGenerator.__init__c C sF | � d| � |�� D ] \}}| � d|t�|�f � q| � d� dS )z* slightly modified startElement() �<z %s=%sz/>N)rt rI �saxutilsZ quoteattr)r r rN rJ r r r � simpleElement� s z$IO_Object_XMLGenerator.simpleElementN)rQ rR rS r rz r r r r r � s r c C s� t �| �}|dkr$ttjd| ��n`|dkr>ttjd| ��nF|d u rXttjd| ��n,t|�dkr�|d |d kr�ttjd| ��d S ) N���z port number in '%s' is too bigro z'%s' is invalid port rangez port range '%s' is ambiguous� r r! )r Z getPortRanger r Z INVALID_PORTrA )�portZ port_ranger r r r s" ��� �r c C s | dvrt tjd| ��d S )N)ZtcpZudpZsctpZdccpz)'%s' not from {'tcp'|'udp'|'sctp'|'dccp'})r r �INVALID_PROTOCOL�Zprotocolr r r r s ��r c C s t �| �sttj| ��d S r- )r Z checkProtocolr r r~ r r r r r s r c C s$ t �| |�s ttjd|| f ��d S )Nz '%s' is not valid %s address)r r r r Z INVALID_ADDR)Zipv�addrr r r r s �r ) rT �__all__Zxml.saxrp Zxml.sax.saxutilsry r � collectionsr Zfirewallr r Zfirewall.errorsr �objectr � ExceptionrU r] ra rq rr r Z XMLGeneratorr r r r r r r r r �<module> s& core/io/__pycache__/service.cpython-39.pyc 0000644 00000015752 15025011705 0014412 0 ustar 00 a ���g'0 � @ s� g d �Z ddlmZ ddlZddlZddlZddlmZ ddlm Z m Z m Z m Z m Z mZmZ ddlmZ ddlmZ ddlmZ G dd � d e �ZG d d � d e �Zd d � Zddd�ZdS ))�Service�service_reader�service_writer� N)�config)� IO_Object�IO_Object_ContentHandler�IO_Object_XMLGenerator� check_port� check_tcpudp�check_protocol� check_address)�log)�errors)� FirewallErrorc s� e Zd Zdddddgfddgfdddifd dgfd dgfd dgfd dgff Zd dgZdddd�Zddgddgdgdgddgddgdgdgd�Z� fdd�Zd d � Zd d � Z � Z S ) r )�version� )�shortr )� descriptionr �ports)r r �modulesr � destination� protocols� source_ports�includes�helpers�_�-N)r r �service�namer �port�protocol�value�ipv4�ipv6r )r r r �moduler � source-port�include�helperc sN t t| ��� d| _d| _d| _g | _g | _g | _i | _ g | _ g | _ g | _ d S �Nr ) �superr �__init__r r r r r r r r r r ��self�� __class__� �</usr/lib/python3.9/site-packages/firewall/core/io/service.pyr* C s zService.__init__c C sh d| _ d| _d| _| jd d �= | jd d �= | jd d �= | j�� | jd d �= | j d d �= | j d d �= d S r( ) r r r r r r r �clearr r r r+ r/ r/ r0 �cleanupP s zService.cleanupc C sd |dkrH|D ]6}|d dkr6t |d � t|d � q t|d � q �n|dkrd|D ] }t|� qTn�|dkr�|D ] }t |d � t|d � qpn�|dkr�|D ]*}|dvr�ttjd | ��t||| � q�n�|d k�r&|D ]J}|�d ��r |�d d�}d |v �r |�d d �}t |�dk r�ttj |��q�n:|dk�r`|D ]*} | |d v�r4ttj d� | j | ����q4d S )Nr r r � r r r �r" r# z'%s' not in {'ipv4'|'ipv6'}r � nf_conntrack_r r � r Zservicesz.Service '{}': Included service '{}' not found.)r r r r r ZINVALID_DESTINATIONr � startswith�replace�lenZINVALID_MODULE�INVALID_SERVICE�formatr ) r, r �itemZ all_configZall_io_objectsr �protor r$ r& r/ r/ r0 � _check_config\ sL �� ��zService._check_config) �__name__� __module__� __qualname__ZIMPORT_EXPORT_STRUCTUREZADDITIONAL_ALNUM_CHARSZ PARSER_REQUIRED_ELEMENT_ATTRSZ PARSER_OPTIONAL_ELEMENT_ATTRSr* r2 r> � __classcell__r/ r/ r- r0 r % s8 � �� r c @ s e Zd Zdd� ZdS )�service_ContentHandlerc C s, t �| ||� | j�||� |dkrTd|v r<t�d|d � d|v rP|d | j_�n�|dkr`�n�|dkrl�n�|dk�r$|d dkr�t|d � t|d � |d |d f}|| jj vr�| jj � |� nt�d |d |d � nBt |d � |d | jj v�r| jj � |d � nt�d |d � �n|d k�rtt |d � |d | jj v�r`| jj � |d � nt�d |d � �n�|d k�r�t|d � t|d � |d |d f}|| jj v�r�| jj � |� nt�d|d |d � �nJ|dk�r:dD ]J}||v �r�t||| � || jjv �r$t�d|� n|| | jj|< �q�n�|dk�r�|d }|�d��rz|�dd�}d|v �rz|�dd�}|| jjv�r�| jj� |� n t�d|� n�|dk�r�|d | jjv�r�| jj� |d � nt�d|d � n@|dk�r(|d | jjv�r| jj� |d � nt�d|d � d S )Nr r z'Ignoring deprecated attribute name='%s'r r r r r r z#Port '%s/%s' already set, ignoring.z$Protocol '%s' already set, ignoring.r! r% z)SourcePort '%s/%s' already set, ignoring.r r4 z2Destination address for '%s' already set, ignoringr$ r5 r r z"Module '%s' already set, ignoring.r& z#Include '%s' already set, ignoring.r' z"Helper '%s' already set, ignoring.)r � startElementr< Zparser_check_element_attrsr Zwarningr r r r �appendr r r r r r7 r8 r r r )r, r �attrs�entry�xr$ r/ r/ r0 rD � s� � � � � � � � � �z#service_ContentHandler.startElementN)r? r@ rA rD r/ r/ r/ r0 rC � s rC c C s t � }| �d�s ttjd| ��| d d� |_|�|j� | |_||_|� t j �rVdnd|_ |j |_ t|�}t�� }|�|� d|| f }t|d��n}t�d �}|�|� z|�|� W n: tjy� } z ttjd|�� ��W Y d }~n d }~0 0 W d � n1 �s 0 Y ~~|S ) Nz.xmlz'%s' is missing .xml suffix���FT�%s/%s�rbz not a valid service file: %s)r �endswithr r Z INVALID_NAMEr Z check_name�filename�pathr7 r � ETC_FIREWALLDZbuiltin�defaultrC �saxZ make_parserZsetContentHandler�openZ InputSourceZ setByteStream�parseZSAXParseExceptionr: Z getException) rM rN r �handler�parserr �f�source�msgr/ r/ r0 r � s: � ��:r c C sZ |r|n| j }| jr$d|| jf }nd|| jf }tj �|�r�zt�|d| � W n2 ty� } zt� d||� W Y d }~n d }~0 0 tj � |�}|� t j �r�tj �|�s�tj �t j �s�t�t j d� t�|d� tj|ddd�}t|�}|�� i }| j�r| jd k�r| j|d < |�d |� |�d � | j�rt| jd k�rt|�d � |�di � |�| j� |�d� |�d � | j�r�| jd k�r�|�d � |�di � |�| j� |�d� |�d � | jD ]4} |�d � |�d| d | d d�� |�d � �q�| j D ]*} |�d � |�dd| i� |�d � �q | j D ]4} |�d � |�d| d | d d�� |�d � �q2| j D ]*} |�d � |�dd| i� |�d � �qnt | j �dk�r�|�d � |�d| j � |�d � | j!D ]*} |�d � |�dd | i� |�d � �q�| j"D ]*} |�d � |�dd| i� |�d � �q|�d � |�d � |�#� |�$� ~d S ) NrJ z %s/%s.xmlz%s.oldz Backup of file '%s' failed: %si� ZwtzUTF-8)�mode�encodingr r r � z r r r r r3 )r r r r! r% r$ r r r& r' )%rN rM r �os�exists�shutil�copy2� Exceptionr �error�dirnamer7 r rO �mkdir�iorR r Z startDocumentr rD ZignorableWhitespacer Z charactersZ endElementr r Z simpleElementr r r r9 r r r Z endDocument�close)r rN �_pathr rX �dirpathrV rT rF r r r$ r& r' r/ r/ r0 r � s� $ � r )N)�__all__Zxml.saxrQ r\ rd r^ Zfirewallr Zfirewall.core.io.io_objectr r r r r r r Zfirewall.core.loggerr r Zfirewall.errorsr r rC r r r/ r/ r/ r0 �<module> s $ dQ core/io/__pycache__/ipset.cpython-39.pyc 0000644 00000024152 15025011705 0014070 0 ustar 00 a ���g P � @ s� d Z g d�ZddlmZ ddlZddlZddlZddlmZ ddl m Z m Z m Z m Z mZmZmZmZ ddlmZmZmZ ddlmZmZ ddlmZmZm Z m Z dd l m Z dd lm Z dd l!m"Z" G d d � d e�Z#G dd� de�Z$dd� Z%ddd�Z&dS )z$ipset io XML handler, reader, writer)�IPSet� ipset_reader� ipset_writer� N)�config)�checkIP�checkIP6� checkIPnMask� checkIP6nMask� check_mac� check_port�checkInterface� checkProtocol)� IO_Object�IO_Object_ContentHandler�IO_Object_XMLGenerator)� IPSET_TYPES�IPSET_CREATE_OPTIONS)�check_icmp_name�check_icmp_type�check_icmpv6_name�check_icmpv6_type)�log)�errors)� FirewallErrorc s� e Zd ZdddddddifddgffZdZg d �Zd d d gd gd d �Zdgdgd�Z� fdd�Zdd� Z e dd� �Z dd� Z � fdd�Z � ZS )r )�version� )�shortr )� descriptionr )�typer �optionsr �entriesz (ssssa{ss}as))�_�-�:�.Nr �name)r r �ipset�option�entryr �value)r& r' c s< t t| ��� d| _d| _d| _d| _g | _i | _d| _ d S �Nr F) �superr �__init__r r r r r r �applied��self�� __class__� �:/usr/lib/python3.9/site-packages/firewall/core/io/ipset.pyr, C s zIPSet.__init__c C s8 d| _ d| _d| _d| _| jd d �= | j�� d| _d S r* )r r r r r r �clearr- r. r2 r2 r3 �cleanupM s z IPSet.cleanupc C s� d}d|v r |d dkr d}|� d�s6ttjd| ��|dd � �d�}| �d�}t|�t|�ksnt|�d k r�ttjd | |f ��t|�D �]@\}}|| }|d k�r�d |v �rV|dk�rV|d kr�ttjd || |f ��|�d �} t| �dk�rttjd|| ||f ��| D ]F} |dk�r$t| ��r8|dk�r t | ��s ttjd| | ||f ���q nh|dk�r�|dk�r�ttjd|| ||f ��|dk�r�t } nt} nt } | |��s�ttjd|| ||f ��q�|dk�r"d |v �r�|�d �} t| �dk�rttjd|| ||f ��|dk�r t| d ��r4|dk�rPt | d ��sPttjd| d | ||f ��|dk�rht | d ��r�|dk�r t | d ��s ttjd| d | ||f ��n�|� d��r�|dk�r�|dk�r�|dk�s�ttjd|| ||f ��|dk�r�t |��r|dk�r�t |��s�ttjd|| ||f ��q�|dk�rVt |��r@|dk�r�ttjd|| f ��q�|dk�r�d|v �r�|�d�} t| �dk�r�ttjd| ��| d d k�r�|dk�r�ttjd || f ��t| d ��s�t| d ��s�ttjd | d | f ��n�| d d v �rV|dk�r ttjd || f ��t| d ��s�t| d ��s�ttjd | d | f ��n\| d d!v�r�t| d ��s�ttjd"| d | f ��n&t| d ��s�ttjd#| d | f ��n t|��s�ttjd$|| f ��q�|d%k�r�|� d&��r$zt|d'�} W n( t�y ttjd(|| f ��Y n0 n6z t|�} W n( t�yX ttjd(|| f ��Y n0 | dk �sn| d)k�r�ttjd(|| f ��q�|d*k�r�t|��r�t|�d+k�r�ttjd,|| f ��q�ttjd| ��q�d S )-NZipv4�family�inet6Zipv6zhash:zipset type '%s' not usable� �,� z)entry '%s' does not match ipset type '%s'�ipr" z invalid address '%s' in '%s'[%d]� z.invalid address range '%s' in '%s' for %s (%s)z(invalid address '%s' in '%s' for %s (%s)z0.0.0.0r �netz/0zhash:net,ifaceZmacz00:00:00:00:00:00z invalid mac address '%s' in '%s'�portr# zinvalid port '%s'Zicmpz(invalid protocol for family '%s' in '%s'z invalid icmp type '%s' in '%s')Zicmpv6z ipv6-icmpz invalid icmpv6 type '%s' in '%s')ZtcpZsctpZudpZudplitez invalid protocol '%s' in '%s'zinvalid port '%s'in '%s'zinvalid port '%s' in '%s'Zmark�0x� zinvalid mark '%s' in '%s'l �� Ziface� z invalid interface '%s' in '%s')� startswithr r � INVALID_IPSET�split�lenZ INVALID_ENTRY� enumerater r r r �endswithr r r r r r r �int� ValueErrorr ) r( r Z ipset_typer6 �flags�items�i�flag�itemZsplitsZ_splitZip_checkZint_valr2 r2 r3 � check_entryV s� � �� �� ���� �� �� �� ��� ���� ��� � ���� �� � � �� � �� �� � �� ���� � � � � ��zIPSet.check_entryc C s� |dkr |t vr ttjd| ��|dkr�|�� D ]�}|tvrLttjd| ��|dv r�zt|| �}W n* ty� ttj d||| f ��Y n0 |dk r�ttj d||| f ��q0|d kr0|| d vr0ttj || ��q0d S ) Nr z '%s' is not valid ipset typer zipset invalid option '%s'��timeout�hashsize�maxelem�)Option '%s': Value '%s' is not an integerr �#Option '%s': Value '%s' is negativer6 �Zinetr7 ) r r r � INVALID_TYPE�keysr rC rH rI � INVALID_VALUE�INVALID_FAMILY)r/ r rN Z all_config�all_io_objects�key� int_valuer2 r2 r3 � _check_config s@ � � �� �� �zIPSet._check_configc sp d|d v r6|d d dkr6t |d �dkr6ttj��|d D ]}t�||d |d � q>tt| ��||� d S )NrQ � �0r8 r � )rE r r ZIPSET_WITH_TIMEOUTr rO r+ � import_config)r/ r r[ r( r0 r2 r3 rb & s zIPSet.import_config)�__name__� __module__� __qualname__ZIMPORT_EXPORT_STRUCTUREZDBUS_SIGNATUREZADDITIONAL_ALNUM_CHARSZ PARSER_REQUIRED_ELEMENT_ATTRSZ PARSER_OPTIONAL_ELEMENT_ATTRSr, r5 � staticmethodrO r^ rb � __classcell__r2 r2 r0 r3 r , s2 ��� 5r c @ s e Zd Zdd� Zdd� ZdS )�ipset_ContentHandlerc C s� t �| ||� | j�||� |dkrpd|v rX|d tvrLttjd|d ��|d | j_d|v rl|d | j_ �nt|dkr|�nh|dkr��n\|dk�r�d}d |v r�|d }|d d vr�ttj d |d ��| jjd kr�|d dv r�ttj d|d | jjf ��|d d v �r"|�s"ttj d|d ��|d dv �r�z t |�}W n, t �yh ttj d|d |f ��Y n0 |dk �r�ttj d|d |f ��|d dk�r�|dv�r�ttj|��|d | jjv�r�|| jj|d < nt�d|d � d S )Nr& r z%sr r r r' r r) r% )r6 rQ rR rS zUnknown option '%s'zhash:mac)r6 z%Unsupported option '%s' for type '%s'z&Missing mandatory value of option '%s'rP rT r rU r6 rV z Option %s already set, ignoring.)r � startElementrN Zparser_check_element_attrsr r r rW r r ZINVALID_OPTIONrH rI rY rZ r r �warning)r/ r% �attrsr) r] r2 r2 r3 ri 1 sx � ���� � �� �� z!ipset_ContentHandler.startElementc C s( t �| |� |dkr$| jj�| j� d S )Nr( )r � endElementrN r �appendZ_element)r/ r% r2 r2 r3 rl h s z ipset_ContentHandler.endElementN)rc rd re ri rl r2 r2 r2 r3 rh 0 s 7rh c C s& t � }| �d�s ttjd| ��| d d� |_|�|j� | |_||_|� t j �rVdnd|_ |j |_ t|�}t�� }|�|� d|| f }t|d��n}t�d �}|�|� z|�|� W n: tjy� } z ttjd|�� ��W Y d }~n d }~0 0 W d � n1 �s 0 Y ~~d |jv �r^|jd d k�r^t|j�d k�r^t � d |j� |jd d �= d } t � } | t|j�k �r |j| | v �r�t � d |j| � |j� | � ntz |� |j| |j|j!� W n> t�y } z$t � d| � |j� | � W Y d } ~ n"d } ~ 0 0 | �"|j| � | d7 } �qh~ |S )Nz.xmlz'%s' is missing .xml suffix���FT�%s/%s�rbznot a valid ipset file: %srQ r` r z6ipset '%s': timeout option is set, entries are ignoredz Entry %s already set, ignoring.z %s, ignoring.r: )#r rG r r Z INVALID_NAMEr% Z check_name�filename�pathrB r � ETC_FIREWALLDZbuiltin�defaultrh �saxZ make_parserZsetContentHandler�openZ InputSourceZ setByteStream�parseZSAXParseExceptionrC Z getExceptionr rE r r rj �set�poprO r �add) rq rr r& �handler�parserr% �f�source�msgrL Z entries_set�er2 r2 r3 r m sd � ��: �� " r c C s� |r|n| j }| jr$d|| jf }nd|| jf }tj �|�r�zt�|d| � W n2 ty� } zt� d||� W Y d }~n d }~0 0 tj � |�}|� t j �r�tj �|�s�tj �t j �s�t�t j d� t�|d� tj|ddd�}t|�}|�� d | ji}| j�r| jd k�r| j|d < |�d |� |�d � | j�rz| jd k�rz|�d� |�di � |�| j� |�d� |�d � | j�r�| jd k�r�|�d� |�di � |�| j� |�d� |�d � | j� � D ]L\} } |�d� | d k�r�|� d| | d�� n|� dd| i� |�d � �q�| j D ]:} |�d� |�di � |�| � |�d� |�d � �q"|�d � |�d � |� � |� � ~d S )Nro z %s/%s.xmlz%s.oldz Backup of file '%s' failed: %si� ZwtzUTF-8)�mode�encodingr r r r& � z r r r' )r% r) r% r( )!rr rq r% �os�exists�shutil�copy2� Exceptionr �error�dirnamerB r rs �mkdir�iorv r Z startDocumentr r ri ZignorableWhitespacer Z charactersrl r r rK Z simpleElementr Z endDocument�close) r& rr �_pathr% r �dirpathr} r{ rk r\ r) r( r2 r2 r3 r � sf $ r )N)'�__doc__�__all__Zxml.saxru r� r� r� Zfirewallr Zfirewall.functionsr r r r r r r r Zfirewall.core.io.io_objectr r r Zfirewall.core.ipsetr r Zfirewall.core.icmpr r r r Zfirewall.core.loggerr r Zfirewall.errorsr r rh r r r2 r2 r2 r3 �<module> s& ( =3 core/io/__pycache__/lockdown_whitelist.cpython-39.pyc 0000644 00000021170 15025011705 0016655 0 ustar 00 a ���g�/ � @ s� d dl mZ d dlZd dlZd dlZd dlmZ d dlmZm Z m Z d dl m Z d dl mZmZmZmZmZ d dlmZ d dlmZ G dd � d e �ZG d d � d e�ZdS ) � N)�config)� IO_Object�IO_Object_ContentHandler�IO_Object_XMLGenerator)�log)�uniqify� checkUser�checkUid� checkCommand� checkContext)�errors)� FirewallErrorc @ s e Zd Zdd� Zdd� ZdS )�!lockdown_whitelist_ContentHandlerc C s t �| |� d| _d S )NF)r �__init__� whitelist)�self�item� r �G/usr/lib/python3.9/site-packages/firewall/core/io/lockdown_whitelist.pyr % s z*lockdown_whitelist_ContentHandler.__init__c C sV t �| ||� | j�||� |dkr@| jr6ttjd��d| _�n|dkrr| js\t� d� d S |d }| j� |� n�|dkr�| js�t� d� d S d |v r�zt |d �}W n& t y� t� d |d � Y d S 0 | j� |� nd|v r�| j�|d � n\|d k�r@| j�st� d � d S d |v�r.t� d� d S | j�|d � nt� d| � d S d S )Nr zMore than one whitelist.T�commandz)Parse Error: command outside of whitelist�name�userz&Parse Error: user outside of whitelist�idz"Parse Error: %s is not a valid uid�selinuxz)Parse Error: selinux outside of whitelist�contextzParse Error: no contextzUnknown XML element %s)r � startElementr Zparser_check_element_attrsr r r Z PARSE_ERRORr �error� add_command�int� ValueError�add_uid�add_user� add_context)r r �attrsr �uidr r r r ) sN � � z.lockdown_whitelist_ContentHandler.startElementN)�__name__� __module__� __qualname__r r r r r r r $ s r c s, e Zd ZdZddgfddgfddgfddgffZdZd gZd d gd d gd �Zddd giZ� fdd�Z dd� Z dd� Z dd� Z dd� Z dd� Zd d � Zd d � Zd d!� Zd"d#� Zd$d%� Zd&d'� Zd(d)� Zd*d+� Zd,d-� Zd.d/� Zd0d1� Zd2d3� Zd4d5� Zd6d7� Z d8d9� Z d:d;� Z d<d=� Z d>d?� Z d@dA� Z!� Z"S )B�LockdownWhitelistz LockdownWhitelist class �commands� �contexts�users�uidsr z (asasasai)�_Nr r )r r r r r r c s6 t t| ��� || _d | _g | _g | _g | _g | _d S �N) �superr( r �filename�parserr) r+ r, r- )r r1 �� __class__r r r m s zLockdownWhitelist.__init__c C s� |dv r,|D ] }| � ||d d� ||� q nv|dkrJt|�s�ttj|��nX|dkrht|�s�ttj|��n:|dkr�t|�s�ttj|��n |dkr�t |�s�ttj |��d S )N�r) r+ r, r- ���r r r r$ ) � _check_configr r r �INVALID_COMMANDr �INVALID_CONTEXTr � INVALID_USERr � INVALID_UID)r r r Z all_configZall_io_objects�xr r r r7 x s z LockdownWhitelist._check_configc C s4 | j d d �= | jd d �= | jd d �= | jd d �= d S r/ r5 �r r r r �cleanup� s zLockdownWhitelist.cleanupc C s@ t |�sttj|��|| jvr,| j�|� nttjd| ��d S )Nz!Command "%s" already in whitelist)r r r r8 r) �append�ALREADY_ENABLED�r r r r r r � s �z LockdownWhitelist.add_commandc C s, || j v r| j �|� nttjd| ��d S )Nz Command "%s" not in whitelist.)r) �remover r � NOT_ENABLEDrA r r r �remove_command� s �z LockdownWhitelist.remove_commandc C s || j v S r/ �r) rA r r r � has_command� s z LockdownWhitelist.has_commandc C sB | j D ]6}|�d�r.|�|d d� �r< dS q||kr dS qdS )N�*r6 TF)r) �endswith� startswith)r r Z_commandr r r � match_command� s z LockdownWhitelist.match_commandc C s | j S r/ rE r= r r r � get_commands� s z LockdownWhitelist.get_commandsc C sD t |�sttjt|���|| jvr0| j�|� nttjd| ��d S )Nz Uid "%s" already in whitelist)r r r r; �strr- r? r@ �r r$ r r r r � s �zLockdownWhitelist.add_uidc C s, || j v r| j �|� nttjd| ��d S )NzUid "%s" not in whitelist.)r- rB r r rC rM r r r � remove_uid� s �z LockdownWhitelist.remove_uidc C s || j v S r/ �r- rM r r r �has_uid� s zLockdownWhitelist.has_uidc C s || j v S r/ rO rM r r r � match_uid� s zLockdownWhitelist.match_uidc C s | j S r/ rO r= r r r �get_uids� s zLockdownWhitelist.get_uidsc C s@ t |�sttj|��|| jvr,| j�|� nttjd| ��d S )Nz User "%s" already in whitelist)r r r r: r, r? r@ �r r r r r r! � s �zLockdownWhitelist.add_userc C s, || j v r| j �|� nttjd| ��d S )NzUser "%s" not in whitelist.)r, rB r r rC rS r r r � remove_user� s �z LockdownWhitelist.remove_userc C s || j v S r/ �r, rS r r r �has_user� s zLockdownWhitelist.has_userc C s || j v S r/ rU rS r r r � match_user� s z LockdownWhitelist.match_userc C s | j S r/ rU r= r r r � get_users� s zLockdownWhitelist.get_usersc C s@ t |�sttj|��|| jvr,| j�|� nttjd| ��d S )Nz!Context "%s" already in whitelist)r r r r9 r+ r? r@ �r r r r r r" s �z LockdownWhitelist.add_contextc C s, || j v r| j �|� nttjd| ��d S )Nz Context "%s" not in whitelist.)r+ rB r r rC rY r r r �remove_context# s �z LockdownWhitelist.remove_contextc C s || j v S r/ �r+ rY r r r � has_context* s z LockdownWhitelist.has_contextc C s || j v S r/ r[ rY r r r � match_context- s z LockdownWhitelist.match_contextc C s | j S r/ r[ r= r r r � get_contexts0 s z LockdownWhitelist.get_contextsc C s� | � � | j�d�s&ttjd| j ��t| �}t�� }|� |� z|� | j� W n: tj y� } z ttj d|� � ��W Y d }~n d }~0 0 ~~d S )Nz.xmlz'%s' is missing .xml suffixzNot a valid file: %s)r> r1 rH r r Z INVALID_NAMEr �saxZ make_parserZsetContentHandler�parseZSAXParseExceptionZ INVALID_TYPEZ getException)r �handlerr2 �msgr r r �read5 s$ � ��zLockdownWhitelist.readc C s� t j�| j�r^zt�| jd| j � W n6 ty\ } z td| j|f ��W Y d }~n d }~0 0 t j�tj �szt � tj d� t j | jddd�}t |�}|�� |�di � |�d� t| j�D ](}|�d � |�d d |i� |�d� q�t| j�D ],}|�d � |�d d t|�i� |�d� q�t| j�D ]*}|�d � |�d d |i� |�d� �q(t| j�D ]*}|�d � |�dd|i� |�d� �q^|�d� |�d� |�� |�� ~d S )Nz%s.oldzBackup of '%s' failed: %si� ZwtzUTF-8)�mode�encodingr � z r r r r r r )�os�path�existsr1 �shutil�copy2� Exception�IOErrorr Z ETC_FIREWALLD�mkdir�io�openr Z startDocumentr ZignorableWhitespacer r) Z simpleElementr- rL r, r+ Z endElementZ endDocument�close)r rb �fra r r$ r r r r r �writeF sB ( zLockdownWhitelist.write)#r% r& r' �__doc__ZIMPORT_EXPORT_STRUCTUREZDBUS_SIGNATUREZADDITIONAL_ALNUM_CHARSZ PARSER_REQUIRED_ELEMENT_ATTRSZ PARSER_OPTIONAL_ELEMENT_ATTRSr r7 r> r rD rF rJ rK r rN rP rQ rR r! rT rV rW rX r" rZ r\ r] r^ rc rs � __classcell__r r r3 r r( V sP ��� 1 r( )Zxml.saxr_ rg ro rj Zfirewallr Zfirewall.core.io.io_objectr r r Zfirewall.core.loggerr Zfirewall.functionsr r r r r r Zfirewall.errorsr r r( r r r r �<module> s 2 core/io/__pycache__/icmptype.cpython-39.opt-1.pyc 0000644 00000010545 15025011705 0015536 0 ustar 00 a ���g� � @ s� g d �Z ddlmZ ddlZddlZddlZddlmZ ddlm Z m Z m Z ddl m Z ddlmZ ddlmZ G dd � d e �ZG d d � d e �Zd d � Zddd�ZdS ))�IcmpType�icmptype_reader�icmptype_writer� N)�config)� IO_Object�IO_Object_ContentHandler�IO_Object_XMLGenerator)�log)�errors)� FirewallErrorc sh e Zd ZdddddgffZdZddgZd d d d �Zd d gd dgd�Z� fdd�Zdd� Z dd� Z � Z S )r )�version� )�shortr )� descriptionr � destinationr z(sssas)�_�-N)r r �icmptype�namer �ipv4�ipv6)r r c s* t t| ��� d| _d| _d| _g | _d S �Nr )�superr �__init__r r r r ��self�� __class__� �=/usr/lib/python3.9/site-packages/firewall/core/io/icmptype.pyr 7 s zIcmpType.__init__c C s" d| _ d| _d| _| jd d �= d S r )r r r r r r r r �cleanup> s zIcmpType.cleanupc C s. |dkr*|D ] }|dvr t tjd| ��q d S )Nr �r r z '%s' not from {'ipv4'|'ipv6'})r r ZINVALID_DESTINATION)r r �itemZ all_configZall_io_objectsr r r r � _check_configD s ��zIcmpType._check_config) �__name__� __module__� __qualname__ZIMPORT_EXPORT_STRUCTUREZDBUS_SIGNATUREZADDITIONAL_ALNUM_CHARSZ PARSER_REQUIRED_ELEMENT_ATTRSZ PARSER_OPTIONAL_ELEMENT_ATTRSr r r# � __classcell__r r r r r $ s" ��� r c @ s e Zd Zdd� ZdS )�icmptype_ContentHandlerc C s� t �| ||� | j�||� |dkrTd|v r>t�d|d � d|v r�|d | j_nP|dkr^nF|dkrhn<|dkr�dD ].}||v rt|| �� d v rt| jj� t |�� qtd S ) Nr r z'Ignoring deprecated attribute name='%s'r r r r r! )�yes�true) r � startElementr" Zparser_check_element_attrsr Zwarningr �lowerr �append�str)r r �attrs�xr r r r+ O s& ��z$icmptype_ContentHandler.startElementN)r$ r% r& r+ r r r r r( N s r( c C s t � }| �d�s ttjd| ��| d d� |_|�|j� | |_||_|� t j �rVdnd|_ |j |_ t|�}t�� }|�|� d|| f }t|d��n}t�d �}|�|� z|�|� W n: tjy� } z ttjd|�� ��W Y d }~n d }~0 0 W d � n1 �s 0 Y ~~|S ) Nz.xmlz%s is missing .xml suffix���FT�%s/%s�rbz not a valid icmptype file: %s)r �endswithr r Z INVALID_NAMEr Z check_name�filename�path� startswithr � ETC_FIREWALLDZbuiltin�defaultr( �saxZ make_parserZsetContentHandler�openZ InputSourceZ setByteStream�parseZSAXParseExceptionZINVALID_ICMPTYPEZ getException) r5 r6 r �handler�parserr �f�source�msgr r r r c s: � ��:r c C s* |r|n| j }| jr$d|| jf }nd|| jf }tj �|�r�zt�|d| � W n2 ty� } zt� d||� W Y d }~n d }~0 0 tj � |�}|� t j �r�tj �|�s�tj �t j �s�t�t j d� t�|d� tj|ddd�}t|�}|�� i }| j�r| jd k�r| j|d < |�d |� |�d � | j�rt| jd k�rt|�d � |�di � |�| j� |�d� |�d � | j�r�| jd k�r�|�d � |�di � |�| j� |�d� |�d � | j�r |�d � i }| jD ]} d|| < �q�|�d|� |�d � |�d � |�d � |� � |� � ~d S )Nr2 z %s/%s.xmlz%s.oldz Backup of file '%s' failed: %si� ZwtzUTF-8)�mode�encodingr r r � z r r r) r ) r6 r5 r �os�exists�shutil�copy2� Exceptionr �error�dirnamer7 r r8 �mkdir�ior; r Z startDocumentr r+ ZignorableWhitespacer Z charactersZ endElementr r Z simpleElementZ endDocument�close) r r6 �_pathr rA �dirpathr? r= r/ r0 r r r r s\ $ r )N)�__all__Zxml.saxr: rE rM rG Zfirewallr Zfirewall.core.io.io_objectr r r Zfirewall.core.loggerr r Zfirewall.errorsr r r( r r r r r r �<module> s * core/io/__pycache__/firewalld_conf.cpython-39.opt-1.pyc 0000644 00000022256 15025011705 0016664 0 ustar 00 a ���gy? � @ s` d dl Zd dlZd dlZd dlZd dlmZ d dlmZ d dlm Z g d�Z G dd� de �Z dS )� N)�config)�log)�errors)� DefaultZone� MinimalMark� CleanupOnExit�CleanupModulesOnExit�Lockdown� IPv6_rpfilter�IndividualCalls� LogDenied�AutomaticHelpers�FirewallBackend�FlushAllOnReload� RFC3964_IPv4�AllowZoneDrifting� ReloadPolicy�NftablesTableOwnerc @ st e Zd Zdd� Zdd� Zdd� Zdd� Zd d � Zd d � Zd d� Z dd� Z dd� Z dd� Z e dd� �Ze dd� �ZdS )�firewalld_confc C s i | _ g | _|| _| �� d S �N)�_config�_deleted�filename�clear)�selfr � r �C/usr/lib/python3.9/site-packages/firewall/core/io/firewalld_conf.py�__init__& s zfirewalld_conf.__init__c C s i | _ g | _d S r )r r �r r r r r , s zfirewalld_conf.clearc C s | j �� g | _d S r )r r r r r r r �cleanup0 s zfirewalld_conf.cleanupc C s | j �|�� �S r )r �get�strip)r �keyr r r r 4 s zfirewalld_conf.getc C s0 |� � }|� � | j|< || jv r,| j�|� d S r )r! r r �remove)r r" �valueZ_keyr r r �set7 s zfirewalld_conf.setc C s8 d}| j �� D ]$\}}|r"|d7 }|d||f 7 }q|S )N� � z%s=%s)r �items)r �sr" r$ r r r �__str__= s zfirewalld_conf.__str__c C s | � dtj� | � dttj�� | � dtjr0dnd� | � dtjrFdnd� | � dtjr\dnd� | � dtj� | � d tj r�dnd� | � d tj � | � d tj � | � d tj � | � d tj r�dnd� | � dtj� | � dtjr�dnd� | � dtjr�dnd� | � dtj�rdnd� d S )Nr r r �yes�nor r r r r r r r r r r r )r% r � FALLBACK_ZONE�str�FALLBACK_MINIMAL_MARK�FALLBACK_CLEANUP_ON_EXIT� FALLBACK_CLEANUP_MODULES_ON_EXIT�FALLBACK_LOCKDOWN�FALLBACK_IPV6_RPFILTER�FALLBACK_INDIVIDUAL_CALLS�FALLBACK_LOG_DENIED�FALLBACK_AUTOMATIC_HELPERS�FALLBACK_FIREWALL_BACKEND� FALLBACK_FLUSH_ALL_ON_RELOAD�FALLBACK_RELOAD_POLICY�FALLBACK_RFC3964_IPV4� FALLBACK_ALLOW_ZONE_DRIFTINGZ FALLBACK_NFTABLES_TABLE_OWNERr r r r � set_defaultsE s$ �zfirewalld_conf.set_defaultsc C s< | � d�dkr8| � d�dv r8t�tjd| � d�� d���d S )Nr Ziptablesr )z loose-forwardzstrict-forwardzIPv6_rpfilter=z] is incompatible with FirewallBackend=iptables. This is a limitation of the iptables backend.)r r Z FirewallErrorZ INVALID_VALUEr r r r � sanity_checkY s �zfirewalld_conf.sanity_checkc C s� | � � zt| jd�}W n> tyV } z&t�d| j|� | �� � W Y d }~n d }~0 0 |D ]�}|sj �q>|�� }t|�dk s\|d dv r�q\dd� |� d�D �}t|�d kr�t�d |�� � q\nj|d t vr�t�d |�� � q\nJ|d d k�rt�d |�� � q\n(| j � |d �d u�r*t�d|�� � q\|d | j |d < q\|� � | � d��srt�dtj� | �dttj�� | � d�}z t|� W nN ttf�y� |d u�r�t�d|�r�|nd tj� | �dttj�� Y n0 | � d�}|�r�|�� dv�r2|d u�rt�d|�r|nd tj� | �dtj�r,dnd� | � d�}|�rP|�� dv�r�|d u�rtt�d|�rj|nd tj� | �dtj�r�dnd� | � d�}|�r�|�� dv�r�|d u�r�t�d |�r�|nd tj� | �dtj�r�dnd� | � d �}|�r|�� tjv�r8|d u�r*t�d |�r |nd tj � | �d tj � | � d �}|�rV|�� dv�r�|d u�rzt�d |�rp|nd tj � | �d tj �r�dnd� | � d!�}|�r�|tj v�r�|d u�r�t�d"|tj � | �d!ttj �� | � d#�}|�r�|�� tj v�r0|d u�r t�d$|�r|nd tj!� | �d#ttj!�� | � d%�}|�rP|�� tj"v�r�|d u�rtt�d&|�rj|nd tj#� | �d%ttj#�� | � d'�}|�r�|�� dv�r�|d u�r�t�d(|�r�|nd tj$� | �d'ttj$�� | � d)�}z| �%|�}W n2 t�y$ t�d*|tj&� | �d)tj&� Y n0 | � d+�}|�rD|�� dv�rz|d u�rht�d,|�r^|nd tj'� | �d+ttj'�� | � d-�}|�r�|�� dv�r�|d u�r�t�d.|�r�|nd tj(� | �d-tj(�r�dnd� | �)� d S )/N�rzFailed to load '%s': %s� r )�#�;c S s g | ] }|� � �qS r )r! )�.0�xr r r � <listcomp>v � z'firewalld_conf.read.<locals>.<listcomp>�=� z Invalid option definition: '%s'zInvalid option: '%s'r& zMissing value: '%s'z!Duplicate option definition: '%s'r z0DefaultZone is not set, using default value '%s'r z7MinimalMark '%s' is not valid, using default value '%d'r )r, �falser+ �truez7CleanupOnExit '%s' is not valid, using default value %sr+ r, r z>CleanupModulesOnExit '%s' is not valid, using default value %sr )r+ rI r, rH z2Lockdown '%s' is not valid, using default value %sr z7IPv6_rpfilter '%s' is not valid, using default value %sr z9IndividualCalls '%s' is not valid, using default value %sr z3LogDenied '%s' is invalid, using default value '%s'r z:AutomaticHelpers '%s' is not valid, using default value %sr z9FirewallBackend '%s' is not valid, using default value %sr z:FlushAllOnReload '%s' is not valid, using default value %sr z8ReloadPolicy '%s' is not valid, using default value '%s'r z6RFC3964_IPv4 '%s' is not valid, using default value %sr z;AllowZoneDrifting '%s' is not valid, using default value %s)*r �openr � Exceptionr �errorr< r! �len�split� valid_keysr r �closer r- r% r. �int� ValueError� TypeErrorZwarningr/ �lowerr0 r1 r2 ZIPV6_RPFILTER_VALUESr3 r4 ZLOG_DENIED_VALUESr5 ZAUTOMATIC_HELPERS_VALUESr6 ZFIREWALL_BACKEND_VALUESr7 r8 �_parse_reload_policyr9 r: r; r= )r �f�msg�lineZpairr$ r r r �readf s � � � � � � � � � � � � � �zfirewalld_conf.readc C s� t | j�dk rd S g }tj�tj�s2t�tjd� z.tj ddtj� | j � tj� | j �dd�}W n4 t y� } z t�d| � � W Y d }~n d }~0 0 d}d}ztj| j dd d �}W nR t �y } z8tj�| j �r�t�d | j |f � � nd }W Y d }~�n<d }~0 0 |D �]*}|�s �q:|�d �}t |�dk �rL|�s6|�d � d }n�|d dk�rtd}|�|� |�d � n�|�d�}t |�dk�r�d}|�|d � �q |d �� } |d �� } | |v�r2| | jv �r| j| | k�rd}|�d| | j| f � d }n$| | jv �rd }nd}|�|d � |�| � nd }�q t | j�dk�r�| j�� D ]P\} } | |v �rj�qT| dv �rx�qT|�s�|�d � d }|�d| | f � d }�qT|�r�|�� |�� |�s�t�|j� d S tj�| j ��r@zt� | j d| j � W nD t �y> } z*t�|j� t d| j |f ��W Y d }~n d }~0 0 zt� |j| j � W nD t �y� } z*t�|j� t d| j |f ��W Y d }~nd }~0 0 t� | j d� d S )Nr? i� Zwtz%s.F)�mode�prefix�dir�deletez!Failed to open temporary file: %sZrtzUTF-8)rZ �encodingzFailed to open '%s': %sr' Tr r@ rF rG z%s=%s )r r r z%s.oldzBackup of '%s' failed: %szFailed to create '%s': %si� ) rM r �os�path�existsr Z ETC_FIREWALLD�mkdir�tempfileZNamedTemporaryFile�basenamer �dirnamerK r rL �iorJ r! �writerN r �appendr( rP r# �name�shutil�copy2�IOError�move�chmod) r ZdoneZ temp_filerW Zmodified�emptyrV rX �pr" r$ r r r rg s� � � � ( (zfirewalld_conf.writec C s� d}dddd�}| r�| � � } | �� }|dv r@|D ] }|||< q0n�| �dd��d�D ]|}|� � }|sdqR|�dd��dd �}t|�d kr�d }qR|d � � �� }||vr�d }qR|d � � �� }|dvr�d }qR|||< qR|s�td ��|S )NT�DROP)ZINPUTZFORWARDZOUTPUT)ZACCEPTZREJECTrq rA �,rF �:rG Fr r? zInvalid ReloadPolicy)r! �upper�replacerN rM rR )r$ Zvalid�result�v�k�aZa2r r r rU o s> � z#firewalld_conf._parse_reload_policyc C s d� dd� | �� D ��S )Nrr c s s | ]\}}|� d |� �V qdS )rs Nr )rB rx rw r r r � <genexpr>� rE z8firewalld_conf._unparse_reload_policy.<locals>.<genexpr>)�joinr( )r$ r r r �_unparse_reload_policy� s z%firewalld_conf._unparse_reload_policyN)�__name__� __module__� __qualname__r r r r r% r* r< r= rY rg � staticmethodrU r| r r r r r % s j %r ) Zos.pathr_ rf rc rj Zfirewallr Zfirewall.core.loggerr r rO �objectr r r r r �<module> s core/io/__pycache__/ifcfg.cpython-39.opt-1.pyc 0000644 00000007675 15025011705 0014774 0 ustar 00 a ���g� � @ sJ d Z dgZddlZddlZddlZddlZddlmZ G dd� de �Z dS )zifcfg file parser�ifcfg� N)�logc @ sL e Zd Zdd� Zdd� Zdd� Zdd� Zd d � Zd d � Zd d� Z dd� Z dS )r c C s i | _ g | _|| _| �� d S �N)�_config�_deleted�filename�clear)�selfr � r �:/usr/lib/python3.9/site-packages/firewall/core/io/ifcfg.py�__init__" s zifcfg.__init__c C s i | _ g | _d S r )r r �r r r r r ( s z ifcfg.clearc C s | j �� d S r )r r r r r r �cleanup, s z ifcfg.cleanupc C s | j �|�� �S r )r �get�strip)r �keyr r r r / s z ifcfg.getc C s0 |� � }|� � | j|< || jv r,| j�|� d S r )r r r �remove)r r �valueZ_keyr r r �set2 s z ifcfg.setc C s8 d}| j �� D ]$\}}|r"|d7 }|d||f 7 }q|S )N� � z%s=%s)r �items)r �sr r r r r �__str__8 s z ifcfg.__str__c C sD | � � zt| jd�}W n6 tyN } z t�d| j|� � W Y d }~n d }~0 0 |D ]�}|sb �q8|�� }t|�dk sT|d dv r�qTdd� |�dd�D �}t|�d kr�qTt|d �d kr�|d � d �r�|d � d �r�|d dd � |d< |d d kr�qTn,| j � |d �d u�r$t� d | j|�� � qT|d | j |d < qT|�� d S )N�rzFailed to load '%s': %s� r )�#�;c S s g | ] }|� � �qS r )r )�.0�xr r r � <listcomp>P � z ifcfg.read.<locals>.<listcomp>�=� �"���r z%%s: Duplicate option definition: '%s')r �openr � Exceptionr �errorr �len�split� startswith�endswithr r Zwarning�close)r �f�msg�lineZpairr r r �readA s8 � � z ifcfg.readc C s� t | j�dk rd S g }z.tjddtj�| j� tj�| j�dd�}W n4 t yx } z t � d| � � W Y d }~n d }~0 0 d}d}zt j | jddd �}W nP t y� } z8tj�| j�r�t � d | j|f � � nd }W Y d }~�njd }~0 0 |D �]X}|s� �qJ|�d �}t |�dk �r,|�sH|�d � d }q�|d dk�rTd}|�|� |�d � q�|�dd�}t |�dk�r�d}|�|d � q�|d �� } |d �� } t | �dk�r�| �d��r�| �d��r�| dd� } | |v�rD| | jv �r| j| | k�rd}|�d| | j| f � d }n$| | jv �r&d }nd}|�|d � |�| � q�d }q�t | j�d k�r�| j�� D ]8\} } | |v �rz�qd|�s�d }|�d| | f � d }�qd|�r�|�� |�� |�s�t�|j� d S tj�| j��r8zt�| jd| j � W nD t �y6 } z*t�|j� t d| j|f ��W Y d }~n d }~0 0 zt� |j| j� W nD t �y� } z*t�|j� t d| j|f ��W Y d }~nd }~0 0 t� | jd� d S )Nr Zwtz%s.F)�mode�prefix�dir�deletez!Failed to open temporary file: %sZrtzUTF-8)r2 �encodingzFailed to open '%s': %sr Tr r r" r# r$ r% z%s=%s z%s.bakzBackup of '%s' failed: %szFailed to create '%s': %si� ) r) r �tempfileZNamedTemporaryFile�os�path�basenamer �dirnamer' r r( �ior& �existsr �writer* r+ r, r �appendr r- r �name�shutil�copy2�IOError�move�chmod) r ZdoneZ temp_filer/ Zmodified�emptyr. r0 �pr r r r r r> ^ s� � �� � ( (z ifcfg.writeN) �__name__� __module__� __qualname__r r r r r r r1 r> r r r r r ! s ) �__doc__�__all__Zos.pathr8 r< r7 rA Zfirewall.core.loggerr �objectr r r r r �<module> s core/io/__pycache__/zone.cpython-39.opt-1.pyc 0000644 00000026225 15025011705 0014661 0 ustar 00 a ���g�I � @ s� g d �Z ddlmZ ddlZddlZddlZddlmZ ddlm Z m Z m Z m Z m Z mZ ddlmZmZ ddlmZmZmZ ddlmZmZmZmZ ddlm Z dd l m Z dd lm Z dd l m!Z! G d d � d e�Z"G dd� de�Z#ddd�Z$ddd�Z%dS ))�Zone� zone_reader� zone_writer� N)�config)� checkIPnMask� checkIP6nMask�checkInterface�uniqify�max_zone_name_len� check_mac)�DEFAULT_ZONE_TARGET� ZONE_TARGETS)� IO_Object�IO_Object_ContentHandler�IO_Object_XMLGenerator)�common_startElement�common_endElement�common_check_config� common_writer)�rich)�log)�errors)� FirewallErrorc sX e Zd ZdZdddddddgfd d gfd dgfd d dgfddgfddgfddgfddgfdd gfddfZg d�Zddddgddgdgdgdddgdgddddgddgddddddd gdgdd �Zg d �d gd d!gd"d#gg d$�g d%�d&d'gg d(�d)gdgd*� Zed+d,� �Z � fd-d.�Z d/d0� Z � fd1d2�Z � fd3d4�Z d5d6� Z� fd7d8�Zd9d:� Z� ZS );r z Zone class )�version� )�shortr )� descriptionr )�UNUSEDF)�targetr �servicesr �ports)r r � icmp_blocks)� masqueradeF� forward_ports)r r r r � interfaces�sources� rules_str� protocols� source_ports)�icmp_block_inversionF)�forwardT)�_�-�/N�name�port�protocol�value�set)r r �zone�servicer/ z icmp-blockz icmp-typer* � forward-port� interface�rule�source� destinationr0 z source-portr �nflog�auditZaccept�rejectZdropZmark�limit�icmp-block-inversion)r. � immutabler r Zenabledzto-portzto-addr�family�priority)�address�mac�invertr@ �ipset)rB rD rE �prefix�level)�grouprF z queue-size�type) r3 r" r5 r7 r8 r9 r r: r< z tcp-mss-clampc C s8 t tj�D ] \}\}}|| kr | S q ttjd��d S )Nz index_of())� enumerater �IMPORT_EXPORT_STRUCTUREr r Z UNKNOWN_ERROR)�element�i�elZdummy� rO �9/usr/lib/python3.9/site-packages/firewall/core/io/zone.py�index_off s z Zone.index_ofc s� t t| ��� d| _d| _d| _d| _t| _g | _ g | _ g | _ g | _ d| _ d| _g | _g | _g | _g | _g | _g | _d| _d| _d| _d S �Nr FT)�superr �__init__r r r r r r r r r' r! r* r" r# r( r$ r% �rulesr& r) �combined�applied��self�� __class__rO rP rT m s* z Zone.__init__c C s� d| _ d| _d| _d| _t| _| jd d �= | jd d �= | jd d �= | j d d �= d| _ d| _ | j d d �= | j d d �= | jd d �= | jd d �= | jd d �= | jd d �= d| _d| _d| _d S rR )r r r r r r r r r' r! r* r" r# r( r$ r% rU r& r) rV rW rX rO rO rP �cleanup� s( z Zone.cleanupc sN |dkr8dd� |D �| _ tt| ��|dd� | j D �� ntt| ��||� d S )Nr& c S s g | ]}t j|d ��qS ))Zrule_str)r Z Rich_Rule��.0�srO rO rP � <listcomp>� � z$Zone.__setattr__.<locals>.<listcomp>c S s g | ] }t |��qS rO )�strr] rO rO rP r` � ra )rU rS r � __setattr__)rY r. r1 rZ rO rP rc � s zZone.__setattr__c s t t| ��� }|d= |S )Nr )rS r �export_config_dict)rY ZconfrZ rO rP rd � s zZone.export_config_dictc C sv t | ||||� | j|d v r2ttjd�| j���|dkr\|tvrXttjd�| j|����n|dkr�|D ]f}t|�s�ttj d�| j|���|d D ]:}|| jkr�q�||d | j v r�ttj d�| j||���q�qhn�|d k�rr|D ]�}t |��s$t |��s$t |��s$|�d ��s$ttjd �| j|���|d D ]B}|| jk�r@�q,||d | jv �r,ttjd �| j||����q,q�d S ) NZpoliciesz0Zone '{}': Can't have the same name as a policy.r z Zone '{}': invalid target '{}'r$ z!Zone '{}': invalid interface '{}'Zzonesz4Zone '{}': interface '{}' already bound to zone '{}'r% �ipset:z Zone '{}': invalid source '{}'z1Zone '{}': source '{}' already bound to zone '{}')r r. r r Z NAME_CONFLICT�formatr �INVALID_TARGETr ZINVALID_INTERFACEr$ r r r � startswith� INVALID_ADDRr% )rY r �itemZ all_configZall_io_objectsr6 r3 r8 rO rO rP � _check_config� sT � � �� �� � ��zZone._check_configc s� t t| ��|� |�d�r.ttjd�|���n�|�d�rLttjd�|���nl|� d�dkrnttjd�|���nJd|v r�|d |� d�� }n|}t |�t � kr�ttjd�|t |�t � ���d S )Nr- z$Zone '{}': name can't start with '/'z"Zone '{}': name can't end with '/'� z%Zone '{}': name has more than one '/'z'Zone '{}': name has {} chars, max is {}) rS r � check_namerh r r � INVALID_NAMErf �endswith�count�find�lenr )rY r. Z checked_namerZ rO rP rm � s, � �� ��zZone.check_namec C s� d| _ d | _d| _d| _d| _|jD ]}|| jvr$| j�|� q$|jD ]}|| jvrF| j�|� qF|jD ]}|| jvrh| j�|� qh|j D ]}|| j vr�| j �|� q�|j D ]}|| j vr�| j �|� q�|j D ]}|| j vr�| j �|� q�|j r�d| _ |j �rd| _ |jD ] }|| jv�r | j�|� �q |jD ] }|| jv�r0| j�|� �q0|jD ]"} | j�| � | j�t| �� �qV|j�r�d| _d S )NTr )rV �filenamer r r r$ �appendr% r r r' r! r* r" r# r( rU r& rb r) ) rY r3 r6 r8 r4 r/ �protoZicmpr* r7 rO rO rP �combine� sL z Zone.combine)�__name__� __module__� __qualname__�__doc__rK ZADDITIONAL_ALNUM_CHARSZ PARSER_REQUIRED_ELEMENT_ATTRSZ PARSER_OPTIONAL_ELEMENT_ATTRS� staticmethodrQ rT r\ rc rd rk rm rv � __classcell__rO rO rZ rP r ( s� ��� % r c @ s$ e Zd Zdd� Zdd� Zdd� ZdS )�zone_ContentHandlerc C s" t �| |� d | _d| _d | _d S )NF)r rT �_rule� _rule_errorZ _limit_ok)rY rj rO rO rP rT s z zone_ContentHandler.__init__c C s� t �| ||� | jrd S | j�||� t| ||�r6d S |dkr�d|v rVt�d|d � d|v rj|d | j_d|v r�t�d|d � d|v r�|d }|t vr�t t j |��|dkr�|t kr�|| j_�n�|d kr�| jjr�t�d � nd | j_�n�|d k�rh| j�rt�d � d | _d S d|v�r.t�d� d | _d S |d | jjv�rT| jj�|d � nt�d|d � �n2|dk�r`| j�r | jj�r�t�dt| j�� d | _d S d}d|v �r�|d �� dv �r�d }d } }}d|v �r�|d }d|v �r�|d }d|v �r|d }tj||||d�| j_d S d|v�rBd|v�rBt�d� d S d|v �rdd|v �rdt�d� d S d|v �r~t�d |d � d|v �r�t�d � d S d|v �r�t|d ��s�t|d ��s�t|d ��s�t t j|d ��d|v �r d |d }|| jj v�r| jj �|� nt�d |d � d|v �r�|d }|| jj v�rN| jj �|� nt�d |d � n:|d k�r�| jj �r�t�d!� nd | j_ nt�d"|� d S d S )#Nr3 r. z'Ignoring deprecated attribute name='%s'r r? z,Ignoring deprecated attribute immutable='%s'r r r* z Forward already set, ignoring.Tr6 z$Invalid rule: interface use in rule.z Invalid interface: Name missing.z%Interface '%s' already set, ignoring.r8 z:Invalid rule: More than one source in rule '%s', ignoring.FrD )Zyes�truerB rC rE )rD z$Invalid source: No address no ipset.z"Invalid source: Address and ipset.r@ z)Ignoring deprecated attribute family='%s'z+Invalid source: Invertion not allowed here.zipset:%sz"Source '%s' already set, ignoring.r> z+Icmp-Block-Inversion already set, ignoring.zUnknown XML element '%s') r � startElementr rj Zparser_check_element_attrsr r Zwarningr r r r rg r r r* r~ r$ rt r8 rb �lowerr Z Rich_Sourcer r r ri r% r) ) rY r. �attrsr rD �addrrC rE �entryrO rO rP r� s� � � � � � � � � � � � z zone_ContentHandler.startElementc C s t �| |� t| |� d S )N)r � endElementr )rY r. rO rO rP r� � s z zone_ContentHandler.endElementN)rw rx ry rT r� r� rO rO rO rP r} s pr} Fc C s& t � }| �d�s ttjd| ��| d d� |_|s>|�|j� | |_||_|� t j �rZdnd|_ |j |_ d|_t|�}t�� }|�|� d|| f }t|d��n}t�d �}|�|� z|�|� W n: tjy� } z ttjd| �� ��W Y d } ~ n d } ~ 0 0 W d � n1 �s0 Y ~~|S ) Nz.xmlz'%s' is missing .xml suffix���FT�%s/%s�rbznot a valid zone file: %s)r ro r r rn r. rm rs �pathrh r � ETC_FIREWALLDZbuiltin�defaultr* r} �saxZ make_parserZsetContentHandler�openZ InputSourceZ setByteStream�parseZSAXParseExceptionZ INVALID_ZONEZ getException) rs r� Z no_check_namer3 �handler�parserr. �fr8 �msgrO rO rP r � s> � ��:r c C sT |r|n| j }| jr$d|| jf }nd|| jf }tj �|�r�zt�|d| � W n2 ty� } zt� d||� W Y d }~n d }~0 0 tj � |�}|� t j �r�tj �|�s�tj �t j �s�t�t j d� t�|d� tj|ddd�}t|�}|�� i }| j�r| jd k�r| j|d < | jtk�r*| j|d < |�d |� |�d � t| |� t| j�D ]*} |�d� |�dd| i� |�d � �qTt| j �D ]N} |�d� d| v �r�|�dd| dd � i� n|�dd| i� |�d � �q�| j �r|�d� |�di � |�d � | j �r*|�d� |�di � |�d � |� d � |�d � |� � |�!� ~d S )Nr� z %s/%s.xmlz%s.oldz Backup of file '%s' failed: %si� ZwtzUTF-8)�mode�encodingr r r r3 � z r6 r. re r8 rE � rB r> r* )"r� rs r. �os�exists�shutil�copy2� Exceptionr �error�dirnamerh r r� �mkdir�ior� r Z startDocumentr r r r� ZignorableWhitespacer r r$ Z simpleElementr% r) r* r� Z endDocument�close) r3 r� �_pathr. r� �dirpathr� r� r� r6 r8 rO rO rP r � s` $ r )F)N)&�__all__Zxml.saxr� r� r� r� Zfirewallr Zfirewall.functionsr r r r r r Zfirewall.core.baser r Zfirewall.core.io.io_objectr r r Zfirewall.core.io.policyr r r r Z firewall.corer Zfirewall.core.loggerr r Zfirewall.errorsr r r} r r rO rO rO rP �<module> s$ e| ! core/io/__pycache__/icmptype.cpython-39.pyc 0000644 00000010545 15025011705 0014577 0 ustar 00 a ���g� � @ s� g d �Z ddlmZ ddlZddlZddlZddlmZ ddlm Z m Z m Z ddl m Z ddlmZ ddlmZ G dd � d e �ZG d d � d e �Zd d � Zddd�ZdS ))�IcmpType�icmptype_reader�icmptype_writer� N)�config)� IO_Object�IO_Object_ContentHandler�IO_Object_XMLGenerator)�log)�errors)� FirewallErrorc sh e Zd ZdddddgffZdZddgZd d d d �Zd d gd dgd�Z� fdd�Zdd� Z dd� Z � Z S )r )�version� )�shortr )� descriptionr � destinationr z(sssas)�_�-N)r r �icmptype�namer �ipv4�ipv6)r r c s* t t| ��� d| _d| _d| _g | _d S �Nr )�superr �__init__r r r r ��self�� __class__� �=/usr/lib/python3.9/site-packages/firewall/core/io/icmptype.pyr 7 s zIcmpType.__init__c C s" d| _ d| _d| _| jd d �= d S r )r r r r r r r r �cleanup> s zIcmpType.cleanupc C s. |dkr*|D ] }|dvr t tjd| ��q d S )Nr �r r z '%s' not from {'ipv4'|'ipv6'})r r ZINVALID_DESTINATION)r r �itemZ all_configZall_io_objectsr r r r � _check_configD s ��zIcmpType._check_config) �__name__� __module__� __qualname__ZIMPORT_EXPORT_STRUCTUREZDBUS_SIGNATUREZADDITIONAL_ALNUM_CHARSZ PARSER_REQUIRED_ELEMENT_ATTRSZ PARSER_OPTIONAL_ELEMENT_ATTRSr r r# � __classcell__r r r r r $ s" ��� r c @ s e Zd Zdd� ZdS )�icmptype_ContentHandlerc C s� t �| ||� | j�||� |dkrTd|v r>t�d|d � d|v r�|d | j_nP|dkr^nF|dkrhn<|dkr�dD ].}||v rt|| �� d v rt| jj� t |�� qtd S ) Nr r z'Ignoring deprecated attribute name='%s'r r r r r! )�yes�true) r � startElementr" Zparser_check_element_attrsr Zwarningr �lowerr �append�str)r r �attrs�xr r r r+ O s& ��z$icmptype_ContentHandler.startElementN)r$ r% r& r+ r r r r r( N s r( c C s t � }| �d�s ttjd| ��| d d� |_|�|j� | |_||_|� t j �rVdnd|_ |j |_ t|�}t�� }|�|� d|| f }t|d��n}t�d �}|�|� z|�|� W n: tjy� } z ttjd|�� ��W Y d }~n d }~0 0 W d � n1 �s 0 Y ~~|S ) Nz.xmlz%s is missing .xml suffix���FT�%s/%s�rbz not a valid icmptype file: %s)r �endswithr r Z INVALID_NAMEr Z check_name�filename�path� startswithr � ETC_FIREWALLDZbuiltin�defaultr( �saxZ make_parserZsetContentHandler�openZ InputSourceZ setByteStream�parseZSAXParseExceptionZINVALID_ICMPTYPEZ getException) r5 r6 r �handler�parserr �f�source�msgr r r r c s: � ��:r c C s* |r|n| j }| jr$d|| jf }nd|| jf }tj �|�r�zt�|d| � W n2 ty� } zt� d||� W Y d }~n d }~0 0 tj � |�}|� t j �r�tj �|�s�tj �t j �s�t�t j d� t�|d� tj|ddd�}t|�}|�� i }| j�r| jd k�r| j|d < |�d |� |�d � | j�rt| jd k�rt|�d � |�di � |�| j� |�d� |�d � | j�r�| jd k�r�|�d � |�di � |�| j� |�d� |�d � | j�r |�d � i }| jD ]} d|| < �q�|�d|� |�d � |�d � |�d � |� � |� � ~d S )Nr2 z %s/%s.xmlz%s.oldz Backup of file '%s' failed: %si� ZwtzUTF-8)�mode�encodingr r r � z r r r) r ) r6 r5 r �os�exists�shutil�copy2� Exceptionr �error�dirnamer7 r r8 �mkdir�ior; r Z startDocumentr r+ ZignorableWhitespacer Z charactersZ endElementr r Z simpleElementZ endDocument�close) r r6 �_pathr rA �dirpathr? r= r/ r0 r r r r s\ $ r )N)�__all__Zxml.saxr: rE rM rG Zfirewallr Zfirewall.core.io.io_objectr r r Zfirewall.core.loggerr r Zfirewall.errorsr r r( r r r r r r �<module> s * core/io/__pycache__/policy.cpython-39.opt-1.pyc 0000644 00000056722 15025011705 0015212 0 ustar 00 a ���g� � @ s g d �Z ddlmZ ddlZddlZddlZddlmZ ddlm Z m Z m Z m Z m Z mZmZmZ ddlmZmZmZ ddlmZmZmZmZmZmZ ddl m Z ddl m Z dd lm Z dd l!m"Z" d d � Z#d d� Z$dd� Z%dd� Z&G dd� de�Z'G dd� de�Z(d dd�Z)d dd�Z*dS ) )�Policy� policy_reader� policy_writer� N)�config)�checkIP�checkIP6� checkUINT16�coalescePortRange�max_policy_name_len�portInPortRange�portStr�uniqify)�DEFAULT_POLICY_TARGET�POLICY_TARGETS�DEFAULT_POLICY_PRIORITY)� IO_Object�IO_Object_ContentHandler�IO_Object_XMLGenerator� check_port� check_tcpudp�check_protocol)�rich)�log)�errors)� FirewallErrorc s� |dkr � n�|dkr� n�|dkr�| j r`| j jrJt�dt| j �� d| _dS t�� d �| j _dS � d | jj vr�| jj � � d � nt�d� d � � n<|dk�r| j r�| j jr�t�dt| j �� d| _dS t� � d � d �| j _dS t � d � t � d � t� d d �� d f}tt� fd d �| jj��}|D ]b}t|d |d ��r4t| jt��rb| jjn| jj}t�ttjd|d � d |f �� � qԐq4t|d dd� |D ��\}}|D ]&} t| d �� d f} | jj�| � �q�|D ]&} t| d �� d f} | jj� | � �q� n�|d k�r�| j �r\| j j�rHt�dt| j �� d| _dS t� � d �| j _nBt � d � � d | jj v�r�| jj � � d � nt�d� d � � n2|dk�r<| j �r| j j�r�t�dt| j �� d| _dS d} d� v �r�� d dv�r�� d } t� | �| j _n*d} d� v �r,d� d � d�} t�d| � �n�|dk�r�| j �r�| j j�rtt�dt| j �� d| _dS t� � d �| j _dS � d | jj!v�r�| jj!� � d � nt�d� d � �n|d k�r&| j �r| j j�r�t�dt| j �� d| _dS t�"� d �| j _dS t�d � d � �n�|d k�r�| j �rl| j j�r^t�dt| j �� d| _dS t�#� | j _n | jj$�r�t�d � nd| j_$�nF|d k�r�d} d!� v �r�� d! } d}d"� v �rĈ d" }| j �r| j j�r�t�dt| j �� d| _dS t�%� d � d | |�| j _dS t � d � t � d � | �r8t | � |�rbt&|��sbt'|��sbttj(d#| ��t� d d �� d t| d �t|�f} | | jj)v�r�| jj)� | � n6t�d$� d � d | �r�d%| nd|�r�d&| nd� �n�|d'k�rZ| j �r2| j j�rt�dt| j �� d| _dS t�*� d � d �| j _dS t � d � t � d � t� d d �� d f}tt� fd(d �| jj+��}|D ]b}t|d |d ��r~t| jt��r�| jjn| jj}t�ttjd|d � d |f �� � qԐq~t|d d)d� |D ��\}}|D ]&} t| d �� d f} | jj+�| � �q|D ]&} t| d �� d f} | jj+� | � �q.�nz|d*k�r| j �s�t�d+� d| _dS | j j,�r�t�d,t| j �� dS d-}d }d.� v �r�� d. }d }d/� v �rЈ d/ }d0� v �r� d0 �-� d1v �r�d}t�.|||�| j _,�n�|d2v �r�| j �s,t�d3� d| _dS | j j/�rJt�d4� d| _dS |d5k�rbt�0� | j _/nh|d6k�r�d }d7� v �r�� d7 }t�1|�| j _/n8|d8k�r�t�2� | j _/n |d9k�rʈ d: }t�3|�| j _/| j j/| _4�n�|d;k� r�| j �s�t�d<� dS | j j� rt�d=� dS d }d>� v � rD� d> }|d?v� rDt�d@� d| _dS d }dA� v � r�� dA }|� rnt5|�dBk� r�t�dC� d| _dS t�6||�| j _| j j| _4�n4|dDk� r�| j � s�t�d<� dS | j j� r�t�d=� dS d }dE� v � r � dE }t7|�� s t�dF� d| _dS d }dA� v � rJ� dA }|� r6t5|�dBk� rJt�dG� d| _dS d }dH� v � r~� dH }t7|�� s~t�dI� d| _dS t�8|||�| j _| j j| _4�n6|dJk� r�| j � s�t�dK� dS | j j9� r�t�dLt| j �� d| _dS t�:� | j _9| j j9| _4n�|dMk� rld }d }dN� v � rD� dN }|dOv� rDt�dP� dN � d| _dS dQ� v � rZt;� dQ �}tj<||dR�| _ nh|dSk� r�| j4� s�t�dT� d| _dS | j4j=� r�t�dUt| j �� d| _dS � d }t�>|�| j4_=nd-S dS )VN�short� description�servicez;Invalid rule: More than one element in rule '%s', ignoring.T�namez#Service '%s' already set, ignoring.�port�protocol�-c s | d � d kS �N� r � ��x��attrsr$ �;/usr/lib/python3.9/site-packages/firewall/core/io/policy.py�<lambda>E � z%common_startElement.<locals>.<lambda>r z'%s:%s' already in '%s'c S s g | ] \}}|�qS r$ r$ ��.0Z_portZ _protocolr$ r$ r) � <listcomp>O r+ z'common_startElement.<locals>.<listcomp>�valuez$Protocol '%s' already set, ignoring.� tcp-mss-clamp�pmtu)N�None� z (value='z)'z-Invalid rule: tcp-mss-clamp%s outside of rule� icmp-blockz&icmp-block '%s' already set, ignoring.� icmp-typez-Invalid rule: icmp-block '%s' outside of rule� masqueradez!Masquerade already set, ignoring.� forward-port�to-port�to-addrz#to-addr '%s' is not a valid addressz-Forward port %s/%s%s%s already set, ignoring.z >%sz @%s� source-portc s | d � d kS r" r$ r% r' r$ r) r* � r+ c S s g | ] \}}|�qS r$ r$ r, r$ r$ r) r. � r+ � destinationz)Invalid rule: Destination outside of rulez?Invalid rule: More than one destination in rule '%s', ignoring.F�address�ipset�invert�Zyes�true)�accept�reject�drop�markz$Invalid rule: Action outside of rulez"Invalid rule: More than one actionrA rB �typerC rD �setr z!Invalid rule: Log outside of rulez Invalid rule: More than one log�level)ZemergZalertZcrit�error�warningZnotice�info�debugz Invalid rule: Invalid log level�prefix� z Invalid rule: Invalid log prefix�nflog�groupz'Invalid rule: Invalid nflog group valuez"Invalid rule: Invalid nflog prefix� queue-sizez&Invalid rule: Invalid nflog queue-size�auditz#Invalid rule: Audit outside of rulez9Invalid rule: More than one audit in rule '%s', ignoring.�rule�family)Zipv4Zipv6z&Invalid rule: Rule family "%s" invalid�priority)rS rT �limitz4Invalid rule: Limit outside of action, log and auditz9Invalid rule: More than one limit in rule '%s', ignoring.)?�_rule�elementr rI �str� _rule_errorr � Rich_Service�item�services�append� Rich_Portr r r �list�filter�portsr � isinstancer �derived_from_zoner r r ZALREADY_ENABLEDr �remove� Rich_Protocolr � protocols�Rich_Tcp_Mss_Clamp�Rich_IcmpBlock� icmp_blocks� Rich_IcmpType�Rich_Masquerader6 �Rich_ForwardPortr r � INVALID_ADDR� forward_ports�Rich_SourcePort� source_portsr; �lowerZRich_Destination�action� Rich_Accept� Rich_Reject� Rich_Drop� Rich_Mark� _limit_ok�len�Rich_Logr Z Rich_NFLogrQ Z Rich_Audit�int� Rich_RulerU Z Rich_Limit)�objr r( Z new_port_idZexisting_port_idsZport_id�_nameZ added_rangesZremoved_rangesZ_range�entry�_value�s�to_portZto_addrr> r< r= Z_typeZ_setrG rL rO � thresholdrS rT r/ r$ r' r) �common_startElement! s� �� � � � � � � �� �� � � � ��� � � � � � �� � � �r� c C s� |dkr�| j s�z| j�� W n8 tyT } z t�d|t| j�� W Y d }~nTd }~0 0 t| j�| jjvr�| jj � | j� | jj� t| j�� nt�dt| j�� d | _d| _ n|dv r�d | _ d S )NrR z%s: %sz Rule '%s' already set, ignoring.F)rA rB rC rD r rQ ) rY rV �check� Exceptionr rI rX r[ � rules_str�rulesr] rw )r| r �er$ r$ r) �common_endElement| s *�r� c C s� t | t�rdnd}|dkrXd|v rX|d }|D ]$}||vr.ttjd�|| j|���q.�nJ|dkr�|D ] }t|d � t|d � qd�n |dkr�|D ] } t | � q��n�|d k�r d |v �r |d } |D ]T} | | vr�ttj d �|| j| ��} | |� d i �� d i �v �rt � d�| �� q�| �qĐn�|dk�r�|D ]�} t| d � t| d � | d �st| d �stttjd�|| j| ���| d �r�t| d � | d �r,t| d ��s,t| d ��s,ttjd�|| j| d ����q,�n�|dk�r|D ] }t|d � t|d � �q�n�|dv �r�|D �]�}tj|d�}|j�r`d |v �r`t |jtj��sXt |jtj��r`|d } |jj| v�r�ttj d �|| j|jj��} |jj|� d i �� d i �v �r�t � d�| �� n| �n�|j�r�|d |jj }|j�r�|j|jv�r�ttj d�|| j|j|jj��} |� d i �� d i �� |jj�}|�rZ|j�rZ|j|jv �rZt � d�| �� n| �n>t |jtj��r|jj|d v�rttjd�|| j|jj����qd S )Nr ZZoner\ z){} '{}': '{}' not among existing servicesra r r# rf ri Z icmptypesz+{} '{}': '{}' not among existing ICMP typesZruntimeZicmptypes_unsupportedz{} (unsupported)rn � � z-{} '{}': '{}' is missing to-port AND to-addr z,{} '{}': to-addr '{}' is not a valid addressrp )r� � rich_rules�Zrule_strz<{} '{}': rich rule family '{}' conflicts with icmp type '{}')rb r r r ZINVALID_SERVICE�formatr r r r ZINVALID_ICMPTYPE�getr Zdebug1�INVALID_FORWARDr r rm r r{ rW rh rj rS r; rZ )r| r r[ � all_config�all_io_objectsZobj_typeZexisting_servicesr r �protoZexisting_icmptypesZicmptype�ex�fwd_portrR Zobj_richZictZict_unsupportedr$ r$ r) �common_check_config� s� �� �� �� �� � � �� �� � ��r� c C s� | j rF| j dkrF|�d� |�di � |�| j � |�d� |�d� | jr�| jdkr�|�d� |�di � |�| j� |�d� |�d� t| j�D ](}|�d� |�dd|i� |�d� q�t| j �D ]2}|�d� |�d|d |d d �� |�d� q�t| j �D ]*}|�d� |�d d |i� |�d� �qt| j �D ]*}|�d� |�dd|i� |�d� �q>| j �r�|�d� |�di � |�d� t| j �D ]�}|�d� |d |d d �}|d �r�|d dk�r�|d |d< |d �r|d dk�r|d |d< |�d|� |�d� �q�t| j�D ]4}|�d� |�d|d |d d �� |�d� �q(| jD �]n}i }|j�r�|j|d< |jd k�r�t|j�|d< |�d� |�d|� |�d� |j�r:i }|jj�r�|jj|d< |jj�r�|jj|d< |jj�r|jj|d< |jj�rd |d < |�d � |�d |� |�d� |j�r�i }|jj�r\|jj|d< |jj�rr|jj|d< |jj�r�d |d < |�d � |�d |� |�d� |j�r�d} i }t|j�tj k�r�d} |jj |d< �n�t|j�tj k�r d} |jj |d< |jj |d < �nnt|j�tj!k�r2d } |jj"|d < �nHt|j�tj#k�rpd!} |jj"�rz|jj"d"k�rz|jj"|d < �n t|j�tj$k�r�d} n�t|j�tj%k�r�d} |jj |d< n�t|j�tj&k�r�d#} |jj |d< n�t|j�tj'k�r4d} |jj |d< |jj |d < |jj(dk�r|jj(|d< |jj)dk�rz|jj)|d< nFt|j�tj*k�rdd} |jj |d< |jj |d < nt+t,j-d$t|j� ��|�d � |�| |� |�d� |j.�rt|j.�tj/k�r\i }|j.j0�r�|j.j0|d%< |j.j1�r�|j.j1|d&< |j.j2�r:|�d � |�d'|� |�d(� |�d)d |j.j2j"i� |�d*� |�d'� n|�d � |�d'|� |�d� n�i }|j.j3�rv|j.j3|d+< |j.j0�r�|j.j0|d%< |j.j4�r�|j.j4|d,< |j.j2�r�|�d � |�d-|� |�d(� |�d)d |j.j2j"i� |�d*� |�d-� n|�d � |�d-|� |�d� |j5�r�i }|j5j2�rz|�d � |�d.i � |�d(� |�d)d |j5j2j"i� |�d*� |�d.� n|�d � |�d.|� |�d� |j6�r�d} i }t|j6�tj7k�r�d/} n|t|j6�tj8k�r�d0} |j6j�r>|j6j|d1< nNt|j6�tj9k�rd2} n6t|j6�tj:k�r,d3} |j6j;|d4< nt.�<d5t|j6�� |j6j2�r�|�d � |�| |� |�d(� |�d)d |j6j2j"i� |�d*� |�| � n|�d � |�| |� |�d� |�d� |�d� |�d� �qdd S )6Nr3 � r � r r r r r r# )r r r r/ r4 r6 r� r8 r� r9 r7 r: rS rT rR r< �macr= �Truer> z �sourcer; r0 r1 r5 z"Unknown element '%s' in obj_writerrL rG r z rU z rO rP rN rQ rA rB rE rC rD rF zUnknown action '%s')=r �ignorableWhitespace� startElementZ characters� endElementr r r\ � simpleElementra rf ri r6 rn rp r� rS rT rX r� �addrr� r= r> r; rW rE r rZ r r^ r r re r/ rg rk rh rj rl r� � to_addressro r r ZINVALID_OBJECTr ry rL rG rU rO r� rQ rr rs rt ru rv rF rI ) r| �handlerr r r ZicmpZforwardr( rR rW rr r$ r$ r) � common_writer� s� � � � � � � r� c sN e Zd ZdZdZeZdgZdddddd gfd d gfd d gfd ddgfdd gfdd gfdd gfddd gfdd gffZg d�Z dddgdgddgdgdgdddgdddd gddgddddddd gd gdgdgd �Z d d gd!d"gd#d gg d$�g d%�d&d'gg d(�d)gd gd*� Z � fd+d,�Z d-d.� Z � fd/d0�Z� fd1d2�Zd3d4� Z� fd5d6�Z� ZS )7r i ���i� r )�versionr3 )r r3 )r r3 )�targetr3 r\ r3 ra )r3 r3 ri )r6 Frn )r3 r3 r3 r3 r� rf rp )rT r � ingress_zones� egress_zones)�_r! �/Nr� r r r r/ rF )r r �policyr r r4 r5 r6 r7 rR r� r; r r: r rN rQ rA rB rC rD rU � ingress-zone� egress-zoner� rT r8 r9 rS )r< r� r> rS r= )r< r> r= rL rG )rO rL rP rE ) r� r7 rR r� r; r rN rB r0 c s� t t| ��� d| _d| _d| _t| _g | _g | _ g | _ g | _ d| _ d| _ g | _g | _g | _g | _d| _| j| _d | _g | _g | _d S �Nr3 F)�superr �__init__r� r r r r� r\ ra rf ri �icmp_block_inversionr6 rn rp r� r� �applied�priority_defaultrT rc r� r� ��self�� __class__r$ r) r� s( zPolicy.__init__c C s� d| _ d| _d| _t| _| jd d �= | jd d �= | jd d �= | jd d �= d| _ d| _ | j d d �= | j d d �= | j d d �= | jd d �= d| _| j| _| jd d �= | jd d �= d S r� )r� r r r r� r\ ra rf ri r� r6 rn rp r� r� r� r� rT r� r� r� r$ r$ r) �cleanup- s$ zPolicy.cleanupc s" |dkr| j S ttt| �|�S d S )Nr� )r� �getattrr� r �r� r r� r$ r) � __getattr__A s zPolicy.__getattr__c sB |dkr,dd� |D �| _ dd� | j D �| _ntt| ��||� d S )Nr� c S s g | ]}t j|d ��qS )r� )r r{ �r- r� r$ r$ r) r. I r+ z&Policy.__setattr__.<locals>.<listcomp>c S s g | ] }t |��qS r$ )rX r� r$ r$ r) r. K r+ )r� r� r� r � __setattr__)r� r r/ r� r$ r) r� G s zPolicy.__setattr__c C s� t | ||||� | j|d v r2ttjd�| j���|dkr\|tvrXttjd�| j|����n�|dkr�|| jv s�|| j ks�|| j k r�ttj d�| j|| j | j | j����nH|dv �r�dd gt |d � � � }|D ]�}||vr�ttjd �| j|���|d v�rtdd g�t|�@ �s.|d v �rDt|�t|g� �rDttjd �| j|���|d kr�|d k�rnd|v �rnd |d v �s�|dkr�d |v r�d |d v r�ttjd�| j���qΐnL|dk�r�|�r�d|v �r�d |d v �r�ttjd�| j���n�d |v �r�d |d v �rttjd�| j���|d D ]r}|dk�r(�q||d v�rLttjd�| j|���|d �d�dk�r|d | j�rttjd�| j|����q�nb|dk�r|D �]p}tj|d�}|j�r�t|jtj��r�d|v �r�d |d v �r�ttjd�| j���n�d |v �r d |d v �r ttjd�| j���|d D ]r}|dk�r:�q(||d v�r^ttjd�| j|���|d �d�dk�r(|d | j�r(ttjd�| j|����q(�q�|j�r�t|jtj��r�d|v �r d |d v �r�|jj�r�ttjd�| j���n�|d �r |jj�sttjd�| j���d|d v�r |d D ]P}||d v�rVttjd�| j|���|d | j�r.ttjd �| j|����q.n�|j�r�t|jtj��r�d|v �r�|d D ]^}|d v �r��q�||d v�r�ttjd�| j|���|d | j�r�ttjd �| j|����q��q�n�|d k�r�|D ]�} d|v �r d |d v �r\| d �r�ttjd�| j���n�|d �r | d �s�ttjd�| j���d|d v�r |d D ]P}||d v�r�ttjd�| j|���|d | j�r�ttjd �| j|����q��q d S ) NZzonesz0Policy '{}': Can't have the same name as a zone.r� z#Policy '{}': '{}' is invalid targetrT z^Policy '{}': {} is invalid priority. Must be in range [{}, {}]. The following are reserved: {})r� r� �ANY�HOSTz*Policy '{}': '{}' not among existing zones)r� r� zKPolicy '{}': '{}' may only contain one of: many regular zones, ANY, or HOSTr� r� zSPolicy '{}': 'HOST' can only appear in either ingress or egress zones, but not bothr6 z;Policy '{}': 'masquerade' is invalid for egress zone 'HOST'z<Policy '{}': 'masquerade' is invalid for ingress zone 'HOST'z&Policy '{}': Zone '{}' does not exist.ZconfZFirewallBackendZnftablesz\Policy '{}': 'masquerade' cannot be used because ingress zone '{}' has assigned interfaces. r� r� zNPolicy '{}': A 'forward-port' with 'to-addr' is invalid for egress zone 'HOST'zPPolicy '{}': 'forward-port' requires 'to-addr' if egress zone is 'ANY' or a zonez[Policy '{}': 'forward-port' cannot be used because egress zone '{}' has assigned interfaceszZPolicy '{}': 'mark' action cannot be used because egress zone '{}' has assigned interfacesrn r� ) r� r r r Z NAME_CONFLICTr� r �INVALID_TARGET�priority_reserved� priority_max� priority_minZINVALID_PRIORITYr_ �keysZ INVALID_ZONErF r� Z interfacesr r{ rW rb rk rl r� r� rr rv ) r� r r[ r� r� Zexisting_zones�zonerR r| r� r$ r$ r) � _check_configO s: ���� �� ������ ��� ��� �� �� � �� �� � �� �� �� �� zPolicy._check_configc s� t t| ��|� |�d�r.ttjd�|���n�|�d�rLttjd�|���nl|� d�dkrnttjd�|���nJd|v r�|d |� d�� }n|}t |�t � kr�ttjd�|t |�t � ���d S )Nr� z&Policy '{}': name can't start with '/'z$Policy '{}': name can't end with '/'r# z'Policy '{}': name has more than one '/'z)Policy '{}': name has {} chars, max is {}) r� r � check_name� startswithr r � INVALID_NAMEr� �endswith�count�findrx r )r� r Z checked_namer� r$ r) r� � s, � �� ��zPolicy.check_name)�__name__� __module__� __qualname__r� r� r r� r� ZIMPORT_EXPORT_STRUCTUREZADDITIONAL_ALNUM_CHARSZ PARSER_REQUIRED_ELEMENT_ATTRSZ PARSER_OPTIONAL_ELEMENT_ATTRSr� r� r� r� r� r� � __classcell__r$ r$ r� r) r � s| ��� xr c @ s$ e Zd Zdd� Zdd� Zdd� ZdS )�policy_ContentHandlerc C s" t �| |� d | _d| _d | _d S )NF)r r� rV rY rw )r� r[ r$ r$ r) r� � s z policy_ContentHandler.__init__c C s t �| ||� | jrd S | j�||� t| ||�r6d S |dkr�d|v rR|d | j_d|v rjt|d �| j_d|v r�|d }|t vr�t t j |��|r�|| j_ �n^|dkr�|d | jjvr�| jj�|d � nt�d|d � �n |dk�r |d | jjv�r| jj�|d � nt�d |d � n�|d k�r�| j�sFt�d � d | _d S | jj�rlt�d t| j�� d | _d S d}d|v �r�|d �� dv �r�d }d } }}d|v �r�|d }d|v �r�|d }d|v �r�|d }tj||||d�| j_d S t�d|� d S d S )Nr� r� rT r� r� r z(Ingress zone '%s' already set, ignoring.r� z'Egress zone '%s' already set, ignoring.r� z$Invalid rule: Source outside of ruleTz:Invalid rule: More than one source in rule '%s', ignoring.Fr> r? r< r� r= )r> zUnknown XML element '%s')r r� rY r[ Zparser_check_element_attrsr� r� rz rT r r r r� r� r� r] r rI r� rV r� rX rq r Z Rich_Source)r� r r( r� r> r� r� r= r$ r$ r) r� � sl � � � z"policy_ContentHandler.startElementc C s t �| |� t| |� d S )N)r r� r� r� r$ r$ r) r� % s z policy_ContentHandler.endElementN)r� r� r� r� r� r� r$ r$ r$ r) r� � s @r� Fc C s t � }| �d�s ttjd| ��| d d� |_|s>|�|j� | |_||_|� t j �rZdnd|_ |j |_ t|�}t�� }|�|� d|| f }t|d��n}t�d �}|�|� z|�|� W n: tjy� } z ttjd| �� ��W Y d } ~ n d } ~ 0 0 W d � n1 �s0 Y ~~|S ) Nz.xmlz'%s' is missing .xml suffix���FT�%s/%s�rbznot a valid policy file: %s)r r� r r r� r r� �filename�pathr� r � ETC_FIREWALLDZbuiltin�defaultr� �saxZ make_parserZsetContentHandler�openZ InputSourceZ setByteStream�parseZSAXParseExceptionZINVALID_POLICYZ getException) r� r� Z no_check_namer� r� �parserr �fr� �msgr$ r$ r) r * s< � ��:r c C s� |r|n| j }| jr$d|| jf }nd|| jf }tj �|�r�zt�|d| � W n2 ty� } zt� d||� W Y d }~n d }~0 0 tj � |�}|� t j �r�tj �|�s�tj �t j �s�t�t j d� t�|d� tj|ddd�}t|�}|�� i }| j�r| jd k�r| j|d < | j| jk�r0t| j�|d < | j|d < |�d |� |�d� t| |� t| j �D ]*} |�d� |� dd| i� |�d� �qdt| j �D ]*} |�d� |� dd| i� |�d� �q�|� d � |�d� |� � |�!� ~d S )Nr� z %s/%s.xmlz%s.oldz Backup of file '%s' failed: %si� ZwtzUTF-8)�mode�encodingr3 r� rT r� r� r� r� r� r r� )"r� r� r �os�exists�shutil�copy2r� r rH �dirnamer� r r� �mkdir�ior� r Z startDocumentr� rT r� rX r� r� r� r� r r� r� r� r� Z endDocument�close) r� r� �_pathr r� �dirpathr� r� r( r� r$ r$ r) r G sN $ r )F)N)+�__all__Zxml.saxr� r� r� r� Zfirewallr Zfirewall.functionsr r r r r r r r Zfirewall.core.baser r r Zfirewall.core.io.io_objectr r r r r r Z firewall.corer Zfirewall.core.loggerr r Zfirewall.errorsr r� r� r� r� r r� r r r$ r$ r$ r) �<module> s2 ( ]T w L core/io/__pycache__/ipset.cpython-39.opt-1.pyc 0000644 00000024152 15025011705 0015027 0 ustar 00 a ���g P � @ s� d Z g d�ZddlmZ ddlZddlZddlZddlmZ ddl m Z m Z m Z m Z mZmZmZmZ ddlmZmZmZ ddlmZmZ ddlmZmZm Z m Z dd l m Z dd lm Z dd l!m"Z" G d d � d e�Z#G dd� de�Z$dd� Z%ddd�Z&dS )z$ipset io XML handler, reader, writer)�IPSet� ipset_reader� ipset_writer� N)�config)�checkIP�checkIP6� checkIPnMask� checkIP6nMask� check_mac� check_port�checkInterface� checkProtocol)� IO_Object�IO_Object_ContentHandler�IO_Object_XMLGenerator)� IPSET_TYPES�IPSET_CREATE_OPTIONS)�check_icmp_name�check_icmp_type�check_icmpv6_name�check_icmpv6_type)�log)�errors)� FirewallErrorc s� e Zd ZdddddddifddgffZdZg d �Zd d d gd gd d �Zdgdgd�Z� fdd�Zdd� Z e dd� �Z dd� Z � fdd�Z � ZS )r )�version� )�shortr )� descriptionr )�typer �optionsr �entriesz (ssssa{ss}as))�_�-�:�.Nr �name)r r �ipset�option�entryr �value)r& r' c s< t t| ��� d| _d| _d| _d| _g | _i | _d| _ d S �Nr F) �superr �__init__r r r r r r �applied��self�� __class__� �:/usr/lib/python3.9/site-packages/firewall/core/io/ipset.pyr, C s zIPSet.__init__c C s8 d| _ d| _d| _d| _| jd d �= | j�� d| _d S r* )r r r r r r �clearr- r. r2 r2 r3 �cleanupM s z IPSet.cleanupc C s� d}d|v r |d dkr d}|� d�s6ttjd| ��|dd � �d�}| �d�}t|�t|�ksnt|�d k r�ttjd | |f ��t|�D �]@\}}|| }|d k�r�d |v �rV|dk�rV|d kr�ttjd || |f ��|�d �} t| �dk�rttjd|| ||f ��| D ]F} |dk�r$t| ��r8|dk�r t | ��s ttjd| | ||f ���q nh|dk�r�|dk�r�ttjd|| ||f ��|dk�r�t } nt} nt } | |��s�ttjd|| ||f ��q�|dk�r"d |v �r�|�d �} t| �dk�rttjd|| ||f ��|dk�r t| d ��r4|dk�rPt | d ��sPttjd| d | ||f ��|dk�rht | d ��r�|dk�r t | d ��s ttjd| d | ||f ��n�|� d��r�|dk�r�|dk�r�|dk�s�ttjd|| ||f ��|dk�r�t |��r|dk�r�t |��s�ttjd|| ||f ��q�|dk�rVt |��r@|dk�r�ttjd|| f ��q�|dk�r�d|v �r�|�d�} t| �dk�r�ttjd| ��| d d k�r�|dk�r�ttjd || f ��t| d ��s�t| d ��s�ttjd | d | f ��n�| d d v �rV|dk�r ttjd || f ��t| d ��s�t| d ��s�ttjd | d | f ��n\| d d!v�r�t| d ��s�ttjd"| d | f ��n&t| d ��s�ttjd#| d | f ��n t|��s�ttjd$|| f ��q�|d%k�r�|� d&��r$zt|d'�} W n( t�y ttjd(|| f ��Y n0 n6z t|�} W n( t�yX ttjd(|| f ��Y n0 | dk �sn| d)k�r�ttjd(|| f ��q�|d*k�r�t|��r�t|�d+k�r�ttjd,|| f ��q�ttjd| ��q�d S )-NZipv4�family�inet6Zipv6zhash:zipset type '%s' not usable� �,� z)entry '%s' does not match ipset type '%s'�ipr" z invalid address '%s' in '%s'[%d]� z.invalid address range '%s' in '%s' for %s (%s)z(invalid address '%s' in '%s' for %s (%s)z0.0.0.0r �netz/0zhash:net,ifaceZmacz00:00:00:00:00:00z invalid mac address '%s' in '%s'�portr# zinvalid port '%s'Zicmpz(invalid protocol for family '%s' in '%s'z invalid icmp type '%s' in '%s')Zicmpv6z ipv6-icmpz invalid icmpv6 type '%s' in '%s')ZtcpZsctpZudpZudplitez invalid protocol '%s' in '%s'zinvalid port '%s'in '%s'zinvalid port '%s' in '%s'Zmark�0x� zinvalid mark '%s' in '%s'l �� Ziface� z invalid interface '%s' in '%s')� startswithr r � INVALID_IPSET�split�lenZ INVALID_ENTRY� enumerater r r r �endswithr r r r r r r �int� ValueErrorr ) r( r Z ipset_typer6 �flags�items�i�flag�itemZsplitsZ_splitZip_checkZint_valr2 r2 r3 � check_entryV s� � �� �� ���� �� �� �� ��� ���� ��� � ���� �� � � �� � �� �� � �� ���� � � � � ��zIPSet.check_entryc C s� |dkr |t vr ttjd| ��|dkr�|�� D ]�}|tvrLttjd| ��|dv r�zt|| �}W n* ty� ttj d||| f ��Y n0 |dk r�ttj d||| f ��q0|d kr0|| d vr0ttj || ��q0d S ) Nr z '%s' is not valid ipset typer zipset invalid option '%s'��timeout�hashsize�maxelem�)Option '%s': Value '%s' is not an integerr �#Option '%s': Value '%s' is negativer6 �Zinetr7 ) r r r � INVALID_TYPE�keysr rC rH rI � INVALID_VALUE�INVALID_FAMILY)r/ r rN Z all_config�all_io_objects�key� int_valuer2 r2 r3 � _check_config s@ � � �� �� �zIPSet._check_configc sp d|d v r6|d d dkr6t |d �dkr6ttj��|d D ]}t�||d |d � q>tt| ��||� d S )NrQ � �0r8 r � )rE r r ZIPSET_WITH_TIMEOUTr rO r+ � import_config)r/ r r[ r( r0 r2 r3 rb & s zIPSet.import_config)�__name__� __module__� __qualname__ZIMPORT_EXPORT_STRUCTUREZDBUS_SIGNATUREZADDITIONAL_ALNUM_CHARSZ PARSER_REQUIRED_ELEMENT_ATTRSZ PARSER_OPTIONAL_ELEMENT_ATTRSr, r5 � staticmethodrO r^ rb � __classcell__r2 r2 r0 r3 r , s2 ��� 5r c @ s e Zd Zdd� Zdd� ZdS )�ipset_ContentHandlerc C s� t �| ||� | j�||� |dkrpd|v rX|d tvrLttjd|d ��|d | j_d|v rl|d | j_ �nt|dkr|�nh|dkr��n\|dk�r�d}d |v r�|d }|d d vr�ttj d |d ��| jjd kr�|d dv r�ttj d|d | jjf ��|d d v �r"|�s"ttj d|d ��|d dv �r�z t |�}W n, t �yh ttj d|d |f ��Y n0 |dk �r�ttj d|d |f ��|d dk�r�|dv�r�ttj|��|d | jjv�r�|| jj|d < nt�d|d � d S )Nr& r z%sr r r r' r r) r% )r6 rQ rR rS zUnknown option '%s'zhash:mac)r6 z%Unsupported option '%s' for type '%s'z&Missing mandatory value of option '%s'rP rT r rU r6 rV z Option %s already set, ignoring.)r � startElementrN Zparser_check_element_attrsr r r rW r r ZINVALID_OPTIONrH rI rY rZ r r �warning)r/ r% �attrsr) r] r2 r2 r3 ri 1 sx � ���� � �� �� z!ipset_ContentHandler.startElementc C s( t �| |� |dkr$| jj�| j� d S )Nr( )r � endElementrN r �appendZ_element)r/ r% r2 r2 r3 rl h s z ipset_ContentHandler.endElementN)rc rd re ri rl r2 r2 r2 r3 rh 0 s 7rh c C s& t � }| �d�s ttjd| ��| d d� |_|�|j� | |_||_|� t j �rVdnd|_ |j |_ t|�}t�� }|�|� d|| f }t|d��n}t�d �}|�|� z|�|� W n: tjy� } z ttjd|�� ��W Y d }~n d }~0 0 W d � n1 �s 0 Y ~~d |jv �r^|jd d k�r^t|j�d k�r^t � d |j� |jd d �= d } t � } | t|j�k �r |j| | v �r�t � d |j| � |j� | � ntz |� |j| |j|j!� W n> t�y } z$t � d| � |j� | � W Y d } ~ n"d } ~ 0 0 | �"|j| � | d7 } �qh~ |S )Nz.xmlz'%s' is missing .xml suffix���FT�%s/%s�rbznot a valid ipset file: %srQ r` r z6ipset '%s': timeout option is set, entries are ignoredz Entry %s already set, ignoring.z %s, ignoring.r: )#r rG r r Z INVALID_NAMEr% Z check_name�filename�pathrB r � ETC_FIREWALLDZbuiltin�defaultrh �saxZ make_parserZsetContentHandler�openZ InputSourceZ setByteStream�parseZSAXParseExceptionrC Z getExceptionr rE r r rj �set�poprO r �add) rq rr r& �handler�parserr% �f�source�msgrL Z entries_set�er2 r2 r3 r m sd � ��: �� " r c C s� |r|n| j }| jr$d|| jf }nd|| jf }tj �|�r�zt�|d| � W n2 ty� } zt� d||� W Y d }~n d }~0 0 tj � |�}|� t j �r�tj �|�s�tj �t j �s�t�t j d� t�|d� tj|ddd�}t|�}|�� d | ji}| j�r| jd k�r| j|d < |�d |� |�d � | j�rz| jd k�rz|�d� |�di � |�| j� |�d� |�d � | j�r�| jd k�r�|�d� |�di � |�| j� |�d� |�d � | j� � D ]L\} } |�d� | d k�r�|� d| | d�� n|� dd| i� |�d � �q�| j D ]:} |�d� |�di � |�| � |�d� |�d � �q"|�d � |�d � |� � |� � ~d S )Nro z %s/%s.xmlz%s.oldz Backup of file '%s' failed: %si� ZwtzUTF-8)�mode�encodingr r r r& � z r r r' )r% r) r% r( )!rr rq r% �os�exists�shutil�copy2� Exceptionr �error�dirnamerB r rs �mkdir�iorv r Z startDocumentr r ri ZignorableWhitespacer Z charactersrl r r rK Z simpleElementr Z endDocument�close) r& rr �_pathr% r �dirpathr} r{ rk r\ r) r( r2 r2 r3 r � sf $ r )N)'�__doc__�__all__Zxml.saxru r� r� r� Zfirewallr Zfirewall.functionsr r r r r r r r Zfirewall.core.io.io_objectr r r Zfirewall.core.ipsetr r Zfirewall.core.icmpr r r r Zfirewall.core.loggerr r Zfirewall.errorsr r rh r r r2 r2 r2 r3 �<module> s& ( =3 core/io/__pycache__/policy.cpython-39.pyc 0000644 00000056722 15025011705 0014253 0 ustar 00 a ���g� � @ s g d �Z ddlmZ ddlZddlZddlZddlmZ ddlm Z m Z m Z m Z m Z mZmZmZ ddlmZmZmZ ddlmZmZmZmZmZmZ ddl m Z ddl m Z dd lm Z dd l!m"Z" d d � Z#d d� Z$dd� Z%dd� Z&G dd� de�Z'G dd� de�Z(d dd�Z)d dd�Z*dS ) )�Policy� policy_reader� policy_writer� N)�config)�checkIP�checkIP6� checkUINT16�coalescePortRange�max_policy_name_len�portInPortRange�portStr�uniqify)�DEFAULT_POLICY_TARGET�POLICY_TARGETS�DEFAULT_POLICY_PRIORITY)� IO_Object�IO_Object_ContentHandler�IO_Object_XMLGenerator� check_port� check_tcpudp�check_protocol)�rich)�log)�errors)� FirewallErrorc s� |dkr � n�|dkr� n�|dkr�| j r`| j jrJt�dt| j �� d| _dS t�� d �| j _dS � d | jj vr�| jj � � d � nt�d� d � � n<|dk�r| j r�| j jr�t�dt| j �� d| _dS t� � d � d �| j _dS t � d � t � d � t� d d �� d f}tt� fd d �| jj��}|D ]b}t|d |d ��r4t| jt��rb| jjn| jj}t�ttjd|d � d |f �� � qԐq4t|d dd� |D ��\}}|D ]&} t| d �� d f} | jj�| � �q�|D ]&} t| d �� d f} | jj� | � �q� n�|d k�r�| j �r\| j j�rHt�dt| j �� d| _dS t� � d �| j _nBt � d � � d | jj v�r�| jj � � d � nt�d� d � � n2|dk�r<| j �r| j j�r�t�dt| j �� d| _dS d} d� v �r�� d dv�r�� d } t� | �| j _n*d} d� v �r,d� d � d�} t�d| � �n�|dk�r�| j �r�| j j�rtt�dt| j �� d| _dS t� � d �| j _dS � d | jj!v�r�| jj!� � d � nt�d� d � �n|d k�r&| j �r| j j�r�t�dt| j �� d| _dS t�"� d �| j _dS t�d � d � �n�|d k�r�| j �rl| j j�r^t�dt| j �� d| _dS t�#� | j _n | jj$�r�t�d � nd| j_$�nF|d k�r�d} d!� v �r�� d! } d}d"� v �rĈ d" }| j �r| j j�r�t�dt| j �� d| _dS t�%� d � d | |�| j _dS t � d � t � d � | �r8t | � |�rbt&|��sbt'|��sbttj(d#| ��t� d d �� d t| d �t|�f} | | jj)v�r�| jj)� | � n6t�d$� d � d | �r�d%| nd|�r�d&| nd� �n�|d'k�rZ| j �r2| j j�rt�dt| j �� d| _dS t�*� d � d �| j _dS t � d � t � d � t� d d �� d f}tt� fd(d �| jj+��}|D ]b}t|d |d ��r~t| jt��r�| jjn| jj}t�ttjd|d � d |f �� � qԐq~t|d d)d� |D ��\}}|D ]&} t| d �� d f} | jj+�| � �q|D ]&} t| d �� d f} | jj+� | � �q.�nz|d*k�r| j �s�t�d+� d| _dS | j j,�r�t�d,t| j �� dS d-}d }d.� v �r�� d. }d }d/� v �rЈ d/ }d0� v �r� d0 �-� d1v �r�d}t�.|||�| j _,�n�|d2v �r�| j �s,t�d3� d| _dS | j j/�rJt�d4� d| _dS |d5k�rbt�0� | j _/nh|d6k�r�d }d7� v �r�� d7 }t�1|�| j _/n8|d8k�r�t�2� | j _/n |d9k�rʈ d: }t�3|�| j _/| j j/| _4�n�|d;k� r�| j �s�t�d<� dS | j j� rt�d=� dS d }d>� v � rD� d> }|d?v� rDt�d@� d| _dS d }dA� v � r�� dA }|� rnt5|�dBk� r�t�dC� d| _dS t�6||�| j _| j j| _4�n4|dDk� r�| j � s�t�d<� dS | j j� r�t�d=� dS d }dE� v � r � dE }t7|�� s t�dF� d| _dS d }dA� v � rJ� dA }|� r6t5|�dBk� rJt�dG� d| _dS d }dH� v � r~� dH }t7|�� s~t�dI� d| _dS t�8|||�| j _| j j| _4�n6|dJk� r�| j � s�t�dK� dS | j j9� r�t�dLt| j �� d| _dS t�:� | j _9| j j9| _4n�|dMk� rld }d }dN� v � rD� dN }|dOv� rDt�dP� dN � d| _dS dQ� v � rZt;� dQ �}tj<||dR�| _ nh|dSk� r�| j4� s�t�dT� d| _dS | j4j=� r�t�dUt| j �� d| _dS � d }t�>|�| j4_=nd-S dS )VN�short� description�servicez;Invalid rule: More than one element in rule '%s', ignoring.T�namez#Service '%s' already set, ignoring.�port�protocol�-c s | d � d kS �N� r � ��x��attrsr$ �;/usr/lib/python3.9/site-packages/firewall/core/io/policy.py�<lambda>E � z%common_startElement.<locals>.<lambda>r z'%s:%s' already in '%s'c S s g | ] \}}|�qS r$ r$ ��.0Z_portZ _protocolr$ r$ r) � <listcomp>O r+ z'common_startElement.<locals>.<listcomp>�valuez$Protocol '%s' already set, ignoring.� tcp-mss-clamp�pmtu)N�None� z (value='z)'z-Invalid rule: tcp-mss-clamp%s outside of rule� icmp-blockz&icmp-block '%s' already set, ignoring.� icmp-typez-Invalid rule: icmp-block '%s' outside of rule� masqueradez!Masquerade already set, ignoring.� forward-port�to-port�to-addrz#to-addr '%s' is not a valid addressz-Forward port %s/%s%s%s already set, ignoring.z >%sz @%s� source-portc s | d � d kS r" r$ r% r' r$ r) r* � r+ c S s g | ] \}}|�qS r$ r$ r, r$ r$ r) r. � r+ � destinationz)Invalid rule: Destination outside of rulez?Invalid rule: More than one destination in rule '%s', ignoring.F�address�ipset�invert�Zyes�true)�accept�reject�drop�markz$Invalid rule: Action outside of rulez"Invalid rule: More than one actionrA rB �typerC rD �setr z!Invalid rule: Log outside of rulez Invalid rule: More than one log�level)ZemergZalertZcrit�error�warningZnotice�info�debugz Invalid rule: Invalid log level�prefix� z Invalid rule: Invalid log prefix�nflog�groupz'Invalid rule: Invalid nflog group valuez"Invalid rule: Invalid nflog prefix� queue-sizez&Invalid rule: Invalid nflog queue-size�auditz#Invalid rule: Audit outside of rulez9Invalid rule: More than one audit in rule '%s', ignoring.�rule�family)Zipv4Zipv6z&Invalid rule: Rule family "%s" invalid�priority)rS rT �limitz4Invalid rule: Limit outside of action, log and auditz9Invalid rule: More than one limit in rule '%s', ignoring.)?�_rule�elementr rI �str� _rule_errorr � Rich_Service�item�services�append� Rich_Portr r r �list�filter�portsr � isinstancer �derived_from_zoner r r ZALREADY_ENABLEDr �remove� Rich_Protocolr � protocols�Rich_Tcp_Mss_Clamp�Rich_IcmpBlock� icmp_blocks� Rich_IcmpType�Rich_Masquerader6 �Rich_ForwardPortr r � INVALID_ADDR� forward_ports�Rich_SourcePort� source_portsr; �lowerZRich_Destination�action� Rich_Accept� Rich_Reject� Rich_Drop� Rich_Mark� _limit_ok�len�Rich_Logr Z Rich_NFLogrQ Z Rich_Audit�int� Rich_RulerU Z Rich_Limit)�objr r( Z new_port_idZexisting_port_idsZport_id�_nameZ added_rangesZremoved_rangesZ_range�entry�_value�s�to_portZto_addrr> r< r= Z_typeZ_setrG rL rO � thresholdrS rT r/ r$ r' r) �common_startElement! s� �� � � � � � � �� �� � � � ��� � � � � � �� � � �r� c C s� |dkr�| j s�z| j�� W n8 tyT } z t�d|t| j�� W Y d }~nTd }~0 0 t| j�| jjvr�| jj � | j� | jj� t| j�� nt�dt| j�� d | _d| _ n|dv r�d | _ d S )NrR z%s: %sz Rule '%s' already set, ignoring.F)rA rB rC rD r rQ ) rY rV �check� Exceptionr rI rX r[ � rules_str�rulesr] rw )r| r �er$ r$ r) �common_endElement| s *�r� c C s� t | t�rdnd}|dkrXd|v rX|d }|D ]$}||vr.ttjd�|| j|���q.�nJ|dkr�|D ] }t|d � t|d � qd�n |dkr�|D ] } t | � q��n�|d k�r d |v �r |d } |D ]T} | | vr�ttj d �|| j| ��} | |� d i �� d i �v �rt � d�| �� q�| �qĐn�|dk�r�|D ]�} t| d � t| d � | d �st| d �stttjd�|| j| ���| d �r�t| d � | d �r,t| d ��s,t| d ��s,ttjd�|| j| d ����q,�n�|dk�r|D ] }t|d � t|d � �q�n�|dv �r�|D �]�}tj|d�}|j�r`d |v �r`t |jtj��sXt |jtj��r`|d } |jj| v�r�ttj d �|| j|jj��} |jj|� d i �� d i �v �r�t � d�| �� n| �n�|j�r�|d |jj }|j�r�|j|jv�r�ttj d�|| j|j|jj��} |� d i �� d i �� |jj�}|�rZ|j�rZ|j|jv �rZt � d�| �� n| �n>t |jtj��r|jj|d v�rttjd�|| j|jj����qd S )Nr ZZoner\ z){} '{}': '{}' not among existing servicesra r r# rf ri Z icmptypesz+{} '{}': '{}' not among existing ICMP typesZruntimeZicmptypes_unsupportedz{} (unsupported)rn � � z-{} '{}': '{}' is missing to-port AND to-addr z,{} '{}': to-addr '{}' is not a valid addressrp )r� � rich_rules�Zrule_strz<{} '{}': rich rule family '{}' conflicts with icmp type '{}')rb r r r ZINVALID_SERVICE�formatr r r r ZINVALID_ICMPTYPE�getr Zdebug1�INVALID_FORWARDr r rm r r{ rW rh rj rS r; rZ )r| r r[ � all_config�all_io_objectsZobj_typeZexisting_servicesr r �protoZexisting_icmptypesZicmptype�ex�fwd_portrR Zobj_richZictZict_unsupportedr$ r$ r) �common_check_config� s� �� �� �� �� � � �� �� � ��r� c C s� | j rF| j dkrF|�d� |�di � |�| j � |�d� |�d� | jr�| jdkr�|�d� |�di � |�| j� |�d� |�d� t| j�D ](}|�d� |�dd|i� |�d� q�t| j �D ]2}|�d� |�d|d |d d �� |�d� q�t| j �D ]*}|�d� |�d d |i� |�d� �qt| j �D ]*}|�d� |�dd|i� |�d� �q>| j �r�|�d� |�di � |�d� t| j �D ]�}|�d� |d |d d �}|d �r�|d dk�r�|d |d< |d �r|d dk�r|d |d< |�d|� |�d� �q�t| j�D ]4}|�d� |�d|d |d d �� |�d� �q(| jD �]n}i }|j�r�|j|d< |jd k�r�t|j�|d< |�d� |�d|� |�d� |j�r:i }|jj�r�|jj|d< |jj�r�|jj|d< |jj�r|jj|d< |jj�rd |d < |�d � |�d |� |�d� |j�r�i }|jj�r\|jj|d< |jj�rr|jj|d< |jj�r�d |d < |�d � |�d |� |�d� |j�r�d} i }t|j�tj k�r�d} |jj |d< �n�t|j�tj k�r d} |jj |d< |jj |d < �nnt|j�tj!k�r2d } |jj"|d < �nHt|j�tj#k�rpd!} |jj"�rz|jj"d"k�rz|jj"|d < �n t|j�tj$k�r�d} n�t|j�tj%k�r�d} |jj |d< n�t|j�tj&k�r�d#} |jj |d< n�t|j�tj'k�r4d} |jj |d< |jj |d < |jj(dk�r|jj(|d< |jj)dk�rz|jj)|d< nFt|j�tj*k�rdd} |jj |d< |jj |d < nt+t,j-d$t|j� ��|�d � |�| |� |�d� |j.�rt|j.�tj/k�r\i }|j.j0�r�|j.j0|d%< |j.j1�r�|j.j1|d&< |j.j2�r:|�d � |�d'|� |�d(� |�d)d |j.j2j"i� |�d*� |�d'� n|�d � |�d'|� |�d� n�i }|j.j3�rv|j.j3|d+< |j.j0�r�|j.j0|d%< |j.j4�r�|j.j4|d,< |j.j2�r�|�d � |�d-|� |�d(� |�d)d |j.j2j"i� |�d*� |�d-� n|�d � |�d-|� |�d� |j5�r�i }|j5j2�rz|�d � |�d.i � |�d(� |�d)d |j5j2j"i� |�d*� |�d.� n|�d � |�d.|� |�d� |j6�r�d} i }t|j6�tj7k�r�d/} n|t|j6�tj8k�r�d0} |j6j�r>|j6j|d1< nNt|j6�tj9k�rd2} n6t|j6�tj:k�r,d3} |j6j;|d4< nt.�<d5t|j6�� |j6j2�r�|�d � |�| |� |�d(� |�d)d |j6j2j"i� |�d*� |�| � n|�d � |�| |� |�d� |�d� |�d� |�d� �qdd S )6Nr3 � r � r r r r r r# )r r r r/ r4 r6 r� r8 r� r9 r7 r: rS rT rR r< �macr= �Truer> z �sourcer; r0 r1 r5 z"Unknown element '%s' in obj_writerrL rG r z rU z rO rP rN rQ rA rB rE rC rD rF zUnknown action '%s')=r �ignorableWhitespace� startElementZ characters� endElementr r r\ � simpleElementra rf ri r6 rn rp r� rS rT rX r� �addrr� r= r> r; rW rE r rZ r r^ r r re r/ rg rk rh rj rl r� � to_addressro r r ZINVALID_OBJECTr ry rL rG rU rO r� rQ rr rs rt ru rv rF rI ) r| �handlerr r r ZicmpZforwardr( rR rW rr r$ r$ r) � common_writer� s� � � � � � � r� c sN e Zd ZdZdZeZdgZdddddd gfd d gfd d gfd ddgfdd gfdd gfdd gfddd gfdd gffZg d�Z dddgdgddgdgdgdddgdddd gddgddddddd gd gdgdgd �Z d d gd!d"gd#d gg d$�g d%�d&d'gg d(�d)gd gd*� Z � fd+d,�Z d-d.� Z � fd/d0�Z� fd1d2�Zd3d4� Z� fd5d6�Z� ZS )7r i ���i� r )�versionr3 )r r3 )r r3 )�targetr3 r\ r3 ra )r3 r3 ri )r6 Frn )r3 r3 r3 r3 r� rf rp )rT r � ingress_zones� egress_zones)�_r! �/Nr� r r r r/ rF )r r �policyr r r4 r5 r6 r7 rR r� r; r r: r rN rQ rA rB rC rD rU � ingress-zone� egress-zoner� rT r8 r9 rS )r< r� r> rS r= )r< r> r= rL rG )rO rL rP rE ) r� r7 rR r� r; r rN rB r0 c s� t t| ��� d| _d| _d| _t| _g | _g | _ g | _ g | _ d| _ d| _ g | _g | _g | _g | _d| _| j| _d | _g | _g | _d S �Nr3 F)�superr �__init__r� r r r r� r\ ra rf ri �icmp_block_inversionr6 rn rp r� r� �applied�priority_defaultrT rc r� r� ��self�� __class__r$ r) r� s( zPolicy.__init__c C s� d| _ d| _d| _t| _| jd d �= | jd d �= | jd d �= | jd d �= d| _ d| _ | j d d �= | j d d �= | j d d �= | jd d �= d| _| j| _| jd d �= | jd d �= d S r� )r� r r r r� r\ ra rf ri r� r6 rn rp r� r� r� r� rT r� r� r� r$ r$ r) �cleanup- s$ zPolicy.cleanupc s" |dkr| j S ttt| �|�S d S )Nr� )r� �getattrr� r �r� r r� r$ r) � __getattr__A s zPolicy.__getattr__c sB |dkr,dd� |D �| _ dd� | j D �| _ntt| ��||� d S )Nr� c S s g | ]}t j|d ��qS )r� )r r{ �r- r� r$ r$ r) r. I r+ z&Policy.__setattr__.<locals>.<listcomp>c S s g | ] }t |��qS r$ )rX r� r$ r$ r) r. K r+ )r� r� r� r � __setattr__)r� r r/ r� r$ r) r� G s zPolicy.__setattr__c C s� t | ||||� | j|d v r2ttjd�| j���|dkr\|tvrXttjd�| j|����n�|dkr�|| jv s�|| j ks�|| j k r�ttj d�| j|| j | j | j����nH|dv �r�dd gt |d � � � }|D ]�}||vr�ttjd �| j|���|d v�rtdd g�t|�@ �s.|d v �rDt|�t|g� �rDttjd �| j|���|d kr�|d k�rnd|v �rnd |d v �s�|dkr�d |v r�d |d v r�ttjd�| j���qΐnL|dk�r�|�r�d|v �r�d |d v �r�ttjd�| j���n�d |v �r�d |d v �rttjd�| j���|d D ]r}|dk�r(�q||d v�rLttjd�| j|���|d �d�dk�r|d | j�rttjd�| j|����q�nb|dk�r|D �]p}tj|d�}|j�r�t|jtj��r�d|v �r�d |d v �r�ttjd�| j���n�d |v �r d |d v �r ttjd�| j���|d D ]r}|dk�r:�q(||d v�r^ttjd�| j|���|d �d�dk�r(|d | j�r(ttjd�| j|����q(�q�|j�r�t|jtj��r�d|v �r d |d v �r�|jj�r�ttjd�| j���n�|d �r |jj�sttjd�| j���d|d v�r |d D ]P}||d v�rVttjd�| j|���|d | j�r.ttjd �| j|����q.n�|j�r�t|jtj��r�d|v �r�|d D ]^}|d v �r��q�||d v�r�ttjd�| j|���|d | j�r�ttjd �| j|����q��q�n�|d k�r�|D ]�} d|v �r d |d v �r\| d �r�ttjd�| j���n�|d �r | d �s�ttjd�| j���d|d v�r |d D ]P}||d v�r�ttjd�| j|���|d | j�r�ttjd �| j|����q��q d S ) NZzonesz0Policy '{}': Can't have the same name as a zone.r� z#Policy '{}': '{}' is invalid targetrT z^Policy '{}': {} is invalid priority. Must be in range [{}, {}]. The following are reserved: {})r� r� �ANY�HOSTz*Policy '{}': '{}' not among existing zones)r� r� zKPolicy '{}': '{}' may only contain one of: many regular zones, ANY, or HOSTr� r� zSPolicy '{}': 'HOST' can only appear in either ingress or egress zones, but not bothr6 z;Policy '{}': 'masquerade' is invalid for egress zone 'HOST'z<Policy '{}': 'masquerade' is invalid for ingress zone 'HOST'z&Policy '{}': Zone '{}' does not exist.ZconfZFirewallBackendZnftablesz\Policy '{}': 'masquerade' cannot be used because ingress zone '{}' has assigned interfaces. r� r� zNPolicy '{}': A 'forward-port' with 'to-addr' is invalid for egress zone 'HOST'zPPolicy '{}': 'forward-port' requires 'to-addr' if egress zone is 'ANY' or a zonez[Policy '{}': 'forward-port' cannot be used because egress zone '{}' has assigned interfaceszZPolicy '{}': 'mark' action cannot be used because egress zone '{}' has assigned interfacesrn r� ) r� r r r Z NAME_CONFLICTr� r �INVALID_TARGET�priority_reserved� priority_max� priority_minZINVALID_PRIORITYr_ �keysZ INVALID_ZONErF r� Z interfacesr r{ rW rb rk rl r� r� rr rv ) r� r r[ r� r� Zexisting_zones�zonerR r| r� r$ r$ r) � _check_configO s: ���� �� ������ ��� ��� �� �� � �� �� � �� �� �� �� zPolicy._check_configc s� t t| ��|� |�d�r.ttjd�|���n�|�d�rLttjd�|���nl|� d�dkrnttjd�|���nJd|v r�|d |� d�� }n|}t |�t � kr�ttjd�|t |�t � ���d S )Nr� z&Policy '{}': name can't start with '/'z$Policy '{}': name can't end with '/'r# z'Policy '{}': name has more than one '/'z)Policy '{}': name has {} chars, max is {}) r� r � check_name� startswithr r � INVALID_NAMEr� �endswith�count�findrx r )r� r Z checked_namer� r$ r) r� � s, � �� ��zPolicy.check_name)�__name__� __module__� __qualname__r� r� r r� r� ZIMPORT_EXPORT_STRUCTUREZADDITIONAL_ALNUM_CHARSZ PARSER_REQUIRED_ELEMENT_ATTRSZ PARSER_OPTIONAL_ELEMENT_ATTRSr� r� r� r� r� r� � __classcell__r$ r$ r� r) r � s| ��� xr c @ s$ e Zd Zdd� Zdd� Zdd� ZdS )�policy_ContentHandlerc C s" t �| |� d | _d| _d | _d S )NF)r r� rV rY rw )r� r[ r$ r$ r) r� � s z policy_ContentHandler.__init__c C s t �| ||� | jrd S | j�||� t| ||�r6d S |dkr�d|v rR|d | j_d|v rjt|d �| j_d|v r�|d }|t vr�t t j |��|r�|| j_ �n^|dkr�|d | jjvr�| jj�|d � nt�d|d � �n |dk�r |d | jjv�r| jj�|d � nt�d |d � n�|d k�r�| j�sFt�d � d | _d S | jj�rlt�d t| j�� d | _d S d}d|v �r�|d �� dv �r�d }d } }}d|v �r�|d }d|v �r�|d }d|v �r�|d }tj||||d�| j_d S t�d|� d S d S )Nr� r� rT r� r� r z(Ingress zone '%s' already set, ignoring.r� z'Egress zone '%s' already set, ignoring.r� z$Invalid rule: Source outside of ruleTz:Invalid rule: More than one source in rule '%s', ignoring.Fr> r? r< r� r= )r> zUnknown XML element '%s')r r� rY r[ Zparser_check_element_attrsr� r� rz rT r r r r� r� r� r] r rI r� rV r� rX rq r Z Rich_Source)r� r r( r� r> r� r� r= r$ r$ r) r� � sl � � � z"policy_ContentHandler.startElementc C s t �| |� t| |� d S )N)r r� r� r� r$ r$ r) r� % s z policy_ContentHandler.endElementN)r� r� r� r� r� r� r$ r$ r$ r) r� � s @r� Fc C s t � }| �d�s ttjd| ��| d d� |_|s>|�|j� | |_||_|� t j �rZdnd|_ |j |_ t|�}t�� }|�|� d|| f }t|d��n}t�d �}|�|� z|�|� W n: tjy� } z ttjd| �� ��W Y d } ~ n d } ~ 0 0 W d � n1 �s0 Y ~~|S ) Nz.xmlz'%s' is missing .xml suffix���FT�%s/%s�rbznot a valid policy file: %s)r r� r r r� r r� �filename�pathr� r � ETC_FIREWALLDZbuiltin�defaultr� �saxZ make_parserZsetContentHandler�openZ InputSourceZ setByteStream�parseZSAXParseExceptionZINVALID_POLICYZ getException) r� r� Z no_check_namer� r� �parserr �fr� �msgr$ r$ r) r * s< � ��:r c C s� |r|n| j }| jr$d|| jf }nd|| jf }tj �|�r�zt�|d| � W n2 ty� } zt� d||� W Y d }~n d }~0 0 tj � |�}|� t j �r�tj �|�s�tj �t j �s�t�t j d� t�|d� tj|ddd�}t|�}|�� i }| j�r| jd k�r| j|d < | j| jk�r0t| j�|d < | j|d < |�d |� |�d� t| |� t| j �D ]*} |�d� |� dd| i� |�d� �qdt| j �D ]*} |�d� |� dd| i� |�d� �q�|� d � |�d� |� � |�!� ~d S )Nr� z %s/%s.xmlz%s.oldz Backup of file '%s' failed: %si� ZwtzUTF-8)�mode�encodingr3 r� rT r� r� r� r� r� r r� )"r� r� r �os�exists�shutil�copy2r� r rH �dirnamer� r r� �mkdir�ior� r Z startDocumentr� rT r� rX r� r� r� r� r r� r� r� r� Z endDocument�close) r� r� �_pathr r� �dirpathr� r� r( r� r$ r$ r) r G sN $ r )F)N)+�__all__Zxml.saxr� r� r� r� Zfirewallr Zfirewall.functionsr r r r r r r r Zfirewall.core.baser r r Zfirewall.core.io.io_objectr r r r r r Z firewall.corer Zfirewall.core.loggerr r Zfirewall.errorsr r� r� r� r� r r� r r r$ r$ r$ r) �<module> s2 ( ]T w L core/io/__pycache__/helper.cpython-39.pyc 0000644 00000012260 15025011705 0014220 0 ustar 00 a ���g2 � @ s� g d �Z ddlmZ ddlZddlZddlZddlmZ ddlm Z m Z m Z m Z m Z ddlmZ ddlmZ ddlmZ G dd � d e �ZG d d � d e �Zd d � Zddd�ZdS ))�Helper� helper_reader� helper_writer� N)�config)� IO_Object�IO_Object_ContentHandler�IO_Object_XMLGenerator� check_port� check_tcpudp)�log)�errors)� FirewallErrorc sv e Zd ZdddddddgffZdZd d gZd d d gd �Zg d�ddgd�Z� fdd�Zdd� Z dd� Z dd� Z � Z S )r )�version� )�shortr )� descriptionr )�familyr )�moduler �ports)r r z (sssssa(ss))�-�.Nr )r r �helper)�namer r �port�protocol)r r c s6 t t| ��� d| _d| _d| _d| _d| _g | _d S �Nr ) �superr �__init__r r r r r r ��self�� __class__� �;/usr/lib/python3.9/site-packages/firewall/core/io/helper.pyr : s zHelper.__init__c C s. d| _ d| _d| _d| _d| _| jd d �= d S r )r r r r r r r r" r" r# �cleanupC s zHelper.cleanupc C s( ddg}||vr$t tjd||f ��d S )NZipv4Zipv6z'%s' not in '%s')r r Z INVALID_IPV)r ZipvZipvsr" r" r# � check_ipvK s �zHelper.check_ipvc C sv |dkr,|D ] }t |d � t|d � q nF|dkrr|�d�sNttjd| ��t|�dd��dk rrttjd| ��d S ) Nr r � r � nf_conntrack_�('%s' does not start with 'nf_conntrack_'r �Module name '%s' too short)r r � startswithr r �INVALID_MODULE�len�replace)r r �itemZ all_configZall_io_objectsr r" r" r# � _check_configQ s ��zHelper._check_config) �__name__� __module__� __qualname__ZIMPORT_EXPORT_STRUCTUREZDBUS_SIGNATUREZADDITIONAL_ALNUM_CHARSZ PARSER_REQUIRED_ELEMENT_ATTRSZ PARSER_OPTIONAL_ELEMENT_ATTRSr r$ r% r/ � __classcell__r" r" r r# r % s( ��� r c @ s e Zd Zdd� ZdS )�helper_ContentHandlerc C s> t �| ||� | j�||� |dkr�d|v r8|d | j_d|v r\| j�|d � |d | j_d|v r�|d �d�s�tt j d|d ��t |d � dd��dk r�tt j d |d ��|d | j_ nz|d kr�np|d kr�nf|d k�r:t|d � t|d � |d |d f}|| jjv�r$| jj�|� nt�d|d |d � d S )Nr r r r r' r( r r& r) r r r r z#Port '%s/%s' already set, ignoring.)r � startElementr. Zparser_check_element_attrsr r% r r* r r r+ r, r- r r r r �appendr Zwarning)r r �attrs�entryr" r" r# r5 b sF �� � �z"helper_ContentHandler.startElementN)r0 r1 r2 r5 r" r" r" r# r4 a s r4 c C s t � }| �d�s ttjd| ��| d d� |_|�|j� | |_||_|� t j �rVdnd|_ |j |_ t|�}t�� }|�|� d|| f }t|d��n}t�d �}|�|� z|�|� W n: tjy� } z ttjd|�� ��W Y d }~n d }~0 0 W d � n1 �s 0 Y ~~|S ) Nz.xmlz'%s' is missing .xml suffix���FT�%s/%s�rbznot a valid helper file: %s)r �endswithr r Z INVALID_NAMEr Z check_name�filename�pathr* r � ETC_FIREWALLDZbuiltin�defaultr4 �saxZ make_parserZsetContentHandler�openZ InputSourceZ setByteStream�parseZSAXParseExceptionZINVALID_HELPERZ getException) r= r> r �handler�parserr �f�source�msgr" r" r# r � s: � ��:r c C sL |r|n| j }| jr$d|| jf }nd|| jf }tj �|�r�zt�|d| � W n2 ty� } zt� d||� W Y d }~n d }~0 0 tj � |�}|� t j �r�tj �|�s�tj �t j �s�t�t j d� t�|d� tj|ddd�}t|�}|�� i }| j|d < | j�r | jd k�r | j|d < | j�r<| jd k�r<| j|d < |�d |� |�d� | j�r�| jd k�r�|�d� |�di � |�| j� |�d� |�d� | j�r�| jd k�r�|�d� |�di � |�| j� |�d� |�d� | j D ]4} |�d� |� d| d | d d�� |�d� �q�|�d � |�d� |� � |� � ~d S )Nr: z %s/%s.xmlz%s.oldz Backup of file '%s' failed: %si� ZwtzUTF-8)�mode�encodingr r r r r � z r r r r r& )r r ) r> r= r �os�exists�shutil�copy2� Exceptionr �error�dirnamer* r r? �mkdir�iorB r Z startDocumentr r r r5 ZignorableWhitespacer Z charactersZ endElementr r Z simpleElementZ endDocument�close) r r> �_pathr rH �dirpathrF rD r7 r r" r" r# r � s\ $ r )N)�__all__Zxml.saxrA rL rT rN Zfirewallr Zfirewall.core.io.io_objectr r r r r Zfirewall.core.loggerr r Zfirewall.errorsr r r4 r r r" r" r" r# �<module> s <# core/io/__pycache__/functions.cpython-39.opt-1.pyc 0000644 00000005163 15025011705 0015714 0 ustar 00 a ���g� � @ s� d dl Z d dlmZ d dlmZ d dlmZ d dlmZ d dl m Z d dl m Z d dl mZ d d lmZ d d lmZ d d lmZ d d lmZ d d lmZ dd� ZdS )� N)�config)� FirewallError)�FirewallConfig)� zone_reader)�service_reader)� ipset_reader)�icmptype_reader)� helper_reader)� policy_reader)�Direct)�LockdownWhitelist)�firewalld_confc C s t | �}zttj�}|�� W n� tyZ } z$t|jdtj|jf ��W Y d }~nNd }~0 tyj Y n6 t y� } z t dtj|f ��W Y d }~n d }~0 0 |� |� t |j tj tjgd�t|jtjtjgd�t|jtjtjgd�t|jtjtjgd�t|j tj tj gd�t |j tj!tj"gd�d�}|�#� D ]p}|| d D ]\}t$j%�&|��sV�q@t't$�(|��D ]4}|�)d��rd|| d ||�} || d | � �qd�q@�q0|�*� t$j%�+tj,��rTz$t-tj,�} | �� | �.| �/� � W nt t�y } z$t|jdtj,|jf ��W Y d }~n@d }~0 t �yR } z t dtj,|f ��W Y d }~n d }~0 0 t$j%�+tj0��r�z$t1tj0�} | �� | �.| �/� � W nt t�y� } z$t|jdtj0|jf ��W Y d }~n@d }~0 t �y� } z t dtj0|f ��W Y d }~n d }~0 0 d S )Nz'%s': %s)�reader�add�dirs)Zipset�helperZicmptypeZservice�zoneZpolicyr z.xmlr r )2r r r ZFIREWALLD_CONF�readr �code�msg�IOError� ExceptionZset_firewalld_confr Z add_ipsetZFIREWALLD_IPSETSZETC_FIREWALLD_IPSETSr Z add_helperZFIREWALLD_HELPERSZETC_FIREWALLD_HELPERSr Z add_icmptypeZFIREWALLD_ICMPTYPESZETC_FIREWALLD_ICMPTYPESr Z add_serviceZFIREWALLD_SERVICESZETC_FIREWALLD_SERVICESr Zadd_zoneZFIREWALLD_ZONESZETC_FIREWALLD_ZONESr Zadd_policy_objectZFIREWALLD_POLICIESZETC_FIREWALLD_POLICIES�keys�os�path�isdir�sorted�listdir�endswithZfull_check_config�isfileZFIREWALLD_DIRECTr Z check_configZ export_configZLOCKDOWN_WHITELISTr ) �fwZ fw_configZ_firewalld_conf�errorr Zreadersr Z_dir�file�obj� r$ �>/usr/lib/python3.9/site-packages/firewall/core/io/functions.py�check_on_disk_config& s~ , ( � � � � � �� ,( ,r& )r Zfirewallr Zfirewall.errorsr Zfirewall.core.fw_configr Zfirewall.core.io.zoner Zfirewall.core.io.servicer Zfirewall.core.io.ipsetr Zfirewall.core.io.icmptyper Zfirewall.core.io.helperr Zfirewall.core.io.policyr Zfirewall.core.io.directr Z#firewall.core.io.lockdown_whitelistr Z firewall.core.io.firewalld_confr r& r$ r$ r$ r% �<module> s core/io/__pycache__/__init__.cpython-39.pyc 0000644 00000001306 15025011705 0014477 0 ustar 00 a ���g< � @ sj d dl Z de jv rfd dlmZ eed�s<dd� Zeede� d dlmZ eed�sfd d � Z eede � dS ) � NZ_xmlplus)�AttributesImpl� __contains__c C s |t | d�v S )NZ_attrs)�getattr)�self�name� r �=/usr/lib/python3.9/site-packages/firewall/core/io/__init__.py� __AttributesImpl__contains__ s r )� XMLGeneratorZ_writec C s t | d��|� d S )NZ_out)r �write)r �textr r r �__XMLGenerator_write$ s r ) Zxml�__file__Zxml.sax.xmlreaderr �hasattrr �setattrZxml.sax.saxutilsr r r r r r �<module> s core/io/__pycache__/direct.cpython-39.opt-1.pyc 0000644 00000026235 15025011705 0015161 0 ustar 00 a ���g�< � @ s� d dl mZ d dlZd dlZd dlZd dlmZ d dlmZ d dl m Z m Z d dl m Z mZmZ d dlmZ d dlmZ d dlmZ d d lmZ d d lmZ G d d � d e�ZG d d� de �ZdS )� N)�config)�LastUpdatedOrderedDict)� splitArgs�joinArgs)� IO_Object�IO_Object_ContentHandler�IO_Object_XMLGenerator)�log)� ipXtables)�ebtables)�errors)� FirewallErrorc @ s$ e Zd Zdd� Zdd� Zdd� ZdS )�direct_ContentHandlerc C s t �| |� d| _d S )NF)r �__init__�direct)�self�item� r �;/usr/lib/python3.9/site-packages/firewall/core/io/direct.pyr ( s z direct_ContentHandler.__init__c C sf t �| ||� | j�||� |dkr@| jr6ttjd��d| _�n"|dkr�| js\t� d� d S |d }|d }|d }| j� |||� n�|dk�r | js�t� d � d S |d }|d vr�ttj d | ��|d }|d }zt |d �}W n( t �y t� d |d � Y d S 0 ||||g| _nD|dk�rP| j�s>t� d� d S |d }|g| _nt� d| � d S d S )Nr zMore than one direct tag.T�chainz$Parse Error: chain outside of direct�ipv�table�rulez#Parse Error: rule outside of direct��ipv4�ipv6Zebz"'%s' not from {'ipv4'|'ipv6'|'eb'}�priorityz'Parse Error: %s is not a valid priority� passthroughz&Parse Error: command outside of directzUnknown XML element %s)r � startElementr Zparser_check_element_attrsr r r Z PARSE_ERRORr �error� add_chain� INVALID_IPV�int� ValueError�_rule� _passthrough)r �name�attrsr r r r r r r r , sV � �� z"direct_ContentHandler.startElementc C s� t �| |� |dkrN| jr<| j�t| j�� | jj| j� n t� d� d | _n@|dkr�| jr~| j �t| j�� | jj | j � n t� d� d | _ d S )Nr z2Error: rule does not have any arguments, ignoring.r z9Error: passthrough does not have any arguments, ignoring.) r � endElementZ_elementr$ �appendr r �add_ruler r r% �add_passthrough)r r& r r r r( \ s z direct_ContentHandler.endElementN)�__name__� __module__� __qualname__r r r( r r r r r ' s 0r c s6 e Zd ZdZddgfddddddgfgfdddgfgffZdZd g d �g d �d gd �Zi Z� fdd�Zdd� Z dd� Z dd� Z dd� Z dd� Z dd� Zd d � Zd d � Zd d!� Zd"d#� Zd$d%� Zd&d'� Zd(d)� Zd*d+� Zd,d-� Zd.d/� Zd0d1� Zd2d3� Zd4d5� Zd6d7� Z d8d9� Z d:d;� Z d<d=� Z d>d?� Z d@dA� Z!� Z"S )B�Directz Direct class �chains)� r1 r1 �rulesr1 r � passthroughsz(a(sss)a(sssias)a(sas))N�r r r �r r r r r )r r r r c s0 t t| ��� || _t� | _t� | _t� | _d S �N)�superr/ r �filenamer r0 r2 r3 )r r8 �� __class__r r r � s zDirect.__init__c C s d S r6 r )r �confr Zall_conf�all_io_objectsr r r � _check_config� s zDirect._check_configc C s� g }g }| j D ]0}| j | D ] }|�tt|�t|g� �� q q|�|� g }| jD ]D}| j| D ]4}|�t|d |d |d |d t|d �f�� qbqT|�|� g }| jD ]*}| j| D ]}|�t|t|�f�� q�q�|�|� t|�S )Nr � � )r0 r) �tuple�listr2 r3 )r �ret�x�keyr r r r r � export_config� s& � zDirect.export_configc C s� | � � | �|� t| j�D ]l\}\}}|dkrH|| D ]}| j|� q8|dkrh|| D ]}| j|� qX|dkr || D ]}| j|� qxq d S )Nr0 r2 r3 )�cleanupZ check_config� enumerate�IMPORT_EXPORT_STRUCTUREr r* r+ )r r; r< �i�elementZdummyrC r r r � import_config� s zDirect.import_configc C s" | j �� | j�� | j�� d S r6 )r0 �clearr2 r3 �r r r r rF � s zDirect.cleanupc C s� t d� | jD ]*}t d|d |d d�| j| �f � qt d� | jD ]L}t d|d |d |d f � | j| D ] \}}t d |d �|�f � qtqHt d � | jD ]2}t d | � | j| D ]}t d d �|� � q�q�d S )Nr0 z (%s, %s): %sr r> �,r2 z (%s, %s, %s):r? z (%d, ('%s'))z','r3 z %s:z ('%s'))�printr0 �joinr2 r3 )r rD r �argsr r r �output� s � z Direct.outputc C s( g d�}||vr$t tjd||f ��d S )Nr �'%s' not in '%s')r r r! )r r Zipvsr r r � _check_ipv� s �zDirect._check_ipvc C sF | � |� |dv r tj�� ntj�� }||vrBttjd||f ��d S )N)r r rS )rT r ZBUILT_IN_CHAINS�keysr r r Z INVALID_TABLE)r r r Ztablesr r r �_check_ipv_table� s � �zDirect._check_ipv_tablec C sd | � ||� ||f}|| jvr(g | j|< || j| vrH| j| �|� nt�d|||f d � d S )Nz(Chain '%s' for table '%s' with ipv '%s' �already in list, ignoring)rV r0 r) r �warning�r r r r rD r r r r � s ��zDirect.add_chainc C sn | � ||� ||f}|| jv rX|| j| v rX| j| �|� t| j| �dkrj| j|= ntd|||f ��d S )Nr z4Chain '%s' with table '%s' with ipv '%s' not in list)rV r0 �remove�lenr# rY r r r � remove_chain� s ��zDirect.remove_chainc C s, | � ||� ||f}|| jv o*|| j| v S r6 )rV r0 rY r r r � query_chain� s zDirect.query_chainc C s< | � ||� ||f}|| jv r(| j| S td||f ��d S )Nz&No chains for table '%s' with ipv '%s')rV r0 r# )r r r rD r r r � get_chains� s �zDirect.get_chainsc C s | j S r6 )r0 rM r r r �get_all_chains� s zDirect.get_all_chainsc C s� | � ||� |||f}|| jvr,t� | j|< |t|�f}|| j| vrV|| j| |< n*t�dd�|�||f d||f d � d S )N�(Rule '%s' for table '%s' and chain '%s' �',z with ipv '%s' and priority %d rW )rV r2 r r@ r rX rP �r r r r r rQ rD �valuer r r r* s � ��zDirect.add_rulec C s� | � ||� |||f}|t|�f}|| jv rb|| j| v rb| j| |= t| j| �dkr�| j|= n$tdd�|�||f d||f ��d S )Nr r` ra z)with ipv '%s' and priority %d not in list)rV r@ r2 r[ r# rP rb r r r � remove_rule s � �zDirect.remove_rulec C s^ | � ||� |||f}|| jv rZ| j| �� D ]}| j| |= q.t| j| �dkrZ| j|= d S )Nr )rV r2 rU r[ )r r r r rD rc r r r � remove_rules s zDirect.remove_rulesc C s: | � ||� |||f}|t|�f}|| jv o8|| j| v S r6 )rV r@ r2 rb r r r � query_rule' s zDirect.query_rulec C sF | � ||� |||f}|| jv r*| j| S td||f d| ��d S )Nz'No rules for table '%s' and chain '%s' z with ipv '%s')rV r2 r# rY r r r � get_rules- s ��zDirect.get_rulesc C s | j S r6 )r2 rM r r r � get_all_rules6 s zDirect.get_all_rulesc C s^ | � |� || jvr g | j|< || j| vr>| j| �|� n t�dd�|�|f d � d S )N� Passthrough '%s' for ipv '%s'ra rW )rT r3 r) r rX rP �r r rQ r r r r+ ; s ��zDirect.add_passthroughc C sl | � |� || jv rN|| j| v rN| j| �|� t| j| �dkrh| j|= ntdd�|�|f d ��d S )Nr ri ra z not in list)rT r3 rZ r[ r# rP rj r r r �remove_passthroughE s ��zDirect.remove_passthroughc C s" | � |� || jv o || j| v S r6 )rT r3 rj r r r �query_passthroughO s zDirect.query_passthroughc C s. | � |� || jv r | j| S td| ��d S )Nz No passthroughs for ipv '%s')rT r3 r# )r r r r r �get_passthroughsS s zDirect.get_passthroughsc C s | j S r6 )r3 rM r r r �get_all_passthroughsZ s zDirect.get_all_passthroughsc C s� | � � | j�d�s&ttjd| j ��t| �}t�� }|� |� t | jd��n}t� d �}|� |� z|� |� W n: tjy� } z ttjd|�� ��W Y d }~n d }~0 0 W d � n1 s�0 Y d S )Nz.xmlz'%s' is missing .xml suffix�rbzNot a valid file: %s)rF r8 �endswithr r Z INVALID_NAMEr �saxZ make_parserZsetContentHandler�openZ InputSourceZ setByteStream�parseZSAXParseExceptionZ INVALID_TYPEZ getException)r �handler�parser�f�source�msgr r r �read_ s& � ��z Direct.readc C s, t j�| j�r^zt�| jd| j � W n6 ty\ } z td| j|f ��W Y d }~n d }~0 0 t j�tj �szt � tj d� t j | jddd�}t |�}|�� |�di � |�d� | jD ]D}|\}}| j| D ],}|�d � |�d |||d �� |�d� q�q�| jD ]�}|\}}}| j| D ]j\}} t| �d k �r6�q |�d � |�d |||d| d�� |�tj�t| ��� |�d � |�d� �q �q| jD ]n}| j| D ]\} t| �d k �r��q�|�d � |�dd|i� |�tj�t| ��� |�d� |�d� �q��q�|�d� |�d� |�� |� � ~d S )Nz%s.oldzBackup of '%s' failed: %si� ZwtzUTF-8)�mode�encodingr � z r r4 r> r z%dr5 r r ) �os�path�existsr8 �shutil�copy2� Exception�IOErrorr Z ETC_FIREWALLD�mkdir�iorr r Z startDocumentr ZignorableWhitespacer0 Z simpleElementr2 r[ rq Zsaxutils�escaper r( r3 Z endDocument�close) r rx rv rt rD r r r r rQ r r r �writeq s^ ( � � z Direct.write)#r, r- r. �__doc__rH ZDBUS_SIGNATUREZ PARSER_REQUIRED_ELEMENT_ATTRSZ PARSER_OPTIONAL_ELEMENT_ATTRSr r= rE rK rF rR rT rV r r\ r] r^ r_ r* rd re rf rg rh r+ rk rl rm rn ry r� � __classcell__r r r9 r r/ q sL �� r/ )Zxml.saxrq r} r� r� Zfirewallr Zfirewall.fw_typesr Zfirewall.functionsr r Zfirewall.core.io.io_objectr r r Zfirewall.core.loggerr Z firewall.corer r r Zfirewall.errorsr r r/ r r r r �<module> s J core/io/__pycache__/ifcfg.cpython-39.pyc 0000644 00000007675 15025011705 0014035 0 ustar 00 a ���g� � @ sJ d Z dgZddlZddlZddlZddlZddlmZ G dd� de �Z dS )zifcfg file parser�ifcfg� N)�logc @ sL e Zd Zdd� Zdd� Zdd� Zdd� Zd d � Zd d � Zd d� Z dd� Z dS )r c C s i | _ g | _|| _| �� d S �N)�_config�_deleted�filename�clear)�selfr � r �:/usr/lib/python3.9/site-packages/firewall/core/io/ifcfg.py�__init__" s zifcfg.__init__c C s i | _ g | _d S r )r r �r r r r r ( s z ifcfg.clearc C s | j �� d S r )r r r r r r �cleanup, s z ifcfg.cleanupc C s | j �|�� �S r )r �get�strip)r �keyr r r r / s z ifcfg.getc C s0 |� � }|� � | j|< || jv r,| j�|� d S r )r r r �remove)r r �valueZ_keyr r r �set2 s z ifcfg.setc C s8 d}| j �� D ]$\}}|r"|d7 }|d||f 7 }q|S )N� � z%s=%s)r �items)r �sr r r r r �__str__8 s z ifcfg.__str__c C sD | � � zt| jd�}W n6 tyN } z t�d| j|� � W Y d }~n d }~0 0 |D ]�}|sb �q8|�� }t|�dk sT|d dv r�qTdd� |�dd�D �}t|�d kr�qTt|d �d kr�|d � d �r�|d � d �r�|d dd � |d< |d d kr�qTn,| j � |d �d u�r$t� d | j|�� � qT|d | j |d < qT|�� d S )N�rzFailed to load '%s': %s� r )�#�;c S s g | ] }|� � �qS r )r )�.0�xr r r � <listcomp>P � z ifcfg.read.<locals>.<listcomp>�=� �"���r z%%s: Duplicate option definition: '%s')r �openr � Exceptionr �errorr �len�split� startswith�endswithr r Zwarning�close)r �f�msg�lineZpairr r r �readA s8 � � z ifcfg.readc C s� t | j�dk rd S g }z.tjddtj�| j� tj�| j�dd�}W n4 t yx } z t � d| � � W Y d }~n d }~0 0 d}d}zt j | jddd �}W nP t y� } z8tj�| j�r�t � d | j|f � � nd }W Y d }~�njd }~0 0 |D �]X}|s� �qJ|�d �}t |�dk �r,|�sH|�d � d }q�|d dk�rTd}|�|� |�d � q�|�dd�}t |�dk�r�d}|�|d � q�|d �� } |d �� } t | �dk�r�| �d��r�| �d��r�| dd� } | |v�rD| | jv �r| j| | k�rd}|�d| | j| f � d }n$| | jv �r&d }nd}|�|d � |�| � q�d }q�t | j�d k�r�| j�� D ]8\} } | |v �rz�qd|�s�d }|�d| | f � d }�qd|�r�|�� |�� |�s�t�|j� d S tj�| j��r8zt�| jd| j � W nD t �y6 } z*t�|j� t d| j|f ��W Y d }~n d }~0 0 zt� |j| j� W nD t �y� } z*t�|j� t d| j|f ��W Y d }~nd }~0 0 t� | jd� d S )Nr Zwtz%s.F)�mode�prefix�dir�deletez!Failed to open temporary file: %sZrtzUTF-8)r2 �encodingzFailed to open '%s': %sr Tr r r" r# r$ r% z%s=%s z%s.bakzBackup of '%s' failed: %szFailed to create '%s': %si� ) r) r �tempfileZNamedTemporaryFile�os�path�basenamer �dirnamer' r r( �ior& �existsr �writer* r+ r, r �appendr r- r �name�shutil�copy2�IOError�move�chmod) r ZdoneZ temp_filer/ Zmodified�emptyr. r0 �pr r r r r r> ^ s� � �� � ( (z ifcfg.writeN) �__name__� __module__� __qualname__r r r r r r r1 r> r r r r r ! s ) �__doc__�__all__Zos.pathr8 r< r7 rA Zfirewall.core.loggerr �objectr r r r r �<module> s core/io/__pycache__/service.cpython-39.opt-1.pyc 0000644 00000015752 15025011705 0015351 0 ustar 00 a ���g'0 � @ s� g d �Z ddlmZ ddlZddlZddlZddlmZ ddlm Z m Z m Z m Z m Z mZmZ ddlmZ ddlmZ ddlmZ G dd � d e �ZG d d � d e �Zd d � Zddd�ZdS ))�Service�service_reader�service_writer� N)�config)� IO_Object�IO_Object_ContentHandler�IO_Object_XMLGenerator� check_port� check_tcpudp�check_protocol� check_address)�log)�errors)� FirewallErrorc s� e Zd Zdddddgfddgfdddifd dgfd dgfd dgfd dgff Zd dgZdddd�Zddgddgdgdgddgddgdgdgd�Z� fdd�Zd d � Zd d � Z � Z S ) r )�version� )�shortr )� descriptionr �ports)r r �modulesr � destination� protocols� source_ports�includes�helpers�_�-N)r r �service�namer �port�protocol�value�ipv4�ipv6r )r r r �moduler � source-port�include�helperc sN t t| ��� d| _d| _d| _g | _g | _g | _i | _ g | _ g | _ g | _ d S �Nr ) �superr �__init__r r r r r r r r r r ��self�� __class__� �</usr/lib/python3.9/site-packages/firewall/core/io/service.pyr* C s zService.__init__c C sh d| _ d| _d| _| jd d �= | jd d �= | jd d �= | j�� | jd d �= | j d d �= | j d d �= d S r( ) r r r r r r r �clearr r r r+ r/ r/ r0 �cleanupP s zService.cleanupc C sd |dkrH|D ]6}|d dkr6t |d � t|d � q t|d � q �n|dkrd|D ] }t|� qTn�|dkr�|D ] }t |d � t|d � qpn�|dkr�|D ]*}|dvr�ttjd | ��t||| � q�n�|d k�r&|D ]J}|�d ��r |�d d�}d |v �r |�d d �}t |�dk r�ttj |��q�n:|dk�r`|D ]*} | |d v�r4ttj d� | j | ����q4d S )Nr r r � r r r �r" r# z'%s' not in {'ipv4'|'ipv6'}r � nf_conntrack_r r � r Zservicesz.Service '{}': Included service '{}' not found.)r r r r r ZINVALID_DESTINATIONr � startswith�replace�lenZINVALID_MODULE�INVALID_SERVICE�formatr ) r, r �itemZ all_configZall_io_objectsr �protor r$ r& r/ r/ r0 � _check_config\ sL �� ��zService._check_config) �__name__� __module__� __qualname__ZIMPORT_EXPORT_STRUCTUREZADDITIONAL_ALNUM_CHARSZ PARSER_REQUIRED_ELEMENT_ATTRSZ PARSER_OPTIONAL_ELEMENT_ATTRSr* r2 r> � __classcell__r/ r/ r- r0 r % s8 � �� r c @ s e Zd Zdd� ZdS )�service_ContentHandlerc C s, t �| ||� | j�||� |dkrTd|v r<t�d|d � d|v rP|d | j_�n�|dkr`�n�|dkrl�n�|dk�r$|d dkr�t|d � t|d � |d |d f}|| jj vr�| jj � |� nt�d |d |d � nBt |d � |d | jj v�r| jj � |d � nt�d |d � �n|d k�rtt |d � |d | jj v�r`| jj � |d � nt�d |d � �n�|d k�r�t|d � t|d � |d |d f}|| jj v�r�| jj � |� nt�d|d |d � �nJ|dk�r:dD ]J}||v �r�t||| � || jjv �r$t�d|� n|| | jj|< �q�n�|dk�r�|d }|�d��rz|�dd�}d|v �rz|�dd�}|| jjv�r�| jj� |� n t�d|� n�|dk�r�|d | jjv�r�| jj� |d � nt�d|d � n@|dk�r(|d | jjv�r| jj� |d � nt�d|d � d S )Nr r z'Ignoring deprecated attribute name='%s'r r r r r r z#Port '%s/%s' already set, ignoring.z$Protocol '%s' already set, ignoring.r! r% z)SourcePort '%s/%s' already set, ignoring.r r4 z2Destination address for '%s' already set, ignoringr$ r5 r r z"Module '%s' already set, ignoring.r& z#Include '%s' already set, ignoring.r' z"Helper '%s' already set, ignoring.)r � startElementr< Zparser_check_element_attrsr Zwarningr r r r �appendr r r r r r7 r8 r r r )r, r �attrs�entry�xr$ r/ r/ r0 rD � s� � � � � � � � � �z#service_ContentHandler.startElementN)r? r@ rA rD r/ r/ r/ r0 rC � s rC c C s t � }| �d�s ttjd| ��| d d� |_|�|j� | |_||_|� t j �rVdnd|_ |j |_ t|�}t�� }|�|� d|| f }t|d��n}t�d �}|�|� z|�|� W n: tjy� } z ttjd|�� ��W Y d }~n d }~0 0 W d � n1 �s 0 Y ~~|S ) Nz.xmlz'%s' is missing .xml suffix���FT�%s/%s�rbz not a valid service file: %s)r �endswithr r Z INVALID_NAMEr Z check_name�filename�pathr7 r � ETC_FIREWALLDZbuiltin�defaultrC �saxZ make_parserZsetContentHandler�openZ InputSourceZ setByteStream�parseZSAXParseExceptionr: Z getException) rM rN r �handler�parserr �f�source�msgr/ r/ r0 r � s: � ��:r c C sZ |r|n| j }| jr$d|| jf }nd|| jf }tj �|�r�zt�|d| � W n2 ty� } zt� d||� W Y d }~n d }~0 0 tj � |�}|� t j �r�tj �|�s�tj �t j �s�t�t j d� t�|d� tj|ddd�}t|�}|�� i }| j�r| jd k�r| j|d < |�d |� |�d � | j�rt| jd k�rt|�d � |�di � |�| j� |�d� |�d � | j�r�| jd k�r�|�d � |�di � |�| j� |�d� |�d � | jD ]4} |�d � |�d| d | d d�� |�d � �q�| j D ]*} |�d � |�dd| i� |�d � �q | j D ]4} |�d � |�d| d | d d�� |�d � �q2| j D ]*} |�d � |�dd| i� |�d � �qnt | j �dk�r�|�d � |�d| j � |�d � | j!D ]*} |�d � |�dd | i� |�d � �q�| j"D ]*} |�d � |�dd| i� |�d � �q|�d � |�d � |�#� |�$� ~d S ) NrJ z %s/%s.xmlz%s.oldz Backup of file '%s' failed: %si� ZwtzUTF-8)�mode�encodingr r r � z r r r r r3 )r r r r! r% r$ r r r& r' )%rN rM r �os�exists�shutil�copy2� Exceptionr �error�dirnamer7 r rO �mkdir�iorR r Z startDocumentr rD ZignorableWhitespacer Z charactersZ endElementr r Z simpleElementr r r r9 r r r Z endDocument�close)r rN �_pathr rX �dirpathrV rT rF r r r$ r& r' r/ r/ r0 r � s� $ � r )N)�__all__Zxml.saxrQ r\ rd r^ Zfirewallr Zfirewall.core.io.io_objectr r r r r r r Zfirewall.core.loggerr r Zfirewall.errorsr r rC r r r/ r/ r/ r0 �<module> s $ dQ core/io/__pycache__/functions.cpython-39.pyc 0000644 00000005163 15025011705 0014755 0 ustar 00 a ���g� � @ s� d dl Z d dlmZ d dlmZ d dlmZ d dlmZ d dl m Z d dl m Z d dl mZ d d lmZ d d lmZ d d lmZ d d lmZ d d lmZ dd� ZdS )� N)�config)� FirewallError)�FirewallConfig)� zone_reader)�service_reader)� ipset_reader)�icmptype_reader)� helper_reader)� policy_reader)�Direct)�LockdownWhitelist)�firewalld_confc C s t | �}zttj�}|�� W n� tyZ } z$t|jdtj|jf ��W Y d }~nNd }~0 tyj Y n6 t y� } z t dtj|f ��W Y d }~n d }~0 0 |� |� t |j tj tjgd�t|jtjtjgd�t|jtjtjgd�t|jtjtjgd�t|j tj tj gd�t |j tj!tj"gd�d�}|�#� D ]p}|| d D ]\}t$j%�&|��sV�q@t't$�(|��D ]4}|�)d��rd|| d ||�} || d | � �qd�q@�q0|�*� t$j%�+tj,��rTz$t-tj,�} | �� | �.| �/� � W nt t�y } z$t|jdtj,|jf ��W Y d }~n@d }~0 t �yR } z t dtj,|f ��W Y d }~n d }~0 0 t$j%�+tj0��r�z$t1tj0�} | �� | �.| �/� � W nt t�y� } z$t|jdtj0|jf ��W Y d }~n@d }~0 t �y� } z t dtj0|f ��W Y d }~n d }~0 0 d S )Nz'%s': %s)�reader�add�dirs)Zipset�helperZicmptypeZservice�zoneZpolicyr z.xmlr r )2r r r ZFIREWALLD_CONF�readr �code�msg�IOError� ExceptionZset_firewalld_confr Z add_ipsetZFIREWALLD_IPSETSZETC_FIREWALLD_IPSETSr Z add_helperZFIREWALLD_HELPERSZETC_FIREWALLD_HELPERSr Z add_icmptypeZFIREWALLD_ICMPTYPESZETC_FIREWALLD_ICMPTYPESr Z add_serviceZFIREWALLD_SERVICESZETC_FIREWALLD_SERVICESr Zadd_zoneZFIREWALLD_ZONESZETC_FIREWALLD_ZONESr Zadd_policy_objectZFIREWALLD_POLICIESZETC_FIREWALLD_POLICIES�keys�os�path�isdir�sorted�listdir�endswithZfull_check_config�isfileZFIREWALLD_DIRECTr Z check_configZ export_configZLOCKDOWN_WHITELISTr ) �fwZ fw_configZ_firewalld_conf�errorr Zreadersr Z_dir�file�obj� r$ �>/usr/lib/python3.9/site-packages/firewall/core/io/functions.py�check_on_disk_config& s~ , ( � � � � � �� ,( ,r& )r Zfirewallr Zfirewall.errorsr Zfirewall.core.fw_configr Zfirewall.core.io.zoner Zfirewall.core.io.servicer Zfirewall.core.io.ipsetr Zfirewall.core.io.icmptyper Zfirewall.core.io.helperr Zfirewall.core.io.policyr Zfirewall.core.io.directr Z#firewall.core.io.lockdown_whitelistr Z firewall.core.io.firewalld_confr r& r$ r$ r$ r% �<module> s core/io/__pycache__/io_object.cpython-39.opt-1.pyc 0000644 00000023516 15025011705 0015643 0 ustar 00 a ���g�- � @ s� d Z g d�ZddlmZ ddlm mZ ddlZddlmZ ddl m Z ddl m Z ddl m Z G dd � d e�ZG d d � d e�ZG d d � d e�ZG dd� de�ZG dd� dejj�ZG dd� dej�Zdd� Zdd� Zdd� Zdd� Z dS ) z5Generic io_object handler, io specific check methods.)� IO_Object�IO_Object_ContentHandler�IO_Object_XMLGenerator� check_port� check_tcpudp�check_protocol� check_address� N)� OrderedDict)� functions)�errors)� FirewallErrorc @ s� e Zd ZdZdZdZg Zi Zi Zdd� Z dd� Z dd � Z d d � Z d d � Z dd� Zi fdd�Zdd� Zdd� Zdd� Zdd� ZdS )r z; Abstract IO_Object as base for icmptype, service and zone � z()c C s" d| _ d| _d| _d| _d| _d S )N� F)�filename�path�name�defaultZbuiltin��selfr r �>/usr/lib/python3.9/site-packages/firewall/core/io/io_object.py�__init__- s zIO_Object.__init__c C s2 g }| j D ] }|�t�t| |d ��� q t|�S )Nr )�IMPORT_EXPORT_STRUCTURE�append�copy�deepcopy�getattr�tuple)r �ret�xr r r � export_config4 s zIO_Object.export_configc C sT i }t dd� | jD ��}|D ]2}t| |�s:tt| |�t�r t�t| |��||< q |S )Nc S s g | ]}|d |d f�qS �r � r ��.0r r r r � <listcomp>< � z0IO_Object.export_config_dict.<locals>.<listcomp>)�dictr r � isinstance�boolr r )r �conf� type_formats�keyr r r �export_config_dict: s z IO_Object.export_config_dictc C s� | � ||� t| j�D ]z\}\}}t|| t�rzg }t� }|| D ] }||vrB|�|� |�|� qB~t| |t � |�� qt| |t � || �� qd S �N) � check_config� enumerater r' �list�setr �add�setattrr r ) r r) �all_io_objects�i�elementZdummyZ_confZ_setr r r r � import_configB s zIO_Object.import_configc C s| | � ||� |D ]f}t| |�s0ttjd�|���t|| t�r`t| |tt � t � || ���� qt| |t � || �� qd S )Nz-Internal error. '{}' is not a valid attribute) �check_config_dict�hasattrr r Z UNKNOWN_ERROR�formatr' r0 r3 r �fromkeysr r )r r) r4 r+ r r r �import_config_dictR s "z IO_Object.import_config_dictc C st t |t�s(ttjd|td�t|�f ��t|�dk r@ttjd��|D ]*}|�� sD|| j vrDttjd||f ��qDd S )N�'%s' not of type %s, but %sr r! zname can't be emptyz'%s' is not allowed in '%s') r' �strr r � INVALID_TYPE�type�lenZ INVALID_NAME�isalnum�ADDITIONAL_ALNUM_CHARS)r r �charr r r � check_name^ s �� �zIO_Object.check_namec C sh t |�t | j�kr0ttjdt |�t | j�f ��i }t| j�D ]\}\}}|| ||< q>| �||� d S )Nz structure size mismatch %d != %d)rA r r r r? r/ r8 )r r) r4 Z conf_dictr5 r �yr r r r. k s ��zIO_Object.check_configc C sp t dd� | jD ��}|D ]R}|dd� | jD �vrBttjd�|���| �|| || � | �|| |||� qd S )Nc S s g | ]}|d |d f�qS r r r" r r r r$ w r% z/IO_Object.check_config_dict.<locals>.<listcomp>c S s g | ] \}}|�qS r r )r# r rF r r r r$ y r% zoption '{}' is not valid)r& r r r ZINVALID_OPTIONr: �_check_config_structure� _check_config)r r) r4 r* r+ r r r r8 v s zIO_Object.check_config_dictc C s d S r- r )r Zdummy1Zdummy2Zdummy3Zdummy4r r r rH ~ s zIO_Object._check_configc C sT t |t|��s,ttjd|t|�t|�f ��t |t�rnt|�dkrRttjd| ��|D ]}| �||d � qVn�t |t�r�t|�t|�kr�ttjd|t|�f ��t |�D ]\}}| �|| |� q�n�t |t ��rPt|� � �d \}}|� � D ]b\}}t |t|���s"ttjd|t|�t|�f ��t |t|��s�ttjd|t|�t|�f ��q�d S )Nr= r! zlen('%s') != 1r zlen('%s') != %d) r' r@ r r r? r0 rA rG r r/ r& �items) r r) Z structurer r5 �valueZskeyZsvaluer+ r r r rG � sJ �� � �� ����z!IO_Object._check_config_structurec C s� |� � }d}|| jv r`d}| j| d ur`| j| D ],}||v rJ|�|� q2ttjd||f ��q2|| jv r�d}| j| D ]}||v rx|�|� qx|s�ttjd| ��|D ]}ttjd||f ��q�d S )NFTzMissing attribute %s for %szUnexpected element %sz%s: Unexpected attribute %s)ZgetNames� PARSER_REQUIRED_ELEMENT_ATTRS�remover r Z PARSE_ERROR� PARSER_OPTIONAL_ELEMENT_ATTRS)r r �attrsZ_attrs�foundr r r r �parser_check_element_attrs� s2 � � �z$IO_Object.parser_check_element_attrsN)�__name__� __module__� __qualname__�__doc__r ZDBUS_SIGNATURErC rK rM r r r, r7 r< rE r. r8 rH rG rP r r r r r $ s" !r c s$ e Zd Z� fdd�Zdd� Z� ZS )�UnexpectedElementErrorc s t t| ��� || _d S r- )�superrU r r �r r �� __class__r r r � s z UnexpectedElementError.__init__c C s d| j S )NzUnexpected element '%s')r r r r r �__str__� s z UnexpectedElementError.__str__�rQ rR rS r rZ � __classcell__r r rX r rU � s rU c s$ e Zd Z� fdd�Zdd� Z� ZS )�MissingAttributeErrorc s t t| ��� || _|| _d S r- )rV r] r r � attribute�r r r^ rX r r r � s z MissingAttributeError.__init__c C s d| j | jf S )Nz$Element '%s': missing '%s' attribute�r r^ r r r r rZ � s �z MissingAttributeError.__str__r[ r r rX r r] � s r] c s$ e Zd Z� fdd�Zdd� Z� ZS )�UnexpectedAttributeErrorc s t t| ��� || _|| _d S r- )rV ra r r r^ r_ rX r r r � s z!UnexpectedAttributeError.__init__c C s d| j | jf S )Nz'Element '%s': unexpected attribute '%s'r` r r r r rZ � s �z UnexpectedAttributeError.__str__r[ r r rX r ra � s ra c @ s4 e Zd Zdd� Zdd� Zdd� Zdd� Zd d � Zd S ) r c C s || _ d| _d S �Nr )�item�_element)r rc r r r r � s z!IO_Object_ContentHandler.__init__c C s d| _ d S rb �rd r r r r � startDocument� s z&IO_Object_ContentHandler.startDocumentc C s d| _ d S rb re )r r rN r r r � startElement� s z%IO_Object_ContentHandler.startElementc C s* |dkr| j | j_n|dkr&| j | j_d S )N�short� description)rd rc rh ri rW r r r � endElement� s z#IO_Object_ContentHandler.endElementc C s | j |�dd�7 _ d S )N� � )rd �replace)r Zcontentr r r � characters� s z#IO_Object_ContentHandler.charactersN)rQ rR rS r rf rg rj rn r r r r r � s r c @ s e Zd Zdd� Zdd� ZdS )r c C sN t jj�| � |j| _|j| _i g| _| jd | _ g | _ d| _ d| _ d| _ d S )N���zutf-8F)�sax�handler�ContentHandlerr �write�_write�flushZ_flushZ _ns_contextsZ_current_contextZ_undeclared_ns_maps� _encodingZ_pending_start_elementZ_short_empty_elements)r �outr r r r � s z IO_Object_XMLGenerator.__init__c C sF | � d| � |�� D ] \}}| � d|t�|�f � q| � d� dS )z* slightly modified startElement() �<z %s=%sz/>N)rt rI �saxutilsZ quoteattr)r r rN rJ r r r � simpleElement� s z$IO_Object_XMLGenerator.simpleElementN)rQ rR rS r rz r r r r r � s r c C s� t �| �}|dkr$ttjd| ��n`|dkr>ttjd| ��nF|d u rXttjd| ��n,t|�dkr�|d |d kr�ttjd| ��d S ) N���z port number in '%s' is too bigro z'%s' is invalid port rangez port range '%s' is ambiguous� r r! )r Z getPortRanger r Z INVALID_PORTrA )�portZ port_ranger r r r s" ��� �r c C s | dvrt tjd| ��d S )N)ZtcpZudpZsctpZdccpz)'%s' not from {'tcp'|'udp'|'sctp'|'dccp'})r r �INVALID_PROTOCOL�Zprotocolr r r r s ��r c C s t �| �sttj| ��d S r- )r Z checkProtocolr r r~ r r r r r s r c C s$ t �| |�s ttjd|| f ��d S )Nz '%s' is not valid %s address)r r r r Z INVALID_ADDR)Zipv�addrr r r r s �r ) rT �__all__Zxml.saxrp Zxml.sax.saxutilsry r � collectionsr Zfirewallr r Zfirewall.errorsr �objectr � ExceptionrU r] ra rq rr r Z XMLGeneratorr r r r r r r r r �<module> s& core/io/__pycache__/direct.cpython-39.pyc 0000644 00000026235 15025011705 0014222 0 ustar 00 a ���g�< � @ s� d dl mZ d dlZd dlZd dlZd dlmZ d dlmZ d dl m Z m Z d dl m Z mZmZ d dlmZ d dlmZ d dlmZ d d lmZ d d lmZ G d d � d e�ZG d d� de �ZdS )� N)�config)�LastUpdatedOrderedDict)� splitArgs�joinArgs)� IO_Object�IO_Object_ContentHandler�IO_Object_XMLGenerator)�log)� ipXtables)�ebtables)�errors)� FirewallErrorc @ s$ e Zd Zdd� Zdd� Zdd� ZdS )�direct_ContentHandlerc C s t �| |� d| _d S )NF)r �__init__�direct)�self�item� r �;/usr/lib/python3.9/site-packages/firewall/core/io/direct.pyr ( s z direct_ContentHandler.__init__c C sf t �| ||� | j�||� |dkr@| jr6ttjd��d| _�n"|dkr�| js\t� d� d S |d }|d }|d }| j� |||� n�|dk�r | js�t� d � d S |d }|d vr�ttj d | ��|d }|d }zt |d �}W n( t �y t� d |d � Y d S 0 ||||g| _nD|dk�rP| j�s>t� d� d S |d }|g| _nt� d| � d S d S )Nr zMore than one direct tag.T�chainz$Parse Error: chain outside of direct�ipv�table�rulez#Parse Error: rule outside of direct��ipv4�ipv6Zebz"'%s' not from {'ipv4'|'ipv6'|'eb'}�priorityz'Parse Error: %s is not a valid priority� passthroughz&Parse Error: command outside of directzUnknown XML element %s)r � startElementr Zparser_check_element_attrsr r r Z PARSE_ERRORr �error� add_chain� INVALID_IPV�int� ValueError�_rule� _passthrough)r �name�attrsr r r r r r r r , sV � �� z"direct_ContentHandler.startElementc C s� t �| |� |dkrN| jr<| j�t| j�� | jj| j� n t� d� d | _n@|dkr�| jr~| j �t| j�� | jj | j � n t� d� d | _ d S )Nr z2Error: rule does not have any arguments, ignoring.r z9Error: passthrough does not have any arguments, ignoring.) r � endElementZ_elementr$ �appendr r �add_ruler r r% �add_passthrough)r r& r r r r( \ s z direct_ContentHandler.endElementN)�__name__� __module__� __qualname__r r r( r r r r r ' s 0r c s6 e Zd ZdZddgfddddddgfgfdddgfgffZdZd g d �g d �d gd �Zi Z� fdd�Zdd� Z dd� Z dd� Z dd� Z dd� Z dd� Zd d � Zd d � Zd d!� Zd"d#� Zd$d%� Zd&d'� Zd(d)� Zd*d+� Zd,d-� Zd.d/� Zd0d1� Zd2d3� Zd4d5� Zd6d7� Z d8d9� Z d:d;� Z d<d=� Z d>d?� Z d@dA� Z!� Z"S )B�Directz Direct class �chains)� r1 r1 �rulesr1 r � passthroughsz(a(sss)a(sssias)a(sas))N�r r r �r r r r r )r r r r c s0 t t| ��� || _t� | _t� | _t� | _d S �N)�superr/ r �filenamer r0 r2 r3 )r r8 �� __class__r r r � s zDirect.__init__c C s d S r6 r )r �confr Zall_conf�all_io_objectsr r r � _check_config� s zDirect._check_configc C s� g }g }| j D ]0}| j | D ] }|�tt|�t|g� �� q q|�|� g }| jD ]D}| j| D ]4}|�t|d |d |d |d t|d �f�� qbqT|�|� g }| jD ]*}| j| D ]}|�t|t|�f�� q�q�|�|� t|�S )Nr � � )r0 r) �tuple�listr2 r3 )r �ret�x�keyr r r r r � export_config� s& � zDirect.export_configc C s� | � � | �|� t| j�D ]l\}\}}|dkrH|| D ]}| j|� q8|dkrh|| D ]}| j|� qX|dkr || D ]}| j|� qxq d S )Nr0 r2 r3 )�cleanupZ check_config� enumerate�IMPORT_EXPORT_STRUCTUREr r* r+ )r r; r< �i�elementZdummyrC r r r � import_config� s zDirect.import_configc C s" | j �� | j�� | j�� d S r6 )r0 �clearr2 r3 �r r r r rF � s zDirect.cleanupc C s� t d� | jD ]*}t d|d |d d�| j| �f � qt d� | jD ]L}t d|d |d |d f � | j| D ] \}}t d |d �|�f � qtqHt d � | jD ]2}t d | � | j| D ]}t d d �|� � q�q�d S )Nr0 z (%s, %s): %sr r> �,r2 z (%s, %s, %s):r? z (%d, ('%s'))z','r3 z %s:z ('%s'))�printr0 �joinr2 r3 )r rD r �argsr r r �output� s � z Direct.outputc C s( g d�}||vr$t tjd||f ��d S )Nr �'%s' not in '%s')r r r! )r r Zipvsr r r � _check_ipv� s �zDirect._check_ipvc C sF | � |� |dv r tj�� ntj�� }||vrBttjd||f ��d S )N)r r rS )rT r ZBUILT_IN_CHAINS�keysr r r Z INVALID_TABLE)r r r Ztablesr r r �_check_ipv_table� s � �zDirect._check_ipv_tablec C sd | � ||� ||f}|| jvr(g | j|< || j| vrH| j| �|� nt�d|||f d � d S )Nz(Chain '%s' for table '%s' with ipv '%s' �already in list, ignoring)rV r0 r) r �warning�r r r r rD r r r r � s ��zDirect.add_chainc C sn | � ||� ||f}|| jv rX|| j| v rX| j| �|� t| j| �dkrj| j|= ntd|||f ��d S )Nr z4Chain '%s' with table '%s' with ipv '%s' not in list)rV r0 �remove�lenr# rY r r r � remove_chain� s ��zDirect.remove_chainc C s, | � ||� ||f}|| jv o*|| j| v S r6 )rV r0 rY r r r � query_chain� s zDirect.query_chainc C s< | � ||� ||f}|| jv r(| j| S td||f ��d S )Nz&No chains for table '%s' with ipv '%s')rV r0 r# )r r r rD r r r � get_chains� s �zDirect.get_chainsc C s | j S r6 )r0 rM r r r �get_all_chains� s zDirect.get_all_chainsc C s� | � ||� |||f}|| jvr,t� | j|< |t|�f}|| j| vrV|| j| |< n*t�dd�|�||f d||f d � d S )N�(Rule '%s' for table '%s' and chain '%s' �',z with ipv '%s' and priority %d rW )rV r2 r r@ r rX rP �r r r r r rQ rD �valuer r r r* s � ��zDirect.add_rulec C s� | � ||� |||f}|t|�f}|| jv rb|| j| v rb| j| |= t| j| �dkr�| j|= n$tdd�|�||f d||f ��d S )Nr r` ra z)with ipv '%s' and priority %d not in list)rV r@ r2 r[ r# rP rb r r r � remove_rule s � �zDirect.remove_rulec C s^ | � ||� |||f}|| jv rZ| j| �� D ]}| j| |= q.t| j| �dkrZ| j|= d S )Nr )rV r2 rU r[ )r r r r rD rc r r r � remove_rules s zDirect.remove_rulesc C s: | � ||� |||f}|t|�f}|| jv o8|| j| v S r6 )rV r@ r2 rb r r r � query_rule' s zDirect.query_rulec C sF | � ||� |||f}|| jv r*| j| S td||f d| ��d S )Nz'No rules for table '%s' and chain '%s' z with ipv '%s')rV r2 r# rY r r r � get_rules- s ��zDirect.get_rulesc C s | j S r6 )r2 rM r r r � get_all_rules6 s zDirect.get_all_rulesc C s^ | � |� || jvr g | j|< || j| vr>| j| �|� n t�dd�|�|f d � d S )N� Passthrough '%s' for ipv '%s'ra rW )rT r3 r) r rX rP �r r rQ r r r r+ ; s ��zDirect.add_passthroughc C sl | � |� || jv rN|| j| v rN| j| �|� t| j| �dkrh| j|= ntdd�|�|f d ��d S )Nr ri ra z not in list)rT r3 rZ r[ r# rP rj r r r �remove_passthroughE s ��zDirect.remove_passthroughc C s" | � |� || jv o || j| v S r6 )rT r3 rj r r r �query_passthroughO s zDirect.query_passthroughc C s. | � |� || jv r | j| S td| ��d S )Nz No passthroughs for ipv '%s')rT r3 r# )r r r r r �get_passthroughsS s zDirect.get_passthroughsc C s | j S r6 )r3 rM r r r �get_all_passthroughsZ s zDirect.get_all_passthroughsc C s� | � � | j�d�s&ttjd| j ��t| �}t�� }|� |� t | jd��n}t� d �}|� |� z|� |� W n: tjy� } z ttjd|�� ��W Y d }~n d }~0 0 W d � n1 s�0 Y d S )Nz.xmlz'%s' is missing .xml suffix�rbzNot a valid file: %s)rF r8 �endswithr r Z INVALID_NAMEr �saxZ make_parserZsetContentHandler�openZ InputSourceZ setByteStream�parseZSAXParseExceptionZ INVALID_TYPEZ getException)r �handler�parser�f�source�msgr r r �read_ s& � ��z Direct.readc C s, t j�| j�r^zt�| jd| j � W n6 ty\ } z td| j|f ��W Y d }~n d }~0 0 t j�tj �szt � tj d� t j | jddd�}t |�}|�� |�di � |�d� | jD ]D}|\}}| j| D ],}|�d � |�d |||d �� |�d� q�q�| jD ]�}|\}}}| j| D ]j\}} t| �d k �r6�q |�d � |�d |||d| d�� |�tj�t| ��� |�d � |�d� �q �q| jD ]n}| j| D ]\} t| �d k �r��q�|�d � |�dd|i� |�tj�t| ��� |�d� |�d� �q��q�|�d� |�d� |�� |� � ~d S )Nz%s.oldzBackup of '%s' failed: %si� ZwtzUTF-8)�mode�encodingr � z r r4 r> r z%dr5 r r ) �os�path�existsr8 �shutil�copy2� Exception�IOErrorr Z ETC_FIREWALLD�mkdir�iorr r Z startDocumentr ZignorableWhitespacer0 Z simpleElementr2 r[ rq Zsaxutils�escaper r( r3 Z endDocument�close) r rx rv rt rD r r r r rQ r r r �writeq s^ ( � � z Direct.write)#r, r- r. �__doc__rH ZDBUS_SIGNATUREZ PARSER_REQUIRED_ELEMENT_ATTRSZ PARSER_OPTIONAL_ELEMENT_ATTRSr r= rE rK rF rR rT rV r r\ r] r^ r_ r* rd re rf rg rh r+ rk rl rm rn ry r� � __classcell__r r r9 r r/ q sL �� r/ )Zxml.saxrq r} r� r� Zfirewallr Zfirewall.fw_typesr Zfirewall.functionsr r Zfirewall.core.io.io_objectr r r Zfirewall.core.loggerr Z firewall.corer r r Zfirewall.errorsr r r/ r r r r �<module> s J core/io/__pycache__/firewalld_conf.cpython-39.pyc 0000644 00000022256 15025011705 0015725 0 ustar 00 a ���gy? � @ s` d dl Zd dlZd dlZd dlZd dlmZ d dlmZ d dlm Z g d�Z G dd� de �Z dS )� N)�config)�log)�errors)� DefaultZone� MinimalMark� CleanupOnExit�CleanupModulesOnExit�Lockdown� IPv6_rpfilter�IndividualCalls� LogDenied�AutomaticHelpers�FirewallBackend�FlushAllOnReload� RFC3964_IPv4�AllowZoneDrifting� ReloadPolicy�NftablesTableOwnerc @ st e Zd Zdd� Zdd� Zdd� Zdd� Zd d � Zd d � Zd d� Z dd� Z dd� Z dd� Z e dd� �Ze dd� �ZdS )�firewalld_confc C s i | _ g | _|| _| �� d S �N)�_config�_deleted�filename�clear)�selfr � r �C/usr/lib/python3.9/site-packages/firewall/core/io/firewalld_conf.py�__init__& s zfirewalld_conf.__init__c C s i | _ g | _d S r )r r �r r r r r , s zfirewalld_conf.clearc C s | j �� g | _d S r )r r r r r r r �cleanup0 s zfirewalld_conf.cleanupc C s | j �|�� �S r )r �get�strip)r �keyr r r r 4 s zfirewalld_conf.getc C s0 |� � }|� � | j|< || jv r,| j�|� d S r )r! r r �remove)r r" �valueZ_keyr r r �set7 s zfirewalld_conf.setc C s8 d}| j �� D ]$\}}|r"|d7 }|d||f 7 }q|S )N� � z%s=%s)r �items)r �sr" r$ r r r �__str__= s zfirewalld_conf.__str__c C s | � dtj� | � dttj�� | � dtjr0dnd� | � dtjrFdnd� | � dtjr\dnd� | � dtj� | � d tj r�dnd� | � d tj � | � d tj � | � d tj � | � d tj r�dnd� | � dtj� | � dtjr�dnd� | � dtjr�dnd� | � dtj�rdnd� d S )Nr r r �yes�nor r r r r r r r r r r r )r% r � FALLBACK_ZONE�str�FALLBACK_MINIMAL_MARK�FALLBACK_CLEANUP_ON_EXIT� FALLBACK_CLEANUP_MODULES_ON_EXIT�FALLBACK_LOCKDOWN�FALLBACK_IPV6_RPFILTER�FALLBACK_INDIVIDUAL_CALLS�FALLBACK_LOG_DENIED�FALLBACK_AUTOMATIC_HELPERS�FALLBACK_FIREWALL_BACKEND� FALLBACK_FLUSH_ALL_ON_RELOAD�FALLBACK_RELOAD_POLICY�FALLBACK_RFC3964_IPV4� FALLBACK_ALLOW_ZONE_DRIFTINGZ FALLBACK_NFTABLES_TABLE_OWNERr r r r � set_defaultsE s$ �zfirewalld_conf.set_defaultsc C s< | � d�dkr8| � d�dv r8t�tjd| � d�� d���d S )Nr Ziptablesr )z loose-forwardzstrict-forwardzIPv6_rpfilter=z] is incompatible with FirewallBackend=iptables. This is a limitation of the iptables backend.)r r Z FirewallErrorZ INVALID_VALUEr r r r � sanity_checkY s �zfirewalld_conf.sanity_checkc C s� | � � zt| jd�}W n> tyV } z&t�d| j|� | �� � W Y d }~n d }~0 0 |D ]�}|sj �q>|�� }t|�dk s\|d dv r�q\dd� |� d�D �}t|�d kr�t�d |�� � q\nj|d t vr�t�d |�� � q\nJ|d d k�rt�d |�� � q\n(| j � |d �d u�r*t�d|�� � q\|d | j |d < q\|� � | � d��srt�dtj� | �dttj�� | � d�}z t|� W nN ttf�y� |d u�r�t�d|�r�|nd tj� | �dttj�� Y n0 | � d�}|�r�|�� dv�r2|d u�rt�d|�r|nd tj� | �dtj�r,dnd� | � d�}|�rP|�� dv�r�|d u�rtt�d|�rj|nd tj� | �dtj�r�dnd� | � d�}|�r�|�� dv�r�|d u�r�t�d |�r�|nd tj� | �dtj�r�dnd� | � d �}|�r|�� tjv�r8|d u�r*t�d |�r |nd tj � | �d tj � | � d �}|�rV|�� dv�r�|d u�rzt�d |�rp|nd tj � | �d tj �r�dnd� | � d!�}|�r�|tj v�r�|d u�r�t�d"|tj � | �d!ttj �� | � d#�}|�r�|�� tj v�r0|d u�r t�d$|�r|nd tj!� | �d#ttj!�� | � d%�}|�rP|�� tj"v�r�|d u�rtt�d&|�rj|nd tj#� | �d%ttj#�� | � d'�}|�r�|�� dv�r�|d u�r�t�d(|�r�|nd tj$� | �d'ttj$�� | � d)�}z| �%|�}W n2 t�y$ t�d*|tj&� | �d)tj&� Y n0 | � d+�}|�rD|�� dv�rz|d u�rht�d,|�r^|nd tj'� | �d+ttj'�� | � d-�}|�r�|�� dv�r�|d u�r�t�d.|�r�|nd tj(� | �d-tj(�r�dnd� | �)� d S )/N�rzFailed to load '%s': %s� r )�#�;c S s g | ] }|� � �qS r )r! )�.0�xr r r � <listcomp>v � z'firewalld_conf.read.<locals>.<listcomp>�=� z Invalid option definition: '%s'zInvalid option: '%s'r& zMissing value: '%s'z!Duplicate option definition: '%s'r z0DefaultZone is not set, using default value '%s'r z7MinimalMark '%s' is not valid, using default value '%d'r )r, �falser+ �truez7CleanupOnExit '%s' is not valid, using default value %sr+ r, r z>CleanupModulesOnExit '%s' is not valid, using default value %sr )r+ rI r, rH z2Lockdown '%s' is not valid, using default value %sr z7IPv6_rpfilter '%s' is not valid, using default value %sr z9IndividualCalls '%s' is not valid, using default value %sr z3LogDenied '%s' is invalid, using default value '%s'r z:AutomaticHelpers '%s' is not valid, using default value %sr z9FirewallBackend '%s' is not valid, using default value %sr z:FlushAllOnReload '%s' is not valid, using default value %sr z8ReloadPolicy '%s' is not valid, using default value '%s'r z6RFC3964_IPv4 '%s' is not valid, using default value %sr z;AllowZoneDrifting '%s' is not valid, using default value %s)*r �openr � Exceptionr �errorr< r! �len�split� valid_keysr r �closer r- r% r. �int� ValueError� TypeErrorZwarningr/ �lowerr0 r1 r2 ZIPV6_RPFILTER_VALUESr3 r4 ZLOG_DENIED_VALUESr5 ZAUTOMATIC_HELPERS_VALUESr6 ZFIREWALL_BACKEND_VALUESr7 r8 �_parse_reload_policyr9 r: r; r= )r �f�msg�lineZpairr$ r r r �readf s � � � � � � � � � � � � � �zfirewalld_conf.readc C s� t | j�dk rd S g }tj�tj�s2t�tjd� z.tj ddtj� | j � tj� | j �dd�}W n4 t y� } z t�d| � � W Y d }~n d }~0 0 d}d}ztj| j dd d �}W nR t �y } z8tj�| j �r�t�d | j |f � � nd }W Y d }~�n<d }~0 0 |D �]*}|�s �q:|�d �}t |�dk �rL|�s6|�d � d }n�|d dk�rtd}|�|� |�d � n�|�d�}t |�dk�r�d}|�|d � �q |d �� } |d �� } | |v�r2| | jv �r| j| | k�rd}|�d| | j| f � d }n$| | jv �rd }nd}|�|d � |�| � nd }�q t | j�dk�r�| j�� D ]P\} } | |v �rj�qT| dv �rx�qT|�s�|�d � d }|�d| | f � d }�qT|�r�|�� |�� |�s�t�|j� d S tj�| j ��r@zt� | j d| j � W nD t �y> } z*t�|j� t d| j |f ��W Y d }~n d }~0 0 zt� |j| j � W nD t �y� } z*t�|j� t d| j |f ��W Y d }~nd }~0 0 t� | j d� d S )Nr? i� Zwtz%s.F)�mode�prefix�dir�deletez!Failed to open temporary file: %sZrtzUTF-8)rZ �encodingzFailed to open '%s': %sr' Tr r@ rF rG z%s=%s )r r r z%s.oldzBackup of '%s' failed: %szFailed to create '%s': %si� ) rM r �os�path�existsr Z ETC_FIREWALLD�mkdir�tempfileZNamedTemporaryFile�basenamer �dirnamerK r rL �iorJ r! �writerN r �appendr( rP r# �name�shutil�copy2�IOError�move�chmod) r ZdoneZ temp_filerW Zmodified�emptyrV rX �pr" r$ r r r rg s� � � � ( (zfirewalld_conf.writec C s� d}dddd�}| r�| � � } | �� }|dv r@|D ] }|||< q0n�| �dd��d�D ]|}|� � }|sdqR|�dd��dd �}t|�d kr�d }qR|d � � �� }||vr�d }qR|d � � �� }|dvr�d }qR|||< qR|s�td ��|S )NT�DROP)ZINPUTZFORWARDZOUTPUT)ZACCEPTZREJECTrq rA �,rF �:rG Fr r? zInvalid ReloadPolicy)r! �upper�replacerN rM rR )r$ Zvalid�result�v�k�aZa2r r r rU o s> � z#firewalld_conf._parse_reload_policyc C s d� dd� | �� D ��S )Nrr c s s | ]\}}|� d |� �V qdS )rs Nr )rB rx rw r r r � <genexpr>� rE z8firewalld_conf._unparse_reload_policy.<locals>.<genexpr>)�joinr( )r$ r r r �_unparse_reload_policy� s z%firewalld_conf._unparse_reload_policyN)�__name__� __module__� __qualname__r r r r r% r* r< r= rY rg � staticmethodrU r| r r r r r % s j %r ) Zos.pathr_ rf rc rj Zfirewallr Zfirewall.core.loggerr r rO �objectr r r r r �<module> s core/io/__pycache__/lockdown_whitelist.cpython-39.opt-1.pyc 0000644 00000021170 15025011705 0017614 0 ustar 00 a ���g�/ � @ s� d dl mZ d dlZd dlZd dlZd dlmZ d dlmZm Z m Z d dl m Z d dl mZmZmZmZmZ d dlmZ d dlmZ G dd � d e �ZG d d � d e�ZdS ) � N)�config)� IO_Object�IO_Object_ContentHandler�IO_Object_XMLGenerator)�log)�uniqify� checkUser�checkUid� checkCommand� checkContext)�errors)� FirewallErrorc @ s e Zd Zdd� Zdd� ZdS )�!lockdown_whitelist_ContentHandlerc C s t �| |� d| _d S )NF)r �__init__� whitelist)�self�item� r �G/usr/lib/python3.9/site-packages/firewall/core/io/lockdown_whitelist.pyr % s z*lockdown_whitelist_ContentHandler.__init__c C sV t �| ||� | j�||� |dkr@| jr6ttjd��d| _�n|dkrr| js\t� d� d S |d }| j� |� n�|dkr�| js�t� d� d S d |v r�zt |d �}W n& t y� t� d |d � Y d S 0 | j� |� nd|v r�| j�|d � n\|d k�r@| j�st� d � d S d |v�r.t� d� d S | j�|d � nt� d| � d S d S )Nr zMore than one whitelist.T�commandz)Parse Error: command outside of whitelist�name�userz&Parse Error: user outside of whitelist�idz"Parse Error: %s is not a valid uid�selinuxz)Parse Error: selinux outside of whitelist�contextzParse Error: no contextzUnknown XML element %s)r � startElementr Zparser_check_element_attrsr r r Z PARSE_ERRORr �error� add_command�int� ValueError�add_uid�add_user� add_context)r r �attrsr �uidr r r r ) sN � � z.lockdown_whitelist_ContentHandler.startElementN)�__name__� __module__� __qualname__r r r r r r r $ s r c s, e Zd ZdZddgfddgfddgfddgffZdZd gZd d gd d gd �Zddd giZ� fdd�Z dd� Z dd� Z dd� Z dd� Z dd� Zd d � Zd d � Zd d!� Zd"d#� Zd$d%� Zd&d'� Zd(d)� Zd*d+� Zd,d-� Zd.d/� Zd0d1� Zd2d3� Zd4d5� Zd6d7� Z d8d9� Z d:d;� Z d<d=� Z d>d?� Z d@dA� Z!� Z"S )B�LockdownWhitelistz LockdownWhitelist class �commands� �contexts�users�uidsr z (asasasai)�_Nr r )r r r r r r c s6 t t| ��� || _d | _g | _g | _g | _g | _d S �N) �superr( r �filename�parserr) r+ r, r- )r r1 �� __class__r r r m s zLockdownWhitelist.__init__c C s� |dv r,|D ] }| � ||d d� ||� q nv|dkrJt|�s�ttj|��nX|dkrht|�s�ttj|��n:|dkr�t|�s�ttj|��n |dkr�t |�s�ttj |��d S )N�r) r+ r, r- ���r r r r$ ) � _check_configr r r �INVALID_COMMANDr �INVALID_CONTEXTr � INVALID_USERr � INVALID_UID)r r r Z all_configZall_io_objects�xr r r r7 x s z LockdownWhitelist._check_configc C s4 | j d d �= | jd d �= | jd d �= | jd d �= d S r/ r5 �r r r r �cleanup� s zLockdownWhitelist.cleanupc C s@ t |�sttj|��|| jvr,| j�|� nttjd| ��d S )Nz!Command "%s" already in whitelist)r r r r8 r) �append�ALREADY_ENABLED�r r r r r r � s �z LockdownWhitelist.add_commandc C s, || j v r| j �|� nttjd| ��d S )Nz Command "%s" not in whitelist.)r) �remover r � NOT_ENABLEDrA r r r �remove_command� s �z LockdownWhitelist.remove_commandc C s || j v S r/ �r) rA r r r � has_command� s z LockdownWhitelist.has_commandc C sB | j D ]6}|�d�r.|�|d d� �r< dS q||kr dS qdS )N�*r6 TF)r) �endswith� startswith)r r Z_commandr r r � match_command� s z LockdownWhitelist.match_commandc C s | j S r/ rE r= r r r � get_commands� s z LockdownWhitelist.get_commandsc C sD t |�sttjt|���|| jvr0| j�|� nttjd| ��d S )Nz Uid "%s" already in whitelist)r r r r; �strr- r? r@ �r r$ r r r r � s �zLockdownWhitelist.add_uidc C s, || j v r| j �|� nttjd| ��d S )NzUid "%s" not in whitelist.)r- rB r r rC rM r r r � remove_uid� s �z LockdownWhitelist.remove_uidc C s || j v S r/ �r- rM r r r �has_uid� s zLockdownWhitelist.has_uidc C s || j v S r/ rO rM r r r � match_uid� s zLockdownWhitelist.match_uidc C s | j S r/ rO r= r r r �get_uids� s zLockdownWhitelist.get_uidsc C s@ t |�sttj|��|| jvr,| j�|� nttjd| ��d S )Nz User "%s" already in whitelist)r r r r: r, r? r@ �r r r r r r! � s �zLockdownWhitelist.add_userc C s, || j v r| j �|� nttjd| ��d S )NzUser "%s" not in whitelist.)r, rB r r rC rS r r r � remove_user� s �z LockdownWhitelist.remove_userc C s || j v S r/ �r, rS r r r �has_user� s zLockdownWhitelist.has_userc C s || j v S r/ rU rS r r r � match_user� s z LockdownWhitelist.match_userc C s | j S r/ rU r= r r r � get_users� s zLockdownWhitelist.get_usersc C s@ t |�sttj|��|| jvr,| j�|� nttjd| ��d S )Nz!Context "%s" already in whitelist)r r r r9 r+ r? r@ �r r r r r r" s �z LockdownWhitelist.add_contextc C s, || j v r| j �|� nttjd| ��d S )Nz Context "%s" not in whitelist.)r+ rB r r rC rY r r r �remove_context# s �z LockdownWhitelist.remove_contextc C s || j v S r/ �r+ rY r r r � has_context* s z LockdownWhitelist.has_contextc C s || j v S r/ r[ rY r r r � match_context- s z LockdownWhitelist.match_contextc C s | j S r/ r[ r= r r r � get_contexts0 s z LockdownWhitelist.get_contextsc C s� | � � | j�d�s&ttjd| j ��t| �}t�� }|� |� z|� | j� W n: tj y� } z ttj d|� � ��W Y d }~n d }~0 0 ~~d S )Nz.xmlz'%s' is missing .xml suffixzNot a valid file: %s)r> r1 rH r r Z INVALID_NAMEr �saxZ make_parserZsetContentHandler�parseZSAXParseExceptionZ INVALID_TYPEZ getException)r �handlerr2 �msgr r r �read5 s$ � ��zLockdownWhitelist.readc C s� t j�| j�r^zt�| jd| j � W n6 ty\ } z td| j|f ��W Y d }~n d }~0 0 t j�tj �szt � tj d� t j | jddd�}t |�}|�� |�di � |�d� t| j�D ](}|�d � |�d d |i� |�d� q�t| j�D ],}|�d � |�d d t|�i� |�d� q�t| j�D ]*}|�d � |�d d |i� |�d� �q(t| j�D ]*}|�d � |�dd|i� |�d� �q^|�d� |�d� |�� |�� ~d S )Nz%s.oldzBackup of '%s' failed: %si� ZwtzUTF-8)�mode�encodingr � z r r r r r r )�os�path�existsr1 �shutil�copy2� Exception�IOErrorr Z ETC_FIREWALLD�mkdir�io�openr Z startDocumentr ZignorableWhitespacer r) Z simpleElementr- rL r, r+ Z endElementZ endDocument�close)r rb �fra r r$ r r r r r �writeF sB ( zLockdownWhitelist.write)#r% r& r' �__doc__ZIMPORT_EXPORT_STRUCTUREZDBUS_SIGNATUREZADDITIONAL_ALNUM_CHARSZ PARSER_REQUIRED_ELEMENT_ATTRSZ PARSER_OPTIONAL_ELEMENT_ATTRSr r7 r> r rD rF rJ rK r rN rP rQ rR r! rT rV rW rX r" rZ r\ r] r^ rc rs � __classcell__r r r3 r r( V sP ��� 1 r( )Zxml.saxr_ rg ro rj Zfirewallr Zfirewall.core.io.io_objectr r r Zfirewall.core.loggerr Zfirewall.functionsr r r r r r Zfirewall.errorsr r r( r r r r �<module> s 2 core/io/__pycache__/zone.cpython-39.pyc 0000644 00000026225 15025011705 0013722 0 ustar 00 a ���g�I � @ s� g d �Z ddlmZ ddlZddlZddlZddlmZ ddlm Z m Z m Z m Z m Z mZ ddlmZmZ ddlmZmZmZ ddlmZmZmZmZ ddlm Z dd l m Z dd lm Z dd l m!Z! G d d � d e�Z"G dd� de�Z#ddd�Z$ddd�Z%dS ))�Zone� zone_reader� zone_writer� N)�config)� checkIPnMask� checkIP6nMask�checkInterface�uniqify�max_zone_name_len� check_mac)�DEFAULT_ZONE_TARGET� ZONE_TARGETS)� IO_Object�IO_Object_ContentHandler�IO_Object_XMLGenerator)�common_startElement�common_endElement�common_check_config� common_writer)�rich)�log)�errors)� FirewallErrorc sX e Zd ZdZdddddddgfd d gfd dgfd d dgfddgfddgfddgfddgfdd gfddfZg d�Zddddgddgdgdgdddgdgddddgddgddddddd gdgdd �Zg d �d gd d!gd"d#gg d$�g d%�d&d'gg d(�d)gdgd*� Zed+d,� �Z � fd-d.�Z d/d0� Z � fd1d2�Z � fd3d4�Z d5d6� Z� fd7d8�Zd9d:� Z� ZS );r z Zone class )�version� )�shortr )� descriptionr )�UNUSEDF)�targetr �servicesr �ports)r r � icmp_blocks)� masqueradeF� forward_ports)r r r r � interfaces�sources� rules_str� protocols� source_ports)�icmp_block_inversionF)�forwardT)�_�-�/N�name�port�protocol�value�set)r r �zone�servicer/ z icmp-blockz icmp-typer* � forward-port� interface�rule�source� destinationr0 z source-portr �nflog�auditZaccept�rejectZdropZmark�limit�icmp-block-inversion)r. � immutabler r Zenabledzto-portzto-addr�family�priority)�address�mac�invertr@ �ipset)rB rD rE �prefix�level)�grouprF z queue-size�type) r3 r" r5 r7 r8 r9 r r: r< z tcp-mss-clampc C s8 t tj�D ] \}\}}|| kr | S q ttjd��d S )Nz index_of())� enumerater �IMPORT_EXPORT_STRUCTUREr r Z UNKNOWN_ERROR)�element�i�elZdummy� rO �9/usr/lib/python3.9/site-packages/firewall/core/io/zone.py�index_off s z Zone.index_ofc s� t t| ��� d| _d| _d| _d| _t| _g | _ g | _ g | _ g | _ d| _ d| _g | _g | _g | _g | _g | _g | _d| _d| _d| _d S �Nr FT)�superr �__init__r r r r r r r r r' r! r* r" r# r( r$ r% �rulesr& r) �combined�applied��self�� __class__rO rP rT m s* z Zone.__init__c C s� d| _ d| _d| _d| _t| _| jd d �= | jd d �= | jd d �= | j d d �= d| _ d| _ | j d d �= | j d d �= | jd d �= | jd d �= | jd d �= | jd d �= d| _d| _d| _d S rR )r r r r r r r r r' r! r* r" r# r( r$ r% rU r& r) rV rW rX rO rO rP �cleanup� s( z Zone.cleanupc sN |dkr8dd� |D �| _ tt| ��|dd� | j D �� ntt| ��||� d S )Nr& c S s g | ]}t j|d ��qS ))Zrule_str)r Z Rich_Rule��.0�srO rO rP � <listcomp>� � z$Zone.__setattr__.<locals>.<listcomp>c S s g | ] }t |��qS rO )�strr] rO rO rP r` � ra )rU rS r � __setattr__)rY r. r1 rZ rO rP rc � s zZone.__setattr__c s t t| ��� }|d= |S )Nr )rS r �export_config_dict)rY ZconfrZ rO rP rd � s zZone.export_config_dictc C sv t | ||||� | j|d v r2ttjd�| j���|dkr\|tvrXttjd�| j|����n|dkr�|D ]f}t|�s�ttj d�| j|���|d D ]:}|| jkr�q�||d | j v r�ttj d�| j||���q�qhn�|d k�rr|D ]�}t |��s$t |��s$t |��s$|�d ��s$ttjd �| j|���|d D ]B}|| jk�r@�q,||d | jv �r,ttjd �| j||����q,q�d S ) NZpoliciesz0Zone '{}': Can't have the same name as a policy.r z Zone '{}': invalid target '{}'r$ z!Zone '{}': invalid interface '{}'Zzonesz4Zone '{}': interface '{}' already bound to zone '{}'r% �ipset:z Zone '{}': invalid source '{}'z1Zone '{}': source '{}' already bound to zone '{}')r r. r r Z NAME_CONFLICT�formatr �INVALID_TARGETr ZINVALID_INTERFACEr$ r r r � startswith� INVALID_ADDRr% )rY r �itemZ all_configZall_io_objectsr6 r3 r8 rO rO rP � _check_config� sT � � �� �� � ��zZone._check_configc s� t t| ��|� |�d�r.ttjd�|���n�|�d�rLttjd�|���nl|� d�dkrnttjd�|���nJd|v r�|d |� d�� }n|}t |�t � kr�ttjd�|t |�t � ���d S )Nr- z$Zone '{}': name can't start with '/'z"Zone '{}': name can't end with '/'� z%Zone '{}': name has more than one '/'z'Zone '{}': name has {} chars, max is {}) rS r � check_namerh r r � INVALID_NAMErf �endswith�count�find�lenr )rY r. Z checked_namerZ rO rP rm � s, � �� ��zZone.check_namec C s� d| _ d | _d| _d| _d| _|jD ]}|| jvr$| j�|� q$|jD ]}|| jvrF| j�|� qF|jD ]}|| jvrh| j�|� qh|j D ]}|| j vr�| j �|� q�|j D ]}|| j vr�| j �|� q�|j D ]}|| j vr�| j �|� q�|j r�d| _ |j �rd| _ |jD ] }|| jv�r | j�|� �q |jD ] }|| jv�r0| j�|� �q0|jD ]"} | j�| � | j�t| �� �qV|j�r�d| _d S )NTr )rV �filenamer r r r$ �appendr% r r r' r! r* r" r# r( rU r& rb r) ) rY r3 r6 r8 r4 r/ �protoZicmpr* r7 rO rO rP �combine� sL z Zone.combine)�__name__� __module__� __qualname__�__doc__rK ZADDITIONAL_ALNUM_CHARSZ PARSER_REQUIRED_ELEMENT_ATTRSZ PARSER_OPTIONAL_ELEMENT_ATTRS� staticmethodrQ rT r\ rc rd rk rm rv � __classcell__rO rO rZ rP r ( s� ��� % r c @ s$ e Zd Zdd� Zdd� Zdd� ZdS )�zone_ContentHandlerc C s" t �| |� d | _d| _d | _d S )NF)r rT �_rule� _rule_errorZ _limit_ok)rY rj rO rO rP rT s z zone_ContentHandler.__init__c C s� t �| ||� | jrd S | j�||� t| ||�r6d S |dkr�d|v rVt�d|d � d|v rj|d | j_d|v r�t�d|d � d|v r�|d }|t vr�t t j |��|dkr�|t kr�|| j_�n�|d kr�| jjr�t�d � nd | j_�n�|d k�rh| j�rt�d � d | _d S d|v�r.t�d� d | _d S |d | jjv�rT| jj�|d � nt�d|d � �n2|dk�r`| j�r | jj�r�t�dt| j�� d | _d S d}d|v �r�|d �� dv �r�d }d } }}d|v �r�|d }d|v �r�|d }d|v �r|d }tj||||d�| j_d S d|v�rBd|v�rBt�d� d S d|v �rdd|v �rdt�d� d S d|v �r~t�d |d � d|v �r�t�d � d S d|v �r�t|d ��s�t|d ��s�t|d ��s�t t j|d ��d|v �r d |d }|| jj v�r| jj �|� nt�d |d � d|v �r�|d }|| jj v�rN| jj �|� nt�d |d � n:|d k�r�| jj �r�t�d!� nd | j_ nt�d"|� d S d S )#Nr3 r. z'Ignoring deprecated attribute name='%s'r r? z,Ignoring deprecated attribute immutable='%s'r r r* z Forward already set, ignoring.Tr6 z$Invalid rule: interface use in rule.z Invalid interface: Name missing.z%Interface '%s' already set, ignoring.r8 z:Invalid rule: More than one source in rule '%s', ignoring.FrD )Zyes�truerB rC rE )rD z$Invalid source: No address no ipset.z"Invalid source: Address and ipset.r@ z)Ignoring deprecated attribute family='%s'z+Invalid source: Invertion not allowed here.zipset:%sz"Source '%s' already set, ignoring.r> z+Icmp-Block-Inversion already set, ignoring.zUnknown XML element '%s') r � startElementr rj Zparser_check_element_attrsr r Zwarningr r r r rg r r r* r~ r$ rt r8 rb �lowerr Z Rich_Sourcer r r ri r% r) ) rY r. �attrsr rD �addrrC rE �entryrO rO rP r� s� � � � � � � � � � � � z zone_ContentHandler.startElementc C s t �| |� t| |� d S )N)r � endElementr )rY r. rO rO rP r� � s z zone_ContentHandler.endElementN)rw rx ry rT r� r� rO rO rO rP r} s pr} Fc C s& t � }| �d�s ttjd| ��| d d� |_|s>|�|j� | |_||_|� t j �rZdnd|_ |j |_ d|_t|�}t�� }|�|� d|| f }t|d��n}t�d �}|�|� z|�|� W n: tjy� } z ttjd| �� ��W Y d } ~ n d } ~ 0 0 W d � n1 �s0 Y ~~|S ) Nz.xmlz'%s' is missing .xml suffix���FT�%s/%s�rbznot a valid zone file: %s)r ro r r rn r. rm rs �pathrh r � ETC_FIREWALLDZbuiltin�defaultr* r} �saxZ make_parserZsetContentHandler�openZ InputSourceZ setByteStream�parseZSAXParseExceptionZ INVALID_ZONEZ getException) rs r� Z no_check_namer3 �handler�parserr. �fr8 �msgrO rO rP r � s> � ��:r c C sT |r|n| j }| jr$d|| jf }nd|| jf }tj �|�r�zt�|d| � W n2 ty� } zt� d||� W Y d }~n d }~0 0 tj � |�}|� t j �r�tj �|�s�tj �t j �s�t�t j d� t�|d� tj|ddd�}t|�}|�� i }| j�r| jd k�r| j|d < | jtk�r*| j|d < |�d |� |�d � t| |� t| j�D ]*} |�d� |�dd| i� |�d � �qTt| j �D ]N} |�d� d| v �r�|�dd| dd � i� n|�dd| i� |�d � �q�| j �r|�d� |�di � |�d � | j �r*|�d� |�di � |�d � |� d � |�d � |� � |�!� ~d S )Nr� z %s/%s.xmlz%s.oldz Backup of file '%s' failed: %si� ZwtzUTF-8)�mode�encodingr r r r3 � z r6 r. re r8 rE � rB r> r* )"r� rs r. �os�exists�shutil�copy2� Exceptionr �error�dirnamerh r r� �mkdir�ior� r Z startDocumentr r r r� ZignorableWhitespacer r r$ Z simpleElementr% r) r* r� Z endDocument�close) r3 r� �_pathr. r� �dirpathr� r� r� r6 r8 rO rO rP r � s` $ r )F)N)&�__all__Zxml.saxr� r� r� r� Zfirewallr Zfirewall.functionsr r r r r r Zfirewall.core.baser r Zfirewall.core.io.io_objectr r r Zfirewall.core.io.policyr r r r Z firewall.corer Zfirewall.core.loggerr r Zfirewall.errorsr r r} r r rO rO rO rP �<module> s$ e| ! core/io/__pycache__/__init__.cpython-39.opt-1.pyc 0000644 00000001306 15025011705 0015436 0 ustar 00 a ���g< � @ sj d dl Z de jv rfd dlmZ eed�s<dd� Zeede� d dlmZ eed�sfd d � Z eede � dS ) � NZ_xmlplus)�AttributesImpl� __contains__c C s |t | d�v S )NZ_attrs)�getattr)�self�name� r �=/usr/lib/python3.9/site-packages/firewall/core/io/__init__.py� __AttributesImpl__contains__ s r )� XMLGeneratorZ_writec C s t | d��|� d S )NZ_out)r �write)r �textr r r �__XMLGenerator_write$ s r ) Zxml�__file__Zxml.sax.xmlreaderr �hasattrr �setattrZxml.sax.saxutilsr r r r r r �<module> s core/io/__pycache__/helper.cpython-39.opt-1.pyc 0000644 00000012260 15025011705 0015157 0 ustar 00 a ���g2 � @ s� g d �Z ddlmZ ddlZddlZddlZddlmZ ddlm Z m Z m Z m Z m Z ddlmZ ddlmZ ddlmZ G dd � d e �ZG d d � d e �Zd d � Zddd�ZdS ))�Helper� helper_reader� helper_writer� N)�config)� IO_Object�IO_Object_ContentHandler�IO_Object_XMLGenerator� check_port� check_tcpudp)�log)�errors)� FirewallErrorc sv e Zd ZdddddddgffZdZd d gZd d d gd �Zg d�ddgd�Z� fdd�Zdd� Z dd� Z dd� Z � Z S )r )�version� )�shortr )� descriptionr )�familyr )�moduler �ports)r r z (sssssa(ss))�-�.Nr )r r �helper)�namer r �port�protocol)r r c s6 t t| ��� d| _d| _d| _d| _d| _g | _d S �Nr ) �superr �__init__r r r r r r ��self�� __class__� �;/usr/lib/python3.9/site-packages/firewall/core/io/helper.pyr : s zHelper.__init__c C s. d| _ d| _d| _d| _d| _| jd d �= d S r )r r r r r r r r" r" r# �cleanupC s zHelper.cleanupc C s( ddg}||vr$t tjd||f ��d S )NZipv4Zipv6z'%s' not in '%s')r r Z INVALID_IPV)r ZipvZipvsr" r" r# � check_ipvK s �zHelper.check_ipvc C sv |dkr,|D ] }t |d � t|d � q nF|dkrr|�d�sNttjd| ��t|�dd��dk rrttjd| ��d S ) Nr r � r � nf_conntrack_�('%s' does not start with 'nf_conntrack_'r �Module name '%s' too short)r r � startswithr r �INVALID_MODULE�len�replace)r r �itemZ all_configZall_io_objectsr r" r" r# � _check_configQ s ��zHelper._check_config) �__name__� __module__� __qualname__ZIMPORT_EXPORT_STRUCTUREZDBUS_SIGNATUREZADDITIONAL_ALNUM_CHARSZ PARSER_REQUIRED_ELEMENT_ATTRSZ PARSER_OPTIONAL_ELEMENT_ATTRSr r$ r% r/ � __classcell__r" r" r r# r % s( ��� r c @ s e Zd Zdd� ZdS )�helper_ContentHandlerc C s> t �| ||� | j�||� |dkr�d|v r8|d | j_d|v r\| j�|d � |d | j_d|v r�|d �d�s�tt j d|d ��t |d � dd��dk r�tt j d |d ��|d | j_ nz|d kr�np|d kr�nf|d k�r:t|d � t|d � |d |d f}|| jjv�r$| jj�|� nt�d|d |d � d S )Nr r r r r' r( r r& r) r r r r z#Port '%s/%s' already set, ignoring.)r � startElementr. Zparser_check_element_attrsr r% r r* r r r+ r, r- r r r r �appendr Zwarning)r r �attrs�entryr" r" r# r5 b sF �� � �z"helper_ContentHandler.startElementN)r0 r1 r2 r5 r" r" r" r# r4 a s r4 c C s t � }| �d�s ttjd| ��| d d� |_|�|j� | |_||_|� t j �rVdnd|_ |j |_ t|�}t�� }|�|� d|| f }t|d��n}t�d �}|�|� z|�|� W n: tjy� } z ttjd|�� ��W Y d }~n d }~0 0 W d � n1 �s 0 Y ~~|S ) Nz.xmlz'%s' is missing .xml suffix���FT�%s/%s�rbznot a valid helper file: %s)r �endswithr r Z INVALID_NAMEr Z check_name�filename�pathr* r � ETC_FIREWALLDZbuiltin�defaultr4 �saxZ make_parserZsetContentHandler�openZ InputSourceZ setByteStream�parseZSAXParseExceptionZINVALID_HELPERZ getException) r= r> r �handler�parserr �f�source�msgr" r" r# r � s: � ��:r c C sL |r|n| j }| jr$d|| jf }nd|| jf }tj �|�r�zt�|d| � W n2 ty� } zt� d||� W Y d }~n d }~0 0 tj � |�}|� t j �r�tj �|�s�tj �t j �s�t�t j d� t�|d� tj|ddd�}t|�}|�� i }| j|d < | j�r | jd k�r | j|d < | j�r<| jd k�r<| j|d < |�d |� |�d� | j�r�| jd k�r�|�d� |�di � |�| j� |�d� |�d� | j�r�| jd k�r�|�d� |�di � |�| j� |�d� |�d� | j D ]4} |�d� |� d| d | d d�� |�d� �q�|�d � |�d� |� � |� � ~d S )Nr: z %s/%s.xmlz%s.oldz Backup of file '%s' failed: %si� ZwtzUTF-8)�mode�encodingr r r r r � z r r r r r& )r r ) r> r= r �os�exists�shutil�copy2� Exceptionr �error�dirnamer* r r? �mkdir�iorB r Z startDocumentr r r r5 ZignorableWhitespacer Z charactersZ endElementr r Z simpleElementZ endDocument�close) r r> �_pathr rH �dirpathrF rD r7 r r" r" r# r � s\ $ r )N)�__all__Zxml.saxrA rL rT rN Zfirewallr Zfirewall.core.io.io_objectr r r r r Zfirewall.core.loggerr r Zfirewall.errorsr r r4 r r r" r" r" r# �<module> s <# core/io/firewalld_conf.py 0000644 00000037571 15025011705 0011444 0 ustar 00 # -*- coding: utf-8 -*- # # Copyright (C) 2011-2012 Red Hat, Inc. # # Authors: # Thomas Woerner <twoerner@redhat.com> # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see <http://www.gnu.org/licenses/>. # import os.path import io import tempfile import shutil from firewall import config from firewall.core.logger import log from firewall import errors valid_keys = [ "DefaultZone", "MinimalMark", "CleanupOnExit", "CleanupModulesOnExit", "Lockdown", "IPv6_rpfilter", "IndividualCalls", "LogDenied", "AutomaticHelpers", "FirewallBackend", "FlushAllOnReload", "RFC3964_IPv4", "AllowZoneDrifting", "ReloadPolicy", "NftablesTableOwner" ] class firewalld_conf(object): def __init__(self, filename): self._config = { } self._deleted = [ ] self.filename = filename self.clear() def clear(self): self._config = { } self._deleted = [ ] def cleanup(self): self._config.clear() self._deleted = [ ] def get(self, key): return self._config.get(key.strip()) def set(self, key, value): _key = key.strip() self._config[_key] = value.strip() if _key in self._deleted: self._deleted.remove(_key) def __str__(self): s = "" for (key,value) in self._config.items(): if s: s += '\n' s += '%s=%s' % (key, value) return s def set_defaults(self): self.set("DefaultZone", config.FALLBACK_ZONE) self.set("MinimalMark", str(config.FALLBACK_MINIMAL_MARK)) self.set("CleanupOnExit", "yes" if config.FALLBACK_CLEANUP_ON_EXIT else "no") self.set("CleanupModulesOnExit", "yes" if config.FALLBACK_CLEANUP_MODULES_ON_EXIT else "no") self.set("Lockdown", "yes" if config.FALLBACK_LOCKDOWN else "no") self.set("IPv6_rpfilter", config.FALLBACK_IPV6_RPFILTER) self.set("IndividualCalls", "yes" if config.FALLBACK_INDIVIDUAL_CALLS else "no") self.set("LogDenied", config.FALLBACK_LOG_DENIED) self.set("AutomaticHelpers", config.FALLBACK_AUTOMATIC_HELPERS) self.set("FirewallBackend", config.FALLBACK_FIREWALL_BACKEND) self.set("FlushAllOnReload", "yes" if config.FALLBACK_FLUSH_ALL_ON_RELOAD else "no") self.set("ReloadPolicy", config.FALLBACK_RELOAD_POLICY) self.set("RFC3964_IPv4", "yes" if config.FALLBACK_RFC3964_IPV4 else "no") self.set("AllowZoneDrifting", "yes" if config.FALLBACK_ALLOW_ZONE_DRIFTING else "no") self.set( "NftablesTableOwner", "yes" if config.FALLBACK_NFTABLES_TABLE_OWNER else "no", ) def sanity_check(self): if self.get("FirewallBackend") == "iptables" and self.get("IPv6_rpfilter") in ( "loose-forward", "strict-forward", ): raise errors.FirewallError( errors.INVALID_VALUE, f"IPv6_rpfilter={self.get('IPv6_rpfilter')} is incompatible " "with FirewallBackend=iptables. This is a limitation " "of the iptables backend.", ) # load self.filename def read(self): self.clear() try: f = open(self.filename, "r") except Exception as msg: log.error("Failed to load '%s': %s", self.filename, msg) self.set_defaults() raise for line in f: if not line: break line = line.strip() if len(line) < 1 or line[0] in ['#', ';']: continue # get key/value pair pair = [ x.strip() for x in line.split("=") ] if len(pair) != 2: log.error("Invalid option definition: '%s'", line.strip()) continue elif pair[0] not in valid_keys: log.error("Invalid option: '%s'", line.strip()) continue elif pair[1] == '': log.error("Missing value: '%s'", line.strip()) continue elif self._config.get(pair[0]) is not None: log.error("Duplicate option definition: '%s'", line.strip()) continue self._config[pair[0]] = pair[1] f.close() # check default zone if not self.get("DefaultZone"): log.error("DefaultZone is not set, using default value '%s'", config.FALLBACK_ZONE) self.set("DefaultZone", str(config.FALLBACK_ZONE)) # check minimal mark value = self.get("MinimalMark") try: int(value) except (ValueError, TypeError): if value is not None: log.warning("MinimalMark '%s' is not valid, using default " "value '%d'", value if value else '', config.FALLBACK_MINIMAL_MARK) self.set("MinimalMark", str(config.FALLBACK_MINIMAL_MARK)) # check cleanup on exit value = self.get("CleanupOnExit") if not value or value.lower() not in [ "no", "false", "yes", "true" ]: if value is not None: log.warning("CleanupOnExit '%s' is not valid, using default " "value %s", value if value else '', config.FALLBACK_CLEANUP_ON_EXIT) self.set("CleanupOnExit", "yes" if config.FALLBACK_CLEANUP_ON_EXIT else "no") # check module cleanup on exit value = self.get("CleanupModulesOnExit") if not value or value.lower() not in [ "no", "false", "yes", "true" ]: if value is not None: log.warning("CleanupModulesOnExit '%s' is not valid, using default " "value %s", value if value else '', config.FALLBACK_CLEANUP_MODULES_ON_EXIT) self.set("CleanupModulesOnExit", "yes" if config.FALLBACK_CLEANUP_MODULES_ON_EXIT else "no") # check lockdown value = self.get("Lockdown") if not value or value.lower() not in [ "yes", "true", "no", "false" ]: if value is not None: log.warning("Lockdown '%s' is not valid, using default " "value %s", value if value else '', config.FALLBACK_LOCKDOWN) self.set("Lockdown", "yes" if config.FALLBACK_LOCKDOWN else "no") # check ipv6_rpfilter value = self.get("IPv6_rpfilter") if not value or value.lower() not in config.IPV6_RPFILTER_VALUES: if value is not None: log.warning( "IPv6_rpfilter '%s' is not valid, using default " "value %s", value if value else "", config.FALLBACK_IPV6_RPFILTER, ) self.set("IPv6_rpfilter", config.FALLBACK_IPV6_RPFILTER) # check individual calls value = self.get("IndividualCalls") if not value or value.lower() not in [ "yes", "true", "no", "false" ]: if value is not None: log.warning("IndividualCalls '%s' is not valid, using default " "value %s", value if value else '', config.FALLBACK_INDIVIDUAL_CALLS) self.set("IndividualCalls", "yes" if config.FALLBACK_INDIVIDUAL_CALLS else "no") # check log denied value = self.get("LogDenied") if not value or value not in config.LOG_DENIED_VALUES: if value is not None: log.warning("LogDenied '%s' is invalid, using default value '%s'", value, config.FALLBACK_LOG_DENIED) self.set("LogDenied", str(config.FALLBACK_LOG_DENIED)) # check automatic helpers value = self.get("AutomaticHelpers") if not value or value.lower() not in config.AUTOMATIC_HELPERS_VALUES: if value is not None: log.warning("AutomaticHelpers '%s' is not valid, using default " "value %s", value if value else '', config.FALLBACK_AUTOMATIC_HELPERS) self.set("AutomaticHelpers", str(config.FALLBACK_AUTOMATIC_HELPERS)) value = self.get("FirewallBackend") if not value or value.lower() not in config.FIREWALL_BACKEND_VALUES: if value is not None: log.warning("FirewallBackend '%s' is not valid, using default " "value %s", value if value else '', config.FALLBACK_FIREWALL_BACKEND) self.set("FirewallBackend", str(config.FALLBACK_FIREWALL_BACKEND)) value = self.get("FlushAllOnReload") if not value or value.lower() not in [ "yes", "true", "no", "false" ]: if value is not None: log.warning("FlushAllOnReload '%s' is not valid, using default " "value %s", value if value else '', config.FALLBACK_FLUSH_ALL_ON_RELOAD) self.set("FlushAllOnReload", str(config.FALLBACK_FLUSH_ALL_ON_RELOAD)) value = self.get("ReloadPolicy") try: value = self._parse_reload_policy(value) except ValueError: log.warning( "ReloadPolicy '%s' is not valid, using default value '%s'", value, config.FALLBACK_RELOAD_POLICY, ) self.set("ReloadPolicy", config.FALLBACK_RELOAD_POLICY) value = self.get("RFC3964_IPv4") if not value or value.lower() not in [ "yes", "true", "no", "false" ]: if value is not None: log.warning("RFC3964_IPv4 '%s' is not valid, using default " "value %s", value if value else '', config.FALLBACK_RFC3964_IPV4) self.set("RFC3964_IPv4", str(config.FALLBACK_RFC3964_IPV4)) value = self.get("AllowZoneDrifting") if not value or value.lower() not in [ "yes", "true", "no", "false" ]: if value is not None: log.warning("AllowZoneDrifting '%s' is not valid, using default " "value %s", value if value else '', config.FALLBACK_ALLOW_ZONE_DRIFTING) self.set("AllowZoneDrifting", "yes" if config.FALLBACK_ALLOW_ZONE_DRIFTING else "no") self.sanity_check() # save to self.filename if there are key/value changes def write(self): if len(self._config) < 1: # no changes: nothing to do return # handled keys done = [ ] if not os.path.exists(config.ETC_FIREWALLD): os.mkdir(config.ETC_FIREWALLD, 0o750) try: temp_file = tempfile.NamedTemporaryFile(mode='wt', prefix="%s." % os.path.basename(self.filename), dir=os.path.dirname(self.filename), delete=False) except Exception as msg: log.error("Failed to open temporary file: %s" % msg) raise modified = False empty = False try: f= io.open(self.filename, mode='rt', encoding='UTF-8') except Exception as msg: if os.path.exists(self.filename): log.error("Failed to open '%s': %s" % (self.filename, msg)) raise else: f = None else: for line in f: if not line: break # remove newline line = line.strip("\n") if len(line) < 1: if not empty: temp_file.write(u"\n") empty = True elif line[0] == '#': empty = False temp_file.write(line) temp_file.write(u"\n") else: p = line.split("=") if len(p) != 2: empty = False temp_file.write(line+u"\n") continue key = p[0].strip() value = p[1].strip() # check for modified key/value pairs if key not in done: if (key in self._config and \ self._config[key] != value): empty = False temp_file.write(u'%s=%s\n' % (key, self._config[key])) modified = True elif key in self._deleted: modified = True else: empty = False temp_file.write(line+u"\n") done.append(key) else: modified = True # write remaining key/value pairs if len(self._config) > 0: for (key,value) in self._config.items(): if key in done: continue if key in ["MinimalMark", "AutomaticHelpers", "AllowZoneDrifting"]: # omit deprecated from new config continue if not empty: temp_file.write(u"\n") empty = True temp_file.write(u'%s=%s\n' % (key, value)) modified = True if f: f.close() temp_file.close() if not modified: # not modified: remove tempfile os.remove(temp_file.name) return # make backup if os.path.exists(self.filename): try: shutil.copy2(self.filename, "%s.old" % self.filename) except Exception as msg: os.remove(temp_file.name) raise IOError("Backup of '%s' failed: %s" % (self.filename, msg)) # copy tempfile try: shutil.move(temp_file.name, self.filename) except Exception as msg: os.remove(temp_file.name) raise IOError("Failed to create '%s': %s" % (self.filename, msg)) else: os.chmod(self.filename, 0o600) @staticmethod def _parse_reload_policy(value): valid = True result = { "INPUT": "DROP", "FORWARD": "DROP", "OUTPUT": "DROP", } if value: value = value.strip() v = value.upper() if v in ("ACCEPT", "REJECT", "DROP"): for k in result: result[k] = v else: for a in value.replace(";", ",").split(","): a = a.strip() if not a: continue a2 = a.replace("=", ":").split(":", 2) if len(a2) != 2: valid = False continue k = a2[0].strip().upper() if k not in result: valid = False continue v = a2[1].strip().upper() if v not in ("ACCEPT", "REJECT", "DROP"): valid = False continue result[k] = v if not valid: raise ValueError("Invalid ReloadPolicy") return result @staticmethod def _unparse_reload_policy(value): return ",".join(f"{k}:{v}" for k, v in value.items()) core/io/lockdown_whitelist.py 0000644 00000027706 15025011705 0012401 0 ustar 00 # -*- coding: utf-8 -*- # # Copyright (C) 2011-2016 Red Hat, Inc. # # Authors: # Thomas Woerner <twoerner@redhat.com> # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see <http://www.gnu.org/licenses/>. # import xml.sax as sax import os import io import shutil from firewall import config from firewall.core.io.io_object import IO_Object, \ IO_Object_ContentHandler, IO_Object_XMLGenerator from firewall.core.logger import log from firewall.functions import uniqify, checkUser, checkUid, checkCommand, \ checkContext from firewall import errors from firewall.errors import FirewallError class lockdown_whitelist_ContentHandler(IO_Object_ContentHandler): def __init__(self, item): IO_Object_ContentHandler.__init__(self, item) self.whitelist = False def startElement(self, name, attrs): IO_Object_ContentHandler.startElement(self, name, attrs) self.item.parser_check_element_attrs(name, attrs) if name == "whitelist": if self.whitelist: raise FirewallError(errors.PARSE_ERROR, "More than one whitelist.") self.whitelist = True elif name == "command": if not self.whitelist: log.error("Parse Error: command outside of whitelist") return command = attrs["name"] self.item.add_command(command) elif name == "user": if not self.whitelist: log.error("Parse Error: user outside of whitelist") return if "id" in attrs: try: uid = int(attrs["id"]) except ValueError: log.error("Parse Error: %s is not a valid uid" % attrs["id"]) return self.item.add_uid(uid) elif "name" in attrs: self.item.add_user(attrs["name"]) elif name == "selinux": if not self.whitelist: log.error("Parse Error: selinux outside of whitelist") return if "context" not in attrs: log.error("Parse Error: no context") return self.item.add_context(attrs["context"]) else: log.error('Unknown XML element %s' % name) return class LockdownWhitelist(IO_Object): """ LockdownWhitelist class """ IMPORT_EXPORT_STRUCTURE = ( ( "commands", [ "" ] ), # as ( "contexts", [ "" ] ), # as ( "users", [ "" ] ), # as ( "uids", [ 0 ] ) # ai ) DBUS_SIGNATURE = '(asasasai)' ADDITIONAL_ALNUM_CHARS = [ "_" ] PARSER_REQUIRED_ELEMENT_ATTRS = { "whitelist": None, "command": [ "name" ], "user": None, # "group": None, "selinux": [ "context" ], } PARSER_OPTIONAL_ELEMENT_ATTRS = { "user": [ "id", "name" ], # "group": [ "id", "name" ], } def __init__(self, filename): super(LockdownWhitelist, self).__init__() self.filename = filename self.parser = None self.commands = [ ] self.contexts = [ ] self.users = [ ] self.uids = [ ] # self.gids = [ ] # self.groups = [ ] def _check_config(self, config, item, all_config, all_io_objects): if item in [ "commands", "contexts", "users", "uids" ]: for x in config: self._check_config(x, item[:-1], all_config, all_io_objects) elif item == "command": if not checkCommand(config): raise FirewallError(errors.INVALID_COMMAND, config) elif item == "context": if not checkContext(config): raise FirewallError(errors.INVALID_CONTEXT, config) elif item == "user": if not checkUser(config): raise FirewallError(errors.INVALID_USER, config) elif item == "uid": if not checkUid(config): raise FirewallError(errors.INVALID_UID, config) def cleanup(self): del self.commands[:] del self.contexts[:] del self.users[:] del self.uids[:] # del self.gids[:] # del self.groups[:] # commands def add_command(self, command): if not checkCommand(command): raise FirewallError(errors.INVALID_COMMAND, command) if command not in self.commands: self.commands.append(command) else: raise FirewallError(errors.ALREADY_ENABLED, 'Command "%s" already in whitelist' % command) def remove_command(self, command): if command in self.commands: self.commands.remove(command) else: raise FirewallError(errors.NOT_ENABLED, 'Command "%s" not in whitelist.' % command) def has_command(self, command): return (command in self.commands) def match_command(self, command): for _command in self.commands: if _command.endswith("*"): if command.startswith(_command[:-1]): return True else: if _command == command: return True return False def get_commands(self): return self.commands # user ids def add_uid(self, uid): if not checkUid(uid): raise FirewallError(errors.INVALID_UID, str(uid)) if uid not in self.uids: self.uids.append(uid) else: raise FirewallError(errors.ALREADY_ENABLED, 'Uid "%s" already in whitelist' % uid) def remove_uid(self, uid): if uid in self.uids: self.uids.remove(uid) else: raise FirewallError(errors.NOT_ENABLED, 'Uid "%s" not in whitelist.' % uid) def has_uid(self, uid): return (uid in self.uids) def match_uid(self, uid): return (uid in self.uids) def get_uids(self): return self.uids # users def add_user(self, user): if not checkUser(user): raise FirewallError(errors.INVALID_USER, user) if user not in self.users: self.users.append(user) else: raise FirewallError(errors.ALREADY_ENABLED, 'User "%s" already in whitelist' % user) def remove_user(self, user): if user in self.users: self.users.remove(user) else: raise FirewallError(errors.NOT_ENABLED, 'User "%s" not in whitelist.' % user) def has_user(self, user): return (user in self.users) def match_user(self, user): return (user in self.users) def get_users(self): return self.users # # group ids # # def add_gid(self, gid): # if gid not in self.gids: # self.gids.append(gid) # # def remove_gid(self, gid): # if gid in self.gids: # self.gids.remove(gid) # else: # raise FirewallError(errors.NOT_ENABLED, # 'Gid "%s" not in whitelist.' % gid) # # def has_gid(self, gid): # return (gid in self.gids) # # def match_gid(self, gid): # return (gid in self.gids) # # def get_gids(self): # return self.gids # # groups # # def add_group(self, group): # if group not in self.groups: # self.groups.append(group) # # def remove_group(self, group): # if group in self.groups: # self.groups.remove(group) # else: # raise FirewallError(errors.NOT_ENABLED, # 'Group "%s" not in whitelist.' % group) # # def has_group(self, group): # return (group in self.groups) # # def match_group(self, group): # return (group in self.groups) # # def get_groups(self): # return self.groups # selinux contexts def add_context(self, context): if not checkContext(context): raise FirewallError(errors.INVALID_CONTEXT, context) if context not in self.contexts: self.contexts.append(context) else: raise FirewallError(errors.ALREADY_ENABLED, 'Context "%s" already in whitelist' % context) def remove_context(self, context): if context in self.contexts: self.contexts.remove(context) else: raise FirewallError(errors.NOT_ENABLED, 'Context "%s" not in whitelist.' % context) def has_context(self, context): return (context in self.contexts) def match_context(self, context): return (context in self.contexts) def get_contexts(self): return self.contexts # read and write def read(self): self.cleanup() if not self.filename.endswith(".xml"): raise FirewallError(errors.INVALID_NAME, "'%s' is missing .xml suffix" % self.filename) handler = lockdown_whitelist_ContentHandler(self) parser = sax.make_parser() parser.setContentHandler(handler) try: parser.parse(self.filename) except sax.SAXParseException as msg: raise FirewallError(errors.INVALID_TYPE, "Not a valid file: %s" % \ msg.getException()) del handler del parser def write(self): if os.path.exists(self.filename): try: shutil.copy2(self.filename, "%s.old" % self.filename) except Exception as msg: raise IOError("Backup of '%s' failed: %s" % (self.filename, msg)) if not os.path.exists(config.ETC_FIREWALLD): os.mkdir(config.ETC_FIREWALLD, 0o750) f = io.open(self.filename, mode='wt', encoding='UTF-8') handler = IO_Object_XMLGenerator(f) handler.startDocument() # start whitelist element handler.startElement("whitelist", { }) handler.ignorableWhitespace("\n") # commands for command in uniqify(self.commands): handler.ignorableWhitespace(" ") handler.simpleElement("command", { "name": command }) handler.ignorableWhitespace("\n") for uid in uniqify(self.uids): handler.ignorableWhitespace(" ") handler.simpleElement("user", { "id": str(uid) }) handler.ignorableWhitespace("\n") for user in uniqify(self.users): handler.ignorableWhitespace(" ") handler.simpleElement("user", { "name": user }) handler.ignorableWhitespace("\n") # for gid in uniqify(self.gids): # handler.ignorableWhitespace(" ") # handler.simpleElement("user", { "id": str(gid) }) # handler.ignorableWhitespace("\n") # for group in uniqify(self.groups): # handler.ignorableWhitespace(" ") # handler.simpleElement("group", { "name": group }) # handler.ignorableWhitespace("\n") for context in uniqify(self.contexts): handler.ignorableWhitespace(" ") handler.simpleElement("selinux", { "context": context }) handler.ignorableWhitespace("\n") # end whitelist element handler.endElement("whitelist") handler.ignorableWhitespace("\n") handler.endDocument() f.close() del handler core/io/helper.py 0000644 00000017062 15025011705 0007736 0 ustar 00 # -*- coding: utf-8 -*- # # Copyright (C) 2011-2016 Red Hat, Inc. # # Authors: # Thomas Woerner <twoerner@redhat.com> # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see <http://www.gnu.org/licenses/>. # __all__ = [ "Helper", "helper_reader", "helper_writer" ] import xml.sax as sax import os import io import shutil from firewall import config from firewall.core.io.io_object import IO_Object, \ IO_Object_ContentHandler, IO_Object_XMLGenerator, check_port, \ check_tcpudp from firewall.core.logger import log from firewall import errors from firewall.errors import FirewallError class Helper(IO_Object): IMPORT_EXPORT_STRUCTURE = ( ( "version", "" ), # s ( "short", "" ), # s ( "description", "" ), # s ( "family", "", ), # s ( "module", "", ), # s ( "ports", [ ( "", "" ), ], ), # a(ss) ) DBUS_SIGNATURE = '(sssssa(ss))' ADDITIONAL_ALNUM_CHARS = [ "-", "." ] PARSER_REQUIRED_ELEMENT_ATTRS = { "short": None, "description": None, "helper": [ "module" ], } PARSER_OPTIONAL_ELEMENT_ATTRS = { "helper": [ "name", "version", "family" ], "port": [ "port", "protocol" ], } def __init__(self): super(Helper, self).__init__() self.version = "" self.short = "" self.description = "" self.module = "" self.family = "" self.ports = [ ] def cleanup(self): self.version = "" self.short = "" self.description = "" self.module = "" self.family = "" del self.ports[:] def check_ipv(self, ipv): ipvs = [ 'ipv4', 'ipv6' ] if ipv not in ipvs: raise FirewallError(errors.INVALID_IPV, "'%s' not in '%s'" % (ipv, ipvs)) def _check_config(self, config, item, all_config, all_io_objects): if item == "ports": for port in config: check_port(port[0]) check_tcpudp(port[1]) elif item == "module": if not config.startswith("nf_conntrack_"): raise FirewallError( errors.INVALID_MODULE, "'%s' does not start with 'nf_conntrack_'" % config) if len(config.replace("nf_conntrack_", "")) < 1: raise FirewallError(errors.INVALID_MODULE, "Module name '%s' too short" % config) # PARSER class helper_ContentHandler(IO_Object_ContentHandler): def startElement(self, name, attrs): IO_Object_ContentHandler.startElement(self, name, attrs) self.item.parser_check_element_attrs(name, attrs) if name == "helper": if "version" in attrs: self.item.version = attrs["version"] if "family" in attrs: self.item.check_ipv(attrs["family"]) self.item.family = attrs["family"] if "module" in attrs: if not attrs["module"].startswith("nf_conntrack_"): raise FirewallError( errors.INVALID_MODULE, "'%s' does not start with 'nf_conntrack_'" % \ attrs["module"]) if len(attrs["module"].replace("nf_conntrack_", "")) < 1: raise FirewallError( errors.INVALID_MODULE, "Module name '%s' too short" % attrs["module"]) self.item.module = attrs["module"] elif name == "short": pass elif name == "description": pass elif name == "port": check_port(attrs["port"]) check_tcpudp(attrs["protocol"]) entry = (attrs["port"], attrs["protocol"]) if entry not in self.item.ports: self.item.ports.append(entry) else: log.warning("Port '%s/%s' already set, ignoring.", attrs["port"], attrs["protocol"]) def helper_reader(filename, path): helper = Helper() if not filename.endswith(".xml"): raise FirewallError(errors.INVALID_NAME, "'%s' is missing .xml suffix" % filename) helper.name = filename[:-4] helper.check_name(helper.name) helper.filename = filename helper.path = path helper.builtin = False if path.startswith(config.ETC_FIREWALLD) else True helper.default = helper.builtin handler = helper_ContentHandler(helper) parser = sax.make_parser() parser.setContentHandler(handler) name = "%s/%s" % (path, filename) with open(name, "rb") as f: source = sax.InputSource(None) source.setByteStream(f) try: parser.parse(source) except sax.SAXParseException as msg: raise FirewallError(errors.INVALID_HELPER, "not a valid helper file: %s" % \ msg.getException()) del handler del parser return helper def helper_writer(helper, path=None): _path = path if path else helper.path if helper.filename: name = "%s/%s" % (_path, helper.filename) else: name = "%s/%s.xml" % (_path, helper.name) if os.path.exists(name): try: shutil.copy2(name, "%s.old" % name) except Exception as msg: log.error("Backup of file '%s' failed: %s", name, msg) dirpath = os.path.dirname(name) if dirpath.startswith(config.ETC_FIREWALLD) and not os.path.exists(dirpath): if not os.path.exists(config.ETC_FIREWALLD): os.mkdir(config.ETC_FIREWALLD, 0o750) os.mkdir(dirpath, 0o750) f = io.open(name, mode='wt', encoding='UTF-8') handler = IO_Object_XMLGenerator(f) handler.startDocument() # start helper element attrs = {} attrs["module"] = helper.module if helper.version and helper.version != "": attrs["version"] = helper.version if helper.family and helper.family != "": attrs["family"] = helper.family handler.startElement("helper", attrs) handler.ignorableWhitespace("\n") # short if helper.short and helper.short != "": handler.ignorableWhitespace(" ") handler.startElement("short", { }) handler.characters(helper.short) handler.endElement("short") handler.ignorableWhitespace("\n") # description if helper.description and helper.description != "": handler.ignorableWhitespace(" ") handler.startElement("description", { }) handler.characters(helper.description) handler.endElement("description") handler.ignorableWhitespace("\n") # ports for port in helper.ports: handler.ignorableWhitespace(" ") handler.simpleElement("port", { "port": port[0], "protocol": port[1] }) handler.ignorableWhitespace("\n") # end helper element handler.endElement('helper') handler.ignorableWhitespace("\n") handler.endDocument() f.close() del handler core/io/policy.py 0000644 00000140707 15025011705 0007761 0 ustar 00 # -*- coding: utf-8 -*- # # SPDX-License-Identifier: GPL-2.0-or-later __all__ = [ "Policy", "policy_reader", "policy_writer" ] import xml.sax as sax import os import io import shutil from firewall import config from firewall.functions import ( checkIP, checkIP6, checkUINT16, coalescePortRange, max_policy_name_len, portInPortRange, portStr, uniqify, ) from firewall.core.base import DEFAULT_POLICY_TARGET, POLICY_TARGETS, DEFAULT_POLICY_PRIORITY from firewall.core.io.io_object import IO_Object, \ IO_Object_ContentHandler, IO_Object_XMLGenerator, check_port, \ check_tcpudp, check_protocol from firewall.core import rich from firewall.core.logger import log from firewall import errors from firewall.errors import FirewallError def common_startElement(obj, name, attrs): if name == "short": pass elif name == "description": pass elif name == "service": if obj._rule: if obj._rule.element: log.warning("Invalid rule: More than one element in rule '%s', ignoring.", str(obj._rule)) obj._rule_error = True return True obj._rule.element = rich.Rich_Service(attrs["name"]) return True if attrs["name"] not in obj.item.services: obj.item.services.append(attrs["name"]) else: log.warning("Service '%s' already set, ignoring.", attrs["name"]) elif name == "port": if obj._rule: if obj._rule.element: log.warning("Invalid rule: More than one element in rule '%s', ignoring.", str(obj._rule)) obj._rule_error = True return True obj._rule.element = rich.Rich_Port(attrs["port"], attrs["protocol"]) return True check_port(attrs["port"]) check_tcpudp(attrs["protocol"]) # coalesce and warn about overlapping ranges new_port_id = (portStr(attrs["port"], "-"), attrs["protocol"]) existing_port_ids = list(filter(lambda x: x[1] == attrs["protocol"], obj.item.ports)) for port_id in existing_port_ids: if portInPortRange(new_port_id[0], port_id[0]): # the range is wholly contained already, so just warn _name = obj.item.derived_from_zone if isinstance(obj.item, Policy) else obj.item.name log.warning(FirewallError(errors.ALREADY_ENABLED, "'%s:%s' already in '%s'" % (new_port_id[0], attrs["protocol"], _name))) break # for else: # the range can be coalesced into the existing set added_ranges, removed_ranges = coalescePortRange(new_port_id[0], [_port for (_port, _protocol) in existing_port_ids]) for _range in removed_ranges: entry = (portStr(_range, "-"), attrs["protocol"]) obj.item.ports.remove(entry) for _range in added_ranges: entry = (portStr(_range, "-"), attrs["protocol"]) obj.item.ports.append(entry) elif name == "protocol": if obj._rule: if obj._rule.element: log.warning("Invalid rule: More than one element in rule '%s', ignoring.", str(obj._rule)) obj._rule_error = True return True obj._rule.element = rich.Rich_Protocol(attrs["value"]) else: check_protocol(attrs["value"]) if attrs["value"] not in obj.item.protocols: obj.item.protocols.append(attrs["value"]) else: log.warning("Protocol '%s' already set, ignoring.", attrs["value"]) elif name == "tcp-mss-clamp": if obj._rule: if obj._rule.element: log.warning("Invalid rule: More than one element in rule '%s', ignoring.", str(obj._rule)) obj._rule_error = True return True _value="pmtu" if "value" in attrs and attrs["value"] not in [None, "None"]: _value = attrs["value"] obj._rule.element = rich.Rich_Tcp_Mss_Clamp(_value) else: s = "" if "value" in attrs: s = f" (value='{attrs['value']})'" log.warning("Invalid rule: tcp-mss-clamp%s outside of rule", s) elif name == "icmp-block": if obj._rule: if obj._rule.element: log.warning("Invalid rule: More than one element in rule '%s', ignoring.", str(obj._rule)) obj._rule_error = True return True obj._rule.element = rich.Rich_IcmpBlock(attrs["name"]) return True if attrs["name"] not in obj.item.icmp_blocks: obj.item.icmp_blocks.append(attrs["name"]) else: log.warning("icmp-block '%s' already set, ignoring.", attrs["name"]) elif name == "icmp-type": if obj._rule: if obj._rule.element: log.warning("Invalid rule: More than one element in rule '%s', ignoring.", str(obj._rule)) obj._rule_error = True return True obj._rule.element = rich.Rich_IcmpType(attrs["name"]) return True else: log.warning("Invalid rule: icmp-block '%s' outside of rule", attrs["name"]) elif name == "masquerade": if obj._rule: if obj._rule.element: log.warning("Invalid rule: More than one element in rule '%s', ignoring.", str(obj._rule)) obj._rule_error = True return True obj._rule.element = rich.Rich_Masquerade() else: if obj.item.masquerade: log.warning("Masquerade already set, ignoring.") else: obj.item.masquerade = True elif name == "forward-port": to_port = "" if "to-port" in attrs: to_port = attrs["to-port"] to_addr = "" if "to-addr" in attrs: to_addr = attrs["to-addr"] if obj._rule: if obj._rule.element: log.warning("Invalid rule: More than one element in rule '%s', ignoring.", str(obj._rule)) obj._rule_error = True return True obj._rule.element = rich.Rich_ForwardPort(attrs["port"], attrs["protocol"], to_port, to_addr) return True check_port(attrs["port"]) check_tcpudp(attrs["protocol"]) if to_port: check_port(to_port) if to_addr: if not checkIP(to_addr) and not checkIP6(to_addr): raise FirewallError(errors.INVALID_ADDR, "to-addr '%s' is not a valid address" \ % to_addr) entry = (portStr(attrs["port"], "-"), attrs["protocol"], portStr(to_port, "-"), str(to_addr)) if entry not in obj.item.forward_ports: obj.item.forward_ports.append(entry) else: log.warning("Forward port %s/%s%s%s already set, ignoring.", attrs["port"], attrs["protocol"], " >%s" % to_port if to_port else "", " @%s" % to_addr if to_addr else "") elif name == "source-port": if obj._rule: if obj._rule.element: log.warning("Invalid rule: More than one element in rule '%s', ignoring.", str(obj._rule)) obj._rule_error = True return True obj._rule.element = rich.Rich_SourcePort(attrs["port"], attrs["protocol"]) return True check_port(attrs["port"]) check_tcpudp(attrs["protocol"]) # coalesce and warn about overlapping ranges new_port_id = (portStr(attrs["port"], "-"), attrs["protocol"]) existing_port_ids = list(filter(lambda x: x[1] == attrs["protocol"], obj.item.source_ports)) for port_id in existing_port_ids: if portInPortRange(new_port_id[0], port_id[0]): # the range is wholly contained already, so just warn _name = obj.item.derived_from_zone if isinstance(obj.item, Policy) else obj.item.name log.warning(FirewallError(errors.ALREADY_ENABLED, "'%s:%s' already in '%s'" % (new_port_id[0], attrs["protocol"], _name))) break # for else: # the range can be coalesced into the existing set added_ranges, removed_ranges = coalescePortRange(new_port_id[0], [_port for (_port, _protocol) in existing_port_ids]) for _range in removed_ranges: entry = (portStr(_range, "-"), attrs["protocol"]) obj.item.source_ports.remove(entry) for _range in added_ranges: entry = (portStr(_range, "-"), attrs["protocol"]) obj.item.source_ports.append(entry) elif name == "destination": if not obj._rule: log.warning('Invalid rule: Destination outside of rule') obj._rule_error = True return True if obj._rule.destination: log.warning("Invalid rule: More than one destination in rule '%s', ignoring.", str(obj._rule)) return True invert = False address = None if "address" in attrs: address = attrs["address"] ipset = None if "ipset" in attrs: ipset = attrs["ipset"] if "invert" in attrs and \ attrs["invert"].lower() in [ "yes", "true" ]: invert = True obj._rule.destination = rich.Rich_Destination(address, ipset, invert) elif name in [ "accept", "reject", "drop", "mark" ]: if not obj._rule: log.warning('Invalid rule: Action outside of rule') obj._rule_error = True return True if obj._rule.action: log.warning('Invalid rule: More than one action') obj._rule_error = True return True if name == "accept": obj._rule.action = rich.Rich_Accept() elif name == "reject": _type = None if "type" in attrs: _type = attrs["type"] obj._rule.action = rich.Rich_Reject(_type) elif name == "drop": obj._rule.action = rich.Rich_Drop() elif name == "mark": _set = attrs["set"] obj._rule.action = rich.Rich_Mark(_set) obj._limit_ok = obj._rule.action elif name == "log": if not obj._rule: log.warning('Invalid rule: Log outside of rule') return True if obj._rule.log: log.warning('Invalid rule: More than one log') return True level = None if "level" in attrs: level = attrs["level"] if level not in [ "emerg", "alert", "crit", "error", "warning", "notice", "info", "debug" ]: log.warning('Invalid rule: Invalid log level') obj._rule_error = True return True prefix = None if "prefix" in attrs: prefix = attrs["prefix"] if not prefix or len(prefix) > 127: log.warning('Invalid rule: Invalid log prefix') obj._rule_error = True return True obj._rule.log = rich.Rich_Log(prefix, level) obj._limit_ok = obj._rule.log elif name == "nflog": if not obj._rule: log.warning('Invalid rule: Log outside of rule') return True if obj._rule.log: log.warning('Invalid rule: More than one log') return True group = None if "group" in attrs: group = attrs["group"] if not checkUINT16(group): log.warning('Invalid rule: Invalid nflog group value') obj._rule_error = True return True prefix = None if "prefix" in attrs: prefix = attrs["prefix"] if not prefix or len(prefix) > 127: log.warning('Invalid rule: Invalid nflog prefix') obj._rule_error = True return True threshold = None if "queue-size" in attrs: threshold = attrs["queue-size"] if not checkUINT16(threshold): log.warning('Invalid rule: Invalid nflog queue-size') obj._rule_error = True return True obj._rule.log = rich.Rich_NFLog(group, prefix, threshold) obj._limit_ok = obj._rule.log elif name == "audit": if not obj._rule: log.warning('Invalid rule: Audit outside of rule') return True if obj._rule.audit: log.warning("Invalid rule: More than one audit in rule '%s', ignoring.", str(obj._rule)) obj._rule_error = True return True obj._rule.audit = rich.Rich_Audit() obj._limit_ok = obj._rule.audit elif name == "rule": family = None priority = 0 if "family" in attrs: family = attrs["family"] if family not in [ "ipv4", "ipv6" ]: log.warning('Invalid rule: Rule family "%s" invalid', attrs["family"]) obj._rule_error = True return True if "priority" in attrs: priority = int(attrs["priority"]) obj._rule = rich.Rich_Rule(family=family, priority=priority) elif name == "limit": if not obj._limit_ok: log.warning('Invalid rule: Limit outside of action, log and audit') obj._rule_error = True return True if obj._limit_ok.limit: log.warning("Invalid rule: More than one limit in rule '%s', ignoring.", str(obj._rule)) obj._rule_error = True return True value = attrs["value"] obj._limit_ok.limit = rich.Rich_Limit(value) else: return False return True def common_endElement(obj, name): if name == "rule": if not obj._rule_error: try: obj._rule.check() except Exception as e: log.warning("%s: %s", e, str(obj._rule)) else: if str(obj._rule) not in obj.item.rules_str: obj.item.rules.append(obj._rule) obj.item.rules_str.append(str(obj._rule)) else: log.warning("Rule '%s' already set, ignoring.", str(obj._rule)) obj._rule = None obj._rule_error = False elif name in [ "accept", "reject", "drop", "mark", "log", "audit" ]: obj._limit_ok = None def common_check_config(obj, config, item, all_config, all_io_objects): obj_type = "Policy" if isinstance(obj, Policy) else "Zone" if item == "services" and "services" in all_io_objects: existing_services = all_io_objects["services"] for service in config: if service not in existing_services: raise FirewallError(errors.INVALID_SERVICE, "{} '{}': '{}' not among existing services".format( obj_type, obj.name, service)) elif item == "ports": for port in config: check_port(port[0]) check_tcpudp(port[1]) elif item == "protocols": for proto in config: check_protocol(proto) elif item == "icmp_blocks" and "icmptypes" in all_io_objects: existing_icmptypes = all_io_objects["icmptypes"] for icmptype in config: if icmptype not in existing_icmptypes: ex = FirewallError(errors.INVALID_ICMPTYPE, "{} '{}': '{}' not among existing ICMP types".format( obj_type, obj.name, icmptype)) if icmptype in all_io_objects.get("runtime", {}).get("icmptypes_unsupported", {}): log.debug1("{} (unsupported)".format(ex)) else: raise ex elif item == "forward_ports": for fwd_port in config: check_port(fwd_port[0]) check_tcpudp(fwd_port[1]) if not fwd_port[2] and not fwd_port[3]: raise FirewallError(errors.INVALID_FORWARD, "{} '{}': '{}' is missing to-port AND to-addr ".format( obj_type, obj.name, fwd_port)) if fwd_port[2]: check_port(fwd_port[2]) if fwd_port[3]: if not checkIP(fwd_port[3]) and not checkIP6(fwd_port[3]): raise FirewallError(errors.INVALID_ADDR, "{} '{}': to-addr '{}' is not a valid address".format( obj_type, obj.name, fwd_port[3])) elif item == "source_ports": for port in config: check_port(port[0]) check_tcpudp(port[1]) elif item in ["rules_str", "rich_rules"]: for rule in config: obj_rich = rich.Rich_Rule(rule_str=rule) if obj_rich.element and "icmptypes" in all_io_objects and \ (isinstance(obj_rich.element, rich.Rich_IcmpBlock) or isinstance(obj_rich.element, rich.Rich_IcmpType)): existing_icmptypes = all_io_objects["icmptypes"] if obj_rich.element.name not in existing_icmptypes: ex = FirewallError(errors.INVALID_ICMPTYPE, "{} '{}': '{}' not among existing ICMP types".format( obj_type, obj.name, obj_rich.element.name)) if obj_rich.element.name in all_io_objects.get("runtime", {}).get("icmptypes_unsupported", {}): log.debug1("{} (unsupported)".format(ex)) else: raise ex elif obj_rich.family: ict = all_io_objects["icmptypes"][obj_rich.element.name] if ict.destination and obj_rich.family not in ict.destination: ex = FirewallError(errors.INVALID_ICMPTYPE, "{} '{}': rich rule family '{}' conflicts with icmp type '{}'".format( obj_type, obj.name, obj_rich.family, obj_rich.element.name)) ict_unsupported = all_io_objects.get("runtime", {}).get("icmptypes_unsupported", {}).get(obj_rich.element.name) if ict_unsupported and ict_unsupported.destination and \ obj_rich.family in ict_unsupported.destination: log.debug1("{} (unsupported)".format(ex)) else: raise ex elif isinstance(obj_rich.element, rich.Rich_Service): if obj_rich.element.name not in all_io_objects["services"]: raise FirewallError( errors.INVALID_SERVICE, "{} '{}': '{}' not among existing services".format( obj_type, obj.name, obj_rich.element.name ), ) def common_writer(obj, handler): # short if obj.short and obj.short != "": handler.ignorableWhitespace(" ") handler.startElement("short", { }) handler.characters(obj.short) handler.endElement("short") handler.ignorableWhitespace("\n") # description if obj.description and obj.description != "": handler.ignorableWhitespace(" ") handler.startElement("description", { }) handler.characters(obj.description) handler.endElement("description") handler.ignorableWhitespace("\n") # services for service in uniqify(obj.services): handler.ignorableWhitespace(" ") handler.simpleElement("service", { "name": service }) handler.ignorableWhitespace("\n") # ports for port in uniqify(obj.ports): handler.ignorableWhitespace(" ") handler.simpleElement("port", { "port": port[0], "protocol": port[1] }) handler.ignorableWhitespace("\n") # protocols for protocol in uniqify(obj.protocols): handler.ignorableWhitespace(" ") handler.simpleElement("protocol", { "value": protocol }) handler.ignorableWhitespace("\n") # icmp-blocks for icmp in uniqify(obj.icmp_blocks): handler.ignorableWhitespace(" ") handler.simpleElement("icmp-block", { "name": icmp }) handler.ignorableWhitespace("\n") # masquerade if obj.masquerade: handler.ignorableWhitespace(" ") handler.simpleElement("masquerade", { }) handler.ignorableWhitespace("\n") # forward-ports for forward in uniqify(obj.forward_ports): handler.ignorableWhitespace(" ") attrs = { "port": forward[0], "protocol": forward[1] } if forward[2] and forward[2] != "" : attrs["to-port"] = forward[2] if forward[3] and forward[3] != "" : attrs["to-addr"] = forward[3] handler.simpleElement("forward-port", attrs) handler.ignorableWhitespace("\n") # source-ports for port in uniqify(obj.source_ports): handler.ignorableWhitespace(" ") handler.simpleElement("source-port", { "port": port[0], "protocol": port[1] }) handler.ignorableWhitespace("\n") # rules for rule in obj.rules: attrs = { } if rule.family: attrs["family"] = rule.family if rule.priority != 0: attrs["priority"] = str(rule.priority) handler.ignorableWhitespace(" ") handler.startElement("rule", attrs) handler.ignorableWhitespace("\n") # source if rule.source: attrs = { } if rule.source.addr: attrs["address"] = rule.source.addr if rule.source.mac: attrs["mac"] = rule.source.mac if rule.source.ipset: attrs["ipset"] = rule.source.ipset if rule.source.invert: attrs["invert"] = "True" handler.ignorableWhitespace(" ") handler.simpleElement("source", attrs) handler.ignorableWhitespace("\n") # destination if rule.destination: attrs = { } if rule.destination.addr: attrs["address"] = rule.destination.addr if rule.destination.ipset: attrs["ipset"] = rule.destination.ipset if rule.destination.invert: attrs["invert"] = "True" handler.ignorableWhitespace(" ") handler.simpleElement("destination", attrs) handler.ignorableWhitespace("\n") # element if rule.element: element = "" attrs = { } if type(rule.element) == rich.Rich_Service: element = "service" attrs["name"] = rule.element.name elif type(rule.element) == rich.Rich_Port: element = "port" attrs["port"] = rule.element.port attrs["protocol"] = rule.element.protocol elif type(rule.element) == rich.Rich_Protocol: element = "protocol" attrs["value"] = rule.element.value elif type(rule.element) == rich.Rich_Tcp_Mss_Clamp: element = "tcp-mss-clamp" if rule.element.value and rule.element.value != "pmtu": attrs["value"] = rule.element.value elif type(rule.element) == rich.Rich_Masquerade: element = "masquerade" elif type(rule.element) == rich.Rich_IcmpBlock: element = "icmp-block" attrs["name"] = rule.element.name elif type(rule.element) == rich.Rich_IcmpType: element = "icmp-type" attrs["name"] = rule.element.name elif type(rule.element) == rich.Rich_ForwardPort: element = "forward-port" attrs["port"] = rule.element.port attrs["protocol"] = rule.element.protocol if rule.element.to_port != "": attrs["to-port"] = rule.element.to_port if rule.element.to_address != "": attrs["to-addr"] = rule.element.to_address elif type(rule.element) == rich.Rich_SourcePort: element = "source-port" attrs["port"] = rule.element.port attrs["protocol"] = rule.element.protocol else: raise FirewallError( errors.INVALID_OBJECT, "Unknown element '%s' in obj_writer" % type(rule.element)) handler.ignorableWhitespace(" ") handler.simpleElement(element, attrs) handler.ignorableWhitespace("\n") # rule.element # log if rule.log: if type(rule.log) == rich.Rich_Log: attrs = { } if rule.log.prefix: attrs["prefix"] = rule.log.prefix if rule.log.level: attrs["level"] = rule.log.level if rule.log.limit: handler.ignorableWhitespace(" ") handler.startElement("log", attrs) handler.ignorableWhitespace("\n ") handler.simpleElement("limit", { "value": rule.log.limit.value }) handler.ignorableWhitespace("\n ") handler.endElement("log") else: handler.ignorableWhitespace(" ") handler.simpleElement("log", attrs) handler.ignorableWhitespace("\n") else: attrs = { } if rule.log.group: attrs["group"] = rule.log.group if rule.log.prefix: attrs["prefix"] = rule.log.prefix if rule.log.threshold: attrs["queue-size"] = rule.log.threshold if rule.log.limit: handler.ignorableWhitespace(" ") handler.startElement("nflog", attrs) handler.ignorableWhitespace("\n ") handler.simpleElement("limit", { "value": rule.log.limit.value }) handler.ignorableWhitespace("\n ") handler.endElement("nflog") else: handler.ignorableWhitespace(" ") handler.simpleElement("nflog", attrs) handler.ignorableWhitespace("\n") # audit if rule.audit: attrs = {} if rule.audit.limit: handler.ignorableWhitespace(" ") handler.startElement("audit", { }) handler.ignorableWhitespace("\n ") handler.simpleElement("limit", { "value": rule.audit.limit.value }) handler.ignorableWhitespace("\n ") handler.endElement("audit") else: handler.ignorableWhitespace(" ") handler.simpleElement("audit", attrs) handler.ignorableWhitespace("\n") # action if rule.action: action = "" attrs = { } if type(rule.action) == rich.Rich_Accept: action = "accept" elif type(rule.action) == rich.Rich_Reject: action = "reject" if rule.action.type: attrs["type"] = rule.action.type elif type(rule.action) == rich.Rich_Drop: action = "drop" elif type(rule.action) == rich.Rich_Mark: action = "mark" attrs["set"] = rule.action.set else: log.warning("Unknown action '%s'", type(rule.action)) if rule.action.limit: handler.ignorableWhitespace(" ") handler.startElement(action, attrs) handler.ignorableWhitespace("\n ") handler.simpleElement("limit", { "value": rule.action.limit.value }) handler.ignorableWhitespace("\n ") handler.endElement(action) else: handler.ignorableWhitespace(" ") handler.simpleElement(action, attrs) handler.ignorableWhitespace("\n") handler.ignorableWhitespace(" ") handler.endElement("rule") handler.ignorableWhitespace("\n") class Policy(IO_Object): priority_min = -32768 priority_max = 32767 priority_default = DEFAULT_POLICY_PRIORITY priority_reserved = [0] IMPORT_EXPORT_STRUCTURE = ( ( "version", "" ), # s ( "short", "" ), # s ( "description", "" ), # s ( "target", "" ), # s ( "services", [ "", ], ), # as ( "ports", [ ( "", "" ), ], ), # a(ss) ( "icmp_blocks", [ "", ], ), # as ( "masquerade", False ), # b ( "forward_ports", [ ( "", "", "", "" ), ], ), # a(ssss) ( "rich_rules", [ "" ] ), # as ( "protocols", [ "", ], ), # as ( "source_ports", [ ( "", "" ), ], ), # a(ss) ( "priority", 0 ), # i ( "ingress_zones", [ "" ] ), # as ( "egress_zones", [ "" ] ), # as ) ADDITIONAL_ALNUM_CHARS = [ "_", "-", "/" ] PARSER_REQUIRED_ELEMENT_ATTRS = { "short": None, "description": None, "policy": ["target"], "service": [ "name" ], "port": [ "port", "protocol" ], "icmp-block": [ "name" ], "icmp-type": [ "name" ], "masquerade": None, "forward-port": [ "port", "protocol" ], "rule": None, "source": None, "destination": None, "protocol": [ "value" ], "source-port": [ "port", "protocol" ], "log": None, "nflog": None, "audit": None, "accept": None, "reject": None, "drop": None, "mark": [ "set" ], "limit": [ "value" ], "ingress-zone": [ "name" ], "egress-zone": [ "name" ], } PARSER_OPTIONAL_ELEMENT_ATTRS = { "policy": [ "version", "priority" ], "forward-port": [ "to-port", "to-addr" ], "rule": [ "family", "priority" ], "source": [ "address", "mac", "invert", "family", "ipset" ], "destination": [ "address", "invert", "ipset" ], "log": [ "prefix", "level" ], "nflog": [ "group", "prefix", "queue-size" ], "reject": [ "type" ], "tcp-mss-clamp": [ "value" ], } def __init__(self): super(Policy, self).__init__() self.version = "" self.short = "" self.description = "" self.target = DEFAULT_POLICY_TARGET self.services = [ ] self.ports = [ ] self.protocols = [ ] self.icmp_blocks = [ ] self.icmp_block_inversion = False # for zones, not written to policy config self.masquerade = False self.forward_ports = [ ] self.source_ports = [ ] self.rules = [ ] self.rules_str = [ ] self.applied = False self.priority = self.priority_default self.derived_from_zone = None self.ingress_zones = [] self.egress_zones = [] def cleanup(self): self.version = "" self.short = "" self.description = "" self.target = DEFAULT_POLICY_TARGET del self.services[:] del self.ports[:] del self.protocols[:] del self.icmp_blocks[:] self.icmp_block_inversion = False self.masquerade = False del self.forward_ports[:] del self.source_ports[:] del self.rules[:] del self.rules_str[:] self.applied = False self.priority = self.priority_default del self.ingress_zones[:] del self.egress_zones[:] def __getattr__(self, name): if name == "rich_rules": return self.rules_str else: return getattr(super(Policy, self), name) def __setattr__(self, name, value): if name == "rich_rules": self.rules = [rich.Rich_Rule(rule_str=s) for s in value] # must convert back to string to get the canonical string. self.rules_str = [str(s) for s in self.rules] else: super(Policy, self).__setattr__(name, value) def _check_config(self, config, item, all_config, all_io_objects): common_check_config(self, config, item, all_config, all_io_objects) if self.name in all_io_objects["zones"]: raise FirewallError(errors.NAME_CONFLICT, "Policy '{}': Can't have the same name as a zone.".format(self.name)) if item == "target": if config not in POLICY_TARGETS: raise FirewallError(errors.INVALID_TARGET, "Policy '{}': '{}' is invalid target".format(self.name, config)) elif item == "priority": if config in self.priority_reserved or \ config > self.priority_max or \ config < self.priority_min: raise FirewallError(errors.INVALID_PRIORITY, "Policy '{}': {} is invalid priority. Must be in range [{}, {}]. The following are reserved: {}".format( self.name, config, self.priority_min, self.priority_max, self.priority_reserved)) elif item in ["ingress_zones", "egress_zones"]: existing_zones = ["ANY", "HOST"] + list(all_io_objects["zones"].keys()) for zone in config: if zone not in existing_zones: raise FirewallError(errors.INVALID_ZONE, "Policy '{}': '{}' not among existing zones".format( self.name, zone)) if ((zone not in ["ANY", "HOST"] and (set(["ANY", "HOST"]) & set(config))) or \ (zone in ["ANY", "HOST"] and (set(config) - set([zone])))): raise FirewallError(errors.INVALID_ZONE, "Policy '{}': '{}' may only contain one of: many regular zones, ANY, or HOST".format( self.name, item)) if zone == "HOST" and \ ((item == "ingress_zones" and "egress_zones" in all_config and "HOST" in all_config["egress_zones"]) or \ (item == "egress_zones" and "ingress_zones" in all_config and "HOST" in all_config["ingress_zones"])): raise FirewallError(errors.INVALID_ZONE, "Policy '{}': 'HOST' can only appear in either ingress or egress zones, but not both".format( self.name)) elif item == "masquerade" and config: if "egress_zones" in all_config and "HOST" in all_config["egress_zones"]: raise FirewallError(errors.INVALID_ZONE, "Policy '{}': 'masquerade' is invalid for egress zone 'HOST'".format( self.name)) elif "ingress_zones" in all_config: if "HOST" in all_config["ingress_zones"]: raise FirewallError(errors.INVALID_ZONE, "Policy '{}': 'masquerade' is invalid for ingress zone 'HOST'".format( self.name)) for zone in all_config["ingress_zones"]: if zone == "ANY": continue if zone not in all_io_objects["zones"]: raise FirewallError(errors.INVALID_ZONE, "Policy '{}': Zone '{}' does not exist.".format(self.name, zone)) if all_io_objects["conf"].get("FirewallBackend") != "nftables" \ and all_io_objects["zones"][zone].interfaces: raise FirewallError(errors.INVALID_ZONE, "Policy '{}': 'masquerade' cannot be used because ingress zone '{}' has assigned interfaces. ".format(self.name, zone)) elif item == "rich_rules": for rule in config: obj = rich.Rich_Rule(rule_str=rule) if obj.element and isinstance(obj.element, rich.Rich_Masquerade): if "egress_zones" in all_config and "HOST" in all_config["egress_zones"]: raise FirewallError(errors.INVALID_ZONE, "Policy '{}': 'masquerade' is invalid for egress zone 'HOST'".format( self.name)) elif "ingress_zones" in all_config: if "HOST" in all_config["ingress_zones"]: raise FirewallError(errors.INVALID_ZONE, "Policy '{}': 'masquerade' is invalid for ingress zone 'HOST'".format( self.name)) for zone in all_config["ingress_zones"]: if zone == "ANY": continue if zone not in all_io_objects["zones"]: raise FirewallError(errors.INVALID_ZONE, "Policy '{}': Zone '{}' does not exist.".format(self.name, zone)) if all_io_objects["conf"].get("FirewallBackend") != "nftables" \ and all_io_objects["zones"][zone].interfaces: raise FirewallError(errors.INVALID_ZONE, "Policy '{}': 'masquerade' cannot be used because ingress zone '{}' has assigned interfaces. ".format(self.name, zone)) elif obj.element and isinstance(obj.element, rich.Rich_ForwardPort): if "egress_zones" in all_config: if "HOST" in all_config["egress_zones"]: if obj.element.to_address: raise FirewallError(errors.INVALID_FORWARD, "Policy '{}': A 'forward-port' with 'to-addr' is invalid for egress zone 'HOST'".format( self.name)) elif all_config["egress_zones"]: if not obj.element.to_address: raise FirewallError(errors.INVALID_FORWARD, "Policy '{}': 'forward-port' requires 'to-addr' if egress zone is 'ANY' or a zone".format( self.name)) if "ANY" not in all_config["egress_zones"]: for zone in all_config["egress_zones"]: if zone not in all_io_objects["zones"]: raise FirewallError(errors.INVALID_ZONE, "Policy '{}': Zone '{}' does not exist.".format(self.name, zone)) if all_io_objects["zones"][zone].interfaces: raise FirewallError(errors.INVALID_ZONE, "Policy '{}': 'forward-port' cannot be used because egress zone '{}' has assigned interfaces".format(self.name, zone)) elif obj.action and isinstance(obj.action, rich.Rich_Mark): if "egress_zones" in all_config: for zone in all_config["egress_zones"]: if zone in ["ANY", "HOST"]: continue if zone not in all_io_objects["zones"]: raise FirewallError(errors.INVALID_ZONE, "Policy '{}': Zone '{}' does not exist.".format(self.name, zone)) if all_io_objects["zones"][zone].interfaces: raise FirewallError(errors.INVALID_ZONE, "Policy '{}': 'mark' action cannot be used because egress zone '{}' has assigned interfaces".format(self.name, zone)) elif item == "forward_ports": for fwd_port in config: if "egress_zones" in all_config: if "HOST" in all_config["egress_zones"]: if fwd_port[3]: raise FirewallError(errors.INVALID_FORWARD, "Policy '{}': A 'forward-port' with 'to-addr' is invalid for egress zone 'HOST'".format( self.name)) elif all_config["egress_zones"]: if not fwd_port[3]: raise FirewallError(errors.INVALID_FORWARD, "Policy '{}': 'forward-port' requires 'to-addr' if egress zone is 'ANY' or a zone".format( self.name)) if "ANY" not in all_config["egress_zones"]: for zone in all_config["egress_zones"]: if zone not in all_io_objects["zones"]: raise FirewallError(errors.INVALID_ZONE, "Policy '{}': Zone '{}' does not exist.".format(self.name, zone)) if all_io_objects["zones"][zone].interfaces: raise FirewallError(errors.INVALID_ZONE, "Policy '{}': 'forward-port' cannot be used because egress zone '{}' has assigned interfaces".format(self.name, zone)) def check_name(self, name): super(Policy, self).check_name(name) if name.startswith('/'): raise FirewallError(errors.INVALID_NAME, "Policy '{}': name can't start with '/'".format(name)) elif name.endswith('/'): raise FirewallError(errors.INVALID_NAME, "Policy '{}': name can't end with '/'".format(name)) elif name.count('/') > 1: raise FirewallError(errors.INVALID_NAME, "Policy '{}': name has more than one '/'".format(name)) else: if "/" in name: checked_name = name[:name.find('/')] else: checked_name = name if len(checked_name) > max_policy_name_len(): raise FirewallError(errors.INVALID_NAME, "Policy '{}': name has {} chars, max is {}".format( name, len(checked_name), max_policy_name_len())) # PARSER class policy_ContentHandler(IO_Object_ContentHandler): def __init__(self, item): IO_Object_ContentHandler.__init__(self, item) self._rule = None self._rule_error = False self._limit_ok = None def startElement(self, name, attrs): IO_Object_ContentHandler.startElement(self, name, attrs) if self._rule_error: return self.item.parser_check_element_attrs(name, attrs) if common_startElement(self, name, attrs): return elif name == "policy": if "version" in attrs: self.item.version = attrs["version"] if "priority" in attrs: self.item.priority = int(attrs["priority"]) if "target" in attrs: target = attrs["target"] if target not in POLICY_TARGETS: raise FirewallError(errors.INVALID_TARGET, target) if target: self.item.target = target elif name == "ingress-zone": if attrs["name"] not in self.item.ingress_zones: self.item.ingress_zones.append(attrs["name"]) else: log.warning("Ingress zone '%s' already set, ignoring.", attrs["name"]) elif name == "egress-zone": if attrs["name"] not in self.item.egress_zones: self.item.egress_zones.append(attrs["name"]) else: log.warning("Egress zone '%s' already set, ignoring.", attrs["name"]) elif name == "source": if not self._rule: log.warning('Invalid rule: Source outside of rule') self._rule_error = True return if self._rule.source: log.warning("Invalid rule: More than one source in rule '%s', ignoring.", str(self._rule)) self._rule_error = True return invert = False if "invert" in attrs and \ attrs["invert"].lower() in [ "yes", "true" ]: invert = True addr = mac = ipset = None if "address" in attrs: addr = attrs["address"] if "mac" in attrs: mac = attrs["mac"] if "ipset" in attrs: ipset = attrs["ipset"] self._rule.source = rich.Rich_Source(addr, mac, ipset, invert=invert) return else: log.warning("Unknown XML element '%s'", name) return def endElement(self, name): IO_Object_ContentHandler.endElement(self, name) common_endElement(self, name) def policy_reader(filename, path, no_check_name=False): policy = Policy() if not filename.endswith(".xml"): raise FirewallError(errors.INVALID_NAME, "'%s' is missing .xml suffix" % filename) policy.name = filename[:-4] if not no_check_name: policy.check_name(policy.name) policy.filename = filename policy.path = path policy.builtin = False if path.startswith(config.ETC_FIREWALLD) else True policy.default = policy.builtin handler = policy_ContentHandler(policy) parser = sax.make_parser() parser.setContentHandler(handler) name = "%s/%s" % (path, filename) with open(name, "rb") as f: source = sax.InputSource(None) source.setByteStream(f) try: parser.parse(source) except sax.SAXParseException as msg: raise FirewallError(errors.INVALID_POLICY, "not a valid policy file: %s" % \ msg.getException()) del handler del parser return policy def policy_writer(policy, path=None): _path = path if path else policy.path if policy.filename: name = "%s/%s" % (_path, policy.filename) else: name = "%s/%s.xml" % (_path, policy.name) if os.path.exists(name): try: shutil.copy2(name, "%s.old" % name) except Exception as msg: log.error("Backup of file '%s' failed: %s", name, msg) dirpath = os.path.dirname(name) if dirpath.startswith(config.ETC_FIREWALLD) and not os.path.exists(dirpath): if not os.path.exists(config.ETC_FIREWALLD): os.mkdir(config.ETC_FIREWALLD, 0o750) os.mkdir(dirpath, 0o750) f = io.open(name, mode='wt', encoding='UTF-8') handler = IO_Object_XMLGenerator(f) handler.startDocument() # start policy element attrs = {} if policy.version and policy.version != "": attrs["version"] = policy.version if policy.priority != policy.priority_default: attrs["priority"] = str(policy.priority) attrs["target"] = policy.target handler.startElement("policy", attrs) handler.ignorableWhitespace("\n") common_writer(policy, handler) # ingress-zones for zone in uniqify(policy.ingress_zones): handler.ignorableWhitespace(" ") handler.simpleElement("ingress-zone", { "name": zone }) handler.ignorableWhitespace("\n") # egress-zones for zone in uniqify(policy.egress_zones): handler.ignorableWhitespace(" ") handler.simpleElement("egress-zone", { "name": zone }) handler.ignorableWhitespace("\n") # end policy element handler.endElement("policy") handler.ignorableWhitespace("\n") handler.endDocument() f.close() del handler core/io/functions.py 0000644 00000010245 15025011705 0010463 0 ustar 00 # -*- coding: utf-8 -*- # # Copyright (C) 2018 Red Hat, Inc. # # Authors: # Eric Garver <egarver@redhat.com> # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see <http://www.gnu.org/licenses/>. # import os from firewall import config from firewall.errors import FirewallError from firewall.core.fw_config import FirewallConfig from firewall.core.io.zone import zone_reader from firewall.core.io.service import service_reader from firewall.core.io.ipset import ipset_reader from firewall.core.io.icmptype import icmptype_reader from firewall.core.io.helper import helper_reader from firewall.core.io.policy import policy_reader from firewall.core.io.direct import Direct from firewall.core.io.lockdown_whitelist import LockdownWhitelist from firewall.core.io.firewalld_conf import firewalld_conf def check_on_disk_config(fw): fw_config = FirewallConfig(fw) try: _firewalld_conf = firewalld_conf(config.FIREWALLD_CONF) _firewalld_conf.read() except FirewallError as error: raise FirewallError(error.code, "'%s': %s" % (config.FIREWALLD_CONF, error.msg)) except IOError: # defaults will be filled pass except Exception as msg: raise Exception("'%s': %s" % (config.FIREWALLD_CONF, msg)) fw_config.set_firewalld_conf(_firewalld_conf) readers = { "ipset": { "reader": ipset_reader, "add": fw_config.add_ipset, "dirs": [config.FIREWALLD_IPSETS, config.ETC_FIREWALLD_IPSETS], }, "helper": { "reader": helper_reader, "add": fw_config.add_helper, "dirs": [config.FIREWALLD_HELPERS, config.ETC_FIREWALLD_HELPERS], }, "icmptype": { "reader": icmptype_reader, "add": fw_config.add_icmptype, "dirs": [config.FIREWALLD_ICMPTYPES, config.ETC_FIREWALLD_ICMPTYPES], }, "service": { "reader": service_reader, "add": fw_config.add_service, "dirs": [config.FIREWALLD_SERVICES, config.ETC_FIREWALLD_SERVICES], }, "zone": { "reader": zone_reader, "add": fw_config.add_zone, "dirs": [config.FIREWALLD_ZONES, config.ETC_FIREWALLD_ZONES], }, "policy": { "reader": policy_reader, "add": fw_config.add_policy_object, "dirs": [config.FIREWALLD_POLICIES, config.ETC_FIREWALLD_POLICIES], }, } for reader in readers.keys(): for _dir in readers[reader]["dirs"]: if not os.path.isdir(_dir): continue for file in sorted(os.listdir(_dir)): if file.endswith(".xml"): obj = readers[reader]["reader"](file, _dir) readers[reader]["add"](obj) fw_config.full_check_config() if os.path.isfile(config.FIREWALLD_DIRECT): try: obj = Direct(config.FIREWALLD_DIRECT) obj.read() obj.check_config(obj.export_config()) except FirewallError as error: raise FirewallError(error.code, "'%s': %s" % (config.FIREWALLD_DIRECT, error.msg)) except Exception as msg: raise Exception("'%s': %s" % (config.FIREWALLD_DIRECT, msg)) if os.path.isfile(config.LOCKDOWN_WHITELIST): try: obj = LockdownWhitelist(config.LOCKDOWN_WHITELIST) obj.read() obj.check_config(obj.export_config()) except FirewallError as error: raise FirewallError(error.code, "'%s': %s" % (config.LOCKDOWN_WHITELIST, error.msg)) except Exception as msg: raise Exception("'%s': %s" % (config.LOCKDOWN_WHITELIST, msg)) core/io/icmptype.py 0000644 00000014211 15025011705 0010302 0 ustar 00 # -*- coding: utf-8 -*- # # Copyright (C) 2011-2016 Red Hat, Inc. # # Authors: # Thomas Woerner <twoerner@redhat.com> # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see <http://www.gnu.org/licenses/>. # __all__ = [ "IcmpType", "icmptype_reader", "icmptype_writer" ] import xml.sax as sax import os import io import shutil from firewall import config from firewall.core.io.io_object import IO_Object, \ IO_Object_ContentHandler, IO_Object_XMLGenerator from firewall.core.logger import log from firewall import errors from firewall.errors import FirewallError class IcmpType(IO_Object): IMPORT_EXPORT_STRUCTURE = ( ( "version", "" ), # s ( "short", "" ), # s ( "description", "" ), # s ( "destination", [ "", ], ), # as ) DBUS_SIGNATURE = '(sssas)' ADDITIONAL_ALNUM_CHARS = [ "_", "-" ] PARSER_REQUIRED_ELEMENT_ATTRS = { "short": None, "description": None, "icmptype": None, } PARSER_OPTIONAL_ELEMENT_ATTRS = { "icmptype": [ "name", "version" ], "destination": [ "ipv4", "ipv6" ], } def __init__(self): super(IcmpType, self).__init__() self.version = "" self.short = "" self.description = "" self.destination = [ ] def cleanup(self): self.version = "" self.short = "" self.description = "" del self.destination[:] def _check_config(self, config, item, all_config, all_io_objects): if item == "destination": for destination in config: if destination not in [ "ipv4", "ipv6" ]: raise FirewallError(errors.INVALID_DESTINATION, "'%s' not from {'ipv4'|'ipv6'}" % \ destination) # PARSER class icmptype_ContentHandler(IO_Object_ContentHandler): def startElement(self, name, attrs): IO_Object_ContentHandler.startElement(self, name, attrs) self.item.parser_check_element_attrs(name, attrs) if name == "icmptype": if "name" in attrs: log.warning("Ignoring deprecated attribute name='%s'" % attrs["name"]) if "version" in attrs: self.item.version = attrs["version"] elif name == "short": pass elif name == "description": pass elif name == "destination": for x in [ "ipv4", "ipv6" ]: if x in attrs and \ attrs[x].lower() in [ "yes", "true" ]: self.item.destination.append(str(x)) def icmptype_reader(filename, path): icmptype = IcmpType() if not filename.endswith(".xml"): raise FirewallError(errors.INVALID_NAME, "%s is missing .xml suffix" % filename) icmptype.name = filename[:-4] icmptype.check_name(icmptype.name) icmptype.filename = filename icmptype.path = path icmptype.builtin = False if path.startswith(config.ETC_FIREWALLD) else True icmptype.default = icmptype.builtin handler = icmptype_ContentHandler(icmptype) parser = sax.make_parser() parser.setContentHandler(handler) name = "%s/%s" % (path, filename) with open(name, "rb") as f: source = sax.InputSource(None) source.setByteStream(f) try: parser.parse(source) except sax.SAXParseException as msg: raise FirewallError(errors.INVALID_ICMPTYPE, "not a valid icmptype file: %s" % \ msg.getException()) del handler del parser return icmptype def icmptype_writer(icmptype, path=None): _path = path if path else icmptype.path if icmptype.filename: name = "%s/%s" % (_path, icmptype.filename) else: name = "%s/%s.xml" % (_path, icmptype.name) if os.path.exists(name): try: shutil.copy2(name, "%s.old" % name) except Exception as msg: log.error("Backup of file '%s' failed: %s", name, msg) dirpath = os.path.dirname(name) if dirpath.startswith(config.ETC_FIREWALLD) and not os.path.exists(dirpath): if not os.path.exists(config.ETC_FIREWALLD): os.mkdir(config.ETC_FIREWALLD, 0o750) os.mkdir(dirpath, 0o750) f = io.open(name, mode='wt', encoding='UTF-8') handler = IO_Object_XMLGenerator(f) handler.startDocument() # start icmptype element attrs = {} if icmptype.version and icmptype.version != "": attrs["version"] = icmptype.version handler.startElement("icmptype", attrs) handler.ignorableWhitespace("\n") # short if icmptype.short and icmptype.short != "": handler.ignorableWhitespace(" ") handler.startElement("short", { }) handler.characters(icmptype.short) handler.endElement("short") handler.ignorableWhitespace("\n") # description if icmptype.description and icmptype.description != "": handler.ignorableWhitespace(" ") handler.startElement("description", { }) handler.characters(icmptype.description) handler.endElement("description") handler.ignorableWhitespace("\n") # destination if icmptype.destination: handler.ignorableWhitespace(" ") attrs = { } for x in icmptype.destination: attrs[x] = "yes" handler.simpleElement("destination", attrs) handler.ignorableWhitespace("\n") # end icmptype element handler.endElement('icmptype') handler.ignorableWhitespace("\n") handler.endDocument() f.close() del handler core/io/io_object.py 0000644 00000026777 15025011705 0010431 0 ustar 00 # -*- coding: utf-8 -*- # # Copyright (C) 2011-2016 Red Hat, Inc. # # Authors: # Thomas Woerner <twoerner@redhat.com> # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see <http://www.gnu.org/licenses/>. # """Generic io_object handler, io specific check methods.""" __all__ = [ "IO_Object", "IO_Object_ContentHandler", "IO_Object_XMLGenerator", "check_port", "check_tcpudp", "check_protocol", "check_address" ] import xml.sax as sax import xml.sax.saxutils as saxutils import copy from collections import OrderedDict from firewall import functions from firewall import errors from firewall.errors import FirewallError class IO_Object(object): """ Abstract IO_Object as base for icmptype, service and zone """ IMPORT_EXPORT_STRUCTURE = ( ) DBUS_SIGNATURE = '()' ADDITIONAL_ALNUM_CHARS = [ ] # additional to alnum PARSER_REQUIRED_ELEMENT_ATTRS = { } PARSER_OPTIONAL_ELEMENT_ATTRS = { } def __init__(self): self.filename = "" self.path = "" self.name = "" self.default = False self.builtin = False def export_config(self): ret = [ ] for x in self.IMPORT_EXPORT_STRUCTURE: ret.append(copy.deepcopy(getattr(self, x[0]))) return tuple(ret) def export_config_dict(self): conf = {} type_formats = dict([(x[0], x[1]) for x in self.IMPORT_EXPORT_STRUCTURE]) for key in type_formats: if getattr(self, key) or isinstance(getattr(self, key), bool): conf[key] = copy.deepcopy(getattr(self, key)) return conf def import_config(self, conf, all_io_objects): self.check_config(conf, all_io_objects) for i,(element,dummy) in enumerate(self.IMPORT_EXPORT_STRUCTURE): if isinstance(conf[i], list): # remove duplicates without changing the order _conf = [ ] _set = set() for x in conf[i]: if x not in _set: _conf.append(x) _set.add(x) del _set setattr(self, element, copy.deepcopy(_conf)) else: setattr(self, element, copy.deepcopy(conf[i])) def import_config_dict(self, conf, all_io_objects): self.check_config_dict(conf, all_io_objects) for key in conf: if not hasattr(self, key): raise FirewallError(errors.UNKNOWN_ERROR, "Internal error. '{}' is not a valid attribute".format(key)) if isinstance(conf[key], list): # maintain list order while removing duplicates setattr(self, key, list(OrderedDict.fromkeys(copy.deepcopy(conf[key])))) else: setattr(self, key, copy.deepcopy(conf[key])) def check_name(self, name): if not isinstance(name, str): raise FirewallError(errors.INVALID_TYPE, "'%s' not of type %s, but %s" % (name, type(""), type(name))) if len(name) < 1: raise FirewallError(errors.INVALID_NAME, "name can't be empty") for char in name: if not char.isalnum() and char not in self.ADDITIONAL_ALNUM_CHARS: raise FirewallError( errors.INVALID_NAME, "'%s' is not allowed in '%s'" % ((char, name))) def check_config(self, conf, all_io_objects={}): if len(conf) != len(self.IMPORT_EXPORT_STRUCTURE): raise FirewallError( errors.INVALID_TYPE, "structure size mismatch %d != %d" % \ (len(conf), len(self.IMPORT_EXPORT_STRUCTURE))) conf_dict = {} for i,(x,y) in enumerate(self.IMPORT_EXPORT_STRUCTURE): conf_dict[x] = conf[i] self.check_config_dict(conf_dict, all_io_objects) def check_config_dict(self, conf, all_io_objects): type_formats = dict([(x[0], x[1]) for x in self.IMPORT_EXPORT_STRUCTURE]) for key in conf: if key not in [x for (x,y) in self.IMPORT_EXPORT_STRUCTURE]: raise FirewallError(errors.INVALID_OPTION, "option '{}' is not valid".format(key)) self._check_config_structure(conf[key], type_formats[key]) self._check_config(conf[key], key, conf, all_io_objects) def _check_config(self, dummy1, dummy2, dummy3, dummy4): # to be overloaded by sub classes return def _check_config_structure(self, conf, structure): if not isinstance(conf, type(structure)): raise FirewallError(errors.INVALID_TYPE, "'%s' not of type %s, but %s" % \ (conf, type(structure), type(conf))) if isinstance(structure, list): # same type elements, else struct if len(structure) != 1: raise FirewallError(errors.INVALID_TYPE, "len('%s') != 1" % structure) for x in conf: self._check_config_structure(x, structure[0]) elif isinstance(structure, tuple): if len(structure) != len(conf): raise FirewallError(errors.INVALID_TYPE, "len('%s') != %d" % (conf, len(structure))) for i,value in enumerate(structure): self._check_config_structure(conf[i], value) elif isinstance(structure, dict): # only one key value pair in structure (skey, svalue) = list(structure.items())[0] for (key, value) in conf.items(): if not isinstance(key, type(skey)): raise FirewallError(errors.INVALID_TYPE, "'%s' not of type %s, but %s" % (\ key, type(skey), type(key))) if not isinstance(value, type(svalue)): raise FirewallError(errors.INVALID_TYPE, "'%s' not of type %s, but %s" % (\ value, type(svalue), type(value))) # check required elements and attributes and also optional attributes def parser_check_element_attrs(self, name, attrs): _attrs = attrs.getNames() found = False if name in self.PARSER_REQUIRED_ELEMENT_ATTRS: found = True if self.PARSER_REQUIRED_ELEMENT_ATTRS[name] is not None: for x in self.PARSER_REQUIRED_ELEMENT_ATTRS[name]: if x in _attrs: _attrs.remove(x) else: raise FirewallError( errors.PARSE_ERROR, "Missing attribute %s for %s" % (x, name)) if name in self.PARSER_OPTIONAL_ELEMENT_ATTRS: found = True for x in self.PARSER_OPTIONAL_ELEMENT_ATTRS[name]: if x in _attrs: _attrs.remove(x) if not found: raise FirewallError(errors.PARSE_ERROR, "Unexpected element %s" % name) # raise attributes[0] for x in _attrs: raise FirewallError(errors.PARSE_ERROR, "%s: Unexpected attribute %s" % (name, x)) # PARSER class UnexpectedElementError(Exception): def __init__(self, name): super(UnexpectedElementError, self).__init__() self.name = name def __str__(self): return "Unexpected element '%s'" % (self.name) class MissingAttributeError(Exception): def __init__(self, name, attribute): super(MissingAttributeError, self).__init__() self.name = name self.attribute = attribute def __str__(self): return "Element '%s': missing '%s' attribute" % \ (self.name, self.attribute) class UnexpectedAttributeError(Exception): def __init__(self, name, attribute): super(UnexpectedAttributeError, self).__init__() self.name = name self.attribute = attribute def __str__(self): return "Element '%s': unexpected attribute '%s'" % \ (self.name, self.attribute) class IO_Object_ContentHandler(sax.handler.ContentHandler): def __init__(self, item): self.item = item self._element = "" def startDocument(self): self._element = "" def startElement(self, name, attrs): self._element = "" def endElement(self, name): if name == "short": self.item.short = self._element elif name == "description": self.item.description = self._element def characters(self, content): self._element += content.replace('\n', ' ') class IO_Object_XMLGenerator(saxutils.XMLGenerator): def __init__(self, out): # fix memory leak in saxutils.XMLGenerator.__init__: # out = _gettextwriter(out, encoding) # creates unbound object results in garbage in gc # # saxutils.XMLGenerator.__init__(self, out, "utf-8") # replaced by modified saxutils.XMLGenerator.__init__ code: sax.handler.ContentHandler.__init__(self) self._write = out.write self._flush = out.flush self._ns_contexts = [{}] # contains uri -> prefix dicts self._current_context = self._ns_contexts[-1] self._undeclared_ns_maps = [] self._encoding = "utf-8" self._pending_start_element = False self._short_empty_elements = False def simpleElement(self, name, attrs): """ slightly modified startElement() """ self._write('<' + name) for (name, value) in attrs.items(): self._write(' %s=%s' % (name, saxutils.quoteattr(value))) self._write('/>') def check_port(port): port_range = functions.getPortRange(port) if port_range == -2: raise FirewallError(errors.INVALID_PORT, "port number in '%s' is too big" % port) elif port_range == -1: raise FirewallError(errors.INVALID_PORT, "'%s' is invalid port range" % port) elif port_range is None: raise FirewallError(errors.INVALID_PORT, "port range '%s' is ambiguous" % port) elif len(port_range) == 2 and port_range[0] >= port_range[1]: raise FirewallError(errors.INVALID_PORT, "'%s' is invalid port range" % port) def check_tcpudp(protocol): if protocol not in [ "tcp", "udp", "sctp", "dccp" ]: raise FirewallError(errors.INVALID_PROTOCOL, "'%s' not from {'tcp'|'udp'|'sctp'|'dccp'}" % \ protocol) def check_protocol(protocol): if not functions.checkProtocol(protocol): raise FirewallError(errors.INVALID_PROTOCOL, protocol) def check_address(ipv, addr): if not functions.check_address(ipv, addr): raise FirewallError(errors.INVALID_ADDR, "'%s' is not valid %s address" % (addr, ipv)) core/io/zone.py 0000644 00000044732 15025011705 0007436 0 ustar 00 # -*- coding: utf-8 -*- # # Copyright (C) 2011-2016 Red Hat, Inc. # # Authors: # Thomas Woerner <twoerner@redhat.com> # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see <http://www.gnu.org/licenses/>. # __all__ = [ "Zone", "zone_reader", "zone_writer" ] import xml.sax as sax import os import io import shutil from firewall import config from firewall.functions import checkIPnMask, checkIP6nMask, checkInterface, uniqify, max_zone_name_len, check_mac from firewall.core.base import DEFAULT_ZONE_TARGET, ZONE_TARGETS from firewall.core.io.io_object import IO_Object, \ IO_Object_ContentHandler, IO_Object_XMLGenerator from firewall.core.io.policy import common_startElement, common_endElement, common_check_config, common_writer from firewall.core import rich from firewall.core.logger import log from firewall import errors from firewall.errors import FirewallError class Zone(IO_Object): """ Zone class """ IMPORT_EXPORT_STRUCTURE = ( ( "version", "" ), # s ( "short", "" ), # s ( "description", "" ), # s ( "UNUSED", False ), # b ( "target", "" ), # s ( "services", [ "", ], ), # as ( "ports", [ ( "", "" ), ], ), # a(ss) ( "icmp_blocks", [ "", ], ), # as ( "masquerade", False ), # b ( "forward_ports", [ ( "", "", "", "" ), ], ), # a(ssss) ( "interfaces", [ "" ] ), # as ( "sources", [ "" ] ), # as ( "rules_str", [ "" ] ), # as ( "protocols", [ "", ], ), # as ( "source_ports", [ ( "", "" ), ], ), # a(ss) ( "icmp_block_inversion", False ), # b ( "forward", True ), # b ) ADDITIONAL_ALNUM_CHARS = [ "_", "-", "/" ] PARSER_REQUIRED_ELEMENT_ATTRS = { "short": None, "description": None, "zone": None, "service": [ "name" ], "port": [ "port", "protocol" ], "icmp-block": [ "name" ], "icmp-type": [ "name" ], "forward": None, "forward-port": [ "port", "protocol" ], "interface": [ "name" ], "rule": None, "source": None, "destination": None, "protocol": [ "value" ], "source-port": [ "port", "protocol" ], "log": None, "nflog": None, "audit": None, "accept": None, "reject": None, "drop": None, "mark": [ "set" ], "limit": [ "value" ], "icmp-block-inversion": None, } PARSER_OPTIONAL_ELEMENT_ATTRS = { "zone": [ "name", "immutable", "target", "version" ], "masquerade": [ "enabled" ], "forward-port": [ "to-port", "to-addr" ], "rule": [ "family", "priority" ], "source": [ "address", "mac", "invert", "family", "ipset" ], "destination": [ "address", "invert", "ipset" ], "log": [ "prefix", "level" ], "nflog": [ "group", "prefix", "queue-size" ], "reject": [ "type" ], "tcp-mss-clamp": [ "value" ], } @staticmethod def index_of(element): for i, (el, dummy) in enumerate(Zone.IMPORT_EXPORT_STRUCTURE): if el == element: return i raise FirewallError(errors.UNKNOWN_ERROR, "index_of()") def __init__(self): super(Zone, self).__init__() self.version = "" self.short = "" self.description = "" self.UNUSED = False self.target = DEFAULT_ZONE_TARGET self.services = [ ] self.ports = [ ] self.protocols = [ ] self.icmp_blocks = [ ] self.forward = True self.masquerade = False self.forward_ports = [ ] self.source_ports = [ ] self.interfaces = [ ] self.sources = [ ] self.rules = [ ] self.rules_str = [ ] self.icmp_block_inversion = False self.combined = False self.applied = False def cleanup(self): self.version = "" self.short = "" self.description = "" self.UNUSED = False self.target = DEFAULT_ZONE_TARGET del self.services[:] del self.ports[:] del self.protocols[:] del self.icmp_blocks[:] self.forward = True self.masquerade = False del self.forward_ports[:] del self.source_ports[:] del self.interfaces[:] del self.sources[:] del self.rules[:] del self.rules_str[:] self.icmp_block_inversion = False self.combined = False self.applied = False def __setattr__(self, name, value): if name == "rules_str": self.rules = [rich.Rich_Rule(rule_str=s) for s in value] # must convert back to string to get the canonical string. super(Zone, self).__setattr__(name, [str(s) for s in self.rules]) else: super(Zone, self).__setattr__(name, value) def export_config_dict(self): conf = super(Zone, self).export_config_dict() del conf["UNUSED"] return conf def _check_config(self, config, item, all_config, all_io_objects): common_check_config(self, config, item, all_config, all_io_objects) if self.name in all_io_objects["policies"]: raise FirewallError(errors.NAME_CONFLICT, "Zone '{}': Can't have the same name as a policy.".format(self.name)) if item == "target": if config not in ZONE_TARGETS: raise FirewallError(errors.INVALID_TARGET, "Zone '{}': invalid target '{}'".format( self.name, config)) elif item == "interfaces": for interface in config: if not checkInterface(interface): raise FirewallError(errors.INVALID_INTERFACE, "Zone '{}': invalid interface '{}'".format( self.name, interface)) for zone in all_io_objects["zones"]: if zone == self.name: continue if interface in all_io_objects["zones"][zone].interfaces: raise FirewallError(errors.INVALID_INTERFACE, "Zone '{}': interface '{}' already bound to zone '{}'".format( self.name, interface, zone)) elif item == "sources": for source in config: if not checkIPnMask(source) and not checkIP6nMask(source) and \ not check_mac(source) and not source.startswith("ipset:"): raise FirewallError(errors.INVALID_ADDR, "Zone '{}': invalid source '{}'".format( self.name, source)) for zone in all_io_objects["zones"]: if zone == self.name: continue if source in all_io_objects["zones"][zone].sources: raise FirewallError(errors.INVALID_ADDR, "Zone '{}': source '{}' already bound to zone '{}'".format( self.name, source, zone)) def check_name(self, name): super(Zone, self).check_name(name) if name.startswith('/'): raise FirewallError(errors.INVALID_NAME, "Zone '{}': name can't start with '/'".format(name)) elif name.endswith('/'): raise FirewallError(errors.INVALID_NAME, "Zone '{}': name can't end with '/'".format(name)) elif name.count('/') > 1: raise FirewallError(errors.INVALID_NAME, "Zone '{}': name has more than one '/'".format(name)) else: if "/" in name: checked_name = name[:name.find('/')] else: checked_name = name if len(checked_name) > max_zone_name_len(): raise FirewallError(errors.INVALID_NAME, "Zone '{}': name has {} chars, max is {}".format( name, len(checked_name), max_zone_name_len())) def combine(self, zone): self.combined = True self.filename = None self.version = "" self.short = "" self.description = "" for interface in zone.interfaces: if interface not in self.interfaces: self.interfaces.append(interface) for source in zone.sources: if source not in self.sources: self.sources.append(source) for service in zone.services: if service not in self.services: self.services.append(service) for port in zone.ports: if port not in self.ports: self.ports.append(port) for proto in zone.protocols: if proto not in self.protocols: self.protocols.append(proto) for icmp in zone.icmp_blocks: if icmp not in self.icmp_blocks: self.icmp_blocks.append(icmp) if zone.forward: self.forward = True if zone.masquerade: self.masquerade = True for forward in zone.forward_ports: if forward not in self.forward_ports: self.forward_ports.append(forward) for port in zone.source_ports: if port not in self.source_ports: self.source_ports.append(port) for rule in zone.rules: self.rules.append(rule) self.rules_str.append(str(rule)) if zone.icmp_block_inversion: self.icmp_block_inversion = True # PARSER class zone_ContentHandler(IO_Object_ContentHandler): def __init__(self, item): IO_Object_ContentHandler.__init__(self, item) self._rule = None self._rule_error = False self._limit_ok = None def startElement(self, name, attrs): IO_Object_ContentHandler.startElement(self, name, attrs) if self._rule_error: return self.item.parser_check_element_attrs(name, attrs) if common_startElement(self, name, attrs): return elif name == "zone": if "name" in attrs: log.warning("Ignoring deprecated attribute name='%s'", attrs["name"]) if "version" in attrs: self.item.version = attrs["version"] if "immutable" in attrs: log.warning("Ignoring deprecated attribute immutable='%s'", attrs["immutable"]) if "target" in attrs: target = attrs["target"] if target not in ZONE_TARGETS: raise FirewallError(errors.INVALID_TARGET, target) if target != "" and target != DEFAULT_ZONE_TARGET: self.item.target = target elif name == "forward": if self.item.forward: log.warning("Forward already set, ignoring.") else: self.item.forward = True elif name == "interface": if self._rule: log.warning('Invalid rule: interface use in rule.') self._rule_error = True return # zone bound to interface if "name" not in attrs: log.warning('Invalid interface: Name missing.') self._rule_error = True return if attrs["name"] not in self.item.interfaces: self.item.interfaces.append(attrs["name"]) else: log.warning("Interface '%s' already set, ignoring.", attrs["name"]) elif name == "source": if self._rule: if self._rule.source: log.warning("Invalid rule: More than one source in rule '%s', ignoring.", str(self._rule)) self._rule_error = True return invert = False if "invert" in attrs and \ attrs["invert"].lower() in [ "yes", "true" ]: invert = True addr = mac = ipset = None if "address" in attrs: addr = attrs["address"] if "mac" in attrs: mac = attrs["mac"] if "ipset" in attrs: ipset = attrs["ipset"] self._rule.source = rich.Rich_Source(addr, mac, ipset, invert=invert) return # zone bound to source if "address" not in attrs and "ipset" not in attrs: log.warning('Invalid source: No address no ipset.') return if "address" in attrs and "ipset" in attrs: log.warning('Invalid source: Address and ipset.') return if "family" in attrs: log.warning("Ignoring deprecated attribute family='%s'", attrs["family"]) if "invert" in attrs: log.warning('Invalid source: Invertion not allowed here.') return if "address" in attrs: if not checkIPnMask(attrs["address"]) and \ not checkIP6nMask(attrs["address"]) and \ not check_mac(attrs["address"]): raise FirewallError(errors.INVALID_ADDR, attrs["address"]) if "ipset" in attrs: entry = "ipset:%s" % attrs["ipset"] if entry not in self.item.sources: self.item.sources.append(entry) else: log.warning("Source '%s' already set, ignoring.", attrs["address"]) if "address" in attrs: entry = attrs["address"] if entry not in self.item.sources: self.item.sources.append(entry) else: log.warning("Source '%s' already set, ignoring.", attrs["address"]) elif name == "icmp-block-inversion": if self.item.icmp_block_inversion: log.warning("Icmp-Block-Inversion already set, ignoring.") else: self.item.icmp_block_inversion = True else: log.warning("Unknown XML element '%s'", name) return def endElement(self, name): IO_Object_ContentHandler.endElement(self, name) common_endElement(self, name) def zone_reader(filename, path, no_check_name=False): zone = Zone() if not filename.endswith(".xml"): raise FirewallError(errors.INVALID_NAME, "'%s' is missing .xml suffix" % filename) zone.name = filename[:-4] if not no_check_name: zone.check_name(zone.name) zone.filename = filename zone.path = path zone.builtin = False if path.startswith(config.ETC_FIREWALLD) else True zone.default = zone.builtin # new Zone() objects default this to True, but if reading on disk # configuration we have to assume False, because the absence of # <forward> element indicates False. Presence indicates True. zone.forward = False handler = zone_ContentHandler(zone) parser = sax.make_parser() parser.setContentHandler(handler) name = "%s/%s" % (path, filename) with open(name, "rb") as f: source = sax.InputSource(None) source.setByteStream(f) try: parser.parse(source) except sax.SAXParseException as msg: raise FirewallError(errors.INVALID_ZONE, "not a valid zone file: %s" % \ msg.getException()) del handler del parser return zone def zone_writer(zone, path=None): _path = path if path else zone.path if zone.filename: name = "%s/%s" % (_path, zone.filename) else: name = "%s/%s.xml" % (_path, zone.name) if os.path.exists(name): try: shutil.copy2(name, "%s.old" % name) except Exception as msg: log.error("Backup of file '%s' failed: %s", name, msg) dirpath = os.path.dirname(name) if dirpath.startswith(config.ETC_FIREWALLD) and not os.path.exists(dirpath): if not os.path.exists(config.ETC_FIREWALLD): os.mkdir(config.ETC_FIREWALLD, 0o750) os.mkdir(dirpath, 0o750) f = io.open(name, mode='wt', encoding='UTF-8') handler = IO_Object_XMLGenerator(f) handler.startDocument() # start zone element attrs = {} if zone.version and zone.version != "": attrs["version"] = zone.version if zone.target != DEFAULT_ZONE_TARGET: attrs["target"] = zone.target handler.startElement("zone", attrs) handler.ignorableWhitespace("\n") common_writer(zone, handler) # interfaces for interface in uniqify(zone.interfaces): handler.ignorableWhitespace(" ") handler.simpleElement("interface", { "name": interface }) handler.ignorableWhitespace("\n") # source for source in uniqify(zone.sources): handler.ignorableWhitespace(" ") if "ipset:" in source: handler.simpleElement("source", { "ipset": source[6:] }) else: handler.simpleElement("source", { "address": source }) handler.ignorableWhitespace("\n") # icmp-block-inversion if zone.icmp_block_inversion: handler.ignorableWhitespace(" ") handler.simpleElement("icmp-block-inversion", { }) handler.ignorableWhitespace("\n") # forward if zone.forward: handler.ignorableWhitespace(" ") handler.simpleElement("forward", { }) handler.ignorableWhitespace("\n") # end zone element handler.endElement("zone") handler.ignorableWhitespace("\n") handler.endDocument() f.close() del handler core/io/ipset.py 0000644 00000050013 15025011705 0007574 0 ustar 00 # -*- coding: utf-8 -*- # # Copyright (C) 2015-2016 Red Hat, Inc. # # Authors: # Thomas Woerner <twoerner@redhat.com> # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see <http://www.gnu.org/licenses/>. # """ipset io XML handler, reader, writer""" __all__ = [ "IPSet", "ipset_reader", "ipset_writer" ] import xml.sax as sax import os import io import shutil from firewall import config from firewall.functions import checkIP, checkIP6, checkIPnMask, \ checkIP6nMask, check_mac, check_port, checkInterface, \ checkProtocol from firewall.core.io.io_object import IO_Object, \ IO_Object_ContentHandler, IO_Object_XMLGenerator from firewall.core.ipset import IPSET_TYPES, IPSET_CREATE_OPTIONS from firewall.core.icmp import check_icmp_name, check_icmp_type, \ check_icmpv6_name, check_icmpv6_type from firewall.core.logger import log from firewall import errors from firewall.errors import FirewallError class IPSet(IO_Object): IMPORT_EXPORT_STRUCTURE = ( ( "version", "" ), # s ( "short", "" ), # s ( "description", "" ), # s ( "type", "" ), # s ( "options", { "": "", }, ), # a{ss} ( "entries", [ "" ], ), # as ) DBUS_SIGNATURE = '(ssssa{ss}as)' ADDITIONAL_ALNUM_CHARS = [ "_", "-", ":", "." ] PARSER_REQUIRED_ELEMENT_ATTRS = { "short": None, "description": None, "ipset": [ "type" ], "option": [ "name" ], "entry": None, } PARSER_OPTIONAL_ELEMENT_ATTRS = { "ipset": [ "version" ], "option": [ "value" ], } def __init__(self): super(IPSet, self).__init__() self.version = "" self.short = "" self.description = "" self.type = "" self.entries = [ ] self.options = { } self.applied = False def cleanup(self): self.version = "" self.short = "" self.description = "" self.type = "" del self.entries[:] self.options.clear() self.applied = False @staticmethod def check_entry(entry, options, ipset_type): family = "ipv4" if "family" in options: if options["family"] == "inet6": family = "ipv6" if not ipset_type.startswith("hash:"): raise FirewallError(errors.INVALID_IPSET, "ipset type '%s' not usable" % ipset_type) flags = ipset_type[5:].split(",") items = entry.split(",") if len(flags) != len(items) or len(flags) < 1: raise FirewallError( errors.INVALID_ENTRY, "entry '%s' does not match ipset type '%s'" % \ (entry, ipset_type)) for i, flag in enumerate(flags): item = items[i] if flag == "ip": if "-" in item and family == "ipv4": # IP ranges only with plain IPs, no masks if i > 1: raise FirewallError( errors.INVALID_ENTRY, "invalid address '%s' in '%s'[%d]" % \ (item, entry, i)) splits = item.split("-") if len(splits) != 2: raise FirewallError( errors.INVALID_ENTRY, "invalid address range '%s' in '%s' for %s (%s)" % \ (item, entry, ipset_type, family)) for _split in splits: if (family == "ipv4" and not checkIP(_split)) or \ (family == "ipv6" and not checkIP6(_split)): raise FirewallError( errors.INVALID_ENTRY, "invalid address '%s' in '%s' for %s (%s)" % \ (_split, entry, ipset_type, family)) else: # IPs with mask only allowed in the first # position of the type if family == "ipv4": if item == "0.0.0.0": raise FirewallError( errors.INVALID_ENTRY, "invalid address '%s' in '%s' for %s (%s)" % \ (item, entry, ipset_type, family)) if i == 0: ip_check = checkIPnMask else: ip_check = checkIP else: ip_check = checkIP6 if not ip_check(item): raise FirewallError( errors.INVALID_ENTRY, "invalid address '%s' in '%s' for %s (%s)" % \ (item, entry, ipset_type, family)) elif flag == "net": if "-" in item: # IP ranges only with plain IPs, no masks splits = item.split("-") if len(splits) != 2: raise FirewallError( errors.INVALID_ENTRY, "invalid address range '%s' in '%s' for %s (%s)" % \ (item, entry, ipset_type, family)) # First part can only be a plain IP if (family == "ipv4" and not checkIP(splits[0])) or \ (family == "ipv6" and not checkIP6(splits[0])): raise FirewallError( errors.INVALID_ENTRY, "invalid address '%s' in '%s' for %s (%s)" % \ (splits[0], entry, ipset_type, family)) # Second part can also have a mask if (family == "ipv4" and not checkIPnMask(splits[1])) or \ (family == "ipv6" and not checkIP6nMask(splits[1])): raise FirewallError( errors.INVALID_ENTRY, "invalid address '%s' in '%s' for %s (%s)" % \ (splits[1], entry, ipset_type, family)) else: # IPs with mask allowed in all positions, but no /0 if item.endswith("/0"): if not (family == "ipv6" and i == 0 and ipset_type == "hash:net,iface"): raise FirewallError( errors.INVALID_ENTRY, "invalid address '%s' in '%s' for %s (%s)" % \ (item, entry, ipset_type, family)) if (family == "ipv4" and not checkIPnMask(item)) or \ (family == "ipv6" and not checkIP6nMask(item)): raise FirewallError( errors.INVALID_ENTRY, "invalid address '%s' in '%s' for %s (%s)" % \ (item, entry, ipset_type, family)) elif flag == "mac": # ipset does not allow to add 00:00:00:00:00:00 if not check_mac(item) or item == "00:00:00:00:00:00": raise FirewallError( errors.INVALID_ENTRY, "invalid mac address '%s' in '%s'" % (item, entry)) elif flag == "port": if ":" in item: splits = item.split(":") if len(splits) != 2: raise FirewallError( errors.INVALID_ENTRY, "invalid port '%s'" % (item)) if splits[0] == "icmp": if family != "ipv4": raise FirewallError( errors.INVALID_ENTRY, "invalid protocol for family '%s' in '%s'" % \ (family, entry)) if not check_icmp_name(splits[1]) and not \ check_icmp_type(splits[1]): raise FirewallError( errors.INVALID_ENTRY, "invalid icmp type '%s' in '%s'" % \ (splits[1], entry)) elif splits[0] in [ "icmpv6", "ipv6-icmp" ]: if family != "ipv6": raise FirewallError( errors.INVALID_ENTRY, "invalid protocol for family '%s' in '%s'" % \ (family, entry)) if not check_icmpv6_name(splits[1]) and not \ check_icmpv6_type(splits[1]): raise FirewallError( errors.INVALID_ENTRY, "invalid icmpv6 type '%s' in '%s'" % \ (splits[1], entry)) elif splits[0] not in [ "tcp", "sctp", "udp", "udplite" ] \ and not checkProtocol(splits[0]): raise FirewallError( errors.INVALID_ENTRY, "invalid protocol '%s' in '%s'" % (splits[0], entry)) elif not check_port(splits[1]): raise FirewallError( errors.INVALID_ENTRY, "invalid port '%s'in '%s'" % (splits[1], entry)) else: if not check_port(item): raise FirewallError( errors.INVALID_ENTRY, "invalid port '%s' in '%s'" % (item, entry)) elif flag == "mark": if item.startswith("0x"): try: int_val = int(item, 16) except ValueError: raise FirewallError( errors.INVALID_ENTRY, "invalid mark '%s' in '%s'" % (item, entry)) else: try: int_val = int(item) except ValueError: raise FirewallError( errors.INVALID_ENTRY, "invalid mark '%s' in '%s'" % (item, entry)) if int_val < 0 or int_val > 4294967295: raise FirewallError( errors.INVALID_ENTRY, "invalid mark '%s' in '%s'" % (item, entry)) elif flag == "iface": if not checkInterface(item) or len(item) > 15: raise FirewallError( errors.INVALID_ENTRY, "invalid interface '%s' in '%s'" % (item, entry)) else: raise FirewallError(errors.INVALID_IPSET, "ipset type '%s' not usable" % ipset_type) def _check_config(self, config, item, all_config, all_io_objects): if item == "type": if config not in IPSET_TYPES: raise FirewallError(errors.INVALID_TYPE, "'%s' is not valid ipset type" % config) if item == "options": for key in config.keys(): if key not in IPSET_CREATE_OPTIONS: raise FirewallError(errors.INVALID_IPSET, "ipset invalid option '%s'" % key) if key in [ "timeout", "hashsize", "maxelem" ]: try: int_value = int(config[key]) except ValueError: raise FirewallError( errors.INVALID_VALUE, "Option '%s': Value '%s' is not an integer" % \ (key, config[key])) if int_value < 0: raise FirewallError( errors.INVALID_VALUE, "Option '%s': Value '%s' is negative" % \ (key, config[key])) elif key == "family" and \ config[key] not in [ "inet", "inet6" ]: raise FirewallError(errors.INVALID_FAMILY, config[key]) def import_config(self, config, all_io_objects): if "timeout" in config[4] and config[4]["timeout"] != "0": if len(config[5]) != 0: raise FirewallError(errors.IPSET_WITH_TIMEOUT) for entry in config[5]: IPSet.check_entry(entry, config[4], config[3]) super(IPSet, self).import_config(config, all_io_objects) # PARSER class ipset_ContentHandler(IO_Object_ContentHandler): def startElement(self, name, attrs): IO_Object_ContentHandler.startElement(self, name, attrs) self.item.parser_check_element_attrs(name, attrs) if name == "ipset": if "type" in attrs: if attrs["type"] not in IPSET_TYPES: raise FirewallError(errors.INVALID_TYPE, "%s" % attrs["type"]) self.item.type = attrs["type"] if "version" in attrs: self.item.version = attrs["version"] elif name == "short": pass elif name == "description": pass elif name == "option": value = "" if "value" in attrs: value = attrs["value"] if attrs["name"] not in \ [ "family", "timeout", "hashsize", "maxelem" ]: raise FirewallError( errors.INVALID_OPTION, "Unknown option '%s'" % attrs["name"]) if self.item.type == "hash:mac" and attrs["name"] in [ "family" ]: raise FirewallError( errors.INVALID_OPTION, "Unsupported option '%s' for type '%s'" % \ (attrs["name"], self.item.type)) if attrs["name"] in [ "family", "timeout", "hashsize", "maxelem" ] \ and not value: raise FirewallError( errors.INVALID_OPTION, "Missing mandatory value of option '%s'" % attrs["name"]) if attrs["name"] in [ "timeout", "hashsize", "maxelem" ]: try: int_value = int(value) except ValueError: raise FirewallError( errors.INVALID_VALUE, "Option '%s': Value '%s' is not an integer" % \ (attrs["name"], value)) if int_value < 0: raise FirewallError( errors.INVALID_VALUE, "Option '%s': Value '%s' is negative" % \ (attrs["name"], value)) if attrs["name"] == "family" and value not in [ "inet", "inet6" ]: raise FirewallError(errors.INVALID_FAMILY, value) if attrs["name"] not in self.item.options: self.item.options[attrs["name"]] = value else: log.warning("Option %s already set, ignoring.", attrs["name"]) # nothing to do for entry and entries here def endElement(self, name): IO_Object_ContentHandler.endElement(self, name) if name == "entry": self.item.entries.append(self._element) def ipset_reader(filename, path): ipset = IPSet() if not filename.endswith(".xml"): raise FirewallError(errors.INVALID_NAME, "'%s' is missing .xml suffix" % filename) ipset.name = filename[:-4] ipset.check_name(ipset.name) ipset.filename = filename ipset.path = path ipset.builtin = False if path.startswith(config.ETC_FIREWALLD) else True ipset.default = ipset.builtin handler = ipset_ContentHandler(ipset) parser = sax.make_parser() parser.setContentHandler(handler) name = "%s/%s" % (path, filename) with open(name, "rb") as f: source = sax.InputSource(None) source.setByteStream(f) try: parser.parse(source) except sax.SAXParseException as msg: raise FirewallError(errors.INVALID_IPSET, "not a valid ipset file: %s" % \ msg.getException()) del handler del parser if "timeout" in ipset.options and ipset.options["timeout"] != "0" and \ len(ipset.entries) > 0: # no entries visible for ipsets with timeout log.warning("ipset '%s': timeout option is set, entries are ignored", ipset.name) del ipset.entries[:] i = 0 entries_set = set() while i < len(ipset.entries): if ipset.entries[i] in entries_set: log.warning("Entry %s already set, ignoring.", ipset.entries[i]) ipset.entries.pop(i) else: try: ipset.check_entry(ipset.entries[i], ipset.options, ipset.type) except FirewallError as e: log.warning("%s, ignoring.", e) ipset.entries.pop(i) else: entries_set.add(ipset.entries[i]) i += 1 del entries_set return ipset def ipset_writer(ipset, path=None): _path = path if path else ipset.path if ipset.filename: name = "%s/%s" % (_path, ipset.filename) else: name = "%s/%s.xml" % (_path, ipset.name) if os.path.exists(name): try: shutil.copy2(name, "%s.old" % name) except Exception as msg: log.error("Backup of file '%s' failed: %s", name, msg) dirpath = os.path.dirname(name) if dirpath.startswith(config.ETC_FIREWALLD) and not os.path.exists(dirpath): if not os.path.exists(config.ETC_FIREWALLD): os.mkdir(config.ETC_FIREWALLD, 0o750) os.mkdir(dirpath, 0o750) f = io.open(name, mode='wt', encoding='UTF-8') handler = IO_Object_XMLGenerator(f) handler.startDocument() # start ipset element attrs = { "type": ipset.type } if ipset.version and ipset.version != "": attrs["version"] = ipset.version handler.startElement("ipset", attrs) handler.ignorableWhitespace("\n") # short if ipset.short and ipset.short != "": handler.ignorableWhitespace(" ") handler.startElement("short", { }) handler.characters(ipset.short) handler.endElement("short") handler.ignorableWhitespace("\n") # description if ipset.description and ipset.description != "": handler.ignorableWhitespace(" ") handler.startElement("description", { }) handler.characters(ipset.description) handler.endElement("description") handler.ignorableWhitespace("\n") # options for key,value in ipset.options.items(): handler.ignorableWhitespace(" ") if value != "": handler.simpleElement("option", { "name": key, "value": value }) else: handler.simpleElement("option", { "name": key }) handler.ignorableWhitespace("\n") # entries for entry in ipset.entries: handler.ignorableWhitespace(" ") handler.startElement("entry", { }) handler.characters(entry) handler.endElement("entry") handler.ignorableWhitespace("\n") # end ipset element handler.endElement('ipset') handler.ignorableWhitespace("\n") handler.endDocument() f.close() del handler core/io/ifcfg.py 0000644 00000014233 15025011705 0007532 0 ustar 00 # -*- coding: utf-8 -*- # # Copyright (C) 2011-2016 Red Hat, Inc. # # Authors: # Thomas Woerner <twoerner@redhat.com> # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see <http://www.gnu.org/licenses/>. # """ifcfg file parser""" __all__ = [ "ifcfg" ] import os.path import io import tempfile import shutil from firewall.core.logger import log class ifcfg(object): def __init__(self, filename): self._config = { } self._deleted = [ ] self.filename = filename self.clear() def clear(self): self._config = { } self._deleted = [ ] def cleanup(self): self._config.clear() def get(self, key): return self._config.get(key.strip()) def set(self, key, value): _key = key.strip() self._config[_key] = value.strip() if _key in self._deleted: self._deleted.remove(_key) def __str__(self): s = "" for (key, value) in self._config.items(): if s: s += '\n' s += '%s=%s' % (key, value) return s # load self.filename def read(self): self.clear() try: f = open(self.filename, "r") except Exception as msg: log.error("Failed to load '%s': %s", self.filename, msg) raise for line in f: if not line: break line = line.strip() if len(line) < 1 or line[0] in ['#', ';']: continue # get key/value pair pair = [ x.strip() for x in line.split("=", 1) ] if len(pair) != 2: continue if len(pair[1]) >= 2 and \ pair[1].startswith('"') and pair[1].endswith('"'): pair[1] = pair[1][1:-1] if pair[1] == '': continue elif self._config.get(pair[0]) is not None: log.warning("%s: Duplicate option definition: '%s'", self.filename, line.strip()) continue self._config[pair[0]] = pair[1] f.close() def write(self): if len(self._config) < 1: # no changes: nothing to do return # handled keys done = [ ] try: temp_file = tempfile.NamedTemporaryFile( mode='wt', prefix="%s." % os.path.basename(self.filename), dir=os.path.dirname(self.filename), delete=False) except Exception as msg: log.error("Failed to open temporary file: %s" % msg) raise modified = False empty = False try: f = io.open(self.filename, mode='rt', encoding='UTF-8') except Exception as msg: if os.path.exists(self.filename): log.error("Failed to open '%s': %s" % (self.filename, msg)) raise else: f = None else: for line in f: if not line: break # remove newline line = line.strip("\n") if len(line) < 1: if not empty: temp_file.write(u"\n") empty = True elif line[0] == '#': empty = False temp_file.write(line) temp_file.write(u"\n") else: p = line.split("=", 1) if len(p) != 2: empty = False temp_file.write(line+u"\n") continue key = p[0].strip() value = p[1].strip() if len(value) >= 2 and \ value.startswith('"') and value.endswith('"'): value = value[1:-1] # check for modified key/value pairs if key not in done: if key in self._config and self._config[key] != value: empty = False temp_file.write(u'%s=%s\n' % (key, self._config[key])) modified = True elif key in self._deleted: modified = True else: empty = False temp_file.write(line+u"\n") done.append(key) else: modified = True # write remaining key/value pairs if len(self._config) > 0: for (key, value) in self._config.items(): if key in done: continue if not empty: empty = True temp_file.write(u'%s=%s\n' % (key, value)) modified = True if f: f.close() temp_file.close() if not modified: # not modified: remove tempfile os.remove(temp_file.name) return # make backup if os.path.exists(self.filename): try: shutil.copy2(self.filename, "%s.bak" % self.filename) except Exception as msg: os.remove(temp_file.name) raise IOError("Backup of '%s' failed: %s" % (self.filename, msg)) # copy tempfile try: shutil.move(temp_file.name, self.filename) except Exception as msg: os.remove(temp_file.name) raise IOError("Failed to create '%s': %s" % (self.filename, msg)) else: os.chmod(self.filename, 0o600) core/io/__init__.py 0000644 00000003074 15025011705 0010214 0 ustar 00 # -*- coding: utf-8 -*- # # Copyright (C) 2012 Red Hat, Inc. # # Authors: # Thomas Woerner <twoerner@redhat.com> # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see <http://www.gnu.org/licenses/>. # # fix xmlplus to be compatible with the python xml sax parser and python 3 # by adding __contains__ to xml.sax.xmlreader.AttributesImpl import xml if "_xmlplus" in xml.__file__: from xml.sax.xmlreader import AttributesImpl if not hasattr(AttributesImpl, "__contains__"): # this is missing: def __AttributesImpl__contains__(self, name): return name in getattr(self, "_attrs") # add it using the name __contains__ setattr(AttributesImpl, "__contains__", __AttributesImpl__contains__) from xml.sax.saxutils import XMLGenerator if not hasattr(XMLGenerator, "_write"): # this is missing: def __XMLGenerator_write(self, text): getattr(self, "_out").write(text) # add it using the name _write setattr(XMLGenerator, "_write", __XMLGenerator_write) core/io/service.py 0000644 00000030047 15025011705 0010115 0 ustar 00 # -*- coding: utf-8 -*- # # Copyright (C) 2011-2016 Red Hat, Inc. # # Authors: # Thomas Woerner <twoerner@redhat.com> # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see <http://www.gnu.org/licenses/>. # __all__ = [ "Service", "service_reader", "service_writer" ] import xml.sax as sax import os import io import shutil from firewall import config from firewall.core.io.io_object import IO_Object, \ IO_Object_ContentHandler, IO_Object_XMLGenerator, check_port, \ check_tcpudp, check_protocol, check_address from firewall.core.logger import log from firewall import errors from firewall.errors import FirewallError class Service(IO_Object): IMPORT_EXPORT_STRUCTURE = ( ( "version", "" ), ( "short", "" ), ( "description", "" ), ( "ports", [ ( "", "" ), ], ), ( "modules", [ "", ], ), ( "destination", { "": "", }, ), ( "protocols", [ "", ], ), ( "source_ports", [ ( "", "" ), ], ), ( "includes", [ "" ], ), ( "helpers", [ "", ], ), ) ADDITIONAL_ALNUM_CHARS = [ "_", "-" ] PARSER_REQUIRED_ELEMENT_ATTRS = { "short": None, "description": None, "service": None, } PARSER_OPTIONAL_ELEMENT_ATTRS = { "service": [ "name", "version" ], "port": [ "port", "protocol" ], "protocol": [ "value" ], "module": [ "name" ], "destination": [ "ipv4", "ipv6" ], "source-port": [ "port", "protocol" ], "include": [ "service" ], "helper": [ "name" ], } def __init__(self): super(Service, self).__init__() self.version = "" self.short = "" self.description = "" self.ports = [ ] self.protocols = [ ] self.modules = [ ] self.destination = { } self.source_ports = [ ] self.includes = [ ] self.helpers = [ ] def cleanup(self): self.version = "" self.short = "" self.description = "" del self.ports[:] del self.protocols[:] del self.modules[:] self.destination.clear() del self.source_ports[:] del self.includes[:] del self.helpers[:] def _check_config(self, config, item, all_config, all_io_objects): if item == "ports": for port in config: if port[0] != "": check_port(port[0]) check_tcpudp(port[1]) else: # only protocol check_protocol(port[1]) elif item == "protocols": for proto in config: check_protocol(proto) elif item == "source_ports": for port in config: check_port(port[0]) check_tcpudp(port[1]) elif item == "destination": for destination in config: if destination not in [ "ipv4", "ipv6" ]: raise FirewallError(errors.INVALID_DESTINATION, "'%s' not in {'ipv4'|'ipv6'}" % \ destination) check_address(destination, config[destination]) elif item == "modules": for module in config: if module.startswith("nf_conntrack_"): module = module.replace("nf_conntrack_", "") if "_" in module: module = module.replace("_", "-") if len(module) < 2: raise FirewallError(errors.INVALID_MODULE, module) elif item == "includes": for include in config: if include not in all_io_objects["services"]: raise FirewallError(errors.INVALID_SERVICE, "Service '{}': Included service '{}' not found.".format( self.name, include)) # PARSER class service_ContentHandler(IO_Object_ContentHandler): def startElement(self, name, attrs): IO_Object_ContentHandler.startElement(self, name, attrs) self.item.parser_check_element_attrs(name, attrs) if name == "service": if "name" in attrs: log.warning("Ignoring deprecated attribute name='%s'", attrs["name"]) if "version" in attrs: self.item.version = attrs["version"] elif name == "short": pass elif name == "description": pass elif name == "port": if attrs["port"] != "": check_port(attrs["port"]) check_tcpudp(attrs["protocol"]) entry = (attrs["port"], attrs["protocol"]) if entry not in self.item.ports: self.item.ports.append(entry) else: log.warning("Port '%s/%s' already set, ignoring.", attrs["port"], attrs["protocol"]) else: check_protocol(attrs["protocol"]) if attrs["protocol"] not in self.item.protocols: self.item.protocols.append(attrs["protocol"]) else: log.warning("Protocol '%s' already set, ignoring.", attrs["protocol"]) elif name == "protocol": check_protocol(attrs["value"]) if attrs["value"] not in self.item.protocols: self.item.protocols.append(attrs["value"]) else: log.warning("Protocol '%s' already set, ignoring.", attrs["value"]) elif name == "source-port": check_port(attrs["port"]) check_tcpudp(attrs["protocol"]) entry = (attrs["port"], attrs["protocol"]) if entry not in self.item.source_ports: self.item.source_ports.append(entry) else: log.warning("SourcePort '%s/%s' already set, ignoring.", attrs["port"], attrs["protocol"]) elif name == "destination": for x in [ "ipv4", "ipv6" ]: if x in attrs: check_address(x, attrs[x]) if x in self.item.destination: log.warning("Destination address for '%s' already set, ignoring", x) else: self.item.destination[x] = attrs[x] elif name == "module": module = attrs["name"] if module.startswith("nf_conntrack_"): module = module.replace("nf_conntrack_", "") if "_" in module: module = module.replace("_", "-") if module not in self.item.modules: self.item.modules.append(module) else: log.warning("Module '%s' already set, ignoring.", module) elif name == "include": if attrs["service"] not in self.item.includes: self.item.includes.append(attrs["service"]) else: log.warning("Include '%s' already set, ignoring.", attrs["service"]) elif name == "helper": if attrs["name"] not in self.item.helpers: self.item.helpers.append(attrs["name"]) else: log.warning("Helper '%s' already set, ignoring.", attrs["name"]) def service_reader(filename, path): service = Service() if not filename.endswith(".xml"): raise FirewallError(errors.INVALID_NAME, "'%s' is missing .xml suffix" % filename) service.name = filename[:-4] service.check_name(service.name) service.filename = filename service.path = path service.builtin = False if path.startswith(config.ETC_FIREWALLD) else True service.default = service.builtin handler = service_ContentHandler(service) parser = sax.make_parser() parser.setContentHandler(handler) name = "%s/%s" % (path, filename) with open(name, "rb") as f: source = sax.InputSource(None) source.setByteStream(f) try: parser.parse(source) except sax.SAXParseException as msg: raise FirewallError(errors.INVALID_SERVICE, "not a valid service file: %s" % \ msg.getException()) del handler del parser return service def service_writer(service, path=None): _path = path if path else service.path if service.filename: name = "%s/%s" % (_path, service.filename) else: name = "%s/%s.xml" % (_path, service.name) if os.path.exists(name): try: shutil.copy2(name, "%s.old" % name) except Exception as msg: log.error("Backup of file '%s' failed: %s", name, msg) dirpath = os.path.dirname(name) if dirpath.startswith(config.ETC_FIREWALLD) and not os.path.exists(dirpath): if not os.path.exists(config.ETC_FIREWALLD): os.mkdir(config.ETC_FIREWALLD, 0o750) os.mkdir(dirpath, 0o750) f = io.open(name, mode='wt', encoding='UTF-8') handler = IO_Object_XMLGenerator(f) handler.startDocument() # start service element attrs = {} if service.version and service.version != "": attrs["version"] = service.version handler.startElement("service", attrs) handler.ignorableWhitespace("\n") # short if service.short and service.short != "": handler.ignorableWhitespace(" ") handler.startElement("short", { }) handler.characters(service.short) handler.endElement("short") handler.ignorableWhitespace("\n") # description if service.description and service.description != "": handler.ignorableWhitespace(" ") handler.startElement("description", { }) handler.characters(service.description) handler.endElement("description") handler.ignorableWhitespace("\n") # ports for port in service.ports: handler.ignorableWhitespace(" ") handler.simpleElement("port", { "port": port[0], "protocol": port[1] }) handler.ignorableWhitespace("\n") # protocols for protocol in service.protocols: handler.ignorableWhitespace(" ") handler.simpleElement("protocol", { "value": protocol }) handler.ignorableWhitespace("\n") # source ports for port in service.source_ports: handler.ignorableWhitespace(" ") handler.simpleElement("source-port", { "port": port[0], "protocol": port[1] }) handler.ignorableWhitespace("\n") # modules for module in service.modules: handler.ignorableWhitespace(" ") handler.simpleElement("module", { "name": module }) handler.ignorableWhitespace("\n") # destination if len(service.destination) > 0: handler.ignorableWhitespace(" ") handler.simpleElement("destination", service.destination) handler.ignorableWhitespace("\n") # includes for include in service.includes: handler.ignorableWhitespace(" ") handler.simpleElement("include", { "service": include }) handler.ignorableWhitespace("\n") # helpers for helper in service.helpers: handler.ignorableWhitespace(" ") handler.simpleElement("helper", { "name": helper }) handler.ignorableWhitespace("\n") # end service element handler.endElement('service') handler.ignorableWhitespace("\n") handler.endDocument() f.close() del handler core/io/direct.py 0000644 00000036324 15025011705 0007733 0 ustar 00 # -*- coding: utf-8 -*- # # Copyright (C) 2011-2016 Red Hat, Inc. # # Authors: # Thomas Woerner <twoerner@redhat.com> # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see <http://www.gnu.org/licenses/>. # import xml.sax as sax import os import io import shutil from firewall import config from firewall.fw_types import LastUpdatedOrderedDict from firewall.functions import splitArgs, joinArgs from firewall.core.io.io_object import IO_Object, IO_Object_ContentHandler, \ IO_Object_XMLGenerator from firewall.core.logger import log from firewall.core import ipXtables from firewall.core import ebtables from firewall import errors from firewall.errors import FirewallError class direct_ContentHandler(IO_Object_ContentHandler): def __init__(self, item): IO_Object_ContentHandler.__init__(self, item) self.direct = False def startElement(self, name, attrs): IO_Object_ContentHandler.startElement(self, name, attrs) self.item.parser_check_element_attrs(name, attrs) if name == "direct": if self.direct: raise FirewallError(errors.PARSE_ERROR, "More than one direct tag.") self.direct = True elif name == "chain": if not self.direct: log.error("Parse Error: chain outside of direct") return ipv = attrs["ipv"] table = attrs["table"] chain = attrs["chain"] self.item.add_chain(ipv, table, chain) elif name == "rule": if not self.direct: log.error("Parse Error: rule outside of direct") return ipv = attrs["ipv"] if ipv not in [ "ipv4", "ipv6", "eb" ]: raise FirewallError(errors.INVALID_IPV, "'%s' not from {'ipv4'|'ipv6'|'eb'}" % ipv) table = attrs["table"] chain = attrs["chain"] try: priority = int(attrs["priority"]) except ValueError: log.error("Parse Error: %s is not a valid priority" % attrs["priority"]) return self._rule = [ ipv, table, chain, priority ] elif name == "passthrough": if not self.direct: log.error("Parse Error: command outside of direct") return ipv = attrs["ipv"] self._passthrough = [ ipv ] else: log.error('Unknown XML element %s' % name) return def endElement(self, name): IO_Object_ContentHandler.endElement(self, name) if name == "rule": if self._element: # add arguments self._rule.append(splitArgs(self._element)) self.item.add_rule(*self._rule) else: log.error("Error: rule does not have any arguments, ignoring.") self._rule = None elif name == "passthrough": if self._element: # add arguments self._passthrough.append(splitArgs(self._element)) self.item.add_passthrough(*self._passthrough) else: log.error("Error: passthrough does not have any arguments, " + "ignoring.") self._passthrough = None class Direct(IO_Object): """ Direct class """ IMPORT_EXPORT_STRUCTURE = ( # chain: [ ipv, table, [ chain ] ] ( "chains", [ ( "", "", "" ), ], ), # a(sss) # rule: [ ipv, table, chain, [ priority, [ arg ] ] ] ( "rules", [ ( "", "", "", 0, [ "" ] ), ], ), # a(sssias) # passthrough: [ ipv, [ [ arg ] ] ] ( "passthroughs", [ ( "", [ "" ]), ], ), # a(sas) ) DBUS_SIGNATURE = '(a(sss)a(sssias)a(sas))' PARSER_REQUIRED_ELEMENT_ATTRS = { "direct": None, "chain": [ "ipv", "table", "chain" ], "rule": [ "ipv", "table", "chain", "priority" ], "passthrough": [ "ipv" ] } PARSER_OPTIONAL_ELEMENT_ATTRS = { } def __init__(self, filename): super(Direct, self).__init__() self.filename = filename self.chains = LastUpdatedOrderedDict() self.rules = LastUpdatedOrderedDict() self.passthroughs = LastUpdatedOrderedDict() def _check_config(self, conf, item, all_conf, all_io_objects): pass # check arg lists def export_config(self): ret = [ ] x = [ ] for key in self.chains: for chain in self.chains[key]: x.append(tuple(list(key) + list([chain]))) ret.append(x) x = [ ] for key in self.rules: for rule in self.rules[key]: x.append(tuple((key[0], key[1], key[2], rule[0], list(rule[1])))) ret.append(x) x = [ ] for key in self.passthroughs: for rule in self.passthroughs[key]: x.append(tuple((key, list(rule)))) ret.append(x) return tuple(ret) def import_config(self, conf, all_io_objects): self.cleanup() self.check_config(conf) for i,(element,dummy) in enumerate(self.IMPORT_EXPORT_STRUCTURE): if element == "chains": for x in conf[i]: self.add_chain(*x) if element == "rules": for x in conf[i]: self.add_rule(*x) if element == "passthroughs": for x in conf[i]: self.add_passthrough(*x) def cleanup(self): self.chains.clear() self.rules.clear() self.passthroughs.clear() def output(self): print("chains") for key in self.chains: print(" (%s, %s): %s" % (key[0], key[1], ",".join(self.chains[key]))) print("rules") for key in self.rules: print(" (%s, %s, %s):" % (key[0], key[1], key[2])) for (priority,args) in self.rules[key]: print(" (%d, ('%s'))" % (priority, "','".join(args))) print("passthroughs") for key in self.passthroughs: print(" %s:" % (key)) for args in self.passthroughs[key]: print(" ('%s')" % ("','".join(args))) def _check_ipv(self, ipv): ipvs = ['ipv4', 'ipv6', 'eb'] if ipv not in ipvs: raise FirewallError(errors.INVALID_IPV, "'%s' not in '%s'" % (ipv, ipvs)) def _check_ipv_table(self, ipv, table): self._check_ipv(ipv) tables = ipXtables.BUILT_IN_CHAINS.keys() if ipv in ['ipv4', 'ipv6'] \ else ebtables.BUILT_IN_CHAINS.keys() if table not in tables: raise FirewallError(errors.INVALID_TABLE, "'%s' not in '%s'" % (table, tables)) # chains def add_chain(self, ipv, table, chain): self._check_ipv_table(ipv, table) key = (ipv, table) if key not in self.chains: self.chains[key] = [ ] if chain not in self.chains[key]: self.chains[key].append(chain) else: log.warning("Chain '%s' for table '%s' with ipv '%s' " % \ (chain, table, ipv) + "already in list, ignoring") def remove_chain(self, ipv, table, chain): self._check_ipv_table(ipv, table) key = (ipv, table) if key in self.chains and chain in self.chains[key]: self.chains[key].remove(chain) if len(self.chains[key]) == 0: del self.chains[key] else: raise ValueError( \ "Chain '%s' with table '%s' with ipv '%s' not in list" % \ (chain, table, ipv)) def query_chain(self, ipv, table, chain): self._check_ipv_table(ipv, table) key = (ipv, table) return (key in self.chains and chain in self.chains[key]) def get_chains(self, ipv, table): self._check_ipv_table(ipv, table) key = (ipv, table) if key in self.chains: return self.chains[key] else: raise ValueError("No chains for table '%s' with ipv '%s'" % \ (table, ipv)) def get_all_chains(self): return self.chains # rules def add_rule(self, ipv, table, chain, priority, args): self._check_ipv_table(ipv, table) key = (ipv, table, chain) if key not in self.rules: self.rules[key] = LastUpdatedOrderedDict() value = (priority, tuple(args)) if value not in self.rules[key]: self.rules[key][value] = priority else: log.warning("Rule '%s' for table '%s' and chain '%s' " % \ ("',".join(args), table, chain) + "with ipv '%s' and priority %d " % (ipv, priority) + "already in list, ignoring") def remove_rule(self, ipv, table, chain, priority, args): self._check_ipv_table(ipv, table) key = (ipv, table, chain) value = (priority, tuple(args)) if key in self.rules and value in self.rules[key]: del self.rules[key][value] if len(self.rules[key]) == 0: del self.rules[key] else: raise ValueError("Rule '%s' for table '%s' and chain '%s' " % \ ("',".join(args), table, chain) + \ "with ipv '%s' and priority %d not in list" % (ipv, priority)) def remove_rules(self, ipv, table, chain): self._check_ipv_table(ipv, table) key = (ipv, table, chain) if key in self.rules: for value in self.rules[key].keys(): del self.rules[key][value] if len(self.rules[key]) == 0: del self.rules[key] def query_rule(self, ipv, table, chain, priority, args): self._check_ipv_table(ipv, table) key = (ipv, table, chain) value = (priority, tuple(args)) return (key in self.rules and value in self.rules[key]) def get_rules(self, ipv, table, chain): self._check_ipv_table(ipv, table) key = (ipv, table, chain) if key in self.rules: return self.rules[key] else: raise ValueError("No rules for table '%s' and chain '%s' " %\ (table, chain) + "with ipv '%s'" % (ipv)) def get_all_rules(self): return self.rules # # passthrough # def add_passthrough(self, ipv, args): self._check_ipv(ipv) if ipv not in self.passthroughs: self.passthroughs[ipv] = [ ] if args not in self.passthroughs[ipv]: self.passthroughs[ipv].append(args) else: log.warning("Passthrough '%s' for ipv '%s'" % \ ("',".join(args), ipv) + "already in list, ignoring") def remove_passthrough(self, ipv, args): self._check_ipv(ipv) if ipv in self.passthroughs and args in self.passthroughs[ipv]: self.passthroughs[ipv].remove(args) if len(self.passthroughs[ipv]) == 0: del self.passthroughs[ipv] else: raise ValueError("Passthrough '%s' for ipv '%s'" % \ ("',".join(args), ipv) + "not in list") def query_passthrough(self, ipv, args): self._check_ipv(ipv) return ipv in self.passthroughs and args in self.passthroughs[ipv] def get_passthroughs(self, ipv): self._check_ipv(ipv) if ipv in self.passthroughs: return self.passthroughs[ipv] else: raise ValueError("No passthroughs for ipv '%s'" % (ipv)) def get_all_passthroughs(self): return self.passthroughs # read def read(self): self.cleanup() if not self.filename.endswith(".xml"): raise FirewallError(errors.INVALID_NAME, "'%s' is missing .xml suffix" % self.filename) handler = direct_ContentHandler(self) parser = sax.make_parser() parser.setContentHandler(handler) with open(self.filename, "rb") as f: source = sax.InputSource(None) source.setByteStream(f) try: parser.parse(source) except sax.SAXParseException as msg: raise FirewallError(errors.INVALID_TYPE, "Not a valid file: %s" % \ msg.getException()) def write(self): if os.path.exists(self.filename): try: shutil.copy2(self.filename, "%s.old" % self.filename) except Exception as msg: raise IOError("Backup of '%s' failed: %s" % (self.filename, msg)) if not os.path.exists(config.ETC_FIREWALLD): os.mkdir(config.ETC_FIREWALLD, 0o750) f = io.open(self.filename, mode='wt', encoding='UTF-8') handler = IO_Object_XMLGenerator(f) handler.startDocument() # start whitelist element handler.startElement("direct", { }) handler.ignorableWhitespace("\n") # chains for key in self.chains: (ipv, table) = key for chain in self.chains[key]: handler.ignorableWhitespace(" ") handler.simpleElement("chain", { "ipv": ipv, "table": table, "chain": chain }) handler.ignorableWhitespace("\n") # rules for key in self.rules: (ipv, table, chain) = key for (priority, args) in self.rules[key]: if len(args) < 1: continue handler.ignorableWhitespace(" ") handler.startElement("rule", { "ipv": ipv, "table": table, "chain": chain, "priority": "%d" % priority }) handler.ignorableWhitespace(sax.saxutils.escape(joinArgs(args))) handler.endElement("rule") handler.ignorableWhitespace("\n") # passthroughs for ipv in self.passthroughs: for args in self.passthroughs[ipv]: if len(args) < 1: continue handler.ignorableWhitespace(" ") handler.startElement("passthrough", { "ipv": ipv }) handler.ignorableWhitespace(sax.saxutils.escape(joinArgs(args))) handler.endElement("passthrough") handler.ignorableWhitespace("\n") # end zone element handler.endElement("direct") handler.ignorableWhitespace("\n") handler.endDocument() f.close() del handler core/fw_zone.py 0000644 00000124737 15025011705 0007527 0 ustar 00 # -*- coding: utf-8 -*- # # Copyright (C) 2011-2016 Red Hat, Inc. # # Authors: # Thomas Woerner <twoerner@redhat.com> # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see <http://www.gnu.org/licenses/>. # import copy from firewall.core.base import SHORTCUTS, DEFAULT_ZONE_TARGET, SOURCE_IPSET_TYPES from firewall.core.fw_transaction import FirewallTransaction from firewall.core.io.policy import Policy from firewall.core.logger import log from firewall.core.rich import ( Rich_ForwardPort, Rich_IcmpBlock, Rich_IcmpType, Rich_Mark, Rich_Masquerade, Rich_Port, Rich_Protocol, Rich_Rule, Rich_Service, Rich_SourcePort, Rich_Tcp_Mss_Clamp ) from firewall.core.fw_nm import nm_get_bus_name from firewall.functions import checkIPnMask, checkIP6nMask, check_mac from firewall import errors from firewall.errors import FirewallError class FirewallZone(object): ZONE_POLICY_PRIORITY = 0 def __init__(self, fw): self._fw = fw self._zones = { } self._zone_policies = { } def __repr__(self): return '%s(%r)' % (self.__class__, self._zones) def cleanup(self): self._zones.clear() self._zone_policies.clear() def new_transaction(self): t = FirewallTransaction(self._fw) t.add_pre(self._fw.full_check_config) return t def policy_name_from_zones(self, fromZone, toZone): return "zone_{fromZone}_{toZone}".format(fromZone=fromZone, toZone=toZone) # zones def get_zones(self): return sorted(self._zones.keys()) def get_active_zones(self): active_zones = [] for zone in self.get_zones(): if self.list_interfaces(zone) or self.list_sources(zone): active_zones.append(zone) return active_zones def get_zone_of_interface(self, interface): interface_id = self.__interface_id(interface) for zone in self._zones: if interface_id in self._zones[zone].interfaces: # an interface can only be part of one zone return zone return None def get_zone_of_source(self, source): source_id = self.__source_id(source) for zone in self._zones: if source_id in self._zones[zone].sources: # a source_id can only be part of one zone return zone return None def get_zone(self, zone): z = self._fw.check_zone(zone) return self._zones[z] def policy_obj_from_zone_obj(self, z_obj, fromZone, toZone): p_obj = Policy() p_obj.derived_from_zone = z_obj.name p_obj.name = self.policy_name_from_zones(fromZone, toZone) p_obj.priority = self.ZONE_POLICY_PRIORITY p_obj.target = z_obj.target p_obj.ingress_zones = [fromZone] p_obj.egress_zones = [toZone] # copy zone permanent config to policy permanent config # WARN: This assumes the same attribute names. # for setting in ["services", "ports", "masquerade", "forward_ports", "source_ports", "icmp_blocks", "icmp_block_inversion", "rules_str", "protocols"]: if fromZone == z_obj.name and toZone == "HOST" and \ setting in ["services", "ports", "source_ports", "icmp_blocks", "icmp_block_inversion", "protocols"]: # zone --> HOST setattr(p_obj, setting, copy.deepcopy(getattr(z_obj, setting))) elif fromZone == "ANY" and toZone == z_obj.name and setting in ["masquerade"]: # any zone --> zone setattr(p_obj, setting, copy.deepcopy(getattr(z_obj, setting))) elif fromZone == z_obj.name and toZone == "ANY" and \ setting in ["forward_ports"]: # zone --> any zone setattr(p_obj, setting, copy.deepcopy(getattr(z_obj, setting))) elif setting in ["rules_str"]: p_obj.rules_str = [] p_obj.rules = [] for rule_str in z_obj.rules_str: current_policy = self.policy_name_from_zones(fromZone, toZone) rule = Rich_Rule(rule_str=rule_str) if current_policy in self._rich_rule_to_policies(z_obj.name, rule): p_obj.rules_str.append(rule_str) p_obj.rules.append(rule) return p_obj def add_zone(self, obj): self._zones[obj.name] = obj self._zone_policies[obj.name] = [] # Create policy objects, will need many: # - (zone --> HOST) - ports, service, etc # - (any zone --> zone) - masquerade # - (zone --> any zone) # - also includes forward-ports because it works on (nat, # PREROUTING) and therefore applies to redirects to the local # host or dnat to a different host. # - also includes rich rule "mark" action for the same reason # for fromZone,toZone in [(obj.name, "HOST"), ("ANY", obj.name), (obj.name, "ANY")]: p_obj = self.policy_obj_from_zone_obj(obj, fromZone, toZone) self._fw.policy.add_policy(p_obj) self._zone_policies[obj.name].append(p_obj.name) def remove_zone(self, zone): obj = self._zones[zone] if obj.applied: self.unapply_zone_settings(zone) del self._zones[zone] del self._zone_policies[zone] def apply_zones(self, use_transaction=None): for zone in self.get_zones(): z_obj = self._zones[zone] if len(z_obj.interfaces) > 0 or len(z_obj.sources) > 0: log.debug1("Applying zone '%s'", zone) self.apply_zone_settings(zone, use_transaction=use_transaction) def set_zone_applied(self, zone, applied): obj = self._zones[zone] obj.applied = applied # zone from chain def zone_from_chain(self, chain): if "_" not in chain: # no zone chain return None splits = chain.split("_") if len(splits) < 2: return None _chain = None for x in SHORTCUTS: if splits[0] == SHORTCUTS[x]: _chain = x if _chain is not None: # next part needs to be zone name if splits[1] not in self.get_zones(): return None if len(splits) == 2 or \ (len(splits) == 3 and splits[2] in [ "pre", "log", "deny", "allow", "post" ]): return (splits[1], _chain) return None def policy_from_chain(self, chain): x = self.zone_from_chain(chain) if x is None: return None (zone, _chain) = x # derived from _get_table_chains_for_zone_dispatch() if _chain in ["PREROUTING", "FORWARD"]: fromZone = zone toZone = "ANY" elif _chain in ["INPUT"]: fromZone = zone toZone = "HOST" elif _chain in ["POSTROUTING"]: fromZone = "ANY" toZone = zone else: raise FirewallError(errors.INVALID_CHAIN, "chain '%s' can't be mapped to a policy" % (chain)) return (self.policy_name_from_zones(fromZone, toZone), _chain) def create_zone_base_by_chain(self, ipv, table, chain, use_transaction=None): # Create zone base chains if the chain is reserved for a zone if ipv in [ "ipv4", "ipv6" ]: x = self.policy_from_chain(chain) if x is not None: (policy, _chain) = self.policy_from_chain(chain) if use_transaction is None: transaction = self.new_transaction() else: transaction = use_transaction self._fw.policy.gen_chain_rules(policy, True, table, _chain, transaction) if use_transaction is None: transaction.execute(True) def _zone_settings(self, enable, zone, transaction): for key in ["interfaces", "sources", "forward", "icmp_block_inversion"]: args_list = getattr(self.get_zone(zone), key) if isinstance(args_list, bool): args_list = [args_list] for args in args_list: if key == "interfaces": self._interface(enable, zone, args, transaction) elif key == "sources": ipv = self.check_source(args) self._source(enable, zone, ipv, args, transaction) elif key == "icmp_block_inversion": continue elif key == "forward": # no need to call this when applying the zone as the rules # will be generated when adding the interfaces/sources pass else: log.warning("Zone '%s': Unknown setting '%s:%s', " "unable to apply", zone, key, args) # ICMP-block-inversion is always applied if enable: self._icmp_block_inversion(enable, zone, transaction) def apply_zone_settings(self, zone, use_transaction=None): _zone = self._fw.check_zone(zone) obj = self._zones[_zone] if obj.applied: return obj.applied = True if use_transaction is None: transaction = self.new_transaction() else: transaction = use_transaction for policy in self._zone_policies[_zone]: log.debug1("Applying policy (%s) derived from zone '%s'", policy, zone) self._fw.policy.apply_policy_settings(policy, use_transaction=transaction) self._zone_settings(True, _zone, transaction) if use_transaction is None: transaction.execute(True) def unapply_zone_settings(self, zone, use_transaction=None): _zone = self._fw.check_zone(zone) obj = self._zones[_zone] if not obj.applied: return if use_transaction is None: transaction = self.new_transaction() else: transaction = use_transaction for policy in self._zone_policies[_zone]: self._fw.policy.unapply_policy_settings(policy, use_transaction=transaction) self._zone_settings(False, _zone, transaction) if use_transaction is None: transaction.execute(True) def get_config_with_settings(self, zone): """ :return: exported config updated with runtime settings """ obj = self.get_zone(zone) conf_dict = self.get_config_with_settings_dict(zone) conf_list = [] for i in range(16): # tuple based API has 16 elements if obj.IMPORT_EXPORT_STRUCTURE[i][0] not in conf_dict: # old API needs the empty elements as well. Grab it from the # class otherwise we don't know the type. conf_list.append(copy.deepcopy(getattr(obj, obj.IMPORT_EXPORT_STRUCTURE[i][0]))) else: conf_list.append(conf_dict[obj.IMPORT_EXPORT_STRUCTURE[i][0]]) return tuple(conf_list) def get_config_with_settings_dict(self, zone): """ :return: exported config updated with runtime settings """ permanent = self.get_zone(zone).export_config_dict() if permanent["target"] == DEFAULT_ZONE_TARGET: permanent["target"] = "default" runtime = { "services": self.list_services(zone), "ports": self.list_ports(zone), "icmp_blocks": self.list_icmp_blocks(zone), "masquerade": self.query_masquerade(zone), "forward_ports": self.list_forward_ports(zone), "interfaces": self.list_interfaces(zone), "sources": self.list_sources(zone), "rules_str": self.list_rules(zone), "protocols": self.list_protocols(zone), "source_ports": self.list_source_ports(zone), "icmp_block_inversion": self.query_icmp_block_inversion(zone), "forward": self.query_forward(zone), } return self._fw.combine_runtime_with_permanent_settings(permanent, runtime) def set_config_with_settings_dict(self, zone, settings, sender): # stupid wrappers to convert rich rule string to rich rule object def add_rule_wrapper(zone, rule_str, timeout=0, sender=None): self.add_rule(zone, Rich_Rule(rule_str=rule_str), timeout=0, sender=sender) def remove_rule_wrapper(zone, rule_str): self.remove_rule(zone, Rich_Rule(rule_str=rule_str)) setting_to_fn = { "services": (self.add_service, self.remove_service), "ports": (self.add_port, self.remove_port), "icmp_blocks": (self.add_icmp_block, self.remove_icmp_block), "masquerade": (self.add_masquerade, self.remove_masquerade), "forward_ports": (self.add_forward_port, self.remove_forward_port), "interfaces": (self.add_interface, self.remove_interface), "sources": (self.add_source, self.remove_source), "rules_str": (add_rule_wrapper, remove_rule_wrapper), "protocols": (self.add_protocol, self.remove_protocol), "source_ports": (self.add_source_port, self.remove_source_port), "icmp_block_inversion": (self.add_icmp_block_inversion, self.remove_icmp_block_inversion), "forward": (self.add_forward, self.remove_forward), } # do a full config check on a temporary object before trying to make # the runtime changes old_obj = self.get_zone(zone) check_obj = copy.copy(old_obj) check_obj.import_config_dict(settings, self._fw.get_all_io_objects_dict()) self._fw.full_check_config({"zones": [check_obj]}) old_settings = self.get_config_with_settings_dict(zone) (add_settings, remove_settings) = self._fw.get_added_and_removed_settings(old_settings, settings) for key in remove_settings: if isinstance(remove_settings[key], list): for args in remove_settings[key]: if isinstance(args, tuple): setting_to_fn[key][1](zone, *args) else: setting_to_fn[key][1](zone, args) else: # bool setting_to_fn[key][1](zone) for key in add_settings: if isinstance(add_settings[key], list): for args in add_settings[key]: if key in ["interfaces", "sources"]: # no timeout arg setting_to_fn[key][0](zone, args, sender=sender) else: if isinstance(args, tuple): setting_to_fn[key][0](zone, *args, timeout=0, sender=sender) else: setting_to_fn[key][0](zone, args, timeout=0, sender=sender) else: # bool if key in ["icmp_block_inversion"]: # no timeout arg setting_to_fn[key][0](zone, sender=sender) else: setting_to_fn[key][0](zone, timeout=0, sender=sender) # INTERFACES def check_interface(self, interface): self._fw.check_interface(interface) def __interface_id(self, interface): self.check_interface(interface) return interface def add_interface(self, zone, interface, sender=None, use_transaction=None, allow_apply=True): self._fw.check_panic() _zone = self._fw.check_zone(zone) _obj = self._zones[_zone] interface_id = self.__interface_id(interface) if interface_id in _obj.interfaces: raise FirewallError(errors.ZONE_ALREADY_SET, "'%s' already bound to '%s'" % (interface, zone)) zoi = self.get_zone_of_interface(interface) if zoi is not None: raise FirewallError(errors.ZONE_CONFLICT, "'%s' already bound to '%s'" % (interface, zoi)) log.debug1("Setting zone of interface '%s' to '%s'" % (interface, _zone)) if use_transaction is None: transaction = self.new_transaction() else: transaction = use_transaction if not _obj.applied and allow_apply: self.apply_zone_settings(zone, use_transaction=transaction) transaction.add_fail(self.set_zone_applied, _zone, False) if allow_apply: self._interface(True, _zone, interface, transaction) self.__register_interface(_obj, interface_id, zone, sender) transaction.add_fail(self.__unregister_interface, _obj, interface_id) if use_transaction is None: transaction.execute(True) return _zone def __register_interface(self, _obj, interface_id, zone, sender): _obj.interfaces.append(interface_id) if not zone or zone == "": self._fw._default_zone_interfaces.append(interface_id) if sender == nm_get_bus_name(): self._fw._nm_assigned_interfaces.append(interface_id) def change_zone_of_interface(self, zone, interface, sender=None): self._fw.check_panic() _old_zone = self.get_zone_of_interface(interface) _new_zone = self._fw.check_zone(zone) if _new_zone == _old_zone: return _old_zone if _old_zone is not None: self.remove_interface(_old_zone, interface) _zone = self.add_interface(zone, interface, sender) return _zone def change_default_zone(self, old_zone, new_zone, use_transaction=None): self._fw.check_panic() if use_transaction is None: transaction = self.new_transaction() else: transaction = use_transaction self.apply_zone_settings(new_zone, transaction) self._interface(True, new_zone, "+", transaction, append=True) if old_zone is not None and old_zone != "": self._interface(False, old_zone, "+", transaction, append=True) if use_transaction is None: transaction.execute(True) def remove_interface(self, zone, interface, use_transaction=None): self._fw.check_panic() zoi = self.get_zone_of_interface(interface) if zoi is None: raise FirewallError(errors.UNKNOWN_INTERFACE, "'%s' is not in any zone" % interface) _zone = zoi if zone == "" else self._fw.check_zone(zone) if zoi != _zone: raise FirewallError(errors.ZONE_CONFLICT, "remove_interface(%s, %s): zoi='%s'" % \ (zone, interface, zoi)) if use_transaction is None: transaction = self.new_transaction() else: transaction = use_transaction _obj = self._zones[_zone] interface_id = self.__interface_id(interface) transaction.add_post(self.__unregister_interface, _obj, interface_id) self._interface(False, _zone, interface, transaction) if use_transaction is None: transaction.execute(True) return _zone def __unregister_interface(self, _obj, interface_id): if interface_id in _obj.interfaces: _obj.interfaces.remove(interface_id) if interface_id in self._fw._default_zone_interfaces: self._fw._default_zone_interfaces.remove(interface_id) if interface_id in self._fw._nm_assigned_interfaces: self._fw._nm_assigned_interfaces.remove(interface_id) def query_interface(self, zone, interface): return self.__interface_id(interface) in self.get_zone(zone).interfaces def list_interfaces(self, zone): return self.get_zone(zone).interfaces # SOURCES def check_source(self, source, applied=False): if checkIPnMask(source): return "ipv4" elif checkIP6nMask(source): return "ipv6" elif check_mac(source): return "" elif source.startswith("ipset:"): self._check_ipset_type_for_source(source[6:]) if applied: self._check_ipset_applied(source[6:]) return self._ipset_family(source[6:]) else: raise FirewallError(errors.INVALID_ADDR, source) def __source_id(self, source, applied=False): self.check_source(source, applied=applied) return source def add_source(self, zone, source, sender=None, use_transaction=None, allow_apply=True): self._fw.check_panic() _zone = self._fw.check_zone(zone) _obj = self._zones[_zone] if check_mac(source): source = source.upper() ipv = self.check_source(source, applied=allow_apply) source_id = self.__source_id(source, applied=allow_apply) if source_id in _obj.sources: raise FirewallError(errors.ZONE_ALREADY_SET, "'%s' already bound to '%s'" % (source, _zone)) if self.get_zone_of_source(source) is not None: raise FirewallError(errors.ZONE_CONFLICT, "'%s' already bound to a zone" % source) if use_transaction is None: transaction = self.new_transaction() else: transaction = use_transaction if not _obj.applied and allow_apply: self.apply_zone_settings(zone, use_transaction=transaction) transaction.add_fail(self.set_zone_applied, _zone, False) if allow_apply: self._source(True, _zone, ipv, source_id, transaction) self.__register_source(_obj, source_id, zone, sender) transaction.add_fail(self.__unregister_source, _obj, source_id) if use_transaction is None: transaction.execute(True) return _zone def __register_source(self, _obj, source_id, zone, sender): _obj.sources.append(source_id) def change_zone_of_source(self, zone, source, sender=None): self._fw.check_panic() _old_zone = self.get_zone_of_source(source) _new_zone = self._fw.check_zone(zone) if _new_zone == _old_zone: return _old_zone if check_mac(source): source = source.upper() if _old_zone is not None: self.remove_source(_old_zone, source) _zone = self.add_source(zone, source, sender) return _zone def remove_source(self, zone, source, use_transaction=None): self._fw.check_panic() if check_mac(source): source = source.upper() zos = self.get_zone_of_source(source) if zos is None: raise FirewallError(errors.UNKNOWN_SOURCE, "'%s' is not in any zone" % source) _zone = zos if zone == "" else self._fw.check_zone(zone) if zos != _zone: raise FirewallError(errors.ZONE_CONFLICT, "remove_source(%s, %s): zos='%s'" % \ (zone, source, zos)) if use_transaction is None: transaction = self.new_transaction() else: transaction = use_transaction _obj = self._zones[_zone] ipv = self.check_source(source) source_id = self.__source_id(source) transaction.add_post(self.__unregister_source, _obj, source_id) self._source(False, _zone, ipv, source_id, transaction) if use_transaction is None: transaction.execute(True) return _zone def __unregister_source(self, _obj, source_id): if source_id in _obj.sources: _obj.sources.remove(source_id) def query_source(self, zone, source): if check_mac(source): source = source.upper() return self.__source_id(source) in self.get_zone(zone).sources def list_sources(self, zone): return self.get_zone(zone).sources def _interface(self, enable, zone, interface, transaction, append=False): for backend in self._fw.enabled_backends(): if not backend.policies_supported: continue for policy in self._zone_policies[zone]: for (table, chain) in self._fw.policy._get_table_chains_for_zone_dispatch(policy): rules = backend.build_zone_source_interface_rules(enable, zone, policy, interface, table, chain, append) transaction.add_rules(backend, rules) # intra zone forward policy = self.policy_name_from_zones(zone, "ANY") # Skip adding wildcard/catch-all interface (for default # zone). Otherwise it would allow forwarding from interface # in default zone -> interface not in default zone (but in # a different zone). if self.get_zone(zone).forward and interface not in ["+", "*"]: rules = backend.build_zone_forward_rules(enable, zone, policy, "filter", interface=interface) transaction.add_rules(backend, rules) # update policy dispatch for any policy using this zone in ingress # or egress for policy in self._fw.policy.get_policies_not_derived_from_zone(): if zone not in self._fw.policy.list_ingress_zones(policy) and \ zone not in self._fw.policy.list_egress_zones(policy): continue if policy in self._fw.policy.get_active_policies_not_derived_from_zone() and self._fw.policy.get_policy(policy).applied: # first remove the old set of interfaces using the current zone # settings. if not enable and len(self.list_interfaces(zone)) == 1: self._fw.policy.unapply_policy_settings(policy, use_transaction=transaction) else: self._fw.policy._ingress_egress_zones(False, policy, transaction) # after the transaction ends and therefore the interface # has been added to the zone's settings, update the # dependent policies transaction.add_post(lambda p: (p in self._fw.policy.get_active_policies_not_derived_from_zone()) and \ self._fw.policy._ingress_egress_zones_transaction(True, p), policy) elif enable: transaction.add_post(lambda p: (p in self._fw.policy.get_active_policies_not_derived_from_zone()) and \ self._fw.policy.apply_policy_settings(p), policy) # IPSETS def _ipset_family(self, name): if self._ipset_type(name) == "hash:mac": return None return self._fw.ipset.get_family(name, applied=False) def _ipset_type(self, name): return self._fw.ipset.get_type(name, applied=False) def _ipset_match_flags(self, name, flag): return ",".join([flag] * self._fw.ipset.get_dimension(name)) def _check_ipset_applied(self, name): return self._fw.ipset.check_applied(name) def _check_ipset_type_for_source(self, name): _type = self._ipset_type(name) if _type not in SOURCE_IPSET_TYPES: raise FirewallError( errors.INVALID_IPSET, "ipset '%s' with type '%s' not usable as source" % \ (name, _type)) def _source(self, enable, zone, ipv, source, transaction): # For mac source bindings ipv is an empty string, the mac source will # be added for ipv4 and ipv6 for backend in [self._fw.get_backend_by_ipv(ipv)] if ipv else self._fw.enabled_backends(): if not backend.policies_supported: continue for policy in self._zone_policies[zone]: for (table, chain) in self._fw.policy._get_table_chains_for_zone_dispatch(policy): rules = backend.build_zone_source_address_rules(enable, zone, policy, source, table, chain) transaction.add_rules(backend, rules) # intra zone forward policy = self.policy_name_from_zones(zone, "ANY") if self.get_zone(zone).forward: rules = backend.build_zone_forward_rules(enable, zone, policy, "filter", source=source) transaction.add_rules(backend, rules) # update policy dispatch for any policy using this zone in ingress # or egress for policy in self._fw.policy.get_policies_not_derived_from_zone(): if zone not in self._fw.policy.list_ingress_zones(policy) and \ zone not in self._fw.policy.list_egress_zones(policy): continue if policy in self._fw.policy.get_active_policies_not_derived_from_zone() and self._fw.policy.get_policy(policy).applied: # first remove the old set of sources using the current zone # settings. if not enable and len(self.list_sources(zone)) == 1: self._fw.policy.unapply_policy_settings(policy, use_transaction=transaction) else: self._fw.policy._ingress_egress_zones(False, policy, transaction) # after the transaction ends and therefore the sources # has been added to the zone's settings, update the # dependent policies transaction.add_post(lambda p: (p in self._fw.policy.get_active_policies_not_derived_from_zone()) and \ self._fw.policy._ingress_egress_zones_transaction(True, p), policy) elif enable: transaction.add_post(lambda p: (p in self._fw.policy.get_active_policies_not_derived_from_zone()) and \ self._fw.policy.apply_policy_settings(p), policy) def add_service(self, zone, service, timeout=0, sender=None): zone = self._fw.check_zone(zone) p_name = self.policy_name_from_zones(zone, "HOST") self._fw.policy.add_service(p_name, service, timeout, sender) return zone def remove_service(self, zone, service): zone = self._fw.check_zone(zone) p_name = self.policy_name_from_zones(zone, "HOST") self._fw.policy.remove_service(p_name, service) return zone def query_service(self, zone, service): zone = self._fw.check_zone(zone) p_name = self.policy_name_from_zones(zone, "HOST") return self._fw.policy.query_service(p_name, service) def list_services(self, zone): zone = self._fw.check_zone(zone) p_name = self.policy_name_from_zones(zone, "HOST") return self._fw.policy.list_services(p_name) def add_port(self, zone, port, protocol, timeout=0, sender=None): zone = self._fw.check_zone(zone) p_name = self.policy_name_from_zones(zone, "HOST") self._fw.policy.add_port(p_name, port, protocol, timeout, sender) return zone def remove_port(self, zone, port, protocol): zone = self._fw.check_zone(zone) p_name = self.policy_name_from_zones(zone, "HOST") self._fw.policy.remove_port(p_name, port, protocol) return zone def query_port(self, zone, port, protocol): zone = self._fw.check_zone(zone) p_name = self.policy_name_from_zones(zone, "HOST") return self._fw.policy.query_port(p_name, port, protocol) def list_ports(self, zone): zone = self._fw.check_zone(zone) p_name = self.policy_name_from_zones(zone, "HOST") return self._fw.policy.list_ports(p_name) def add_source_port(self, zone, source_port, protocol, timeout=0, sender=None): zone = self._fw.check_zone(zone) p_name = self.policy_name_from_zones(zone, "HOST") self._fw.policy.add_source_port(p_name, source_port, protocol, timeout, sender) return zone def remove_source_port(self, zone, source_port, protocol): zone = self._fw.check_zone(zone) p_name = self.policy_name_from_zones(zone, "HOST") self._fw.policy.remove_source_port(p_name, source_port, protocol) return zone def query_source_port(self, zone, source_port, protocol): zone = self._fw.check_zone(zone) p_name = self.policy_name_from_zones(zone, "HOST") return self._fw.policy.query_source_port(p_name, source_port, protocol) def list_source_ports(self, zone): zone = self._fw.check_zone(zone) p_name = self.policy_name_from_zones(zone, "HOST") return self._fw.policy.list_source_ports(p_name) def _rich_rule_to_policies(self, zone, rule): zone = self._fw.check_zone(zone) if type(rule.action) == Rich_Mark: return [self.policy_name_from_zones(zone, "ANY")] elif type(rule.element) in [Rich_Service, Rich_Port, Rich_Protocol, Rich_SourcePort, Rich_IcmpBlock, Rich_IcmpType]: return [self.policy_name_from_zones(zone, "HOST")] elif type(rule.element) in [Rich_ForwardPort]: return [self.policy_name_from_zones(zone, "ANY")] elif type(rule.element) in [Rich_Masquerade]: return [self.policy_name_from_zones("ANY", zone)] elif type(rule.element) in [Rich_Tcp_Mss_Clamp]: return [self.policy_name_from_zones(zone, "ANY")] elif rule.element is None: return [self.policy_name_from_zones(zone, "HOST")] else: raise FirewallError(errors.INVALID_RULE, "Rich rule type (%s) not handled." % (type(rule.element))) def add_rule(self, zone, rule, timeout=0, sender=None): for p_name in self._rich_rule_to_policies(zone, rule): self._fw.policy.add_rule(p_name, rule, timeout, sender) return zone def remove_rule(self, zone, rule): for p_name in self._rich_rule_to_policies(zone, rule): self._fw.policy.remove_rule(p_name, rule) return zone def query_rule(self, zone, rule): ret = True for p_name in self._rich_rule_to_policies(zone, rule): ret = ret and self._fw.policy.query_rule(p_name, rule) return ret def list_rules(self, zone): zone = self._fw.check_zone(zone) ret = set() for p_name in [self.policy_name_from_zones(zone, "ANY"), self.policy_name_from_zones(zone, "HOST"), self.policy_name_from_zones("ANY", zone)]: ret.update(set(self._fw.policy.list_rules(p_name))) return list(ret) def add_protocol(self, zone, protocol, timeout=0, sender=None): zone = self._fw.check_zone(zone) p_name = self.policy_name_from_zones(zone, "HOST") self._fw.policy.add_protocol(p_name, protocol, timeout, sender) return zone def remove_protocol(self, zone, protocol): zone = self._fw.check_zone(zone) p_name = self.policy_name_from_zones(zone, "HOST") self._fw.policy.remove_protocol(p_name, protocol) return zone def query_protocol(self, zone, protocol): zone = self._fw.check_zone(zone) p_name = self.policy_name_from_zones(zone, "HOST") return self._fw.policy.query_protocol(p_name, protocol) def list_protocols(self, zone): zone = self._fw.check_zone(zone) p_name = self.policy_name_from_zones(zone, "HOST") return self._fw.policy.list_protocols(p_name) def add_masquerade(self, zone, timeout=0, sender=None): zone = self._fw.check_zone(zone) p_name = self.policy_name_from_zones("ANY", zone) self._fw.policy.add_masquerade(p_name, timeout, sender) return zone def remove_masquerade(self, zone): zone = self._fw.check_zone(zone) p_name = self.policy_name_from_zones("ANY", zone) self._fw.policy.remove_masquerade(p_name) return zone def query_masquerade(self, zone): zone = self._fw.check_zone(zone) p_name = self.policy_name_from_zones("ANY", zone) return self._fw.policy.query_masquerade(p_name) def add_forward_port(self, zone, port, protocol, toport=None, toaddr=None, timeout=0, sender=None): zone = self._fw.check_zone(zone) p_name = self.policy_name_from_zones(zone, "ANY") self._fw.policy.add_forward_port(p_name, port, protocol, toport, toaddr, timeout, sender) return zone def remove_forward_port(self, zone, port, protocol, toport=None, toaddr=None): zone = self._fw.check_zone(zone) p_name = self.policy_name_from_zones(zone, "ANY") self._fw.policy.remove_forward_port(p_name, port, protocol, toport, toaddr) return zone def query_forward_port(self, zone, port, protocol, toport=None, toaddr=None): zone = self._fw.check_zone(zone) p_name = self.policy_name_from_zones(zone, "ANY") return self._fw.policy.query_forward_port(p_name, port, protocol, toport, toaddr) def list_forward_ports(self, zone): zone = self._fw.check_zone(zone) p_name = self.policy_name_from_zones(zone, "ANY") return self._fw.policy.list_forward_ports(p_name) def add_icmp_block(self, zone, icmp, timeout=0, sender=None): zone = self._fw.check_zone(zone) p_name = self.policy_name_from_zones(zone, "HOST") self._fw.policy.add_icmp_block(p_name, icmp, timeout, sender) return zone def remove_icmp_block(self, zone, icmp): zone = self._fw.check_zone(zone) p_name = self.policy_name_from_zones(zone, "HOST") self._fw.policy.remove_icmp_block(p_name, icmp) return zone def query_icmp_block(self, zone, icmp): zone = self._fw.check_zone(zone) p_name_host = self.policy_name_from_zones(zone, "HOST") return self._fw.policy.query_icmp_block(p_name_host, icmp) def list_icmp_blocks(self, zone): zone = self._fw.check_zone(zone) p_name_host = self.policy_name_from_zones(zone, "HOST") return sorted(set(self._fw.policy.list_icmp_blocks(p_name_host))) def add_icmp_block_inversion(self, zone, sender=None): zone = self._fw.check_zone(zone) p_name = self.policy_name_from_zones(zone, "HOST") self._fw.policy.add_icmp_block_inversion(p_name, sender) return zone def _icmp_block_inversion(self, enable, zone, transaction): zone = self._fw.check_zone(zone) p_name = self.policy_name_from_zones(zone, "HOST") self._fw.policy._icmp_block_inversion(enable, p_name, transaction) def remove_icmp_block_inversion(self, zone): zone = self._fw.check_zone(zone) p_name = self.policy_name_from_zones(zone, "HOST") self._fw.policy.remove_icmp_block_inversion(p_name) return zone def query_icmp_block_inversion(self, zone): zone = self._fw.check_zone(zone) p_name_host = self.policy_name_from_zones(zone, "HOST") return self._fw.policy.query_icmp_block_inversion(p_name_host) def _forward(self, enable, zone, transaction): p_name = self.policy_name_from_zones(zone, "ANY") for interface in self._zones[zone].interfaces: for backend in self._fw.enabled_backends(): if not backend.policies_supported: continue rules = backend.build_zone_forward_rules(enable, zone, p_name, "filter", interface=interface) transaction.add_rules(backend, rules) for source in self._zones[zone].sources: ipv = self.check_source(source) for backend in [self._fw.get_backend_by_ipv(ipv)] if ipv else self._fw.enabled_backends(): if not backend.policies_supported: continue rules = backend.build_zone_forward_rules(enable, zone, p_name, "filter", source=source) transaction.add_rules(backend, rules) def add_forward(self, zone, timeout=0, sender=None, use_transaction=None): _zone = self._fw.check_zone(zone) self._fw.check_timeout(timeout) self._fw.check_panic() _obj = self._zones[_zone] if _obj.forward: raise FirewallError(errors.ALREADY_ENABLED, "forward already enabled in '%s'" % _zone) if use_transaction is None: transaction = self.new_transaction() else: transaction = use_transaction if _obj.applied: self._forward(True, _zone, transaction) self.__register_forward(_obj, timeout, sender) transaction.add_fail(self.__unregister_forward, _obj) if use_transaction is None: transaction.execute(True) return _zone def __register_forward(self, _obj, timeout, sender): _obj.forward = True def remove_forward(self, zone, use_transaction=None): _zone = self._fw.check_zone(zone) self._fw.check_panic() _obj = self._zones[_zone] if not _obj.forward: raise FirewallError(errors.NOT_ENABLED, "forward not enabled in '%s'" % _zone) if use_transaction is None: transaction = self.new_transaction() else: transaction = use_transaction if _obj.applied: self._forward(False, _zone, transaction) transaction.add_post(self.__unregister_forward, _obj) if use_transaction is None: transaction.execute(True) return _zone def __unregister_forward(self, _obj): _obj.forward = False def query_forward(self, zone): return self.get_zone(zone).forward core/fw_direct.py 0000644 00000054734 15025011705 0010025 0 ustar 00 # -*- coding: utf-8 -*- # # Copyright (C) 2010-2016 Red Hat, Inc. # # Authors: # Thomas Woerner <twoerner@redhat.com> # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see <http://www.gnu.org/licenses/>. # __all__ = [ "FirewallDirect" ] from firewall.fw_types import LastUpdatedOrderedDict from firewall.core import ipXtables from firewall.core import ebtables from firewall.core.fw_transaction import FirewallTransaction from firewall.core.logger import log from firewall import errors from firewall.errors import FirewallError ############################################################################ # # class Firewall # ############################################################################ class FirewallDirect(object): def __init__(self, fw): self._fw = fw self.__init_vars() def __repr__(self): return '%s(%r, %r, %r)' % (self.__class__, self._chains, self._rules, self._rule_priority_positions) def __init_vars(self): self._chains = { } self._rules = { } self._rule_priority_positions = { } self._passthroughs = { } self._obj = None def cleanup(self): self.__init_vars() # transaction def new_transaction(self): return FirewallTransaction(self._fw) # configuration def set_permanent_config(self, obj): self._obj = obj def has_runtime_configuration(self): if len(self._chains) + len(self._rules) + len(self._passthroughs) > 0: return True return False def has_configuration(self): if self.has_runtime_configuration(): return True if len(self._obj.get_all_chains()) + \ len(self._obj.get_all_rules()) + \ len(self._obj.get_all_passthroughs()) > 0: return True return False def apply_direct(self, use_transaction=None): if use_transaction is None: transaction = self.new_transaction() else: transaction = use_transaction # Apply permanent configuration and save the obj to be able to # remove permanent configuration settings within get_runtime_config # for use in firewalld reload. self.set_config((self._obj.get_all_chains(), self._obj.get_all_rules(), self._obj.get_all_passthroughs()), transaction) if use_transaction is None: transaction.execute(True) def get_runtime_config(self): # Return only runtime changes # Remove all chains, rules and passthroughs that are in self._obj # (permanent config applied in firewalld _start. chains = { } rules = { } passthroughs = { } for table_id in self._chains: (ipv, table) = table_id for chain in self._chains[table_id]: if not self._obj.query_chain(ipv, table, chain): chains.setdefault(table_id, [ ]).append(chain) for chain_id in self._rules: (ipv, table, chain) = chain_id for (priority, args) in self._rules[chain_id]: if not self._obj.query_rule(ipv, table, chain, priority, args): if chain_id not in rules: rules[chain_id] = LastUpdatedOrderedDict() rules[chain_id][(priority, args)] = priority for ipv in self._passthroughs: for args in self._passthroughs[ipv]: if not self._obj.query_passthrough(ipv, args): if ipv not in passthroughs: passthroughs[ipv] = [ ] passthroughs[ipv].append(args) return (chains, rules, passthroughs) def get_config(self): return (self._chains, self._rules, self._passthroughs) def set_config(self, conf, use_transaction=None): if use_transaction is None: transaction = self.new_transaction() else: transaction = use_transaction (_chains, _rules, _passthroughs) = conf for table_id in _chains: (ipv, table) = table_id for chain in _chains[table_id]: if not self.query_chain(ipv, table, chain): try: self.add_chain(ipv, table, chain, use_transaction=transaction) except FirewallError as error: log.warning(str(error)) for chain_id in _rules: (ipv, table, chain) = chain_id for (priority, args) in _rules[chain_id]: if not self.query_rule(ipv, table, chain, priority, args): try: self.add_rule(ipv, table, chain, priority, args, use_transaction=transaction) except FirewallError as error: log.warning(str(error)) for ipv in _passthroughs: for args in _passthroughs[ipv]: if not self.query_passthrough(ipv, args): try: self.add_passthrough(ipv, args, use_transaction=transaction) except FirewallError as error: log.warning(str(error)) if use_transaction is None: transaction.execute(True) def _check_ipv(self, ipv): ipvs = ['ipv4', 'ipv6', 'eb'] if ipv not in ipvs: raise FirewallError(errors.INVALID_IPV, "'%s' not in '%s'" % (ipv, ipvs)) def _check_ipv_table(self, ipv, table): self._check_ipv(ipv) tables = ipXtables.BUILT_IN_CHAINS.keys() if ipv in [ 'ipv4', 'ipv6' ] \ else ebtables.BUILT_IN_CHAINS.keys() if table not in tables: raise FirewallError(errors.INVALID_TABLE, "'%s' not in '%s'" % (table, tables)) def _check_builtin_chain(self, ipv, table, chain): if ipv in ['ipv4', 'ipv6']: built_in_chains = ipXtables.BUILT_IN_CHAINS[table] if self._fw.nftables_enabled: our_chains = {} else: our_chains = self._fw.get_direct_backend_by_ipv(ipv).our_chains[table] else: built_in_chains = ebtables.BUILT_IN_CHAINS[table] our_chains = ebtables.OUR_CHAINS[table] if chain in built_in_chains: raise FirewallError(errors.BUILTIN_CHAIN, "chain '%s' is built-in chain" % chain) if chain in our_chains: raise FirewallError(errors.BUILTIN_CHAIN, "chain '%s' is reserved" % chain) if ipv in [ "ipv4", "ipv6" ]: if self._fw.zone.zone_from_chain(chain) is not None: raise FirewallError(errors.INVALID_CHAIN, "Chain '%s' is reserved" % chain) def _register_chain(self, table_id, chain, add): if add: self._chains.setdefault(table_id, [ ]).append(chain) else: self._chains[table_id].remove(chain) if len(self._chains[table_id]) == 0: del self._chains[table_id] def add_chain(self, ipv, table, chain, use_transaction=None): if use_transaction is None: transaction = self.new_transaction() else: transaction = use_transaction if self._fw.may_skip_flush_direct_backends(): transaction.add_pre(self._fw.flush_direct_backends) if self._fw.ipset_enabled and self._fw.ipset.omit_native_ipset(): transaction.add_pre(self._fw.ipset.apply_ipsets, [self._fw.ipset_backend]) #TODO: policy="ACCEPT" self._chain(True, ipv, table, chain, transaction) if use_transaction is None: transaction.execute(True) def remove_chain(self, ipv, table, chain, use_transaction=None): if use_transaction is None: transaction = self.new_transaction() else: transaction = use_transaction self._chain(False, ipv, table, chain, transaction) if use_transaction is None: transaction.execute(True) def query_chain(self, ipv, table, chain): self._check_ipv_table(ipv, table) self._check_builtin_chain(ipv, table, chain) table_id = (ipv, table) return (table_id in self._chains and chain in self._chains[table_id]) def get_chains(self, ipv, table): self._check_ipv_table(ipv, table) table_id = (ipv, table) if table_id in self._chains: return self._chains[table_id] return [ ] def get_all_chains(self): r = [ ] for key in self._chains: (ipv, table) = key for chain in self._chains[key]: r.append((ipv, table, chain)) return r def add_rule(self, ipv, table, chain, priority, args, use_transaction=None): if use_transaction is None: transaction = self.new_transaction() else: transaction = use_transaction if self._fw.may_skip_flush_direct_backends(): transaction.add_pre(self._fw.flush_direct_backends) if self._fw.ipset_enabled and self._fw.ipset.omit_native_ipset(): transaction.add_pre(self._fw.ipset.apply_ipsets, [self._fw.ipset_backend]) self._rule(True, ipv, table, chain, priority, args, transaction) if use_transaction is None: transaction.execute(True) def remove_rule(self, ipv, table, chain, priority, args, use_transaction=None): if use_transaction is None: transaction = self.new_transaction() else: transaction = use_transaction self._rule(False, ipv, table, chain, priority, args, transaction) if use_transaction is None: transaction.execute(True) def query_rule(self, ipv, table, chain, priority, args): self._check_ipv_table(ipv, table) chain_id = (ipv, table, chain) return chain_id in self._rules and \ (priority, args) in self._rules[chain_id] def get_rules(self, ipv, table, chain): self._check_ipv_table(ipv, table) chain_id = (ipv, table, chain) if chain_id in self._rules: return list(self._rules[chain_id].keys()) return [ ] def get_all_rules(self): r = [ ] for key in self._rules: (ipv, table, chain) = key for (priority, args) in self._rules[key]: r.append((ipv, table, chain, priority, list(args))) return r def _register_rule(self, rule_id, chain_id, priority, enable, count): if enable: if chain_id not in self._rules: self._rules[chain_id] = LastUpdatedOrderedDict() self._rules[chain_id][rule_id] = priority if chain_id not in self._rule_priority_positions: self._rule_priority_positions[chain_id] = { } if priority in self._rule_priority_positions[chain_id]: self._rule_priority_positions[chain_id][priority] += count else: self._rule_priority_positions[chain_id][priority] = count else: del self._rules[chain_id][rule_id] if len(self._rules[chain_id]) == 0: del self._rules[chain_id] self._rule_priority_positions[chain_id][priority] -= count # DIRECT PASSTHROUGH (untracked) def passthrough(self, ipv, args): try: return self._fw.rule(self._fw.get_direct_backend_by_ipv(ipv).name, args) except Exception as msg: log.debug2(msg) raise FirewallError(errors.COMMAND_FAILED, msg) def _register_passthrough(self, ipv, args, enable): if enable: if ipv not in self._passthroughs: self._passthroughs[ipv] = [ ] self._passthroughs[ipv].append(args) else: self._passthroughs[ipv].remove(args) if len(self._passthroughs[ipv]) == 0: del self._passthroughs[ipv] def add_passthrough(self, ipv, args, use_transaction=None): if use_transaction is None: transaction = self.new_transaction() else: transaction = use_transaction if self._fw.may_skip_flush_direct_backends(): transaction.add_pre(self._fw.flush_direct_backends) if self._fw.ipset_enabled and self._fw.ipset.omit_native_ipset(): transaction.add_pre(self._fw.ipset.apply_ipsets, [self._fw.ipset_backend]) self._passthrough(True, ipv, list(args), transaction) if use_transaction is None: transaction.execute(True) def remove_passthrough(self, ipv, args, use_transaction=None): if use_transaction is None: transaction = self.new_transaction() else: transaction = use_transaction self._passthrough(False, ipv, list(args), transaction) if use_transaction is None: transaction.execute(True) def query_passthrough(self, ipv, args): return ipv in self._passthroughs and \ tuple(args) in self._passthroughs[ipv] def get_all_passthroughs(self): r = [ ] for ipv in self._passthroughs: for args in self._passthroughs[ipv]: r.append((ipv, list(args))) return r def get_passthroughs(self, ipv): r = [ ] if ipv in self._passthroughs: for args in self._passthroughs[ipv]: r.append(list(args)) return r def split_value(self, rules, opts): """Split values combined with commas for options in opts""" out_rules = [ ] for rule in rules: processed = False for opt in opts: try: i = rule.index(opt) except ValueError: pass else: if len(rule) > i and "," in rule[i+1]: # For all items in the comma separated list in index # i of the rule, a new rule is created with a single # item from this list processed = True items = rule[i+1].split(",") for item in items: _rule = rule[:] _rule[i+1] = item out_rules.append(_rule) if not processed: out_rules.append(rule) return out_rules def _rule(self, enable, ipv, table, chain, priority, args, transaction): self._check_ipv_table(ipv, table) # Do not create zone chains if we're using nftables. Only allow direct # rules in the built in chains. if not self._fw.nftables_enabled \ and ipv in [ "ipv4", "ipv6" ]: self._fw.zone.create_zone_base_by_chain(ipv, table, chain, transaction) _chain = chain backend = self._fw.get_direct_backend_by_ipv(ipv) # if nftables is in use, just put the direct rules in the chain # specified by the user. i.e. don't append _direct. if not self._fw.nftables_enabled \ and backend.is_chain_builtin(ipv, table, chain): _chain = "%s_direct" % (chain) elif self._fw.nftables_enabled and chain[-7:] == "_direct" \ and backend.is_chain_builtin(ipv, table, chain[:-7]): # strip _direct suffix. If we're using nftables we don't bother # creating the *_direct chains for builtin chains. _chain = chain[:-7] chain_id = (ipv, table, chain) rule_id = (priority, args) if enable: if chain_id in self._rules and \ rule_id in self._rules[chain_id]: raise FirewallError(errors.ALREADY_ENABLED, "rule '%s' already is in '%s:%s:%s'" % \ (args, ipv, table, chain)) else: if chain_id not in self._rules or \ rule_id not in self._rules[chain_id]: raise FirewallError(errors.NOT_ENABLED, "rule '%s' is not in '%s:%s:%s'" % \ (args, ipv, table, chain)) # get priority of rule priority = self._rules[chain_id][rule_id] # If a rule gets added, the initial rule index position within the # ipv, table and chain combination (chain_id) is 1. # Tf the chain_id exists in _rule_priority_positions, there are already # other rules for this chain_id. The number of rules for a priority # less or equal to the priority of the new rule will increase the # index of the new rule. The index is the ip*tables -I insert rule # number. # # Example: We have the following rules for chain_id (ipv4, filter, # INPUT) already: # ipv4, filter, INPUT, 1, -i, foo1, -j, ACCEPT # ipv4, filter, INPUT, 2, -i, foo2, -j, ACCEPT # ipv4, filter, INPUT, 2, -i, foo2_1, -j, ACCEPT # ipv4, filter, INPUT, 3, -i, foo3, -j, ACCEPT # This results in the following _rule_priority_positions structure: # _rule_priority_positions[(ipv4,filter,INPUT)][1] = 1 # _rule_priority_positions[(ipv4,filter,INPUT)][2] = 2 # _rule_priority_positions[(ipv4,filter,INPUT)][3] = 1 # The new rule # ipv4, filter, INPUT, 2, -i, foo2_2, -j, ACCEPT # has the same pritority as the second rule before and will be added # right after it. # The initial index is 1 and the chain_id is already in # _rule_priority_positions. Therefore the index will increase for # the number of rules in every rule position in # _rule_priority_positions[(ipv4,filter,INPUT)].keys() # where position is smaller or equal to the entry in keys. # With the example from above: # The priority of the new rule is 2. Therefore for all keys in # _rule_priority_positions[chain_id] where priority is 1 or 2, the # number of the rules will increase the index of the rule. # For _rule_priority_positions[chain_id][1]: index += 1 # _rule_priority_positions[chain_id][2]: index += 2 # index will be 4 in the end and the rule in the table chain # combination will be added at index 4. # If there are no rules in the table chain combination, a new rule # has index 1. index = 1 count = 0 if chain_id in self._rule_priority_positions: positions = sorted(self._rule_priority_positions[chain_id].keys()) j = 0 while j < len(positions) and priority >= positions[j]: index += self._rule_priority_positions[chain_id][positions[j]] j += 1 # split the direct rule in some cases as iptables-restore can't handle # compound args. # args_list = [list(args)] args_list = self.split_value(args_list, [ "-s", "--source" ]) args_list = self.split_value(args_list, [ "-d", "--destination" ]) for _args in args_list: transaction.add_rule(backend, backend.build_rule(enable, table, _chain, index, tuple(_args))) index += 1 count += 1 self._register_rule(rule_id, chain_id, priority, enable, count) transaction.add_fail(self._register_rule, rule_id, chain_id, priority, not enable, count) def _chain(self, add, ipv, table, chain, transaction): self._check_ipv_table(ipv, table) self._check_builtin_chain(ipv, table, chain) table_id = (ipv, table) if add: if table_id in self._chains and \ chain in self._chains[table_id]: raise FirewallError(errors.ALREADY_ENABLED, "chain '%s' already is in '%s:%s'" % \ (chain, ipv, table)) else: if table_id not in self._chains or \ chain not in self._chains[table_id]: raise FirewallError(errors.NOT_ENABLED, "chain '%s' is not in '%s:%s'" % \ (chain, ipv, table)) backend = self._fw.get_direct_backend_by_ipv(ipv) transaction.add_rules(backend, backend.build_chain_rules(add, table, chain)) self._register_chain(table_id, chain, add) transaction.add_fail(self._register_chain, table_id, chain, not add) def _passthrough(self, enable, ipv, args, transaction): self._check_ipv(ipv) tuple_args = tuple(args) if enable: if ipv in self._passthroughs and \ tuple_args in self._passthroughs[ipv]: raise FirewallError(errors.ALREADY_ENABLED, "passthrough '%s', '%s'" % (ipv, args)) else: if ipv not in self._passthroughs or \ tuple_args not in self._passthroughs[ipv]: raise FirewallError(errors.NOT_ENABLED, "passthrough '%s', '%s'" % (ipv, args)) backend = self._fw.get_direct_backend_by_ipv(ipv) if enable: backend.check_passthrough(args) # try to find out if a zone chain should be used if ipv in [ "ipv4", "ipv6" ]: table, chain = backend.passthrough_parse_table_chain(args) if table and chain: self._fw.zone.create_zone_base_by_chain(ipv, table, chain) _args = args else: _args = backend.reverse_passthrough(args) transaction.add_rule(backend, _args) self._register_passthrough(ipv, tuple_args, enable) transaction.add_fail(self._register_passthrough, ipv, tuple_args, not enable) core/fw_helper.py 0000644 00000003451 15025011705 0010020 0 ustar 00 # -*- coding: utf-8 -*- # # Copyright (C) 2015-2016 Red Hat, Inc. # # Authors: # Thomas Woerner <twoerner@redhat.com> # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see <http://www.gnu.org/licenses/>. # """helper backend""" __all__ = [ "FirewallHelper" ] from firewall import errors from firewall.errors import FirewallError class FirewallHelper(object): def __init__(self, fw): self._fw = fw self._helpers = { } def __repr__(self): return '%s(%r)' % (self.__class__, self._helpers) # helpers def cleanup(self): self._helpers.clear() def check_helper(self, name): if name not in self.get_helpers(): raise FirewallError(errors.INVALID_HELPER, name) def query_helper(self, name): return name in self.get_helpers() def get_helpers(self): return sorted(self._helpers.keys()) def has_helpers(self): return len(self._helpers) > 0 def get_helper(self, name): self.check_helper(name) return self._helpers[name] def add_helper(self, obj): self._helpers[obj.name] = obj def remove_helper(self, name): if name not in self._helpers: raise FirewallError(errors.INVALID_HELPER, name) del self._helpers[name] core/ipset.py 0000644 00000031161 15025011705 0007170 0 ustar 00 # -*- coding: utf-8 -*- # # Copyright (C) 2015-2016 Red Hat, Inc. # # Authors: # Thomas Woerner <twoerner@redhat.com> # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see <http://www.gnu.org/licenses/>. # """The ipset command wrapper""" __all__ = [ "ipset", "check_ipset_name", "remove_default_create_options" ] import os.path import ipaddress from firewall import errors from firewall.errors import FirewallError from firewall.core.prog import runProg from firewall.core.logger import log from firewall.functions import tempFile, readfile from firewall.config import COMMANDS IPSET_MAXNAMELEN = 32 IPSET_TYPES = [ # bitmap and set types are currently not supported # "bitmap:ip", # "bitmap:ip,mac", # "bitmap:port", # "list:set", "hash:ip", "hash:ip,port", "hash:ip,port,ip", "hash:ip,port,net", "hash:ip,mark", "hash:net", "hash:net,net", "hash:net,port", "hash:net,port,net", "hash:net,iface", "hash:mac", ] IPSET_CREATE_OPTIONS = { "family": "inet|inet6", "hashsize": "value", "maxelem": "value", "timeout": "value in secs", #"counters": None, #"comment": None, } IPSET_DEFAULT_CREATE_OPTIONS = { "family": "inet", "hashsize": "1024", "maxelem": "65536", } class ipset(object): """ipset command wrapper class""" def __init__(self): self._command = COMMANDS["ipset"] self.name = "ipset" def __run(self, args): """Call ipset with args""" # convert to string list _args = ["%s" % item for item in args] log.debug2("%s: %s %s", self.__class__, self._command, " ".join(_args)) (status, ret) = runProg(self._command, _args) if status != 0: raise ValueError("'%s %s' failed: %s" % (self._command, " ".join(_args), ret)) return ret def check_name(self, name): """Check ipset name""" if len(name) > IPSET_MAXNAMELEN: raise FirewallError(errors.INVALID_NAME, "ipset name '%s' is not valid" % name) def set_supported_types(self): """Return types that are supported by the ipset command and kernel""" ret = [ ] output = "" try: output = self.__run(["--help"]) except ValueError as ex: log.debug1("ipset error: %s" % ex) lines = output.splitlines() in_types = False for line in lines: #print(line) if in_types: splits = line.strip().split(None, 2) if splits[0] not in ret and splits[0] in IPSET_TYPES: ret.append(splits[0]) if line.startswith("Supported set types:"): in_types = True return ret def check_type(self, type_name): """Check ipset type""" if len(type_name) > IPSET_MAXNAMELEN or type_name not in IPSET_TYPES: raise FirewallError(errors.INVALID_TYPE, "ipset type name '%s' is not valid" % type_name) def set_create(self, set_name, type_name, options=None): """Create an ipset with name, type and options""" self.check_name(set_name) self.check_type(type_name) args = [ "create", set_name, type_name ] if isinstance(options, dict): for key, val in options.items(): args.append(key) if val != "": args.append(val) return self.__run(args) def set_destroy(self, set_name): self.check_name(set_name) return self.__run([ "destroy", set_name ]) def set_add(self, set_name, entry): args = [ "add", set_name, entry ] return self.__run(args) def set_delete(self, set_name, entry): args = [ "del", set_name, entry ] return self.__run(args) def test(self, set_name, entry, options=None): args = [ "test", set_name, entry ] if options: args.append("%s" % " ".join(options)) return self.__run(args) def set_list(self, set_name=None, options=None): args = [ "list" ] if set_name: args.append(set_name) if options: args.extend(options) return self.__run(args).split("\n") def set_get_active_terse(self): """ Get active ipsets (only headers) """ lines = self.set_list(options=["-terse"]) ret = { } _name = _type = None _options = { } for line in lines: if len(line) < 1: continue pair = [ x.strip() for x in line.split(":", 1) ] if len(pair) != 2: continue elif pair[0] == "Name": _name = pair[1] elif pair[0] == "Type": _type = pair[1] elif pair[0] == "Header": splits = pair[1].split() i = 0 while i < len(splits): opt = splits[i] if opt in [ "family", "hashsize", "maxelem", "timeout", "netmask" ]: if len(splits) > i: i += 1 _options[opt] = splits[i] else: log.error("Malformed ipset list -terse output: %s", line) return { } i += 1 if _name and _type: ret[_name] = (_type, remove_default_create_options(_options)) _name = _type = None _options.clear() return ret def save(self, set_name=None): args = [ "save" ] if set_name: args.append(set_name) return self.__run(args) def set_restore(self, set_name, type_name, entries, create_options=None, entry_options=None): self.check_name(set_name) self.check_type(type_name) temp_file = tempFile() if ' ' in set_name: set_name = "'%s'" % set_name args = [ "create", set_name, type_name, "-exist" ] if create_options: for key, val in create_options.items(): args.append(key) if val != "": args.append(val) temp_file.write("%s\n" % " ".join(args)) temp_file.write("flush %s\n" % set_name) for entry in entries: if ' ' in entry: entry = "'%s'" % entry if entry_options: temp_file.write("add %s %s %s\n" % \ (set_name, entry, " ".join(entry_options))) else: temp_file.write("add %s %s\n" % (set_name, entry)) temp_file.close() stat = os.stat(temp_file.name) log.debug2("%s: %s restore %s", self.__class__, self._command, "%s: %d" % (temp_file.name, stat.st_size)) args = [ "restore" ] (status, ret) = runProg(self._command, args, stdin=temp_file.name) if log.getDebugLogLevel() > 2: try: readfile(temp_file.name) except Exception: pass else: i = 1 for line in readfile(temp_file.name): log.debug3("%8d: %s" % (i, line), nofmt=1, nl=0) if not line.endswith("\n"): log.debug3("", nofmt=1) i += 1 os.unlink(temp_file.name) if status != 0: raise ValueError("'%s %s' failed: %s" % (self._command, " ".join(args), ret)) return ret def set_flush(self, set_name): args = [ "flush" ] if set_name: args.append(set_name) return self.__run(args) def rename(self, old_set_name, new_set_name): return self.__run([ "rename", old_set_name, new_set_name ]) def swap(self, set_name_1, set_name_2): return self.__run([ "swap", set_name_1, set_name_2 ]) def version(self): return self.__run([ "version" ]) def check_ipset_name(name): """Return true if ipset name is valid""" if len(name) > IPSET_MAXNAMELEN: return False return True def remove_default_create_options(options): """ Return only non default create options """ _options = options.copy() for opt in IPSET_DEFAULT_CREATE_OPTIONS: if opt in _options and \ IPSET_DEFAULT_CREATE_OPTIONS[opt] == _options[opt]: del _options[opt] return _options def normalize_ipset_entry(entry): """ Normalize IP addresses in entry """ _entry = [] for _part in entry.split(","): try: _part.index("/") _entry.append(str(ipaddress.ip_network(_part, strict=False))) except ValueError: _entry.append(_part) return ",".join(_entry) def check_entry_overlaps_existing(entry, entries): """ Check if entry overlaps any entry in the list of entries """ # Only check simple types if len(entry.split(",")) > 1: return try: entry_network = ipaddress.ip_network(entry, strict=False) except ValueError: # could not parse the new IP address, maybe a MAC return for itr in entries: if entry_network.overlaps(ipaddress.ip_network(itr, strict=False)): raise FirewallError(errors.INVALID_ENTRY, "Entry '{}' overlaps with existing entry '{}'".format(entry, itr)) def check_for_overlapping_entries(entries): """ Check if any entry overlaps any entry in the list of entries """ try: entries = [ipaddress.ip_network(x, strict=False) for x in entries] except ValueError: # at least one entry can not be parsed return if len(entries) == 0: return # We can take advantage of some facts of IPv4Network/IPv6Network and # how Python sorts the networks to quickly detect overlaps. # # Facts: # # 1. IPv{4,6}Network are normalized to remove host bits, e.g. # 10.1.1.0/16 will become 10.1.0.0/16. # # 2. IPv{4,6}Network objects are sorted by: # a. IP address (network bits) # then # b. netmask (significant bits count) # # Because of the above we have these properties: # # 1. big networks (netA) are sorted before smaller networks (netB) # that overlap the big network (netA) # - e.g. 10.1.128.0/17 (netA) sorts before 10.1.129.0/24 (netB) # 2. same value addresses (network bits) are grouped together even # if the number of network bits vary. e.g. /16 vs /24 # - recall that address are normalized to remove host bits # - e.g. 10.1.128.0/17 (netA) sorts before 10.1.128.0/24 (netC) # 3. non-overlapping networks (netD, netE) are always sorted before or # after networks that overlap (netB, netC) the current one (netA) # - e.g. 10.1.128.0/17 (netA) sorts before 10.2.128.0/16 (netD) # - e.g. 10.1.128.0/17 (netA) sorts after 9.1.128.0/17 (netE) # - e.g. 9.1.128.0/17 (netE) sorts before 10.1.129.0/24 (netB) # # With this we know the sorted list looks like: # # list: [ netE, netA, netB, netC, netD ] # # netE = non-overlapping network # netA = big network # netB = smaller network that overlaps netA (subnet) # netC = smaller network that overlaps netA (subnet) # netD = non-overlapping network # # If networks netB and netC exist in the list, they overlap and are # adjacent to netA. # # Checking for overlaps on a sorted list is thus: # # 1. compare adjacent elements in the list for overlaps # # Recall that we only need to detect a single overlap. We do not need to # detect them all. # entries.sort() prev_network = entries.pop(0) for current_network in entries: if prev_network.overlaps(current_network): raise FirewallError(errors.INVALID_ENTRY, "Entry '{}' overlaps entry '{}'".format(prev_network, current_network)) prev_network = current_network core/__init__.py 0000644 00000000000 15025011705 0007567 0 ustar 00 core/rich.py 0000644 00000104513 15025011705 0006773 0 ustar 00 # -*- coding: utf-8 -*- # # Copyright (C) 2013-2016 Red Hat, Inc. # # Authors: # Thomas Woerner <twoerner@redhat.com> # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see <http://www.gnu.org/licenses/>. # __all__ = [ "Rich_Source", "Rich_Destination", "Rich_Service", "Rich_Port", "Rich_Protocol", "Rich_Masquerade", "Rich_IcmpBlock", "Rich_IcmpType", "Rich_SourcePort", "Rich_ForwardPort", "Rich_Log", "Rich_NFLog", "Rich_Accept", "Rich_Reject", "Rich_Drop", "Rich_Mark", "Rich_Audit", "Rich_Limit", "Rich_Rule", "Rich_Tcp_Mss_Clamp" ] from firewall import functions from firewall.core.ipset import check_ipset_name from firewall.core.base import REJECT_TYPES from firewall import errors from firewall.errors import FirewallError class Rich_Source(object): def __init__(self, addr, mac, ipset, invert=False): self.addr = addr if self.addr == "": self.addr = None self.mac = mac if self.mac == "" or self.mac is None: self.mac = None elif self.mac is not None: self.mac = self.mac.upper() self.ipset = ipset if self.ipset == "": self.ipset = None self.invert = invert if self.addr is None and self.mac is None and self.ipset is None: raise FirewallError(errors.INVALID_RULE, "no address, mac and ipset") def __str__(self): ret = 'source%s ' % (" NOT" if self.invert else "") if self.addr is not None: return ret + 'address="%s"' % self.addr elif self.mac is not None: return ret + 'mac="%s"' % self.mac elif self.ipset is not None: return ret + 'ipset="%s"' % self.ipset raise FirewallError(errors.INVALID_RULE, "no address, mac and ipset") class Rich_Destination(object): def __init__(self, addr, ipset, invert=False): self.addr = addr if self.addr == "": self.addr = None self.ipset = ipset if self.ipset == "": self.ipset = None self.invert = invert if self.addr is None and self.ipset is None: raise FirewallError(errors.INVALID_RULE, "no address and ipset") def __str__(self): ret = 'destination%s ' % (" NOT" if self.invert else "") if self.addr is not None: return ret + 'address="%s"' % self.addr elif self.ipset is not None: return ret + 'ipset="%s"' % self.ipset raise FirewallError(errors.INVALID_RULE, "no address and ipset") class Rich_Service(object): def __init__(self, name): self.name = name def __str__(self): return 'service name="%s"' % (self.name) class Rich_Port(object): def __init__(self, port, protocol): self.port = port self.protocol = protocol def __str__(self): return 'port port="%s" protocol="%s"' % (self.port, self.protocol) class Rich_SourcePort(Rich_Port): def __str__(self): return 'source-port port="%s" protocol="%s"' % (self.port, self.protocol) class Rich_Protocol(object): def __init__(self, value): self.value = value def __str__(self): return 'protocol value="%s"' % (self.value) class Rich_Masquerade(object): def __init__(self): pass def __str__(self): return 'masquerade' class Rich_IcmpBlock(object): def __init__(self, name): self.name = name def __str__(self): return 'icmp-block name="%s"' % (self.name) class Rich_IcmpType(object): def __init__(self, name): self.name = name def __str__(self): return 'icmp-type name="%s"' % (self.name) class Rich_Tcp_Mss_Clamp(object): def __init__(self, value): self.value = value def __str__(self): if self.value: return 'tcp-mss-clamp value="%s"' % (self.value) else: return 'tcp-mss-clamp' class Rich_ForwardPort(object): def __init__(self, port, protocol, to_port, to_address): self.port = port self.protocol = protocol self.to_port = to_port self.to_address = to_address # replace None with "" in to_port and/or to_address if self.to_port is None: self.to_port = "" if self.to_address is None: self.to_address = "" def __str__(self): return 'forward-port port="%s" protocol="%s"%s%s' % \ (self.port, self.protocol, ' to-port="%s"' % self.to_port if self.to_port != "" else '', ' to-addr="%s"' % self.to_address if self.to_address != "" else '') class Rich_Log(object): def __init__(self, prefix=None, level=None, limit=None): #TODO check default level in iptables self.prefix = prefix self.level = level self.limit = limit def __str__(self): return 'log%s%s%s' % \ (' prefix="%s"' % (self.prefix) if self.prefix else "", ' level="%s"' % (self.level) if self.level else "", " %s" % self.limit if self.limit else "") def check(self): if self.prefix and len(self.prefix) > 127: raise FirewallError(errors.INVALID_LOG_PREFIX, "maximum accepted length of 'prefix' is 127.") if self.level and \ self.level not in [ "emerg", "alert", "crit", "error", "warning", "notice", "info", "debug" ]: raise FirewallError(errors.INVALID_LOG_LEVEL, self.level) if self.limit is not None: self.limit.check() class Rich_NFLog(object): def __init__(self, group=None, prefix=None, queue_size=None, limit=None): self.group = group self.prefix = prefix self.threshold = queue_size self.limit = limit def __str__(self): return 'nflog%s%s%s%s' % \ (' group="%s"' % (self.group) if self.group else "", ' prefix="%s"' % (self.prefix) if self.prefix else "", ' queue-size="%s"' % (self.threshold) if self.threshold else "", " %s" % self.limit if self.limit else "") def check(self): if self.group and not functions.checkUINT16(self.group): raise FirewallError(errors.INVALID_NFLOG_GROUP, "nflog 'group' must be an integer between 0 and 65535.") if self.prefix and len(self.prefix) > 127: raise FirewallError(errors.INVALID_LOG_PREFIX, "maximum accepted length of 'prefix' is 127.") if self.threshold and not functions.checkUINT16(self.threshold): raise FirewallError(errors.INVALID_NFLOG_QUEUE, "nflog 'queue-size' must be an integer between 0 and 65535.") if self.limit is not None: self.limit.check() class Rich_Audit(object): def __init__(self, limit=None): #TODO check default level in iptables self.limit = limit def __str__(self): return 'audit%s' % (" %s" % self.limit if self.limit else "") class Rich_Accept(object): def __init__(self, limit=None): self.limit = limit def __str__(self): return "accept%s" % (" %s" % self.limit if self.limit else "") class Rich_Reject(object): def __init__(self, _type=None, limit=None): self.type = _type self.limit = limit def __str__(self): return "reject%s%s" % (' type="%s"' % self.type if self.type else "", " %s" % self.limit if self.limit else "") def check(self, family): if self.type: if not family: raise FirewallError(errors.INVALID_RULE, "When using reject type you must specify also rule family.") if family in ['ipv4', 'ipv6'] and \ self.type not in REJECT_TYPES[family]: valid_types = ", ".join(REJECT_TYPES[family]) raise FirewallError(errors.INVALID_RULE, "Wrong reject type %s.\nUse one of: %s." % (self.type, valid_types)) class Rich_Drop(Rich_Accept): def __str__(self): return "drop%s" % (" %s" % self.limit if self.limit else "") class Rich_Mark(object): def __init__(self, _set, limit=None): self.set = _set self.limit = limit def __str__(self): return "mark set=%s%s" % (self.set, " %s" % self.limit if self.limit else "") def check(self): if self.set is not None: x = self.set else: raise FirewallError(errors.INVALID_MARK, "no value set") if "/" in x: splits = x.split("/") if len(splits) != 2: raise FirewallError(errors.INVALID_MARK, x) if not functions.checkUINT32(splits[0]) or \ not functions.checkUINT32(splits[1]): # value and mask are uint32 raise FirewallError(errors.INVALID_MARK, x) else: if not functions.checkUINT32(x): # value is uint32 raise FirewallError(errors.INVALID_MARK, x) class Rich_Limit(object): def __init__(self, value): self.value = value if "/" in self.value: splits = self.value.split("/") if len(splits) == 2 and \ splits[1] in [ "second", "minute", "hour", "day" ]: self.value = "%s/%s" % (splits[0], splits[1][:1]) def check(self): splits = None if "/" in self.value: splits = self.value.split("/") if not splits or len(splits) != 2: raise FirewallError(errors.INVALID_LIMIT, self.value) (rate, duration) = splits try: rate = int(rate) except: raise FirewallError(errors.INVALID_LIMIT, self.value) if rate < 1 or duration not in [ "s", "m", "h", "d" ]: raise FirewallError(errors.INVALID_LIMIT, self.value) mult = 1 if duration == "s": mult = 1 elif duration == "m": mult = 60 elif duration == "h": mult = 60*60 elif duration == "d": mult = 24*60*60 if 10000 * mult / rate == 0: raise FirewallError(errors.INVALID_LIMIT, "%s too fast" % self.value) if rate == 1 and duration == "d": # iptables (v1.4.21) doesn't accept 1/d raise FirewallError(errors.INVALID_LIMIT, "%s too slow" % self.value) def __str__(self): return 'limit value="%s"' % (self.value) def command(self): return '' class Rich_Rule(object): priority_min = -32768 priority_max = 32767 def __init__(self, family=None, rule_str=None, priority=0): if family is not None: self.family = str(family) else: self.family = None self.priority = priority self.source = None self.destination = None self.element = None self.log = None self.audit = None self.action = None if rule_str: self._import_from_string(rule_str) def _lexer(self, rule_str): """ Lexical analysis """ tokens = [] for r in functions.splitArgs(rule_str): if "=" in r: attr = r.split('=') if len(attr) != 2 or not attr[0] or not attr[1]: raise FirewallError(errors.INVALID_RULE, 'internal error in _lexer(): %s' % r) tokens.append({'attr_name':attr[0], 'attr_value':attr[1]}) else: tokens.append({'element':r}) tokens.append({'element':'EOL'}) return tokens def _import_from_string(self, rule_str): if not rule_str: raise FirewallError(errors.INVALID_RULE, 'empty rule') rule_str = functions.stripNonPrintableCharacters(rule_str) self.priority = 0 self.family = None self.source = None self.destination = None self.element = None self.log = None self.audit = None self.action = None tokens = self._lexer(rule_str) if tokens and tokens[0].get('element') == 'EOL': raise FirewallError(errors.INVALID_RULE, 'empty rule') attrs = {} # attributes of elements in_elements = [] # stack with elements we are in index = 0 # index into tokens while not (tokens[index].get('element') == 'EOL' and in_elements == ['rule']): element = tokens[index].get('element') attr_name = tokens[index].get('attr_name') attr_value = tokens[index].get('attr_value') #print ("in_elements: ", in_elements) #print ("index: %s, element: %s, attribute: %s=%s" % (index, element, attr_name, attr_value)) if attr_name: # attribute if attr_name not in ['priority', 'family', 'address', 'mac', 'ipset', 'invert', 'value', 'port', 'protocol', 'to-port', 'to-addr', 'name', 'group', 'prefix', 'level', 'queue-size', 'type', 'set']: raise FirewallError(errors.INVALID_RULE, "bad attribute '%s'" % attr_name) else: # element if element in ['rule', 'source', 'destination', 'protocol', 'service', 'port', 'icmp-block', 'icmp-type', 'masquerade', 'forward-port', 'source-port', 'log', 'nflog', 'audit', 'accept', 'drop', 'reject', 'mark', 'limit', 'not', 'NOT', 'EOL', 'tcp-mss-clamp']: if element == 'source' and self.source: raise FirewallError(errors.INVALID_RULE, "more than one 'source' element") elif element == 'destination' and self.destination: raise FirewallError(errors.INVALID_RULE, "more than one 'destination' element") elif element in ['protocol', 'service', 'port', 'icmp-block', 'icmp-type', 'masquerade', 'forward-port', 'source-port'] and self.element: raise FirewallError(errors.INVALID_RULE, "more than one element. There cannot be both '%s' and '%s' in one rule." % (element, self.element)) elif element in ['log', 'nflog'] and self.log: raise FirewallError(errors.INVALID_RULE, "more than one logging element") elif element == 'audit' and self.audit: raise FirewallError(errors.INVALID_RULE, "more than one 'audit' element") elif element in ['accept', 'drop', 'reject', 'mark'] and self.action: raise FirewallError(errors.INVALID_RULE, "more than one 'action' element. There cannot be both '%s' and '%s' in one rule." % (element, self.action)) else: raise FirewallError(errors.INVALID_RULE, "unknown element %s" % element) in_element = in_elements[len(in_elements)-1] if len(in_elements) > 0 else '' if in_element == '': if not element and attr_name: if attr_name == 'family': raise FirewallError(errors.INVALID_RULE, "'family' outside of rule. Use 'rule family=...'.") elif attr_name == 'priority': raise FirewallError(errors.INVALID_RULE, "'priority' outside of rule. Use 'rule priority=...'.") else: raise FirewallError(errors.INVALID_RULE, "'%s' outside of any element. Use 'rule <element> %s= ...'." % (attr_name, attr_name)) elif 'rule' not in element: raise FirewallError(errors.INVALID_RULE, "'%s' outside of rule. Use 'rule ... %s ...'." % (element, element)) else: in_elements.append('rule') # push into stack elif in_element == 'rule': if attr_name == 'family': if attr_value not in ['ipv4', 'ipv6']: raise FirewallError(errors.INVALID_RULE, "'family' attribute cannot have '%s' value. Use 'ipv4' or 'ipv6' instead." % attr_value) self.family = attr_value elif attr_name == 'priority': try: self.priority = int(attr_value) except ValueError: raise FirewallError(errors.INVALID_PRIORITY, "invalid 'priority' attribute value '%s'." % attr_value) elif attr_name: if attr_name == 'protocol': err_msg = "wrong 'protocol' usage. Use either 'rule protocol value=...' or 'rule [forward-]port protocol=...'." else: err_msg = "attribute '%s' outside of any element. Use 'rule <element> %s= ...'." % (attr_name, attr_name) raise FirewallError(errors.INVALID_RULE, err_msg) else: in_elements.append(element) # push into stack elif in_element == 'source': if attr_name in ['address', 'mac', 'ipset', 'invert']: attrs[attr_name] = attr_value elif element in ['not', 'NOT']: attrs['invert'] = True else: self.source = Rich_Source(attrs.get('address'), attrs.get('mac'), attrs.get('ipset'), attrs.get('invert', False)) in_elements.pop() # source attrs.clear() index = index -1 # return token to input elif in_element == 'destination': if attr_name in ['address', 'ipset', 'invert']: attrs[attr_name] = attr_value elif element in ['not', 'NOT']: attrs['invert'] = True else: self.destination = Rich_Destination(attrs.get('address'), attrs.get('ipset'), attrs.get('invert', False)) in_elements.pop() # destination attrs.clear() index = index -1 # return token to input elif in_element == 'protocol': if attr_name == 'value': self.element = Rich_Protocol(attr_value) in_elements.pop() # protocol else: raise FirewallError(errors.INVALID_RULE, "invalid 'protocol' element") elif in_element == 'tcp-mss-clamp': if attr_name == 'value': attrs[attr_name] = attr_value else: self.element = Rich_Tcp_Mss_Clamp(attrs.get('value')) in_elements.pop() attrs.clear() index = index -1 elif in_element == 'service': if attr_name == 'name': self.element = Rich_Service(attr_value) in_elements.pop() # service else: raise FirewallError(errors.INVALID_RULE, "invalid 'service' element") elif in_element == 'port': if attr_name in ['port', 'protocol']: attrs[attr_name] = attr_value else: self.element = Rich_Port(attrs.get('port'), attrs.get('protocol')) in_elements.pop() # port attrs.clear() index = index -1 # return token to input elif in_element == 'icmp-block': if attr_name == 'name': self.element = Rich_IcmpBlock(attr_value) in_elements.pop() # icmp-block else: raise FirewallError(errors.INVALID_RULE, "invalid 'icmp-block' element") elif in_element == 'icmp-type': if attr_name == 'name': self.element = Rich_IcmpType(attr_value) in_elements.pop() # icmp-type else: raise FirewallError(errors.INVALID_RULE, "invalid 'icmp-type' element") elif in_element == 'masquerade': self.element = Rich_Masquerade() in_elements.pop() attrs.clear() index = index -1 # return token to input elif in_element == 'forward-port': if attr_name in ['port', 'protocol', 'to-port', 'to-addr']: attrs[attr_name] = attr_value else: self.element = Rich_ForwardPort(attrs.get('port'), attrs.get('protocol'), attrs.get('to-port'), attrs.get('to-addr')) in_elements.pop() # forward-port attrs.clear() index = index -1 # return token to input elif in_element == 'source-port': if attr_name in ['port', 'protocol']: attrs[attr_name] = attr_value else: self.element = Rich_SourcePort(attrs.get('port'), attrs.get('protocol')) in_elements.pop() # source-port attrs.clear() index = index -1 # return token to input elif in_element == 'log': if attr_name in ['prefix', 'level']: attrs[attr_name] = attr_value elif element == 'limit': in_elements.append('limit') else: self.log = Rich_Log(attrs.get('prefix'), attrs.get('level'), attrs.get('limit')) in_elements.pop() # log attrs.clear() index = index -1 # return token to input elif in_element == 'nflog': if attr_name in ['group', 'prefix', 'queue-size']: attrs[attr_name] = attr_value elif element == 'limit': in_elements.append('limit') else: self.log = Rich_NFLog(attrs.get('group'), attrs.get('prefix'), attrs.get('queue-size'), attrs.get('limit')) in_elements.pop() # nflog attrs.clear() index = index -1 # return token to input elif in_element == 'audit': if element == 'limit': in_elements.append('limit') else: self.audit = Rich_Audit(attrs.get('limit')) in_elements.pop() # audit attrs.clear() index = index -1 # return token to input elif in_element == 'accept': if element == 'limit': in_elements.append('limit') else: self.action = Rich_Accept(attrs.get('limit')) in_elements.pop() # accept attrs.clear() index = index -1 # return token to input elif in_element == 'drop': if element == 'limit': in_elements.append('limit') else: self.action = Rich_Drop(attrs.get('limit')) in_elements.pop() # drop attrs.clear() index = index -1 # return token to input elif in_element == 'reject': if attr_name == 'type': attrs[attr_name] = attr_value elif element == 'limit': in_elements.append('limit') else: self.action = Rich_Reject(attrs.get('type'), attrs.get('limit')) in_elements.pop() # accept attrs.clear() index = index -1 # return token to input elif in_element == 'mark': if attr_name == 'set': attrs[attr_name] = attr_value elif element == 'limit': in_elements.append('limit') else: self.action = Rich_Mark(attrs.get('set'), attrs.get('limit')) in_elements.pop() # accept attrs.clear() index = index -1 # return token to input elif in_element == 'limit': if attr_name == 'value': attrs['limit'] = Rich_Limit(attr_value) in_elements.pop() # limit else: raise FirewallError(errors.INVALID_RULE, "invalid 'limit' element") index = index + 1 self.check() def check(self): if self.family is not None and self.family not in [ "ipv4", "ipv6" ]: raise FirewallError(errors.INVALID_FAMILY, self.family) if self.family is None: if (self.source is not None and self.source.addr is not None) or \ self.destination is not None: raise FirewallError(errors.MISSING_FAMILY) if type(self.element) == Rich_ForwardPort: raise FirewallError(errors.MISSING_FAMILY) if self.priority < self.priority_min or self.priority > self.priority_max: raise FirewallError(errors.INVALID_PRIORITY, "'priority' attribute must be between %d and %d." \ % (self.priority_min, self.priority_max)) if self.element is None and \ (self.log is None or (self.log is not None and self.priority == 0)): if self.action is None: raise FirewallError(errors.INVALID_RULE, "no element, no action") if self.source is None and self.destination is None and self.priority == 0: raise FirewallError(errors.INVALID_RULE, "no element, no source, no destination") if type(self.element) not in [ Rich_IcmpBlock, Rich_ForwardPort, Rich_Masquerade, Rich_Tcp_Mss_Clamp ]: if self.log is None and self.audit is None and \ self.action is None: raise FirewallError(errors.INVALID_RULE, "no action, no log, no audit") # source if self.source is not None: if self.source.addr is not None: if self.family is None: raise FirewallError(errors.INVALID_FAMILY) if self.source.mac is not None: raise FirewallError(errors.INVALID_RULE, "address and mac") if self.source.ipset is not None: raise FirewallError(errors.INVALID_RULE, "address and ipset") if not functions.check_address(self.family, self.source.addr): raise FirewallError(errors.INVALID_ADDR, str(self.source.addr)) elif self.source.mac is not None: if self.source.ipset is not None: raise FirewallError(errors.INVALID_RULE, "mac and ipset") if not functions.check_mac(self.source.mac): raise FirewallError(errors.INVALID_MAC, str(self.source.mac)) elif self.source.ipset is not None: if not check_ipset_name(self.source.ipset): raise FirewallError(errors.INVALID_IPSET, str(self.source.ipset)) else: raise FirewallError(errors.INVALID_RULE, "invalid source") # destination if self.destination is not None: if self.destination.addr is not None: if self.family is None: raise FirewallError(errors.INVALID_FAMILY) if self.destination.ipset is not None: raise FirewallError(errors.INVALID_DESTINATION, "address and ipset") if not functions.check_address(self.family, self.destination.addr): raise FirewallError(errors.INVALID_ADDR, str(self.destination.addr)) elif self.destination.ipset is not None: if not check_ipset_name(self.destination.ipset): raise FirewallError(errors.INVALID_IPSET, str(self.destination.ipset)) else: raise FirewallError(errors.INVALID_RULE, "invalid destination") # service if type(self.element) == Rich_Service: # service availability needs to be checked in Firewall, here is no # knowledge about this, therefore only simple check if self.element.name is None or len(self.element.name) < 1: raise FirewallError(errors.INVALID_SERVICE, str(self.element.name)) # port elif type(self.element) == Rich_Port: if not functions.check_port(self.element.port): raise FirewallError(errors.INVALID_PORT, self.element.port) if self.element.protocol not in [ "tcp", "udp", "sctp", "dccp" ]: raise FirewallError(errors.INVALID_PROTOCOL, self.element.protocol) # protocol elif type(self.element) == Rich_Protocol: if not functions.checkProtocol(self.element.value): raise FirewallError(errors.INVALID_PROTOCOL, self.element.value) # masquerade elif type(self.element) == Rich_Masquerade: if self.action is not None: raise FirewallError(errors.INVALID_RULE, "masquerade and action") if self.source is not None and self.source.mac is not None: raise FirewallError(errors.INVALID_RULE, "masquerade and mac source") # icmp-block elif type(self.element) == Rich_IcmpBlock: # icmp type availability needs to be checked in Firewall, here is no # knowledge about this, therefore only simple check if self.element.name is None or len(self.element.name) < 1: raise FirewallError(errors.INVALID_ICMPTYPE, str(self.element.name)) if self.action: raise FirewallError(errors.INVALID_RULE, "icmp-block and action") # icmp-type elif type(self.element) == Rich_IcmpType: # icmp type availability needs to be checked in Firewall, here is no # knowledge about this, therefore only simple check if self.element.name is None or len(self.element.name) < 1: raise FirewallError(errors.INVALID_ICMPTYPE, str(self.element.name)) # forward-port elif type(self.element) == Rich_ForwardPort: if not functions.check_port(self.element.port): raise FirewallError(errors.INVALID_PORT, self.element.port) if self.element.protocol not in [ "tcp", "udp", "sctp", "dccp" ]: raise FirewallError(errors.INVALID_PROTOCOL, self.element.protocol) if self.element.to_port == "" and self.element.to_address == "": raise FirewallError(errors.INVALID_PORT, self.element.to_port) if self.element.to_port != "" and \ not functions.check_port(self.element.to_port): raise FirewallError(errors.INVALID_PORT, self.element.to_port) if self.element.to_address != "" and \ not functions.check_single_address(self.family, self.element.to_address): raise FirewallError(errors.INVALID_ADDR, self.element.to_address) if self.family is None: raise FirewallError(errors.INVALID_FAMILY) if self.action is not None: raise FirewallError(errors.INVALID_RULE, "forward-port and action") # source-port elif type(self.element) == Rich_SourcePort: if not functions.check_port(self.element.port): raise FirewallError(errors.INVALID_PORT, self.element.port) if self.element.protocol not in [ "tcp", "udp", "sctp", "dccp" ]: raise FirewallError(errors.INVALID_PROTOCOL, self.element.protocol) # tcp-mss-clamp elif type(self.element) == Rich_Tcp_Mss_Clamp: if self.action is not None: raise FirewallError(errors.INVALID_RULE, "tcp-mss-clamp and %s are mutually exclusive" % self.action) if self.element.value: if not functions.checkTcpMssClamp(self.element.value): raise FirewallError(errors.INVALID_RULE, self.element.value) # other element and not empty? elif self.element is not None: raise FirewallError(errors.INVALID_RULE, "Unknown element %s" % type(self.element)) # log if self.log is not None: self.log.check() # audit if self.audit is not None: if type(self.action) not in [ Rich_Accept, Rich_Reject, Rich_Drop ]: raise FirewallError(errors.INVALID_AUDIT_TYPE, type(self.action)) if self.audit.limit is not None: self.audit.limit.check() # action if self.action is not None: if type(self.action) == Rich_Reject: self.action.check(self.family) elif type(self.action) == Rich_Mark: self.action.check() if self.action.limit is not None: self.action.limit.check() def __str__(self): ret = 'rule' if self.priority: ret += ' priority="%d"' % self.priority if self.family: ret += ' family="%s"' % self.family if self.source: ret += " %s" % self.source if self.destination: ret += " %s" % self.destination if self.element: ret += " %s" % self.element if self.log: ret += " %s" % self.log if self.audit: ret += " %s" % self.audit if self.action: ret += " %s" % self.action return ret #class Rich_RawRule(object): #class Rich_RuleSet(object): #class Rich_AddressList(object): core/icmp.py 0000644 00000006037 15025011705 0007000 0 ustar 00 # -*- coding: utf-8 -*- # # Copyright (C) 2017 Red Hat, Inc. # # Authors: # Thomas Woerner <twoerner@redhat.com> # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see <http://www.gnu.org/licenses/>. # __all__ = [ "ICMP_TYPES", "ICMPV6_TYPES", "check_icmp_type", "check_icmpv6_type" ] ICMP_TYPES = { "echo-reply": "0/0", "pong": "0/0", "network-unreachable": "3/0", "host-unreachable": "3/1", "protocol-unreachable": "3/2", "port-unreachable": "3/3", "fragmentation-needed": "3/4", "source-route-failed": "3/5", "network-unknown": "3/6", "host-unknown": "3/7", "network-prohibited": "3/9", "host-prohibited": "3/10", "TOS-network-unreachable": "3/11", "TOS-host-unreachable": "3/12", "communication-prohibited": "3/13", "host-precedence-violation": "3/14", "precedence-cutoff": "3/15", "source-quench": "4/0", "network-redirect": "5/0", "host-redirect": "5/1", "TOS-network-redirect": "5/2", "TOS-host-redirect": "5/3", "echo-request": "8/0", "ping": "8/0", "router-advertisement": "9/0", "router-solicitation": "10/0", "ttl-zero-during-transit": "11/0", "ttl-zero-during-reassembly": "11/1", "ip-header-bad": "12/0", "required-option-missing": "12/1", "timestamp-request": "13/0", "timestamp-reply": "14/0", "address-mask-request": "17/0", "address-mask-reply": "18/0", } ICMPV6_TYPES = { "no-route": "1/0", "communication-prohibited": "1/1", "address-unreachable": "1/3", "port-unreachable": "1/4", "packet-too-big": "2/0", "ttl-zero-during-transit": "3/0", "ttl-zero-during-reassembly": "3/1", "bad-header": "4/0", "unknown-header-type": "4/1", "unknown-option": "4/2", "echo-request": "128/0", "ping": "128/0", "echo-reply": "129/0", "pong": "129/0", "router-solicitation": "133/0", "router-advertisement": "134/0", "neighbour-solicitation": "135/0", "neigbour-solicitation": "135/0", "neighbour-advertisement": "136/0", "neigbour-advertisement": "136/0", "redirect": "137/0", } def check_icmp_name(_name): if _name in ICMP_TYPES: return True return False def check_icmp_type(_type): if _type in ICMP_TYPES.values(): return True return False def check_icmpv6_name(_name): if _name in ICMPV6_TYPES: return True return False def check_icmpv6_type(_type): if _type in ICMPV6_TYPES.values(): return True return False core/fw_policy.py 0000644 00000221504 15025011705 0010041 0 ustar 00 # -*- coding: utf-8 -*- # # SPDX-License-Identifier: GPL-2.0-or-later import copy from firewall.core.logger import log from firewall.functions import portStr, checkIPnMask, checkIP6nMask, \ checkProtocol, enable_ip_forwarding, check_single_address, \ portInPortRange, get_nf_conntrack_short_name, coalescePortRange, breakPortRange, \ checkTcpMssClamp from firewall.core.rich import Rich_Rule, Rich_Accept, \ Rich_Service, Rich_Port, Rich_Protocol, \ Rich_Masquerade, Rich_ForwardPort, Rich_SourcePort, Rich_IcmpBlock, \ Rich_IcmpType, Rich_Tcp_Mss_Clamp from firewall.core.fw_transaction import FirewallTransaction from firewall import errors from firewall.errors import FirewallError from firewall.core.base import SOURCE_IPSET_TYPES class FirewallPolicy(object): def __init__(self, fw): self._fw = fw self._chains = { } self._policies = { } def __repr__(self): return '%s(%r, %r)' % (self.__class__, self._chains, self._policies) def cleanup(self): self._chains.clear() self._policies.clear() # transaction def new_transaction(self): t = FirewallTransaction(self._fw) t.add_pre(self._fw.full_check_config) return t # policies def get_policies(self): return sorted(self._policies.keys()) def get_policies_not_derived_from_zone(self): policies = [] for p in self.get_policies(): p_obj = self.get_policy(p) if not p_obj.derived_from_zone: policies.append(p) return sorted(policies) def get_active_policies_not_derived_from_zone(self): active_policies = [] for policy in self.get_policies_not_derived_from_zone(): p_obj = self.get_policy(policy) if (set(p_obj.ingress_zones) & (set(self._fw.zone.get_active_zones()) | set(["HOST", "ANY"]))) and \ (set(p_obj.egress_zones) & (set(self._fw.zone.get_active_zones()) | set(["HOST", "ANY"]))): active_policies.append(policy) return active_policies def get_policy(self, policy): p = self._fw.check_policy(policy) return self._policies[p] def add_policy(self, obj): self._policies[obj.name] = obj def remove_policy(self, policy): obj = self._policies[policy] if obj.applied: self.unapply_policy_settings(policy) del self._policies[policy] def apply_policies(self, use_transaction=None): for policy in self.get_policies(): p_obj = self._policies[policy] if p_obj.derived_from_zone: continue if policy in self.get_active_policies_not_derived_from_zone(): log.debug1("Applying policy '%s'", policy) self.apply_policy_settings(policy, use_transaction=use_transaction) def set_policy_applied(self, policy, applied): obj = self._policies[policy] obj.applied = applied def _policy_settings(self, enable, policy, use_transaction=None): _policy = self._fw.check_policy(policy) obj = self._policies[_policy] if (enable and obj.applied) or (not enable and not obj.applied): return if enable: obj.applied = True if use_transaction is None: transaction = self.new_transaction() else: transaction = use_transaction if enable: # build the base chain layout of the policy for (table, chain) in self._get_table_chains_for_policy_dispatch(policy) if not obj.derived_from_zone \ else self._get_table_chains_for_zone_dispatch(policy): self.gen_chain_rules(policy, True, table, chain, transaction) if not obj.derived_from_zone: self._ingress_egress_zones(enable, _policy, transaction) for key in ["services", "ports", "masquerade", "forward_ports", "source_ports", "icmp_blocks", "rules_str", "protocols", "icmp_block_inversion", "ingress_zones", "egress_zones"]: args_list = getattr(self.get_policy(policy), key) if isinstance(args_list, bool): if not ((enable and args_list) or (not enable and args_list)): continue args_list = [args_list] for args in args_list: if key == "icmp_blocks": self._icmp_block(enable, _policy, args, transaction) elif key == "icmp_block_inversion": continue elif key == "forward_ports": self._forward_port(enable, _policy, transaction, *args) elif key == "services": self._service(enable, _policy, args, transaction) elif key == "ports": self._port(enable, _policy, args[0], args[1], transaction) elif key == "protocols": self._protocol(enable, _policy, args, transaction) elif key == "source_ports": self._source_port(enable, _policy, args[0], args[1], transaction) elif key == "masquerade": self._masquerade(enable, _policy, transaction) elif key == "rules_str": self.__rule(enable, _policy, Rich_Rule(rule_str=args), transaction) elif key == "ingress_zones": continue elif key == "egress_zones": continue else: log.warning("Policy '%s': Unknown setting '%s:%s', " "unable to apply", policy, key, args) if not enable: for (table, chain) in self._get_table_chains_for_policy_dispatch(policy) if not obj.derived_from_zone \ else self._get_table_chains_for_zone_dispatch(policy): self.gen_chain_rules(policy, False, table, chain, transaction) obj.applied = False if use_transaction is None: transaction.execute(enable) def apply_policy_settings(self, policy, use_transaction=None): self._policy_settings(True, policy, use_transaction=use_transaction) def unapply_policy_settings(self, policy, use_transaction=None): self._policy_settings(False, policy, use_transaction=use_transaction) def get_config_with_settings_dict(self, policy): return self.get_policy(policy).export_config_dict() def set_config_with_settings_dict(self, policy, settings, sender): # stupid wrappers to convert rich rule string to rich rule object from firewall.core.rich import Rich_Rule def add_rule_wrapper(policy, rule_str, timeout=0, sender=None): self.add_rule(policy, Rich_Rule(rule_str=rule_str), timeout=0, sender=sender) def remove_rule_wrapper(policy, rule_str): self.remove_rule(policy, Rich_Rule(rule_str=rule_str)) setting_to_fn = { "services": (self.add_service, self.remove_service), "ports": (self.add_port, self.remove_port), "icmp_blocks": (self.add_icmp_block, self.remove_icmp_block), "masquerade": (self.add_masquerade, self.remove_masquerade), "forward_ports": (self.add_forward_port, self.remove_forward_port), "rich_rules": (add_rule_wrapper, remove_rule_wrapper), "protocols": (self.add_protocol, self.remove_protocol), "source_ports": (self.add_source_port, self.remove_source_port), "ingress_zones": (self.add_ingress_zone, self.remove_ingress_zone), "egress_zones": (self.add_egress_zone, self.remove_egress_zone), } # do a full config check on a temporary object before trying to make # the runtime changes old_obj = self.get_policy(policy) check_obj = copy.copy(old_obj) check_obj.import_config_dict(settings, self._fw.get_all_io_objects_dict()) self._fw.full_check_config({"policies": [check_obj]}) old_settings = self.get_config_with_settings_dict(policy) (add_settings, remove_settings) = self._fw.get_added_and_removed_settings(old_settings, settings) for key in remove_settings: if isinstance(remove_settings[key], list): for args in remove_settings[key]: if isinstance(args, tuple): setting_to_fn[key][1](policy, *args) else: setting_to_fn[key][1](policy, args) else: # bool setting_to_fn[key][1](policy) for key in add_settings: if isinstance(add_settings[key], list): for args in add_settings[key]: if isinstance(args, tuple): setting_to_fn[key][0](policy, *args, timeout=0, sender=sender) else: setting_to_fn[key][0](policy, args, timeout=0, sender=sender) else: # bool setting_to_fn[key][0](policy, timeout=0, sender=sender) # ingress zones def check_ingress_zone(self, zone): if not zone: raise FirewallError(errors.INVALID_ZONE) if zone not in ["HOST", "ANY"]: self._fw.check_zone(zone) def __ingress_zone_id(self, zone): self.check_ingress_zone(zone) return zone def add_ingress_zone(self, policy, zone, timeout=0, sender=None, use_transaction=None, allow_apply=True): _policy = self._fw.check_policy(policy) self._fw.check_timeout(timeout) self._fw.check_panic() _obj = self._policies[_policy] zone_id = self.__ingress_zone_id(zone) if zone_id in _obj.ingress_zones: raise FirewallError(errors.ALREADY_ENABLED, "'%s' already in '%s'" % (zone, _policy)) if use_transaction is None: transaction = self.new_transaction() else: transaction = use_transaction if allow_apply: if _obj.applied: self._ingress_egress_zones(False, _policy, transaction) # register early so backends can access updated zone list self.__register_ingress_zone(_obj, zone_id, timeout, sender) transaction.add_fail(self.__unregister_ingress_zone, _obj, zone_id) if not _obj.applied: if _policy in self.get_active_policies_not_derived_from_zone(): self.apply_policy_settings(_policy, use_transaction=transaction) transaction.add_fail(self.set_policy_applied, _policy, False) else: self._ingress_egress_zones(True, _policy, transaction) else: self.__register_ingress_zone(_obj, zone_id, timeout, sender) transaction.add_fail(self.__unregister_ingress_zone, _obj, zone_id) if use_transaction is None: transaction.execute(True) def __register_ingress_zone(self, _obj, zone_id, timeout, sender): _obj.ingress_zones.append(zone_id) def remove_ingress_zone(self, policy, zone, use_transaction=None): _policy = self._fw.check_policy(policy) self._fw.check_panic() _obj = self._policies[_policy] zone_id = self.__ingress_zone_id(zone) if zone_id not in _obj.ingress_zones: raise FirewallError(errors.NOT_ENABLED, "'%s' not in '%s'" % (zone, _policy)) if use_transaction is None: transaction = self.new_transaction() else: transaction = use_transaction if _obj.applied: if len(_obj.ingress_zones) == 1: self.unapply_policy_settings(_policy, transaction) else: self._ingress_egress_zones(False, _policy, transaction) # unregister early so backends have updated zone list self.__unregister_ingress_zone(_obj, zone_id) transaction.add_fail(self.__register_ingress_zone, _obj, zone_id, None, None) if _policy in self.get_active_policies_not_derived_from_zone(): self._ingress_egress_zones(True, _policy, transaction) else: transaction.add_post(self.__unregister_ingress_zone, _obj, zone_id) if use_transaction is None: transaction.execute(True) return _policy def __unregister_ingress_zone(self, _obj, zone_id): if zone_id in _obj.ingress_zones: _obj.ingress_zones.remove(zone_id) def query_ingress_zone(self, policy, zone): return self.__ingress_zone_id(zone) in self.get_policy(policy).ingress_zones def list_ingress_zones(self, policy): return self.get_policy(policy).ingress_zones # egress zones def check_egress_zone(self, zone): if not zone: raise FirewallError(errors.INVALID_ZONE) if zone not in ["HOST", "ANY"]: self._fw.check_zone(zone) def __egress_zone_id(self, zone): self.check_egress_zone(zone) return zone def add_egress_zone(self, policy, zone, timeout=0, sender=None, use_transaction=None, allow_apply=True): _policy = self._fw.check_policy(policy) self._fw.check_timeout(timeout) self._fw.check_panic() _obj = self._policies[_policy] zone_id = self.__egress_zone_id(zone) if zone_id in _obj.egress_zones: raise FirewallError(errors.ALREADY_ENABLED, "'%s' already in '%s'" % (zone, _policy)) if use_transaction is None: transaction = self.new_transaction() else: transaction = use_transaction if allow_apply: if _obj.applied: self._ingress_egress_zones(False, _policy, transaction) # register early so backends can access updated zone list self.__register_egress_zone(_obj, zone_id, timeout, sender) transaction.add_fail(self.__unregister_egress_zone, _obj, zone_id) if not _obj.applied: if _policy in self.get_active_policies_not_derived_from_zone(): self.apply_policy_settings(_policy, use_transaction=transaction) transaction.add_fail(self.set_policy_applied, _policy, False) else: self._ingress_egress_zones(True, _policy, transaction) else: self.__register_egress_zone(_obj, zone_id, timeout, sender) transaction.add_fail(self.__unregister_egress_zone, _obj, zone_id) if use_transaction is None: transaction.execute(True) def __register_egress_zone(self, _obj, zone_id, timeout, sender): _obj.egress_zones.append(zone_id) def remove_egress_zone(self, policy, zone, use_transaction=None): _policy = self._fw.check_policy(policy) self._fw.check_panic() _obj = self._policies[_policy] zone_id = self.__egress_zone_id(zone) if zone_id not in _obj.egress_zones: raise FirewallError(errors.NOT_ENABLED, "'%s' not in '%s'" % (zone, _policy)) if use_transaction is None: transaction = self.new_transaction() else: transaction = use_transaction if _obj.applied: if len(_obj.egress_zones) == 1: self.unapply_policy_settings(_policy, transaction) else: self._ingress_egress_zones(False, _policy, transaction) # unregister early so backends have updated zone list self.__unregister_egress_zone(_obj, zone_id) transaction.add_fail(self.__register_egress_zone, _obj, zone_id, None, None) if _policy in self.get_active_policies_not_derived_from_zone(): self._ingress_egress_zones(True, _policy, transaction) else: transaction.add_post(self.__unregister_egress_zone, _obj, zone_id) if use_transaction is None: transaction.execute(True) return _policy def __unregister_egress_zone(self, _obj, zone_id): if zone_id in _obj.egress_zones: _obj.egress_zones.remove(zone_id) def query_egress_zone(self, policy, zone): return self.__egress_zone_id(zone) in self.get_policy(policy).egress_zones def list_egress_zones(self, policy): return self.get_policy(policy).egress_zones # RICH LANGUAGE def check_rule(self, rule): rule.check() def __rule_id(self, rule): self.check_rule(rule) return str(rule) def _rule_source_ipv(self, source): if not source: return None if source.addr: if checkIPnMask(source.addr): return "ipv4" elif checkIP6nMask(source.addr): return "ipv6" elif hasattr(source, "mac") and source.mac: return "" elif hasattr(source, "ipset") and source.ipset: self._check_ipset_type_for_source(source.ipset) self._check_ipset_applied(source.ipset) return self._ipset_family(source.ipset) return None def __rule(self, enable, policy, rule, transaction): self._rule_prepare(enable, policy, rule, transaction) def add_rule(self, policy, rule, timeout=0, sender=None, use_transaction=None): _policy = self._fw.check_policy(policy) self._fw.check_timeout(timeout) self._fw.check_panic() _obj = self._policies[_policy] rule_id = self.__rule_id(rule) if rule_id in _obj.rules_str: _name = _obj.derived_from_zone if _obj.derived_from_zone else _policy raise FirewallError(errors.ALREADY_ENABLED, "'%s' already in '%s'" % (rule, _name)) if use_transaction is None: transaction = self.new_transaction() else: transaction = use_transaction if _obj.applied: self.__rule(True, _policy, rule, transaction) self.__register_rule(_obj, rule_id, timeout, sender) transaction.add_fail(self.__unregister_rule, _obj, rule_id) if use_transaction is None: transaction.execute(True) return _policy def __register_rule(self, _obj, rule_id, timeout, sender): _obj.rules_str.append(rule_id) def remove_rule(self, policy, rule, use_transaction=None): _policy = self._fw.check_policy(policy) self._fw.check_panic() _obj = self._policies[_policy] rule_id = self.__rule_id(rule) if rule_id not in _obj.rules_str: _name = _obj.derived_from_zone if _obj.derived_from_zone else _policy raise FirewallError(errors.NOT_ENABLED, "'%s' not in '%s'" % (rule, _name)) if use_transaction is None: transaction = self.new_transaction() else: transaction = use_transaction if _obj.applied: self.__rule(False, _policy, rule, transaction) transaction.add_post(self.__unregister_rule, _obj, rule_id) if use_transaction is None: transaction.execute(True) return _policy def __unregister_rule(self, _obj, rule_id): if rule_id in _obj.rules_str: _obj.rules_str.remove(rule_id) def query_rule(self, policy, rule): return self.__rule_id(rule) in self.get_policy(policy).rules_str def list_rules(self, policy): return self.get_policy(policy).rules_str # SERVICES def check_service(self, service): self._fw.check_service(service) def __service_id(self, service): self.check_service(service) return service def add_service(self, policy, service, timeout=0, sender=None, use_transaction=None): _policy = self._fw.check_policy(policy) self._fw.check_timeout(timeout) self._fw.check_panic() _obj = self._policies[_policy] service_id = self.__service_id(service) if service_id in _obj.services: _name = _obj.derived_from_zone if _obj.derived_from_zone else _policy raise FirewallError(errors.ALREADY_ENABLED, "'%s' already in '%s'" % (service, _name)) if use_transaction is None: transaction = self.new_transaction() else: transaction = use_transaction if _obj.applied: self._service(True, _policy, service, transaction) self.__register_service(_obj, service_id, timeout, sender) transaction.add_fail(self.__unregister_service, _obj, service_id) if use_transaction is None: transaction.execute(True) return _policy def __register_service(self, _obj, service_id, timeout, sender): _obj.services.append(service_id) def remove_service(self, policy, service, use_transaction=None): _policy = self._fw.check_policy(policy) self._fw.check_panic() _obj = self._policies[_policy] service_id = self.__service_id(service) if service_id not in _obj.services: _name = _obj.derived_from_zone if _obj.derived_from_zone else _policy raise FirewallError(errors.NOT_ENABLED, "'%s' not in '%s'" % (service, _name)) if use_transaction is None: transaction = self.new_transaction() else: transaction = use_transaction if _obj.applied: self._service(False, _policy, service, transaction) transaction.add_post(self.__unregister_service, _obj, service_id) if use_transaction is None: transaction.execute(True) return _policy def __unregister_service(self, _obj, service_id): if service_id in _obj.services: _obj.services.remove(service_id) def query_service(self, policy, service): return self.__service_id(service) in self.get_policy(policy).services def list_services(self, policy): return self.get_policy(policy).services def get_helpers_for_service_helpers(self, helpers): _helpers = [ ] for helper in helpers: try: _helper = self._fw.helper.get_helper(helper) except FirewallError: raise FirewallError(errors.INVALID_HELPER, helper) _helpers.append(_helper) return _helpers def get_helpers_for_service_modules(self, modules, enable): # If automatic helper assignment is turned off, helpers that # do not have ports defined will be replaced by the helpers # that the helper.module defines. _helpers = [ ] for module in modules: try: helper = self._fw.helper.get_helper(module) except FirewallError: raise FirewallError(errors.INVALID_HELPER, module) if len(helper.ports) < 1: _module_short_name = get_nf_conntrack_short_name(helper.module) try: _helper = self._fw.helper.get_helper(_module_short_name) _helpers.append(_helper) except FirewallError: if enable: log.warning("Helper '%s' is not available" % _module_short_name) continue else: _helpers.append(helper) return _helpers # PORTS def check_port(self, port, protocol): self._fw.check_port(port) self._fw.check_tcpudp(protocol) def __port_id(self, port, protocol): self.check_port(port, protocol) return (portStr(port, "-"), protocol) def add_port(self, policy, port, protocol, timeout=0, sender=None, use_transaction=None): _policy = self._fw.check_policy(policy) self._fw.check_timeout(timeout) self._fw.check_panic() _obj = self._policies[_policy] existing_port_ids = list(filter(lambda x: x[1] == protocol, _obj.ports)) for port_id in existing_port_ids: if portInPortRange(port, port_id[0]): _name = _obj.derived_from_zone if _obj.derived_from_zone else _policy raise FirewallError(errors.ALREADY_ENABLED, "'%s:%s' already in '%s'" % (port, protocol, _name)) added_ranges, removed_ranges = coalescePortRange(port, [_port for (_port, _protocol) in existing_port_ids]) if use_transaction is None: transaction = self.new_transaction() else: transaction = use_transaction if _obj.applied: for range in added_ranges: self._port(True, _policy, portStr(range, "-"), protocol, transaction) for range in removed_ranges: self._port(False, _policy, portStr(range, "-"), protocol, transaction) for range in added_ranges: port_id = self.__port_id(range, protocol) self.__register_port(_obj, port_id, timeout, sender) transaction.add_fail(self.__unregister_port, _obj, port_id) for range in removed_ranges: port_id = self.__port_id(range, protocol) transaction.add_post(self.__unregister_port, _obj, port_id) if use_transaction is None: transaction.execute(True) return _policy def __register_port(self, _obj, port_id, timeout, sender): _obj.ports.append(port_id) def remove_port(self, policy, port, protocol, use_transaction=None): _policy = self._fw.check_policy(policy) self._fw.check_panic() _obj = self._policies[_policy] existing_port_ids = list(filter(lambda x: x[1] == protocol, _obj.ports)) for port_id in existing_port_ids: if portInPortRange(port, port_id[0]): break else: _name = _obj.derived_from_zone if _obj.derived_from_zone else _policy raise FirewallError(errors.NOT_ENABLED, "'%s:%s' not in '%s'" % (port, protocol, _name)) added_ranges, removed_ranges = breakPortRange(port, [_port for (_port, _protocol) in existing_port_ids]) if use_transaction is None: transaction = self.new_transaction() else: transaction = use_transaction if _obj.applied: for range in added_ranges: self._port(True, _policy, portStr(range, "-"), protocol, transaction) for range in removed_ranges: self._port(False, _policy, portStr(range, "-"), protocol, transaction) for range in added_ranges: port_id = self.__port_id(range, protocol) self.__register_port(_obj, port_id, 0, None) transaction.add_fail(self.__unregister_port, _obj, port_id) for range in removed_ranges: port_id = self.__port_id(range, protocol) transaction.add_post(self.__unregister_port, _obj, port_id) if use_transaction is None: transaction.execute(True) return _policy def __unregister_port(self, _obj, port_id): if port_id in _obj.ports: _obj.ports.remove(port_id) def query_port(self, policy, port, protocol): for (_port, _protocol) in self.get_policy(policy).ports: if portInPortRange(port, _port) and protocol == _protocol: return True return False def list_ports(self, policy): return self.get_policy(policy).ports # PROTOCOLS def check_protocol(self, protocol): if not checkProtocol(protocol): raise FirewallError(errors.INVALID_PROTOCOL, protocol) def check_tcp_mss_clamp(self, tcp_mss_clamp_value): if not checkTcpMssClamp(tcp_mss_clamp_value): raise FirewallError(errors.INVALID_RULE, "tcp-mss-clamp value must be greater than or equal to 536, or the value 'pmtu'. Invalid value '%s'" % (tcp_mss_clamp_value)) def __protocol_id(self, protocol): self.check_protocol(protocol) return protocol def add_protocol(self, policy, protocol, timeout=0, sender=None, use_transaction=None): _policy = self._fw.check_policy(policy) self._fw.check_timeout(timeout) self._fw.check_panic() _obj = self._policies[_policy] protocol_id = self.__protocol_id(protocol) if protocol_id in _obj.protocols: _name = _obj.derived_from_zone if _obj.derived_from_zone else _policy raise FirewallError(errors.ALREADY_ENABLED, "'%s' already in '%s'" % (protocol, _name)) if use_transaction is None: transaction = self.new_transaction() else: transaction = use_transaction if _obj.applied: self._protocol(True, _policy, protocol, transaction) self.__register_protocol(_obj, protocol_id, timeout, sender) transaction.add_fail(self.__unregister_protocol, _obj, protocol_id) if use_transaction is None: transaction.execute(True) return _policy def __register_protocol(self, _obj, protocol_id, timeout, sender): _obj.protocols.append(protocol_id) def remove_protocol(self, policy, protocol, use_transaction=None): _policy = self._fw.check_policy(policy) self._fw.check_panic() _obj = self._policies[_policy] protocol_id = self.__protocol_id(protocol) if protocol_id not in _obj.protocols: _name = _obj.derived_from_zone if _obj.derived_from_zone else _policy raise FirewallError(errors.NOT_ENABLED, "'%s' not in '%s'" % (protocol, _name)) if use_transaction is None: transaction = self.new_transaction() else: transaction = use_transaction if _obj.applied: self._protocol(False, _policy, protocol, transaction) transaction.add_post(self.__unregister_protocol, _obj, protocol_id) if use_transaction is None: transaction.execute(True) return _policy def __unregister_protocol(self, _obj, protocol_id): if protocol_id in _obj.protocols: _obj.protocols.remove(protocol_id) def query_protocol(self, policy, protocol): return self.__protocol_id(protocol) in self.get_policy(policy).protocols def list_protocols(self, policy): return self.get_policy(policy).protocols # SOURCE PORTS def __source_port_id(self, port, protocol): self.check_port(port, protocol) return (portStr(port, "-"), protocol) def add_source_port(self, policy, port, protocol, timeout=0, sender=None, use_transaction=None): _policy = self._fw.check_policy(policy) self._fw.check_timeout(timeout) self._fw.check_panic() _obj = self._policies[_policy] existing_port_ids = list(filter(lambda x: x[1] == protocol, _obj.source_ports)) for port_id in existing_port_ids: if portInPortRange(port, port_id[0]): _name = _obj.derived_from_zone if _obj.derived_from_zone else _policy raise FirewallError(errors.ALREADY_ENABLED, "'%s:%s' already in '%s'" % (port, protocol, _name)) added_ranges, removed_ranges = coalescePortRange(port, [_port for (_port, _protocol) in existing_port_ids]) if use_transaction is None: transaction = self.new_transaction() else: transaction = use_transaction if _obj.applied: for range in added_ranges: self._source_port(True, _policy, portStr(range, "-"), protocol, transaction) for range in removed_ranges: self._source_port(False, _policy, portStr(range, "-"), protocol, transaction) for range in added_ranges: port_id = self.__source_port_id(range, protocol) self.__register_source_port(_obj, port_id, timeout, sender) transaction.add_fail(self.__unregister_source_port, _obj, port_id) for range in removed_ranges: port_id = self.__source_port_id(range, protocol) transaction.add_post(self.__unregister_source_port, _obj, port_id) if use_transaction is None: transaction.execute(True) return _policy def __register_source_port(self, _obj, port_id, timeout, sender): _obj.source_ports.append(port_id) def remove_source_port(self, policy, port, protocol, use_transaction=None): _policy = self._fw.check_policy(policy) self._fw.check_panic() _obj = self._policies[_policy] existing_port_ids = list(filter(lambda x: x[1] == protocol, _obj.source_ports)) for port_id in existing_port_ids: if portInPortRange(port, port_id[0]): break else: _name = _obj.derived_from_zone if _obj.derived_from_zone else _policy raise FirewallError(errors.NOT_ENABLED, "'%s:%s' not in '%s'" % (port, protocol, _name)) added_ranges, removed_ranges = breakPortRange(port, [_port for (_port, _protocol) in existing_port_ids]) if use_transaction is None: transaction = self.new_transaction() else: transaction = use_transaction if _obj.applied: for range in added_ranges: self._source_port(True, _policy, portStr(range, "-"), protocol, transaction) for range in removed_ranges: self._source_port(False, _policy, portStr(range, "-"), protocol, transaction) for range in added_ranges: port_id = self.__source_port_id(range, protocol) self.__register_source_port(_obj, port_id, 0, None) transaction.add_fail(self.__unregister_source_port, _obj, port_id) for range in removed_ranges: port_id = self.__source_port_id(range, protocol) transaction.add_post(self.__unregister_source_port, _obj, port_id) if use_transaction is None: transaction.execute(True) return _policy def __unregister_source_port(self, _obj, port_id): if port_id in _obj.source_ports: _obj.source_ports.remove(port_id) def query_source_port(self, policy, port, protocol): for (_port, _protocol) in self.get_policy(policy).source_ports: if portInPortRange(port, _port) and protocol == _protocol: return True return False def list_source_ports(self, policy): return self.get_policy(policy).source_ports # MASQUERADE def add_masquerade(self, policy, timeout=0, sender=None, use_transaction=None): _policy = self._fw.check_policy(policy) self._fw.check_timeout(timeout) self._fw.check_panic() _obj = self._policies[_policy] if _obj.masquerade: _name = _obj.derived_from_zone if _obj.derived_from_zone else _policy raise FirewallError(errors.ALREADY_ENABLED, "masquerade already enabled in '%s'" % _name) if use_transaction is None: transaction = self.new_transaction() else: transaction = use_transaction if _obj.applied: self._masquerade(True, _policy, transaction) self.__register_masquerade(_obj, timeout, sender) transaction.add_fail(self.__unregister_masquerade, _obj) if use_transaction is None: transaction.execute(True) return _policy def __register_masquerade(self, _obj, timeout, sender): _obj.masquerade = True def remove_masquerade(self, policy, use_transaction=None): _policy = self._fw.check_policy(policy) self._fw.check_panic() _obj = self._policies[_policy] if not _obj.masquerade: _name = _obj.derived_from_zone if _obj.derived_from_zone else _policy raise FirewallError(errors.NOT_ENABLED, "masquerade not enabled in '%s'" % _name) if use_transaction is None: transaction = self.new_transaction() else: transaction = use_transaction if _obj.applied: self._masquerade(False, _policy, transaction) transaction.add_post(self.__unregister_masquerade, _obj) if use_transaction is None: transaction.execute(True) return _policy def __unregister_masquerade(self, _obj): _obj.masquerade = False def query_masquerade(self, policy): return self.get_policy(policy).masquerade # PORT FORWARDING def check_forward_port(self, ipv, port, protocol, toport=None, toaddr=None): self._fw.check_port(port) self._fw.check_tcpudp(protocol) if toport: self._fw.check_port(toport) if toaddr: if not check_single_address(ipv, toaddr): raise FirewallError(errors.INVALID_ADDR, toaddr) if not toport and not toaddr: raise FirewallError( errors.INVALID_FORWARD, "port-forwarding is missing to-port AND to-addr") def __forward_port_id(self, port, protocol, toport=None, toaddr=None): if check_single_address("ipv6", toaddr): self.check_forward_port("ipv6", port, protocol, toport, toaddr) else: self.check_forward_port("ipv4", port, protocol, toport, toaddr) return (portStr(port, "-"), protocol, portStr(toport, "-"), str(toaddr)) def add_forward_port(self, policy, port, protocol, toport=None, toaddr=None, timeout=0, sender=None, use_transaction=None): _policy = self._fw.check_policy(policy) self._fw.check_timeout(timeout) self._fw.check_panic() _obj = self._policies[_policy] forward_id = self.__forward_port_id(port, protocol, toport, toaddr) if forward_id in _obj.forward_ports: _name = _obj.derived_from_zone if _obj.derived_from_zone else _policy raise FirewallError(errors.ALREADY_ENABLED, "'%s:%s:%s:%s' already in '%s'" % \ (port, protocol, toport, toaddr, _name)) if use_transaction is None: transaction = self.new_transaction() else: transaction = use_transaction if _obj.applied: self._forward_port(True, _policy, transaction, port, protocol, toport, toaddr) self.__register_forward_port(_obj, forward_id, timeout, sender) transaction.add_fail(self.__unregister_forward_port, _obj, forward_id) if use_transaction is None: transaction.execute(True) return _policy def __register_forward_port(self, _obj, forward_id, timeout, sender): _obj.forward_ports.append(forward_id) def remove_forward_port(self, policy, port, protocol, toport=None, toaddr=None, use_transaction=None): _policy = self._fw.check_policy(policy) self._fw.check_panic() _obj = self._policies[_policy] forward_id = self.__forward_port_id(port, protocol, toport, toaddr) if forward_id not in _obj.forward_ports: _name = _obj.derived_from_zone if _obj.derived_from_zone else _policy raise FirewallError(errors.NOT_ENABLED, "'%s:%s:%s:%s' not in '%s'" % \ (port, protocol, toport, toaddr, _name)) if use_transaction is None: transaction = self.new_transaction() else: transaction = use_transaction if _obj.applied: self._forward_port(False, _policy, transaction, port, protocol, toport, toaddr) transaction.add_post(self.__unregister_forward_port, _obj, forward_id) if use_transaction is None: transaction.execute(True) return _policy def __unregister_forward_port(self, _obj, forward_id): if forward_id in _obj.forward_ports: _obj.forward_ports.remove(forward_id) def query_forward_port(self, policy, port, protocol, toport=None, toaddr=None): forward_id = self.__forward_port_id(port, protocol, toport, toaddr) return forward_id in self.get_policy(policy).forward_ports def list_forward_ports(self, policy): return self.get_policy(policy).forward_ports # ICMP BLOCK def check_icmp_block(self, icmp): self._fw.check_icmptype(icmp) def __icmp_block_id(self, icmp): self.check_icmp_block(icmp) return icmp def add_icmp_block(self, policy, icmp, timeout=0, sender=None, use_transaction=None): _policy = self._fw.check_policy(policy) self._fw.check_timeout(timeout) self._fw.check_panic() _obj = self._policies[_policy] icmp_id = self.__icmp_block_id(icmp) if icmp_id in _obj.icmp_blocks: _name = _obj.derived_from_zone if _obj.derived_from_zone else _policy raise FirewallError(errors.ALREADY_ENABLED, "'%s' already in '%s'" % (icmp, _name)) if use_transaction is None: transaction = self.new_transaction() else: transaction = use_transaction if _obj.applied: self._icmp_block(True, _policy, icmp, transaction) self.__register_icmp_block(_obj, icmp_id, timeout, sender) transaction.add_fail(self.__unregister_icmp_block, _obj, icmp_id) if use_transaction is None: transaction.execute(True) return _policy def __register_icmp_block(self, _obj, icmp_id, timeout, sender): _obj.icmp_blocks.append(icmp_id) def remove_icmp_block(self, policy, icmp, use_transaction=None): _policy = self._fw.check_policy(policy) self._fw.check_panic() _obj = self._policies[_policy] icmp_id = self.__icmp_block_id(icmp) if icmp_id not in _obj.icmp_blocks: _name = _obj.derived_from_zone if _obj.derived_from_zone else _policy raise FirewallError(errors.NOT_ENABLED, "'%s' not in '%s'" % (icmp, _name)) if use_transaction is None: transaction = self.new_transaction() else: transaction = use_transaction if _obj.applied: self._icmp_block(False, _policy, icmp, transaction) transaction.add_post(self.__unregister_icmp_block, _obj, icmp_id) if use_transaction is None: transaction.execute(True) return _policy def __unregister_icmp_block(self, _obj, icmp_id): if icmp_id in _obj.icmp_blocks: _obj.icmp_blocks.remove(icmp_id) def query_icmp_block(self, policy, icmp): return self.__icmp_block_id(icmp) in self.get_policy(policy).icmp_blocks def list_icmp_blocks(self, policy): return self.get_policy(policy).icmp_blocks # ICMP BLOCK INVERSION def add_icmp_block_inversion(self, policy, sender=None, use_transaction=None): _policy = self._fw.check_policy(policy) self._fw.check_panic() _obj = self._policies[_policy] if _obj.icmp_block_inversion: _name = _obj.derived_from_zone if _obj.derived_from_zone else _policy raise FirewallError( errors.ALREADY_ENABLED, "icmp-block-inversion already enabled in '%s'" % _name) if use_transaction is None: transaction = self.new_transaction() else: transaction = use_transaction if _obj.applied: # undo icmp blocks for args in _obj.icmp_blocks: self._icmp_block(False, _policy, args, transaction) self._icmp_block_inversion(False, _policy, transaction) self.__register_icmp_block_inversion(_obj, sender) transaction.add_fail(self.__undo_icmp_block_inversion, _policy, _obj) # redo icmp blocks if _obj.applied: for args in _obj.icmp_blocks: self._icmp_block(True, _policy, args, transaction) self._icmp_block_inversion(True, _policy, transaction) if use_transaction is None: transaction.execute(True) return _policy def __register_icmp_block_inversion(self, _obj, sender): _obj.icmp_block_inversion = True def __undo_icmp_block_inversion(self, _policy, _obj): transaction = self.new_transaction() # undo icmp blocks if _obj.applied: for args in _obj.icmp_blocks: self._icmp_block(False, _policy, args, transaction) _obj.icmp_block_inversion = False # redo icmp blocks if _obj.applied: for args in _obj.icmp_blocks: self._icmp_block(True, _policy, args, transaction) transaction.execute(True) def remove_icmp_block_inversion(self, policy, use_transaction=None): _policy = self._fw.check_policy(policy) self._fw.check_panic() _obj = self._policies[_policy] if not _obj.icmp_block_inversion: _name = _obj.derived_from_zone if _obj.derived_from_zone else _policy raise FirewallError( errors.NOT_ENABLED, "icmp-block-inversion not enabled in '%s'" % _name) if use_transaction is None: transaction = self.new_transaction() else: transaction = use_transaction if _obj.applied: # undo icmp blocks for args in _obj.icmp_blocks: self._icmp_block(False, _policy, args, transaction) self._icmp_block_inversion(False, _policy, transaction) self.__unregister_icmp_block_inversion(_obj) transaction.add_fail(self.__register_icmp_block_inversion, _obj, None) # redo icmp blocks if _obj.applied: for args in _obj.icmp_blocks: self._icmp_block(True, _policy, args, transaction) self._icmp_block_inversion(True, _policy, transaction) if use_transaction is None: transaction.execute(True) return _policy def __unregister_icmp_block_inversion(self, _obj): _obj.icmp_block_inversion = False def query_icmp_block_inversion(self, policy): return self.get_policy(policy).icmp_block_inversion def gen_chain_rules(self, policy, create, table, chain, transaction): obj = self._fw.policy.get_policy(policy) if obj.derived_from_zone: # For policies derived from zones, use only the first policy in the # list to track chain creation. The chain names are converted to # zone-based names as such they're "global" for all zone derived # policies. tracking_policy = self._fw.zone._zone_policies[obj.derived_from_zone][0] else: tracking_policy = policy if create: if tracking_policy in self._chains and \ (table, chain) in self._chains[tracking_policy]: return else: if tracking_policy not in self._chains or \ (table, chain) not in self._chains[tracking_policy]: return for backend in self._fw.enabled_backends(): if backend.policies_supported and \ table in backend.get_available_tables(): rules = backend.build_policy_chain_rules(create, policy, table, chain) transaction.add_rules(backend, rules) self._register_chains(tracking_policy, create, [(table, chain)]) transaction.add_fail(self._register_chains, tracking_policy, not create, [(table, chain)]) def _register_chains(self, policy, create, tables): for (table, chain) in tables: if create: self._chains.setdefault(policy, []).append((table, chain)) else: self._chains[policy].remove((table, chain)) if len(self._chains[policy]) == 0: del self._chains[policy] # IPSETS def _ipset_family(self, name): if self._fw.ipset.get_type(name) == "hash:mac": return None return self._fw.ipset.get_family(name) def __ipset_type(self, name): return self._fw.ipset.get_type(name) def _ipset_match_flags(self, name, flag): return ",".join([flag] * self._fw.ipset.get_dimension(name)) def _check_ipset_applied(self, name): return self._fw.ipset.check_applied(name) def _check_ipset_type_for_source(self, name): _type = self.__ipset_type(name) if _type not in SOURCE_IPSET_TYPES: raise FirewallError( errors.INVALID_IPSET, "ipset '%s' with type '%s' not usable as source" % \ (name, _type)) def _rule_prepare(self, enable, policy, rule, transaction, included_services=None): # First apply any services this service may include if type(rule.element) == Rich_Service: svc = self._fw.service.get_service(rule.element.name) if included_services is None: included_services = [rule.element.name] for include in svc.includes: if include in included_services: continue self.check_service(include) included_services.append(include) _rule = copy.deepcopy(rule) _rule.element.name = include self._rule_prepare(enable, policy, _rule, transaction, included_services=included_services) ipvs = [] if rule.family: ipvs = [ rule.family ] elif rule.element and (isinstance(rule.element, Rich_IcmpBlock) or isinstance(rule.element, Rich_IcmpType)): ict = self._fw.config.get_icmptype(rule.element.name) if ict.destination: ipvs = [ipv for ipv in ["ipv4", "ipv6"] if ipv in ict.destination] source_ipv = self._rule_source_ipv(rule.source) if source_ipv: if rule.family: # rule family is defined by user, no way to change it if rule.family != source_ipv: raise FirewallError(errors.INVALID_RULE, "Source address family '%s' conflicts with rule family '%s'." % (source_ipv, rule.family)) else: # use the source family as rule family ipvs = [ source_ipv ] if not ipvs: ipvs = ["ipv4", "ipv6"] # clamp ipvs to those that are actually enabled. ipvs = [ipv for ipv in ipvs if self._fw.is_ipv_enabled(ipv)] # add an element to object to allow backends to know what ipvs this applies to rule.ipvs = ipvs for backend in set([self._fw.get_backend_by_ipv(x) for x in ipvs]): # SERVICE if type(rule.element) == Rich_Service: svc = self._fw.service.get_service(rule.element.name) destinations = [] if len(svc.destination) > 0: if rule.destination: # we can not use two destinations at the same time raise FirewallError(errors.INVALID_RULE, "Destination conflict with service.") for ipv in ipvs: if ipv in svc.destination and backend.is_ipv_supported(ipv): destinations.append(svc.destination[ipv]) else: # dummy for the following for loop destinations.append(None) for destination in destinations: if type(rule.action) == Rich_Accept: # only load modules for accept action helpers = self.get_helpers_for_service_modules(svc.modules, enable) helpers += self.get_helpers_for_service_helpers(svc.helpers) helpers = sorted(set(helpers), key=lambda x: x.name) modules = [ ] for helper in helpers: module = helper.module _module_short_name = get_nf_conntrack_short_name(module) nat_module = module.replace("conntrack", "nat") modules.append(nat_module) if helper.family != "" and not backend.is_ipv_supported(helper.family): # no support for family ipv, continue continue if len(helper.ports) < 1: modules.append(module) else: for (port,proto) in helper.ports: rules = backend.build_policy_helper_ports_rules( enable, policy, proto, port, destination, helper.name, _module_short_name) transaction.add_rules(backend, rules) transaction.add_modules(modules) # create rules for (port,proto) in svc.ports: rules = backend.build_policy_ports_rules( enable, policy, proto, port, destination, rule) transaction.add_rules(backend, rules) for proto in svc.protocols: rules = backend.build_policy_protocol_rules( enable, policy, proto, destination, rule) transaction.add_rules(backend, rules) # create rules for (port,proto) in svc.source_ports: rules = backend.build_policy_source_ports_rules( enable, policy, proto, port, destination, rule) transaction.add_rules(backend, rules) # PORT elif type(rule.element) == Rich_Port: port = rule.element.port protocol = rule.element.protocol self.check_port(port, protocol) rules = backend.build_policy_ports_rules( enable, policy, protocol, port, None, rule) transaction.add_rules(backend, rules) # PROTOCOL elif type(rule.element) == Rich_Protocol: protocol = rule.element.value self.check_protocol(protocol) rules = backend.build_policy_protocol_rules( enable, policy, protocol, None, rule) transaction.add_rules(backend, rules) # TCP/MSS CLAMP elif type(rule.element) == Rich_Tcp_Mss_Clamp: tcp_mss_clamp_value = rule.element.value self.check_tcp_mss_clamp(tcp_mss_clamp_value) rules = backend.build_policy_tcp_mss_clamp_rules( enable, policy, tcp_mss_clamp_value, None, rule) transaction.add_rules(backend, rules) # MASQUERADE elif type(rule.element) == Rich_Masquerade: if enable: for ipv in ipvs: if backend.is_ipv_supported(ipv): transaction.add_post(enable_ip_forwarding, ipv) rules = backend.build_policy_masquerade_rules(enable, policy, rule) transaction.add_rules(backend, rules) # FORWARD PORT elif type(rule.element) == Rich_ForwardPort: port = rule.element.port protocol = rule.element.protocol toport = rule.element.to_port toaddr = rule.element.to_address for ipv in ipvs: if backend.is_ipv_supported(ipv): self.check_forward_port(ipv, port, protocol, toport, toaddr) if toaddr and enable: transaction.add_post(enable_ip_forwarding, ipv) rules = backend.build_policy_forward_port_rules( enable, policy, port, protocol, toport, toaddr, rule) transaction.add_rules(backend, rules) # SOURCE PORT elif type(rule.element) == Rich_SourcePort: port = rule.element.port protocol = rule.element.protocol self.check_port(port, protocol) rules = backend.build_policy_source_ports_rules( enable, policy, protocol, port, None, rule) transaction.add_rules(backend, rules) # ICMP BLOCK and ICMP TYPE elif type(rule.element) == Rich_IcmpBlock or \ type(rule.element) == Rich_IcmpType: ict = self._fw.config.get_icmptype(rule.element.name) if rule.family and ict.destination and \ rule.family not in ict.destination: raise FirewallError(errors.INVALID_ICMPTYPE, "rich rule family '%s' conflicts with icmp type '%s'" % \ (rule.family, rule.element.name)) if type(rule.element) == Rich_IcmpBlock and \ rule.action and type(rule.action) == Rich_Accept: # icmp block might have reject or drop action, but not accept raise FirewallError(errors.INVALID_RULE, "IcmpBlock not usable with accept action") rules = backend.build_policy_icmp_block_rules(enable, policy, ict, rule) transaction.add_rules(backend, rules) elif rule.element is None: rules = backend.build_policy_rich_source_destination_rules( enable, policy, rule) transaction.add_rules(backend, rules) # EVERYTHING ELSE else: raise FirewallError(errors.INVALID_RULE, "Unknown element %s" % type(rule.element)) def _service(self, enable, policy, service, transaction, included_services=None): svc = self._fw.service.get_service(service) helpers = self.get_helpers_for_service_modules(svc.modules, enable) helpers += self.get_helpers_for_service_helpers(svc.helpers) helpers = sorted(set(helpers), key=lambda x: x.name) # First apply any services this service may include if included_services is None: included_services = [service] for include in svc.includes: if include in included_services: continue self.check_service(include) included_services.append(include) self._service(enable, policy, include, transaction, included_services=included_services) # build a list of (backend, destination). The destination may be ipv4, # ipv6 or None # backends_ipv = [] for ipv in ["ipv4", "ipv6"]: if not self._fw.is_ipv_enabled(ipv): continue backend = self._fw.get_backend_by_ipv(ipv) if len(svc.destination) > 0: if ipv in svc.destination: backends_ipv.append((backend, svc.destination[ipv])) else: if (backend, None) not in backends_ipv: backends_ipv.append((backend, None)) for (backend,destination) in backends_ipv: for helper in helpers: module = helper.module _module_short_name = get_nf_conntrack_short_name(module) nat_module = helper.module.replace("conntrack", "nat") transaction.add_module(nat_module) if helper.family != "" and not backend.is_ipv_supported(helper.family): # no support for family ipv, continue continue if len(helper.ports) < 1: transaction.add_module(module) else: for (port,proto) in helper.ports: rules = backend.build_policy_helper_ports_rules( enable, policy, proto, port, destination, helper.name, _module_short_name) transaction.add_rules(backend, rules) for (port,proto) in svc.ports: rules = backend.build_policy_ports_rules(enable, policy, proto, port, destination) transaction.add_rules(backend, rules) for protocol in svc.protocols: rules = backend.build_policy_protocol_rules( enable, policy, protocol, destination) transaction.add_rules(backend, rules) for (port,proto) in svc.source_ports: rules = backend.build_policy_source_ports_rules( enable, policy, proto, port, destination) transaction.add_rules(backend, rules) def _port(self, enable, policy, port, protocol, transaction): for backend in self._fw.enabled_backends(): if not backend.policies_supported: continue rules = backend.build_policy_ports_rules(enable, policy, protocol, port) transaction.add_rules(backend, rules) def _protocol(self, enable, policy, protocol, transaction): for backend in self._fw.enabled_backends(): if not backend.policies_supported: continue rules = backend.build_policy_protocol_rules(enable, policy, protocol) transaction.add_rules(backend, rules) def _source_port(self, enable, policy, port, protocol, transaction): for backend in self._fw.enabled_backends(): if not backend.policies_supported: continue rules = backend.build_policy_source_ports_rules(enable, policy, protocol, port) transaction.add_rules(backend, rules) def _masquerade(self, enable, policy, transaction): ipv = "ipv4" transaction.add_post(enable_ip_forwarding, ipv) backend = self._fw.get_backend_by_ipv(ipv) rules = backend.build_policy_masquerade_rules(enable, policy) transaction.add_rules(backend, rules) def _forward_port(self, enable, policy, transaction, port, protocol, toport=None, toaddr=None): if check_single_address("ipv6", toaddr): ipv = "ipv6" else: ipv = "ipv4" if toaddr and enable: transaction.add_post(enable_ip_forwarding, ipv) backend = self._fw.get_backend_by_ipv(ipv) rules = backend.build_policy_forward_port_rules( enable, policy, port, protocol, toport, toaddr) transaction.add_rules(backend, rules) def _icmp_block(self, enable, policy, icmp, transaction): ict = self._fw.config.get_icmptype(icmp) for backend in self._fw.enabled_backends(): if not backend.policies_supported: continue skip_backend = False if ict.destination: for ipv in ["ipv4", "ipv6"]: if ipv in ict.destination: if not backend.is_ipv_supported(ipv): skip_backend = True break if skip_backend: continue rules = backend.build_policy_icmp_block_rules(enable, policy, ict) transaction.add_rules(backend, rules) def _icmp_block_inversion(self, enable, policy, transaction): target = self._policies[policy].target # Do not add general icmp accept rules into a trusted, block or drop # policy. if target in [ "DROP", "%%REJECT%%", "REJECT" ]: return if not self.query_icmp_block_inversion(policy) and target == "ACCEPT": # ibi target and policy target are ACCEPT, no need to add an extra # rule return for backend in self._fw.enabled_backends(): if not backend.policies_supported: continue rules = backend.build_policy_icmp_block_inversion_rules(enable, policy) transaction.add_rules(backend, rules) def _ingress_egress_zones_transaction(self, enable, policy): transaction = FirewallTransaction(self._fw) self._ingress_egress_zones(enable, policy, transaction) transaction.execute(True) def _ingress_egress_zones(self, enable, policy, transaction): obj = self._policies[policy] ingress_zones = obj.ingress_zones egress_zones = obj.egress_zones ingress_interfaces = set() egress_interfaces = set() ingress_sources = set() egress_sources = set() for zone in ingress_zones: if zone in ["ANY", "HOST"]: continue ingress_interfaces |= set(self._fw.zone.list_interfaces(zone)) ingress_sources |= set(self._fw.zone.list_sources(zone)) for zone in egress_zones: if zone in ["ANY", "HOST"]: continue egress_interfaces |= set(self._fw.zone.list_interfaces(zone)) egress_sources |= set(self._fw.zone.list_sources(zone)) for backend in self._fw.enabled_backends(): if not backend.policies_supported: continue for (table, chain) in self._get_table_chains_for_policy_dispatch(policy): rules = backend.build_policy_ingress_egress_rules(enable, policy, table, chain, ingress_interfaces, egress_interfaces, ingress_sources, egress_sources) transaction.add_rules(backend, rules) def _get_table_chains_for_policy_dispatch(self, policy): """Create a list of (table, chain) needed for policy dispatch""" obj = self._policies[policy] if "ANY" in obj.ingress_zones and "HOST" in obj.egress_zones: # any --> HOST tc = [("filter", "INPUT"), ("nat", "PREROUTING"), ("mangle", "PREROUTING")] # iptables backend needs to put conntrack helper rules in raw # prerouting. if not self._fw.nftables_enabled: tc.append(("raw", "PREROUTING")) return tc elif "HOST" in obj.egress_zones: # zone --> HOST tc = [("filter", "INPUT")] # iptables backend needs to put conntrack helper rules in raw # prerouting. if not self._fw.nftables_enabled: tc.append(("raw", "PREROUTING")) return tc elif "HOST" in obj.ingress_zones: # HOST --> zone/any return [("filter", "OUTPUT"), ("nat", "OUTPUT")] elif "ANY" in obj.ingress_zones and "ANY" in obj.egress_zones: # any --> any tc = [("filter", "FORWARD"), ("nat", "PREROUTING"), ("nat", "POSTROUTING"), ("mangle", "PREROUTING")] # iptables backend needs to put conntrack helper rules in raw # prerouting. if not self._fw.nftables_enabled: tc.append(("raw", "PREROUTING")) return tc elif "ANY" in obj.egress_zones: # zone --> any tc = [("filter", "FORWARD"), ("nat", "PREROUTING"), ("mangle", "PREROUTING")] # iptables backend needs to put conntrack helper rules in raw # prerouting. if not self._fw.nftables_enabled: tc.append(("raw", "PREROUTING")) if self._fw._firewall_backend == "nftables": tc.append(("nat", "POSTROUTING")) else: for zone in obj.ingress_zones: if self._fw.zone.get_zone(zone).interfaces: break else: tc.append(("nat", "POSTROUTING")) return tc elif "ANY" in obj.ingress_zones: # any --> zone tc = [("filter", "FORWARD"), ("nat", "POSTROUTING")] # iptables backend needs to put conntrack helper rules in raw # prerouting. if not self._fw.nftables_enabled: tc.append(("raw", "PREROUTING")) for zone in obj.egress_zones: if self._fw.zone.get_zone(zone).interfaces: break else: tc.append(("nat", "PREROUTING")) tc.append(("mangle", "PREROUTING")) return tc else: # zone -> zone tc = [("filter", "FORWARD")] # iptables backend needs to put conntrack helper rules in raw # prerouting. if not self._fw.nftables_enabled: tc.append(("raw", "PREROUTING")) if self._fw._firewall_backend == "nftables": tc.append(("nat", "POSTROUTING")) else: for zone in obj.ingress_zones: if self._fw.zone.get_zone(zone).interfaces: break else: tc.append(("nat", "POSTROUTING")) for zone in obj.egress_zones: if self._fw.zone.get_zone(zone).interfaces: break else: tc.append(("nat", "PREROUTING")) tc.append(("mangle", "PREROUTING")) return tc def _get_table_chains_for_zone_dispatch(self, policy): """Create a list of (table, chain) needed for zone dispatch""" obj = self._policies[policy] if "HOST" in obj.egress_zones: # zone --> Host tc = [("filter", "INPUT")] # iptables backend needs to put conntrack helper rules in raw # prerouting. if not self._fw.nftables_enabled: tc.append(("raw", "PREROUTING")) return tc elif "ANY" in obj.egress_zones: # zone --> any return [("filter", "FORWARD"), ("nat", "PREROUTING"), ("mangle", "PREROUTING")] elif "ANY" in obj.ingress_zones: # any --> zone return [("nat", "POSTROUTING")] raise FirewallError(errors.INVALID_POLICY, "Invalid policy: %s" % (policy)) def policy_base_chain_name(self, policy, table, policy_prefix, isSNAT=False): obj = self._fw.policy.get_policy(policy) if obj.derived_from_zone: suffix = obj.derived_from_zone else: suffix = policy_prefix + policy if "HOST" in obj.egress_zones: # zone/any --> Host if table == "filter": return "IN_" + suffix if table == "raw": # NOTE: nftables doesn't actually use this. Only iptables return "PRE_" + suffix if not obj.derived_from_zone: if table in ["mangle", "nat"]: return "PRE_" + suffix elif "HOST" in obj.ingress_zones: # HOST --> zone/any if not obj.derived_from_zone: if table in ["filter", "nat"]: return "OUT_" + suffix elif "ANY" in obj.egress_zones: # zone/any --> any if table == "filter": return "FWD_" + suffix elif table == "nat": if isSNAT: return "POST_" + suffix else: return "PRE_" + suffix elif table in ["mangle", "raw"]: return "PRE_" + suffix elif "ANY" in obj.ingress_zones: # any --> zone if table == "filter": return "FWD_" + suffix elif table == "nat": if isSNAT: return "POST_" + suffix else: return "PRE_" + suffix elif table in ["mangle", "raw"]: if not obj.derived_from_zone: return "PRE_" + suffix elif not obj.derived_from_zone: # zone --> zone if table == "filter": return "FWD_" + suffix elif table == "nat": if isSNAT: return "POST_" + suffix else: return "PRE_" + suffix elif table in ["mangle", "raw"]: return "PRE_" + suffix raise FirewallError(errors.INVALID_POLICY, "Can't convert policy to chain name: %s, %s, %s" % (policy, table, isSNAT)) client.py 0000644 00000355021 15025011705 0006376 0 ustar 00 # -*- coding: utf-8 -*- # # Copyright (C) 2009-2016 Red Hat, Inc. # # Authors: # Thomas Woerner <twoerner@redhat.com> # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see <http://www.gnu.org/licenses/>. # from gi.repository import GLib import dbus.mainloop.glib import functools from firewall import config from firewall.core.base import DEFAULT_ZONE_TARGET, DEFAULT_POLICY_TARGET, DEFAULT_POLICY_PRIORITY from firewall.dbus_utils import dbus_to_python from firewall.core.rich import Rich_Rule from firewall.core.ipset import normalize_ipset_entry, check_entry_overlaps_existing, \ check_for_overlapping_entries from firewall import errors from firewall.errors import FirewallError import dbus import traceback exception_handler = None not_authorized_loop = False def handle_exceptions(func): """Decorator to handle exceptions """ @functools.wraps(func) def _impl(*args, **kwargs): authorized = False while not authorized: try: return func(*args, **kwargs) except dbus.exceptions.DBusException as e: dbus_message = e.get_dbus_message() # returns unicode dbus_name = e.get_dbus_name() if not exception_handler: raise if "NotAuthorizedException" in dbus_name: exception_handler("NotAuthorizedException") elif "org.freedesktop.DBus.Error" in dbus_name: # dbus error, try again exception_handler(dbus_message) else: authorized = True if dbus_message: exception_handler(dbus_message) else: exception_handler(str(e)) except FirewallError as e: if not exception_handler: raise else: exception_handler(str(e)) except Exception: if not exception_handler: raise else: exception_handler(traceback.format_exc()) if not not_authorized_loop: break return _impl # zone config settings class FirewallClientZoneSettings(object): @handle_exceptions def __init__(self, settings = None): self.settings = ["", "", "", False, DEFAULT_ZONE_TARGET, [], [], [], False, [], [], [], [], [], [], False, False] self.settings_name = ["version", "short", "description", "UNUSED", "target", "services", "ports", "icmp_blocks", "masquerade", "forward_ports", "interfaces", "sources", "rules_str", "protocols", "source_ports", "icmp_block_inversion", "forward"] self.settings_dbus_type = ["s", "s", "s", "b", "s", "s", "(ss)", "s", "b", "(ssss)", "s", "s", "s", "s", "(ss)", "b", "b"] if settings: if isinstance(settings, list): for i,v in enumerate(settings): self.settings[i] = settings[i] if isinstance(settings, dict): self.setSettingsDict(settings) @handle_exceptions def __repr__(self): return '%s(%r)' % (self.__class__, self.settings) @handle_exceptions def getSettingsDict(self): settings = {} for key,value in zip(self.settings_name, self.settings): if key == 'UNUSED': continue settings[key] = value return settings @handle_exceptions def setSettingsDict(self, settings): for key in settings: self.settings[self.settings_name.index(key)] = settings[key] @handle_exceptions def getSettingsDbusDict(self): settings = {} for key,value,sig in zip(self.settings_name, self.settings, self.settings_dbus_type): if key == 'UNUSED': continue if type(value) is list: settings[key] = dbus.Array(value, signature=sig) elif type(value) is dict: settings[key] = dbus.Dictionary(value, signature=sig) else: settings[key] = value return settings @handle_exceptions def getRuntimeSettingsDict(self): settings = self.getSettingsDict() # These are not configurable at runtime: del settings['version'] del settings['short'] del settings['description'] del settings['target'] return settings @handle_exceptions def getRuntimeSettingsDbusDict(self): settings = self.getSettingsDbusDict() # These are not configurable at runtime: del settings['version'] del settings['short'] del settings['description'] del settings['target'] return settings @handle_exceptions def getVersion(self): return self.settings[0] @handle_exceptions def setVersion(self, version): self.settings[0] = version @handle_exceptions def getShort(self): return self.settings[1] @handle_exceptions def setShort(self, short): self.settings[1] = short @handle_exceptions def getDescription(self): return self.settings[2] @handle_exceptions def setDescription(self, description): self.settings[2] = description # self.settings[3] was used for 'immutable' @handle_exceptions def getTarget(self): return self.settings[4] if self.settings[4] != DEFAULT_ZONE_TARGET else "default" @handle_exceptions def setTarget(self, target): self.settings[4] = target if target != "default" else DEFAULT_ZONE_TARGET @handle_exceptions def getServices(self): return self.settings[5] @handle_exceptions def setServices(self, services): self.settings[5] = services @handle_exceptions def addService(self, service): if service not in self.settings[5]: self.settings[5].append(service) else: raise FirewallError(errors.ALREADY_ENABLED, service) @handle_exceptions def removeService(self, service): if service in self.settings[5]: self.settings[5].remove(service) else: raise FirewallError(errors.NOT_ENABLED, service) @handle_exceptions def queryService(self, service): return service in self.settings[5] @handle_exceptions def getPorts(self): return self.settings[6] @handle_exceptions def setPorts(self, ports): self.settings[6] = ports @handle_exceptions def addPort(self, port, protocol): if (port,protocol) not in self.settings[6]: self.settings[6].append((port,protocol)) else: raise FirewallError(errors.ALREADY_ENABLED, "'%s:%s'" % (port, protocol)) @handle_exceptions def removePort(self, port, protocol): if (port,protocol) in self.settings[6]: self.settings[6].remove((port,protocol)) else: raise FirewallError(errors.NOT_ENABLED, "'%s:%s'" % (port, protocol)) @handle_exceptions def queryPort(self, port, protocol): return (port,protocol) in self.settings[6] @handle_exceptions def getProtocols(self): return self.settings[13] @handle_exceptions def setProtocols(self, protocols): self.settings[13] = protocols @handle_exceptions def addProtocol(self, protocol): if protocol not in self.settings[13]: self.settings[13].append(protocol) else: raise FirewallError(errors.ALREADY_ENABLED, protocol) @handle_exceptions def removeProtocol(self, protocol): if protocol in self.settings[13]: self.settings[13].remove(protocol) else: raise FirewallError(errors.NOT_ENABLED, protocol) @handle_exceptions def queryProtocol(self, protocol): return protocol in self.settings[13] @handle_exceptions def getSourcePorts(self): return self.settings[14] @handle_exceptions def setSourcePorts(self, ports): self.settings[14] = ports @handle_exceptions def addSourcePort(self, port, protocol): if (port,protocol) not in self.settings[14]: self.settings[14].append((port,protocol)) else: raise FirewallError(errors.ALREADY_ENABLED, "'%s:%s'" % (port, protocol)) @handle_exceptions def removeSourcePort(self, port, protocol): if (port,protocol) in self.settings[14]: self.settings[14].remove((port,protocol)) else: raise FirewallError(errors.NOT_ENABLED, "'%s:%s'" % (port, protocol)) @handle_exceptions def querySourcePort(self, port, protocol): return (port,protocol) in self.settings[14] @handle_exceptions def getIcmpBlocks(self): return self.settings[7] @handle_exceptions def setIcmpBlocks(self, icmpblocks): self.settings[7] = icmpblocks @handle_exceptions def addIcmpBlock(self, icmptype): if icmptype not in self.settings[7]: self.settings[7].append(icmptype) else: raise FirewallError(errors.ALREADY_ENABLED, icmptype) @handle_exceptions def removeIcmpBlock(self, icmptype): if icmptype in self.settings[7]: self.settings[7].remove(icmptype) else: raise FirewallError(errors.NOT_ENABLED, icmptype) @handle_exceptions def queryIcmpBlock(self, icmptype): return icmptype in self.settings[7] @handle_exceptions def getIcmpBlockInversion(self): return self.settings[15] @handle_exceptions def setIcmpBlockInversion(self, flag): self.settings[15] = flag @handle_exceptions def addIcmpBlockInversion(self): if not self.settings[15]: self.settings[15] = True else: raise FirewallError(errors.ALREADY_ENABLED, "icmp-block-inversion") @handle_exceptions def removeIcmpBlockInversion(self): if self.settings[15]: self.settings[15] = False else: raise FirewallError(errors.NOT_ENABLED, "icmp-block-inversion") @handle_exceptions def queryIcmpBlockInversion(self): return self.settings[15] @handle_exceptions def getForward(self): return self.settings[16] @handle_exceptions def setForward(self, forward): self.settings[16] = forward @handle_exceptions def addForward(self): if not self.settings[16]: self.settings[16] = True else: raise FirewallError(errors.ALREADY_ENABLED, "forward") @handle_exceptions def removeForward(self): if self.settings[16]: self.settings[16] = False else: raise FirewallError(errors.NOT_ENABLED, "forward") @handle_exceptions def queryForward(self): return self.settings[16] @handle_exceptions def getMasquerade(self): return self.settings[8] @handle_exceptions def setMasquerade(self, masquerade): self.settings[8] = masquerade @handle_exceptions def addMasquerade(self): if not self.settings[8]: self.settings[8] = True else: raise FirewallError(errors.ALREADY_ENABLED, "masquerade") @handle_exceptions def removeMasquerade(self): if self.settings[8]: self.settings[8] = False else: raise FirewallError(errors.NOT_ENABLED, "masquerade") @handle_exceptions def queryMasquerade(self): return self.settings[8] @handle_exceptions def getForwardPorts(self): return self.settings[9] @handle_exceptions def setForwardPorts(self, ports): self.settings[9] = ports @handle_exceptions def addForwardPort(self, port, protocol, to_port, to_addr): if to_port is None: to_port = '' if to_addr is None: to_addr = '' if (port,protocol,to_port,to_addr) not in self.settings[9]: self.settings[9].append((port,protocol,to_port,to_addr)) else: raise FirewallError(errors.ALREADY_ENABLED, "'%s:%s:%s:%s'" % \ (port, protocol, to_port, to_addr)) @handle_exceptions def removeForwardPort(self, port, protocol, to_port, to_addr): if to_port is None: to_port = '' if to_addr is None: to_addr = '' if (port,protocol,to_port,to_addr) in self.settings[9]: self.settings[9].remove((port,protocol,to_port,to_addr)) else: raise FirewallError(errors.NOT_ENABLED, "'%s:%s:%s:%s'" % \ (port, protocol, to_port, to_addr)) @handle_exceptions def queryForwardPort(self, port, protocol, to_port, to_addr): if to_port is None: to_port = '' if to_addr is None: to_addr = '' return (port,protocol,to_port,to_addr) in self.settings[9] @handle_exceptions def getInterfaces(self): return self.settings[10] @handle_exceptions def setInterfaces(self, interfaces): self.settings[10] = interfaces @handle_exceptions def addInterface(self, interface): if interface not in self.settings[10]: self.settings[10].append(interface) else: raise FirewallError(errors.ALREADY_ENABLED, interface) @handle_exceptions def removeInterface(self, interface): if interface in self.settings[10]: self.settings[10].remove(interface) else: raise FirewallError(errors.NOT_ENABLED, interface) @handle_exceptions def queryInterface(self, interface): return interface in self.settings[10] @handle_exceptions def getSources(self): return self.settings[11] @handle_exceptions def setSources(self, sources): self.settings[11] = sources @handle_exceptions def addSource(self, source): if source not in self.settings[11]: self.settings[11].append(source) else: raise FirewallError(errors.ALREADY_ENABLED, source) @handle_exceptions def removeSource(self, source): if source in self.settings[11]: self.settings[11].remove(source) else: raise FirewallError(errors.NOT_ENABLED, source) @handle_exceptions def querySource(self, source): return source in self.settings[11] @handle_exceptions def getRichRules(self): return self.settings[12] @handle_exceptions def setRichRules(self, rules): rules = [ str(Rich_Rule(rule_str=r)) for r in rules ] self.settings[12] = rules @handle_exceptions def addRichRule(self, rule): rule = str(Rich_Rule(rule_str=rule)) if rule not in self.settings[12]: self.settings[12].append(rule) else: raise FirewallError(errors.ALREADY_ENABLED, rule) @handle_exceptions def removeRichRule(self, rule): rule = str(Rich_Rule(rule_str=rule)) if rule in self.settings[12]: self.settings[12].remove(rule) else: raise FirewallError(errors.NOT_ENABLED, rule) @handle_exceptions def queryRichRule(self, rule): rule = str(Rich_Rule(rule_str=rule)) return rule in self.settings[12] # zone config class FirewallClientConfigZone(object): def __init__(self, bus, path): self.bus = bus self.path = path self.dbus_obj = self.bus.get_object(config.dbus.DBUS_INTERFACE, path) self.fw_zone = dbus.Interface( self.dbus_obj, dbus_interface=config.dbus.DBUS_INTERFACE_CONFIG_ZONE) self.fw_properties = dbus.Interface( self.dbus_obj, dbus_interface='org.freedesktop.DBus.Properties') #TODO: check interface version and revision (need to match client # version) @handle_exceptions def get_property(self, prop): return dbus_to_python(self.fw_properties.Get( config.dbus.DBUS_INTERFACE_CONFIG_ZONE, prop)) @handle_exceptions def get_properties(self): return dbus_to_python(self.fw_properties.GetAll( config.dbus.DBUS_INTERFACE_CONFIG_ZONE)) @handle_exceptions def set_property(self, prop, value): self.fw_properties.Set(config.dbus.DBUS_INTERFACE_CONFIG_ZONE, prop, value) @handle_exceptions def getSettings(self): return FirewallClientZoneSettings(dbus_to_python(self.fw_zone.getSettings2())) @handle_exceptions def update(self, settings): self.fw_zone.update2(settings.getSettingsDbusDict()) @handle_exceptions def loadDefaults(self): self.fw_zone.loadDefaults() @handle_exceptions def remove(self): self.fw_zone.remove() @handle_exceptions def rename(self, name): self.fw_zone.rename(name) # version @handle_exceptions def getVersion(self): return self.fw_zone.getVersion() @handle_exceptions def setVersion(self, version): self.fw_zone.setVersion(version) # short @handle_exceptions def getShort(self): return self.fw_zone.getShort() @handle_exceptions def setShort(self, short): self.fw_zone.setShort(short) # description @handle_exceptions def getDescription(self): return self.fw_zone.getDescription() @handle_exceptions def setDescription(self, description): self.fw_zone.setDescription(description) # target @handle_exceptions def getTarget(self): return self.fw_zone.getTarget() @handle_exceptions def setTarget(self, target): self.fw_zone.setTarget(target) # service @handle_exceptions def getServices(self): return self.fw_zone.getServices() @handle_exceptions def setServices(self, services): self.fw_zone.setServices(services) @handle_exceptions def addService(self, service): self.fw_zone.addService(service) @handle_exceptions def removeService(self, service): self.fw_zone.removeService(service) @handle_exceptions def queryService(self, service): return self.fw_zone.queryService(service) # port @handle_exceptions def getPorts(self): return self.fw_zone.getPorts() @handle_exceptions def setPorts(self, ports): self.fw_zone.setPorts(ports) @handle_exceptions def addPort(self, port, protocol): self.fw_zone.addPort(port, protocol) @handle_exceptions def removePort(self, port, protocol): self.fw_zone.removePort(port, protocol) @handle_exceptions def queryPort(self, port, protocol): return self.fw_zone.queryPort(port, protocol) # protocol @handle_exceptions def getProtocols(self): return self.fw_zone.getProtocols() @handle_exceptions def setProtocols(self, protocols): self.fw_zone.setProtocols(protocols) @handle_exceptions def addProtocol(self, protocol): self.fw_zone.addProtocol(protocol) @handle_exceptions def removeProtocol(self, protocol): self.fw_zone.removeProtocol(protocol) @handle_exceptions def queryProtocol(self, protocol): return self.fw_zone.queryProtocol(protocol) # source-port @handle_exceptions def getSourcePorts(self): return self.fw_zone.getSourcePorts() @handle_exceptions def setSourcePorts(self, ports): self.fw_zone.setSourcePorts(ports) @handle_exceptions def addSourcePort(self, port, protocol): self.fw_zone.addSourcePort(port, protocol) @handle_exceptions def removeSourcePort(self, port, protocol): self.fw_zone.removeSourcePort(port, protocol) @handle_exceptions def querySourcePort(self, port, protocol): return self.fw_zone.querySourcePort(port, protocol) # icmp block @handle_exceptions def getIcmpBlocks(self): return self.fw_zone.getIcmpBlocks() @handle_exceptions def setIcmpBlocks(self, icmptypes): self.fw_zone.setIcmpBlocks(icmptypes) @handle_exceptions def addIcmpBlock(self, icmptype): self.fw_zone.addIcmpBlock(icmptype) @handle_exceptions def removeIcmpBlock(self, icmptype): self.fw_zone.removeIcmpBlock(icmptype) @handle_exceptions def queryIcmpBlock(self, icmptype): return self.fw_zone.queryIcmpBlock(icmptype) # icmp-block-inversion @handle_exceptions def getIcmpBlockInversion(self): return self.fw_zone.getIcmpBlockInversion() @handle_exceptions def setIcmpBlockInversion(self, inversion): self.fw_zone.setIcmpBlockInversion(inversion) @handle_exceptions def addIcmpBlockInversion(self): self.fw_zone.addIcmpBlockInversion() @handle_exceptions def removeIcmpBlockInversion(self): self.fw_zone.removeIcmpBlockInversion() @handle_exceptions def queryIcmpBlockInversion(self): return self.fw_zone.queryIcmpBlockInversion() # forward @handle_exceptions def getForward(self): return self.fw_zone.getSettings2()["forward"] @handle_exceptions def setForward(self, forward): self.fw_zone.update2({"forward": forward}) @handle_exceptions def addForward(self): self.fw_zone.update2({"forward": True}) @handle_exceptions def removeForward(self): self.fw_zone.update2({"forward": False}) @handle_exceptions def queryForward(self): return self.fw_zone.getSettings2()["forward"] # masquerade @handle_exceptions def getMasquerade(self): return self.fw_zone.getMasquerade() @handle_exceptions def setMasquerade(self, masquerade): self.fw_zone.setMasquerade(masquerade) @handle_exceptions def addMasquerade(self): self.fw_zone.addMasquerade() @handle_exceptions def removeMasquerade(self): self.fw_zone.removeMasquerade() @handle_exceptions def queryMasquerade(self): return self.fw_zone.queryMasquerade() # forward port @handle_exceptions def getForwardPorts(self): return self.fw_zone.getForwardPorts() @handle_exceptions def setForwardPorts(self, ports): self.fw_zone.setForwardPorts(ports) @handle_exceptions def addForwardPort(self, port, protocol, toport, toaddr): if toport is None: toport = '' if toaddr is None: toaddr = '' self.fw_zone.addForwardPort(port, protocol, toport, toaddr) @handle_exceptions def removeForwardPort(self, port, protocol, toport, toaddr): if toport is None: toport = '' if toaddr is None: toaddr = '' self.fw_zone.removeForwardPort(port, protocol, toport, toaddr) @handle_exceptions def queryForwardPort(self, port, protocol, toport, toaddr): if toport is None: toport = '' if toaddr is None: toaddr = '' return self.fw_zone.queryForwardPort(port, protocol, toport, toaddr) # interface @handle_exceptions def getInterfaces(self): return self.fw_zone.getInterfaces() @handle_exceptions def setInterfaces(self, interfaces): self.fw_zone.setInterfaces(interfaces) @handle_exceptions def addInterface(self, interface): self.fw_zone.addInterface(interface) @handle_exceptions def removeInterface(self, interface): self.fw_zone.removeInterface(interface) @handle_exceptions def queryInterface(self, interface): return self.fw_zone.queryInterface(interface) # source @handle_exceptions def getSources(self): return self.fw_zone.getSources() @handle_exceptions def setSources(self, sources): self.fw_zone.setSources(sources) @handle_exceptions def addSource(self, source): self.fw_zone.addSource(source) @handle_exceptions def removeSource(self, source): self.fw_zone.removeSource(source) @handle_exceptions def querySource(self, source): return self.fw_zone.querySource(source) # rich rule @handle_exceptions def getRichRules(self): return self.fw_zone.getRichRules() @handle_exceptions def setRichRules(self, rules): self.fw_zone.setRichRules(rules) @handle_exceptions def addRichRule(self, rule): self.fw_zone.addRichRule(rule) @handle_exceptions def removeRichRule(self, rule): self.fw_zone.removeRichRule(rule) @handle_exceptions def queryRichRule(self, rule): return self.fw_zone.queryRichRule(rule) class FirewallClientPolicySettings(object): @handle_exceptions def __init__(self, settings=None): self.settings = {"description": "", "egress_zones": [], "forward_ports": [], "icmp_blocks": [], "ingress_zones": [], "masquerade": False, "ports": [], "priority": DEFAULT_POLICY_PRIORITY, "protocols": [], "rich_rules": [], "services": [], "short": "", "source_ports": [], "target": DEFAULT_POLICY_TARGET, "version": "", } self.settings_dbus_type = ["s", "s", "(ssss)", "s", "s", "b", "(ss)", "i", "s", "s", "s", "s", "(ss)", "s", "s"] if settings: self.setSettingsDict(settings) @handle_exceptions def __repr__(self): return '%s(%r)' % (self.__class__, self.settings) @handle_exceptions def getSettingsDict(self): return self.settings @handle_exceptions def setSettingsDict(self, settings): for key in settings: self.settings[key] = settings[key] @handle_exceptions def getSettingsDbusDict(self): settings = {} for key,sig in zip(self.settings, self.settings_dbus_type): value = self.settings[key] if type(value) is list: settings[key] = dbus.Array(value, signature=sig) elif type(value) is dict: settings[key] = dbus.Dictionary(value, signature=sig) else: settings[key] = value return settings def getRuntimeSettingsDbusDict(self): settings = self.getSettingsDbusDict() for key in ["version", "short", "description", "target"]: del settings[key] return settings @handle_exceptions def getVersion(self): return self.settings["version"] @handle_exceptions def setVersion(self, version): self.settings["version"] = version @handle_exceptions def getShort(self): return self.settings["short"] @handle_exceptions def setShort(self, short): self.settings["short"] = short @handle_exceptions def getDescription(self): return self.settings["description"] @handle_exceptions def setDescription(self, description): self.settings["description"] = description @handle_exceptions def getTarget(self): return self.settings["target"] @handle_exceptions def setTarget(self, target): self.settings["target"] = target @handle_exceptions def getServices(self): return self.settings["services"] @handle_exceptions def setServices(self, services): self.settings["services"] = services @handle_exceptions def addService(self, service): if service not in self.settings["services"]: self.settings["services"].append(service) else: raise FirewallError(errors.ALREADY_ENABLED, service) @handle_exceptions def removeService(self, service): if service in self.settings["services"]: self.settings["services"].remove(service) else: raise FirewallError(errors.NOT_ENABLED, service) @handle_exceptions def queryService(self, service): return service in self.settings["services"] @handle_exceptions def getPorts(self): return self.settings["ports"] @handle_exceptions def setPorts(self, ports): self.settings["ports"] = ports @handle_exceptions def addPort(self, port, protocol): if (port,protocol) not in self.settings["ports"]: self.settings["ports"].append((port,protocol)) else: raise FirewallError(errors.ALREADY_ENABLED, "'%s:%s'" % (port, protocol)) @handle_exceptions def removePort(self, port, protocol): if (port,protocol) in self.settings["ports"]: self.settings["ports"].remove((port,protocol)) else: raise FirewallError(errors.NOT_ENABLED, "'%s:%s'" % (port, protocol)) @handle_exceptions def queryPort(self, port, protocol): return (port,protocol) in self.settings["ports"] @handle_exceptions def getProtocols(self): return self.settings["protocols"] @handle_exceptions def setProtocols(self, protocols): self.settings["protocols"] = protocols @handle_exceptions def addProtocol(self, protocol): if protocol not in self.settings["protocols"]: self.settings["protocols"].append(protocol) else: raise FirewallError(errors.ALREADY_ENABLED, protocol) @handle_exceptions def removeProtocol(self, protocol): if protocol in self.settings["protocols"]: self.settings["protocols"].remove(protocol) else: raise FirewallError(errors.NOT_ENABLED, protocol) @handle_exceptions def queryProtocol(self, protocol): return protocol in self.settings["protocols"] @handle_exceptions def getSourcePorts(self): return self.settings["source_ports"] @handle_exceptions def setSourcePorts(self, ports): self.settings["source_ports"] = ports @handle_exceptions def addSourcePort(self, port, protocol): if (port,protocol) not in self.settings["source_ports"]: self.settings["source_ports"].append((port,protocol)) else: raise FirewallError(errors.ALREADY_ENABLED, "'%s:%s'" % (port, protocol)) @handle_exceptions def removeSourcePort(self, port, protocol): if (port,protocol) in self.settings["source_ports"]: self.settings["source_ports"].remove((port,protocol)) else: raise FirewallError(errors.NOT_ENABLED, "'%s:%s'" % (port, protocol)) @handle_exceptions def querySourcePort(self, port, protocol): return (port,protocol) in self.settings["source_ports"] @handle_exceptions def getIcmpBlocks(self): return self.settings["icmp_blocks"] @handle_exceptions def setIcmpBlocks(self, icmpblocks): self.settings["icmp_blocks"] = icmpblocks @handle_exceptions def addIcmpBlock(self, icmptype): if icmptype not in self.settings["icmp_blocks"]: self.settings["icmp_blocks"].append(icmptype) else: raise FirewallError(errors.ALREADY_ENABLED, icmptype) @handle_exceptions def removeIcmpBlock(self, icmptype): if icmptype in self.settings["icmp_blocks"]: self.settings["icmp_blocks"].remove(icmptype) else: raise FirewallError(errors.NOT_ENABLED, icmptype) @handle_exceptions def queryIcmpBlock(self, icmptype): return icmptype in self.settings["icmp_blocks"] @handle_exceptions def getMasquerade(self): return self.settings["masquerade"] @handle_exceptions def setMasquerade(self, masquerade): self.settings["masquerade"] = masquerade @handle_exceptions def addMasquerade(self): if not self.settings["masquerade"]: self.settings["masquerade"] = True else: raise FirewallError(errors.ALREADY_ENABLED, "masquerade") @handle_exceptions def removeMasquerade(self): if self.settings["masquerade"]: self.settings["masquerade"] = False else: raise FirewallError(errors.NOT_ENABLED, "masquerade") @handle_exceptions def queryMasquerade(self): return self.settings["masquerade"] @handle_exceptions def getForwardPorts(self): return self.settings["forward_ports"] @handle_exceptions def setForwardPorts(self, ports): self.settings["forward_ports"] = ports @handle_exceptions def addForwardPort(self, port, protocol, to_port, to_addr): if to_port is None: to_port = '' if to_addr is None: to_addr = '' if (port,protocol,to_port,to_addr) not in self.settings["forward_ports"]: self.settings["forward_ports"].append((port,protocol,to_port,to_addr)) else: raise FirewallError(errors.ALREADY_ENABLED, "'%s:%s:%s:%s'" % \ (port, protocol, to_port, to_addr)) @handle_exceptions def removeForwardPort(self, port, protocol, to_port, to_addr): if to_port is None: to_port = '' if to_addr is None: to_addr = '' if (port,protocol,to_port,to_addr) in self.settings["forward_ports"]: self.settings["forward_ports"].remove((port,protocol,to_port,to_addr)) else: raise FirewallError(errors.NOT_ENABLED, "'%s:%s:%s:%s'" % \ (port, protocol, to_port, to_addr)) @handle_exceptions def queryForwardPort(self, port, protocol, to_port, to_addr): if to_port is None: to_port = '' if to_addr is None: to_addr = '' return (port,protocol,to_port,to_addr) in self.settings["forward_ports"] @handle_exceptions def getRichRules(self): return self.settings["rich_rules"] @handle_exceptions def setRichRules(self, rules): rules = [ str(Rich_Rule(rule_str=r)) for r in rules ] self.settings["rich_rules"] = rules @handle_exceptions def addRichRule(self, rule): rule = str(Rich_Rule(rule_str=rule)) if rule not in self.settings["rich_rules"]: self.settings["rich_rules"].append(rule) else: raise FirewallError(errors.ALREADY_ENABLED, rule) @handle_exceptions def removeRichRule(self, rule): rule = str(Rich_Rule(rule_str=rule)) if rule in self.settings["rich_rules"]: self.settings["rich_rules"].remove(rule) else: raise FirewallError(errors.NOT_ENABLED, rule) @handle_exceptions def queryRichRule(self, rule): rule = str(Rich_Rule(rule_str=rule)) return rule in self.settings["rich_rules"] @handle_exceptions def getIngressZones(self): return self.settings["ingress_zones"] @handle_exceptions def setIngressZones(self, ingress_zones): self.settings["ingress_zones"] = ingress_zones @handle_exceptions def addIngressZone(self, ingress_zone): if ingress_zone not in self.settings["ingress_zones"]: self.settings["ingress_zones"].append(ingress_zone) else: raise FirewallError(errors.ALREADY_ENABLED, ingress_zone) @handle_exceptions def removeIngressZone(self, ingress_zone): if ingress_zone in self.settings["ingress_zones"]: self.settings["ingress_zones"].remove(ingress_zone) else: raise FirewallError(errors.NOT_ENABLED, ingress_zone) @handle_exceptions def queryIngressZone(self, ingress_zone): return ingress_zone in self.settings["ingress_zones"] @handle_exceptions def getEgressZones(self): return self.settings["egress_zones"] @handle_exceptions def setEgressZones(self, egress_zones): self.settings["egress_zones"] = egress_zones @handle_exceptions def addEgressZone(self, egress_zone): if egress_zone not in self.settings["egress_zones"]: self.settings["egress_zones"].append(egress_zone) else: raise FirewallError(errors.ALREADY_ENABLED, egress_zone) @handle_exceptions def removeEgressZone(self, egress_zone): if egress_zone in self.settings["egress_zones"]: self.settings["egress_zones"].remove(egress_zone) else: raise FirewallError(errors.NOT_ENABLED, egress_zone) @handle_exceptions def queryEgressZone(self, egress_zone): return egress_zone in self.settings["egress_zones"] @handle_exceptions def getPriority(self): return self.settings["priority"] @handle_exceptions def setPriority(self, priority): self.settings["priority"] = int(priority) class FirewallClientConfigPolicy(object): def __init__(self, bus, path): self.bus = bus self.path = path self.dbus_obj = self.bus.get_object(config.dbus.DBUS_INTERFACE, path) self.fw_policy = dbus.Interface( self.dbus_obj, dbus_interface=config.dbus.DBUS_INTERFACE_CONFIG_POLICY) self.fw_properties = dbus.Interface( self.dbus_obj, dbus_interface='org.freedesktop.DBus.Properties') @handle_exceptions def get_property(self, prop): return dbus_to_python(self.fw_properties.Get( config.dbus.DBUS_INTERFACE_CONFIG_POLICY, prop)) @handle_exceptions def get_properties(self): return dbus_to_python(self.fw_properties.GetAll( config.dbus.DBUS_INTERFACE_CONFIG_POLICY)) @handle_exceptions def set_property(self, prop, value): self.fw_properties.Set(config.dbus.DBUS_INTERFACE_CONFIG_POLICY, prop, value) @handle_exceptions def getSettings(self): return FirewallClientPolicySettings(dbus_to_python(self.fw_policy.getSettings())) @handle_exceptions def update(self, settings): self.fw_policy.update(settings.getSettingsDbusDict()) @handle_exceptions def loadDefaults(self): self.fw_policy.loadDefaults() @handle_exceptions def remove(self): self.fw_policy.remove() @handle_exceptions def rename(self, name): self.fw_policy.rename(name) # service config settings class FirewallClientServiceSettings(object): @handle_exceptions def __init__(self, settings=None): self.settings = ["", "", "", [], [], {}, [], [], [], []] self.settings_name = ["version", "short", "description", "ports", "modules", "destination", "protocols", "source_ports", "includes", "helpers"] self.settings_dbus_type = ["s", "s", "s", "(ss)", "s", "ss", "s", "(ss)", "s", "s"] if settings: if type(settings) is list: for i,v in enumerate(settings): self.settings[i] = settings[i] elif type(settings) is dict: self.setSettingsDict(settings) @handle_exceptions def __repr__(self): return '%s(%r)' % (self.__class__, self.settings) @handle_exceptions def getSettingsDict(self): settings = {} for key,value in zip(self.settings_name, self.settings): settings[key] = value return settings @handle_exceptions def setSettingsDict(self, settings): for key in settings: self.settings[self.settings_name.index(key)] = settings[key] @handle_exceptions def getSettingsDbusDict(self): settings = {} for key,value,sig in zip(self.settings_name, self.settings, self.settings_dbus_type): if type(value) is list: settings[key] = dbus.Array(value, signature=sig) elif type(value) is dict: settings[key] = dbus.Dictionary(value, signature=sig) else: settings[key] = value return settings @handle_exceptions def getVersion(self): return self.settings[0] @handle_exceptions def setVersion(self, version): self.settings[0] = version @handle_exceptions def getShort(self): return self.settings[1] @handle_exceptions def setShort(self, short): self.settings[1] = short @handle_exceptions def getDescription(self): return self.settings[2] @handle_exceptions def setDescription(self, description): self.settings[2] = description @handle_exceptions def getPorts(self): return self.settings[3] @handle_exceptions def setPorts(self, ports): self.settings[3] = ports @handle_exceptions def addPort(self, port, protocol): if (port,protocol) not in self.settings[3]: self.settings[3].append((port,protocol)) else: raise FirewallError(errors.ALREADY_ENABLED, "'%s:%s'" % (port, protocol)) @handle_exceptions def removePort(self, port, protocol): if (port,protocol) in self.settings[3]: self.settings[3].remove((port,protocol)) else: raise FirewallError(errors.NOT_ENABLED, "'%s:%s'" % (port, protocol)) @handle_exceptions def queryPort(self, port, protocol): return (port,protocol) in self.settings[3] @handle_exceptions def getProtocols(self): return self.settings[6] @handle_exceptions def setProtocols(self, protocols): self.settings[6] = protocols @handle_exceptions def addProtocol(self, protocol): if protocol not in self.settings[6]: self.settings[6].append(protocol) else: raise FirewallError(errors.ALREADY_ENABLED, protocol) @handle_exceptions def removeProtocol(self, protocol): if protocol in self.settings[6]: self.settings[6].remove(protocol) else: raise FirewallError(errors.NOT_ENABLED, protocol) @handle_exceptions def queryProtocol(self, protocol): return protocol in self.settings[6] @handle_exceptions def getSourcePorts(self): return self.settings[7] @handle_exceptions def setSourcePorts(self, ports): self.settings[7] = ports @handle_exceptions def addSourcePort(self, port, protocol): if (port,protocol) not in self.settings[7]: self.settings[7].append((port,protocol)) else: raise FirewallError(errors.ALREADY_ENABLED, "'%s:%s'" % (port, protocol)) @handle_exceptions def removeSourcePort(self, port, protocol): if (port,protocol) in self.settings[7]: self.settings[7].remove((port,protocol)) else: raise FirewallError(errors.NOT_ENABLED, "'%s:%s'" % (port, protocol)) @handle_exceptions def querySourcePort(self, port, protocol): return (port,protocol) in self.settings[7] @handle_exceptions def getModules(self): return self.settings[4] @handle_exceptions def setModules(self, modules): self.settings[4] = modules @handle_exceptions def addModule(self, module): if module not in self.settings[4]: self.settings[4].append(module) else: raise FirewallError(errors.ALREADY_ENABLED, module) @handle_exceptions def removeModule(self, module): if module in self.settings[4]: self.settings[4].remove(module) else: raise FirewallError(errors.NOT_ENABLED, module) @handle_exceptions def queryModule(self, module): return module in self.settings[4] @handle_exceptions def getDestinations(self): return self.settings[5] @handle_exceptions def setDestinations(self, destinations): self.settings[5] = destinations @handle_exceptions def setDestination(self, dest_type, address): if dest_type not in self.settings[5] or \ self.settings[5][dest_type] != address: self.settings[5][dest_type] = address else: raise FirewallError(errors.ALREADY_ENABLED, "'%s:%s'" % \ (dest_type, address)) @handle_exceptions def removeDestination(self, dest_type, address=None): if dest_type in self.settings[5]: if address is not None and self.settings[5][dest_type] != address: raise FirewallError(errors.NOT_ENABLED, "'%s:%s'" % \ (dest_type, address)) del self.settings[5][dest_type] else: raise FirewallError(errors.NOT_ENABLED, "'%s'" % dest_type) @handle_exceptions def queryDestination(self, dest_type, address): return (dest_type in self.settings[5] and \ address == self.settings[5][dest_type]) @handle_exceptions def getIncludes(self): return self.settings[8] @handle_exceptions def setIncludes(self, includes): self.settings[8] = includes @handle_exceptions def addInclude(self, include): if include not in self.settings[8]: self.settings[8].append(include) else: raise FirewallError(errors.ALREADY_ENABLED, include) @handle_exceptions def removeInclude(self, include): if include in self.settings[8]: self.settings[8].remove(include) else: raise FirewallError(errors.NOT_ENABLED, include) @handle_exceptions def queryInclude(self, include): return include in self.settings[8] @handle_exceptions def getHelpers(self): return self.settings[9] @handle_exceptions def setHelpers(self, helpers): self.settings[9] = helpers @handle_exceptions def addHelper(self, helper): if helper not in self.settings[9]: self.settings[9].append(helper) else: raise FirewallError(errors.ALREADY_ENABLED, helper) @handle_exceptions def removeHelper(self, helper): if helper in self.settings[9]: self.settings[9].remove(helper) else: raise FirewallError(errors.NOT_ENABLED, helper) @handle_exceptions def queryHelper(self, helper): return helper in self.settings[9] # ipset config settings class FirewallClientIPSetSettings(object): @handle_exceptions def __init__(self, settings=None): if settings: self.settings = settings else: self.settings = ["", "", "", "", {}, []] @handle_exceptions def __repr__(self): return '%s(%r)' % (self.__class__, self.settings) @handle_exceptions def getVersion(self): return self.settings[0] @handle_exceptions def setVersion(self, version): self.settings[0] = version @handle_exceptions def getShort(self): return self.settings[1] @handle_exceptions def setShort(self, short): self.settings[1] = short @handle_exceptions def getDescription(self): return self.settings[2] @handle_exceptions def setDescription(self, description): self.settings[2] = description @handle_exceptions def getType(self): return self.settings[3] @handle_exceptions def setType(self, ipset_type): self.settings[3] = ipset_type @handle_exceptions def getOptions(self): return self.settings[4] @handle_exceptions def setOptions(self, options): self.settings[4] = options @handle_exceptions def addOption(self, key, value): if key not in self.settings[4] or self.settings[4][key] != value: self.settings[4][key] = value else: raise FirewallError(errors.ALREADY_ENABLED, "'%s=%s'" % (key,value) if value else key) @handle_exceptions def removeOption(self, key): if key in self.settings[4]: del self.settings[4][key] else: raise FirewallError(errors.NOT_ENABLED, key) @handle_exceptions def queryOption(self, key, value): return key in self.settings[4] and self.settings[4][key] == value @handle_exceptions def getEntries(self): return self.settings[5] @handle_exceptions def setEntries(self, entries): if "timeout" in self.settings[4] and \ self.settings[4]["timeout"] != "0": raise FirewallError(errors.IPSET_WITH_TIMEOUT) check_for_overlapping_entries(entries) self.settings[5] = entries @handle_exceptions def addEntry(self, entry): if "timeout" in self.settings[4] and \ self.settings[4]["timeout"] != "0": raise FirewallError(errors.IPSET_WITH_TIMEOUT) entry = normalize_ipset_entry(entry) if entry not in self.settings[5]: check_entry_overlaps_existing(entry, self.settings[5]) self.settings[5].append(entry) else: raise FirewallError(errors.ALREADY_ENABLED, entry) @handle_exceptions def removeEntry(self, entry): if "timeout" in self.settings[4] and \ self.settings[4]["timeout"] != "0": raise FirewallError(errors.IPSET_WITH_TIMEOUT) entry = normalize_ipset_entry(entry) if entry in self.settings[5]: self.settings[5].remove(entry) else: raise FirewallError(errors.NOT_ENABLED, entry) @handle_exceptions def queryEntry(self, entry): if "timeout" in self.settings[4] and \ self.settings[4]["timeout"] != "0": raise FirewallError(errors.IPSET_WITH_TIMEOUT) entry = normalize_ipset_entry(entry) return entry in self.settings[5] # ipset config class FirewallClientConfigIPSet(object): @handle_exceptions def __init__(self, bus, path): self.bus = bus self.path = path self.dbus_obj = self.bus.get_object(config.dbus.DBUS_INTERFACE, path) self.fw_ipset = dbus.Interface( self.dbus_obj, dbus_interface=config.dbus.DBUS_INTERFACE_CONFIG_IPSET) self.fw_properties = dbus.Interface( self.dbus_obj, dbus_interface='org.freedesktop.DBus.Properties') @handle_exceptions def get_property(self, prop): return dbus_to_python(self.fw_properties.Get( config.dbus.DBUS_INTERFACE_CONFIG_IPSET, prop)) @handle_exceptions def get_properties(self): return dbus_to_python(self.fw_properties.GetAll( config.dbus.DBUS_INTERFACE_CONFIG_IPSET)) @handle_exceptions def set_property(self, prop, value): self.fw_properties.Set(config.dbus.DBUS_INTERFACE_CONFIG_IPSET, prop, value) @handle_exceptions def getSettings(self): return FirewallClientIPSetSettings(list(dbus_to_python(\ self.fw_ipset.getSettings()))) @handle_exceptions def update(self, settings): self.fw_ipset.update(tuple(settings.settings)) @handle_exceptions def loadDefaults(self): self.fw_ipset.loadDefaults() @handle_exceptions def remove(self): self.fw_ipset.remove() @handle_exceptions def rename(self, name): self.fw_ipset.rename(name) # version @handle_exceptions def getVersion(self): return self.fw_ipset.getVersion() @handle_exceptions def setVersion(self, version): self.fw_ipset.setVersion(version) # short @handle_exceptions def getShort(self): return self.fw_ipset.getShort() @handle_exceptions def setShort(self, short): self.fw_ipset.setShort(short) # description @handle_exceptions def getDescription(self): return self.fw_ipset.getDescription() @handle_exceptions def setDescription(self, description): self.fw_ipset.setDescription(description) # entry @handle_exceptions def getEntries(self): return self.fw_ipset.getEntries() @handle_exceptions def setEntries(self, entries): self.fw_ipset.setEntries(entries) @handle_exceptions def addEntry(self, entry): self.fw_ipset.addEntry(entry) @handle_exceptions def removeEntry(self, entry): self.fw_ipset.removeEntry(entry) @handle_exceptions def queryEntry(self, entry): return self.fw_ipset.queryEntry(entry) # helper config settings class FirewallClientHelperSettings(object): @handle_exceptions def __init__(self, settings=None): if settings: self.settings = settings else: self.settings = ["", "", "", "", "", [ ]] @handle_exceptions def __repr__(self): return '%s(%r)' % (self.__class__, self.settings) @handle_exceptions def getVersion(self): return self.settings[0] @handle_exceptions def setVersion(self, version): self.settings[0] = version @handle_exceptions def getShort(self): return self.settings[1] @handle_exceptions def setShort(self, short): self.settings[1] = short @handle_exceptions def getDescription(self): return self.settings[2] @handle_exceptions def setDescription(self, description): self.settings[2] = description @handle_exceptions def getFamily(self): return self.settings[3] @handle_exceptions def setFamily(self, ipv): if ipv is None: self.settings[3] = "" self.settings[3] = ipv @handle_exceptions def getModule(self): return self.settings[4] @handle_exceptions def setModule(self, module): self.settings[4] = module @handle_exceptions def getPorts(self): return self.settings[5] @handle_exceptions def setPorts(self, ports): self.settings[5] = ports @handle_exceptions def addPort(self, port, protocol): if (port,protocol) not in self.settings[5]: self.settings[5].append((port,protocol)) else: raise FirewallError(errors.ALREADY_ENABLED, "'%s:%s'" % (port, protocol)) @handle_exceptions def removePort(self, port, protocol): if (port,protocol) in self.settings[5]: self.settings[5].remove((port,protocol)) else: raise FirewallError(errors.NOT_ENABLED, "'%s:%s'" % (port, protocol)) @handle_exceptions def queryPort(self, port, protocol): return (port,protocol) in self.settings[5] # helper config class FirewallClientConfigHelper(object): @handle_exceptions def __init__(self, bus, path): self.bus = bus self.path = path self.dbus_obj = self.bus.get_object(config.dbus.DBUS_INTERFACE, path) self.fw_helper = dbus.Interface( self.dbus_obj, dbus_interface=config.dbus.DBUS_INTERFACE_CONFIG_HELPER) self.fw_properties = dbus.Interface( self.dbus_obj, dbus_interface='org.freedesktop.DBus.Properties') @handle_exceptions def get_property(self, prop): return dbus_to_python(self.fw_properties.Get( config.dbus.DBUS_INTERFACE_CONFIG_HELPER, prop)) @handle_exceptions def get_properties(self): return dbus_to_python(self.fw_properties.GetAll( config.dbus.DBUS_INTERFACE_CONFIG_HELPER)) @handle_exceptions def set_property(self, prop, value): self.fw_properties.Set(config.dbus.DBUS_INTERFACE_CONFIG_HELPER, prop, value) @handle_exceptions def getSettings(self): return FirewallClientHelperSettings(list(dbus_to_python(\ self.fw_helper.getSettings()))) @handle_exceptions def update(self, settings): self.fw_helper.update(tuple(settings.settings)) @handle_exceptions def loadDefaults(self): self.fw_helper.loadDefaults() @handle_exceptions def remove(self): self.fw_helper.remove() @handle_exceptions def rename(self, name): self.fw_helper.rename(name) # version @handle_exceptions def getVersion(self): return self.fw_helper.getVersion() @handle_exceptions def setVersion(self, version): self.fw_helper.setVersion(version) # short @handle_exceptions def getShort(self): return self.fw_helper.getShort() @handle_exceptions def setShort(self, short): self.fw_helper.setShort(short) # description @handle_exceptions def getDescription(self): return self.fw_helper.getDescription() @handle_exceptions def setDescription(self, description): self.fw_helper.setDescription(description) # port @handle_exceptions def getPorts(self): return self.fw_helper.getPorts() @handle_exceptions def setPorts(self, ports): self.fw_helper.setPorts(ports) @handle_exceptions def addPort(self, port, protocol): self.fw_helper.addPort(port, protocol) @handle_exceptions def removePort(self, port, protocol): self.fw_helper.removePort(port, protocol) @handle_exceptions def queryPort(self, port, protocol): return self.fw_helper.queryPort(port, protocol) # family @handle_exceptions def getFamily(self): return self.fw_helper.getFamily() @handle_exceptions def setFamily(self, ipv): if ipv is None: self.fw_helper.setFamily("") self.fw_helper.setFamily(ipv) # module @handle_exceptions def getModule(self): return self.fw_helper.getModule() @handle_exceptions def setModule(self, module): self.fw_helper.setModule(module) # service config class FirewallClientConfigService(object): @handle_exceptions def __init__(self, bus, path): self.bus = bus self.path = path self.dbus_obj = self.bus.get_object(config.dbus.DBUS_INTERFACE, path) self.fw_service = dbus.Interface( self.dbus_obj, dbus_interface=config.dbus.DBUS_INTERFACE_CONFIG_SERVICE) self.fw_properties = dbus.Interface( self.dbus_obj, dbus_interface='org.freedesktop.DBus.Properties') @handle_exceptions def get_property(self, prop): return dbus_to_python(self.fw_properties.Get( config.dbus.DBUS_INTERFACE_CONFIG_SERVICE, prop)) @handle_exceptions def get_properties(self): return dbus_to_python(self.fw_properties.GetAll( config.dbus.DBUS_INTERFACE_CONFIG_SERVICE)) @handle_exceptions def set_property(self, prop, value): self.fw_properties.Set(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE, prop, value) @handle_exceptions def getSettings(self): return FirewallClientServiceSettings(dbus_to_python( self.fw_service.getSettings2())) @handle_exceptions def update(self, settings): self.fw_service.update2(settings.getSettingsDbusDict()) @handle_exceptions def loadDefaults(self): self.fw_service.loadDefaults() @handle_exceptions def remove(self): self.fw_service.remove() @handle_exceptions def rename(self, name): self.fw_service.rename(name) # version @handle_exceptions def getVersion(self): return self.fw_service.getVersion() @handle_exceptions def setVersion(self, version): self.fw_service.setVersion(version) # short @handle_exceptions def getShort(self): return self.fw_service.getShort() @handle_exceptions def setShort(self, short): self.fw_service.setShort(short) # description @handle_exceptions def getDescription(self): return self.fw_service.getDescription() @handle_exceptions def setDescription(self, description): self.fw_service.setDescription(description) # port @handle_exceptions def getPorts(self): return self.fw_service.getPorts() @handle_exceptions def setPorts(self, ports): self.fw_service.setPorts(ports) @handle_exceptions def addPort(self, port, protocol): self.fw_service.addPort(port, protocol) @handle_exceptions def removePort(self, port, protocol): self.fw_service.removePort(port, protocol) @handle_exceptions def queryPort(self, port, protocol): return self.fw_service.queryPort(port, protocol) # protocol @handle_exceptions def getProtocols(self): return self.fw_service.getProtocols() @handle_exceptions def setProtocols(self, protocols): self.fw_service.setProtocols(protocols) @handle_exceptions def addProtocol(self, protocol): self.fw_service.addProtocol(protocol) @handle_exceptions def removeProtocol(self, protocol): self.fw_service.removeProtocol(protocol) @handle_exceptions def queryProtocol(self, protocol): return self.fw_service.queryProtocol(protocol) # source-port @handle_exceptions def getSourcePorts(self): return self.fw_service.getSourcePorts() @handle_exceptions def setSourcePorts(self, ports): self.fw_service.setSourcePorts(ports) @handle_exceptions def addSourcePort(self, port, protocol): self.fw_service.addSourcePort(port, protocol) @handle_exceptions def removeSourcePort(self, port, protocol): self.fw_service.removeSourcePort(port, protocol) @handle_exceptions def querySourcePort(self, port, protocol): return self.fw_service.querySourcePort(port, protocol) # module @handle_exceptions def getModules(self): return self.fw_service.getModules() @handle_exceptions def setModules(self, modules): self.fw_service.setModules(modules) @handle_exceptions def addModule(self, module): self.fw_service.addModule(module) @handle_exceptions def removeModule(self, module): self.fw_service.removeModule(module) @handle_exceptions def queryModule(self, module): return self.fw_service.queryModule(module) # destination @handle_exceptions def getDestinations(self): return self.fw_service.getDestinations() @handle_exceptions def setDestinations(self, destinations): self.fw_service.setDestinations(destinations) @handle_exceptions def getDestination(self, destination): return self.fw_service.getDestination(destination) @handle_exceptions def setDestination(self, destination, address): self.fw_service.setDestination(destination, address) @handle_exceptions def removeDestination(self, destination, address=None): if address is not None and self.getDestination(destination) != address: raise FirewallError(errors.NOT_ENABLED, "'%s:%s'" % \ (destination, address)) self.fw_service.removeDestination(destination) @handle_exceptions def queryDestination(self, destination, address): return self.fw_service.queryDestination(destination, address) # include @handle_exceptions def getIncludes(self): return self.fw_service.getIncludes() @handle_exceptions def setIncludes(self, includes): self.fw_service.setIncludes(includes) @handle_exceptions def addInclude(self, include): self.fw_service.addInclude(include) @handle_exceptions def removeInclude(self, include): self.fw_service.removeInclude(include) @handle_exceptions def queryInclude(self, include): return self.fw_service.queryInclude(include) # icmptype config settings class FirewallClientIcmpTypeSettings(object): @handle_exceptions def __init__(self, settings=None): if settings: self.settings = settings else: self.settings = ["", "", "", []] @handle_exceptions def __repr__(self): return '%s(%r)' % (self.__class__, self.settings) @handle_exceptions def getVersion(self): return self.settings[0] @handle_exceptions def setVersion(self, version): self.settings[0] = version @handle_exceptions def getShort(self): return self.settings[1] @handle_exceptions def setShort(self, short): self.settings[1] = short @handle_exceptions def getDescription(self): return self.settings[2] @handle_exceptions def setDescription(self, description): self.settings[2] = description @handle_exceptions def getDestinations(self): return self.settings[3] @handle_exceptions def setDestinations(self, destinations): self.settings[3] = destinations @handle_exceptions def addDestination(self, destination): # empty means all if not self.settings[3]: raise FirewallError(errors.ALREADY_ENABLED, destination) elif destination not in self.settings[3]: self.settings[3].append(destination) else: raise FirewallError(errors.ALREADY_ENABLED, destination) @handle_exceptions def removeDestination(self, destination): if destination in self.settings[3]: self.settings[3].remove(destination) # empty means all elif not self.settings[3]: self.setDestinations(list(set(['ipv4','ipv6']) - \ set([destination]))) else: raise FirewallError(errors.NOT_ENABLED, destination) @handle_exceptions def queryDestination(self, destination): # empty means all return not self.settings[3] or \ destination in self.settings[3] # icmptype config class FirewallClientConfigIcmpType(object): @handle_exceptions def __init__(self, bus, path): self.bus = bus self.path = path self.dbus_obj = self.bus.get_object(config.dbus.DBUS_INTERFACE, path) self.fw_icmptype = dbus.Interface( self.dbus_obj, dbus_interface=config.dbus.DBUS_INTERFACE_CONFIG_ICMPTYPE) self.fw_properties = dbus.Interface( self.dbus_obj, dbus_interface='org.freedesktop.DBus.Properties') @handle_exceptions def get_property(self, prop): return dbus_to_python(self.fw_properties.Get( config.dbus.DBUS_INTERFACE_CONFIG_ICMPTYPE, prop)) @handle_exceptions def get_properties(self): return dbus_to_python(self.fw_properties.GetAll( config.dbus.DBUS_INTERFACE_CONFIG_ICMPTYPE)) @handle_exceptions def set_property(self, prop, value): self.fw_properties.Set(config.dbus.DBUS_INTERFACE_CONFIG_ICMPTYPE, prop, value) @handle_exceptions def getSettings(self): return FirewallClientIcmpTypeSettings(list(dbus_to_python(\ self.fw_icmptype.getSettings()))) @handle_exceptions def update(self, settings): self.fw_icmptype.update(tuple(settings.settings)) @handle_exceptions def loadDefaults(self): self.fw_icmptype.loadDefaults() @handle_exceptions def remove(self): self.fw_icmptype.remove() @handle_exceptions def rename(self, name): self.fw_icmptype.rename(name) # version @handle_exceptions def getVersion(self): return self.fw_icmptype.getVersion() @handle_exceptions def setVersion(self, version): self.fw_icmptype.setVersion(version) # short @handle_exceptions def getShort(self): return self.fw_icmptype.getShort() @handle_exceptions def setShort(self, short): self.fw_icmptype.setShort(short) # description @handle_exceptions def getDescription(self): return self.fw_icmptype.getDescription() @handle_exceptions def setDescription(self, description): self.fw_icmptype.setDescription(description) # destination @handle_exceptions def getDestinations(self): return self.fw_icmptype.getDestinations() @handle_exceptions def setDestinations(self, destinations): self.fw_icmptype.setDestinations(destinations) @handle_exceptions def addDestination(self, destination): self.fw_icmptype.addDestination(destination) @handle_exceptions def removeDestination(self, destination): self.fw_icmptype.removeDestination(destination) @handle_exceptions def queryDestination(self, destination): return self.fw_icmptype.queryDestination(destination) # config.policies lockdown whitelist class FirewallClientPoliciesLockdownWhitelist(object): @handle_exceptions def __init__(self, settings=None): if settings: self.settings = settings else: self.settings = [ [], [], [], [] ] @handle_exceptions def __repr__(self): return '%s(%r)' % (self.__class__, self.settings) @handle_exceptions def getCommands(self): return self.settings[0] @handle_exceptions def setCommands(self, commands): self.settings[0] = commands @handle_exceptions def addCommand(self, command): if command not in self.settings[0]: self.settings[0].append(command) @handle_exceptions def removeCommand(self, command): if command in self.settings[0]: self.settings[0].remove(command) @handle_exceptions def queryCommand(self, command): return command in self.settings[0] @handle_exceptions def getContexts(self): return self.settings[1] @handle_exceptions def setContexts(self, contexts): self.settings[1] = contexts @handle_exceptions def addContext(self, context): if context not in self.settings[1]: self.settings[1].append(context) @handle_exceptions def removeContext(self, context): if context in self.settings[1]: self.settings[1].remove(context) @handle_exceptions def queryContext(self, context): return context in self.settings[1] @handle_exceptions def getUsers(self): return self.settings[2] @handle_exceptions def setUsers(self, users): self.settings[2] = users @handle_exceptions def addUser(self, user): if user not in self.settings[2]: self.settings[2].append(user) @handle_exceptions def removeUser(self, user): if user in self.settings[2]: self.settings[2].remove(user) @handle_exceptions def queryUser(self, user): return user in self.settings[2] @handle_exceptions def getUids(self): return self.settings[3] @handle_exceptions def setUids(self, uids): self.settings[3] = uids @handle_exceptions def addUid(self, uid): if uid not in self.settings[3]: self.settings[3].append(uid) @handle_exceptions def removeUid(self, uid): if uid in self.settings[3]: self.settings[3].remove(uid) @handle_exceptions def queryUid(self, uid): return uid in self.settings[3] # config.policies class FirewallClientConfigPolicies(object): @handle_exceptions def __init__(self, bus): self.bus = bus self.dbus_obj = self.bus.get_object(config.dbus.DBUS_INTERFACE, config.dbus.DBUS_PATH_CONFIG) self.fw_policies = dbus.Interface( self.dbus_obj, dbus_interface=config.dbus.DBUS_INTERFACE_CONFIG_POLICIES) @handle_exceptions def getLockdownWhitelist(self): return FirewallClientPoliciesLockdownWhitelist( \ list(dbus_to_python(self.fw_policies.getLockdownWhitelist()))) @handle_exceptions def setLockdownWhitelist(self, settings): self.fw_policies.setLockdownWhitelist(tuple(settings.settings)) # command @handle_exceptions def addLockdownWhitelistCommand(self, command): self.fw_policies.addLockdownWhitelistCommand(command) @handle_exceptions def removeLockdownWhitelistCommand(self, command): self.fw_policies.removeLockdownWhitelistCommand(command) @handle_exceptions def queryLockdownWhitelistCommand(self, command): return dbus_to_python(self.fw_policies.queryLockdownWhitelistCommand(command)) @handle_exceptions def getLockdownWhitelistCommands(self): return dbus_to_python(self.fw_policies.getLockdownWhitelistCommands()) # context @handle_exceptions def addLockdownWhitelistContext(self, context): self.fw_policies.addLockdownWhitelistContext(context) @handle_exceptions def removeLockdownWhitelistContext(self, context): self.fw_policies.removeLockdownWhitelistContext(context) @handle_exceptions def queryLockdownWhitelistContext(self, context): return dbus_to_python(self.fw_policies.queryLockdownWhitelistContext(context)) @handle_exceptions def getLockdownWhitelistContexts(self): return dbus_to_python(self.fw_policies.getLockdownWhitelistContexts()) # user @handle_exceptions def addLockdownWhitelistUser(self, user): self.fw_policies.addLockdownWhitelistUser(user) @handle_exceptions def removeLockdownWhitelistUser(self, user): self.fw_policies.removeLockdownWhitelistUser(user) @handle_exceptions def queryLockdownWhitelistUser(self, user): return dbus_to_python(self.fw_policies.queryLockdownWhitelistUser(user)) @handle_exceptions def getLockdownWhitelistUsers(self): return dbus_to_python(self.fw_policies.getLockdownWhitelistUsers()) # uid @handle_exceptions def getLockdownWhitelistUids(self): return dbus_to_python(self.fw_policies.getLockdownWhitelistUids()) @handle_exceptions def setLockdownWhitelistUids(self, uids): self.fw_policies.setLockdownWhitelistUids(uids) @handle_exceptions def addLockdownWhitelistUid(self, uid): self.fw_policies.addLockdownWhitelistUid(uid) @handle_exceptions def removeLockdownWhitelistUid(self, uid): self.fw_policies.removeLockdownWhitelistUid(uid) @handle_exceptions def queryLockdownWhitelistUid(self, uid): return dbus_to_python(self.fw_policies.queryLockdownWhitelistUid(uid)) # config.direct class FirewallClientDirect(object): @handle_exceptions def __init__(self, settings=None): if settings: self.settings = settings else: self.settings = [ [], [], [], ] @handle_exceptions def __repr__(self): return '%s(%r)' % (self.__class__, self.settings) @handle_exceptions def getAllChains(self): return self.settings[0] @handle_exceptions def getChains(self, ipv, table): return [ entry[2] for entry in self.settings[0] \ if entry[0] == ipv and entry[1] == table ] @handle_exceptions def setAllChains(self, chains): self.settings[0] = chains @handle_exceptions def addChain(self, ipv, table, chain): idx = (ipv, table, chain) if idx not in self.settings[0]: self.settings[0].append(idx) @handle_exceptions def removeChain(self, ipv, table, chain): idx = (ipv, table, chain) if idx in self.settings[0]: self.settings[0].remove(idx) @handle_exceptions def queryChain(self, ipv, table, chain): idx = (ipv, table, chain) return idx in self.settings[0] @handle_exceptions def getAllRules(self): return self.settings[1] @handle_exceptions def getRules(self, ipv, table, chain): return [ entry[3:] for entry in self.settings[1] \ if entry[0] == ipv and entry[1] == table \ and entry[2] == chain ] @handle_exceptions def setAllRules(self, rules): self.settings[1] = rules @handle_exceptions def addRule(self, ipv, table, chain, priority, args): idx = (ipv, table, chain, priority, args) if idx not in self.settings[1]: self.settings[1].append(idx) @handle_exceptions def removeRule(self, ipv, table, chain, priority, args): idx = (ipv, table, chain, priority, args) if idx in self.settings[1]: self.settings[1].remove(idx) @handle_exceptions def removeRules(self, ipv, table, chain): for idx in list(self.settings[1]): if idx[0] == ipv and idx[1] == table and idx[2] == chain: self.settings[1].remove(idx) @handle_exceptions def queryRule(self, ipv, table, chain, priority, args): idx = (ipv, table, chain, priority, args) return idx in self.settings[1] @handle_exceptions def getAllPassthroughs(self): return self.settings[2] @handle_exceptions def setAllPassthroughs(self, passthroughs): self.settings[2] = passthroughs @handle_exceptions def removeAllPassthroughs(self): self.settings[2] = [] @handle_exceptions def getPassthroughs(self, ipv): return [ entry[1] for entry in self.settings[2] \ if entry[0] == ipv ] @handle_exceptions def addPassthrough(self, ipv, args): idx = (ipv, args) if idx not in self.settings[2]: self.settings[2].append(idx) @handle_exceptions def removePassthrough(self, ipv, args): idx = (ipv, args) if idx in self.settings[2]: self.settings[2].remove(idx) @handle_exceptions def queryPassthrough(self, ipv, args): idx = (ipv, args) return idx in self.settings[2] # config.direct class FirewallClientConfigDirect(object): @handle_exceptions def __init__(self, bus): self.bus = bus self.dbus_obj = self.bus.get_object(config.dbus.DBUS_INTERFACE, config.dbus.DBUS_PATH_CONFIG) self.fw_direct = dbus.Interface( self.dbus_obj, dbus_interface=config.dbus.DBUS_INTERFACE_CONFIG_DIRECT) @handle_exceptions def getSettings(self): return FirewallClientDirect( \ list(dbus_to_python(self.fw_direct.getSettings()))) @handle_exceptions def update(self, settings): self.fw_direct.update(tuple(settings.settings)) # direct chain @handle_exceptions def addChain(self, ipv, table, chain): self.fw_direct.addChain(ipv, table, chain) @handle_exceptions def removeChain(self, ipv, table, chain): self.fw_direct.removeChain(ipv, table, chain) @handle_exceptions def queryChain(self, ipv, table, chain): return dbus_to_python(self.fw_direct.queryChain(ipv, table, chain)) @handle_exceptions def getChains(self, ipv, table): return dbus_to_python(self.fw_direct.getChains(ipv, table)) @handle_exceptions def getAllChains(self): return dbus_to_python(self.fw_direct.getAllChains()) # direct rule @handle_exceptions def addRule(self, ipv, table, chain, priority, args): self.fw_direct.addRule(ipv, table, chain, priority, args) @handle_exceptions def removeRule(self, ipv, table, chain, priority, args): self.fw_direct.removeRule(ipv, table, chain, priority, args) @handle_exceptions def removeRules(self, ipv, table, chain): self.fw_direct.removeRules(ipv, table, chain) @handle_exceptions def queryRule(self, ipv, table, chain, priority, args): return dbus_to_python(self.fw_direct.queryRule(ipv, table, chain, priority, args)) @handle_exceptions def getRules(self, ipv, table, chain): return dbus_to_python(self.fw_direct.getRules(ipv, table, chain)) @handle_exceptions def getAllRules(self): return dbus_to_python(self.fw_direct.getAllRules()) # tracked passthrough @handle_exceptions def addPassthrough(self, ipv, args): self.fw_direct.addPassthrough(ipv, args) @handle_exceptions def removePassthrough(self, ipv, args): self.fw_direct.removePassthrough(ipv, args) @handle_exceptions def queryPassthrough(self, ipv, args): return dbus_to_python(self.fw_direct.queryPassthrough(ipv, args)) @handle_exceptions def getPassthroughs(self, ipv): return dbus_to_python(self.fw_direct.getPassthroughs(ipv)) @handle_exceptions def getAllPassthroughs(self): return dbus_to_python(self.fw_direct.getAllPassthroughs()) # config class FirewallClientConfig(object): @handle_exceptions def __init__(self, bus): self.bus = bus self.dbus_obj = self.bus.get_object(config.dbus.DBUS_INTERFACE, config.dbus.DBUS_PATH_CONFIG) self.fw_config = dbus.Interface( self.dbus_obj, dbus_interface=config.dbus.DBUS_INTERFACE_CONFIG) self.fw_properties = dbus.Interface( self.dbus_obj, dbus_interface='org.freedesktop.DBus.Properties') self._policies = FirewallClientConfigPolicies(self.bus) self._direct = FirewallClientConfigDirect(self.bus) # properties @handle_exceptions def get_property(self, prop): return dbus_to_python(self.fw_properties.Get( config.dbus.DBUS_INTERFACE_CONFIG, prop)) @handle_exceptions def get_properties(self): return dbus_to_python(self.fw_properties.GetAll( config.dbus.DBUS_INTERFACE_CONFIG)) @handle_exceptions def set_property(self, prop, value): self.fw_properties.Set(config.dbus.DBUS_INTERFACE_CONFIG, prop, value) # ipset @handle_exceptions def getIPSetNames(self): return dbus_to_python(self.fw_config.getIPSetNames()) @handle_exceptions def listIPSets(self): return dbus_to_python(self.fw_config.listIPSets()) @handle_exceptions def getIPSet(self, path): return FirewallClientConfigIPSet(self.bus, path) @handle_exceptions def getIPSetByName(self, name): path = dbus_to_python(self.fw_config.getIPSetByName(name)) return FirewallClientConfigIPSet(self.bus, path) @handle_exceptions def addIPSet(self, name, settings): if isinstance(settings, FirewallClientIPSetSettings): path = self.fw_config.addIPSet(name, tuple(settings.settings)) else: path = self.fw_config.addIPSet(name, tuple(settings)) return FirewallClientConfigIPSet(self.bus, path) # zone @handle_exceptions def getZoneNames(self): return dbus_to_python(self.fw_config.getZoneNames()) @handle_exceptions def listZones(self): return dbus_to_python(self.fw_config.listZones()) @handle_exceptions def getZone(self, path): return FirewallClientConfigZone(self.bus, path) @handle_exceptions def getZoneByName(self, name): path = dbus_to_python(self.fw_config.getZoneByName(name)) return FirewallClientConfigZone(self.bus, path) @handle_exceptions def getZoneOfInterface(self, iface): return dbus_to_python(self.fw_config.getZoneOfInterface(iface)) @handle_exceptions def getZoneOfSource(self, source): return dbus_to_python(self.fw_config.getZoneOfSource(source)) @handle_exceptions def addZone(self, name, settings): if isinstance(settings, FirewallClientZoneSettings): path = self.fw_config.addZone2(name, settings.getSettingsDbusDict()) elif isinstance(settings, dict): path = self.fw_config.addZone2(name, settings) else: # tuple based dbus API has 16 elements. Slice what we're given down # to the expected size. path = self.fw_config.addZone(name, tuple(settings[:16])) return FirewallClientConfigZone(self.bus, path) # policy @handle_exceptions def getPolicyNames(self): return dbus_to_python(self.fw_config.getPolicyNames()) @handle_exceptions def listPolicies(self): return dbus_to_python(self.fw_config.listPolicies()) @handle_exceptions def getPolicy(self, path): return FirewallClientConfigPolicy(self.bus, path) @handle_exceptions def getPolicyByName(self, name): path = dbus_to_python(self.fw_config.getPolicyByName(name)) return FirewallClientConfigPolicy(self.bus, path) @handle_exceptions def addPolicy(self, name, settings): if isinstance(settings, FirewallClientPolicySettings): path = self.fw_config.addPolicy(name, settings.getSettingsDbusDict()) else: # dict path = self.fw_config.addPolicy(name, settings) return FirewallClientConfigPolicy(self.bus, path) # service @handle_exceptions def getServiceNames(self): return dbus_to_python(self.fw_config.getServiceNames()) @handle_exceptions def listServices(self): return dbus_to_python(self.fw_config.listServices()) @handle_exceptions def getService(self, path): return FirewallClientConfigService(self.bus, path) @handle_exceptions def getServiceByName(self, name): path = dbus_to_python(self.fw_config.getServiceByName(name)) return FirewallClientConfigService(self.bus, path) @handle_exceptions def addService(self, name, settings): if isinstance(settings, FirewallClientServiceSettings): path = self.fw_config.addService2(name, settings.getSettingsDbusDict()) elif type(settings) is dict: path = self.fw_config.addService2(name, settings) else: # tuple based dbus API has 8 elements. Slice what we're given down # to the expected size. path = self.fw_config.addService(name, tuple(settings[:8])) return FirewallClientConfigService(self.bus, path) # icmptype @handle_exceptions def getIcmpTypeNames(self): return dbus_to_python(self.fw_config.getIcmpTypeNames()) @handle_exceptions def listIcmpTypes(self): return dbus_to_python(self.fw_config.listIcmpTypes()) @handle_exceptions def getIcmpType(self, path): return FirewallClientConfigIcmpType(self.bus, path) @handle_exceptions def getIcmpTypeByName(self, name): path = dbus_to_python(self.fw_config.getIcmpTypeByName(name)) return FirewallClientConfigIcmpType(self.bus, path) @handle_exceptions def addIcmpType(self, name, settings): if isinstance(settings, FirewallClientIcmpTypeSettings): path = self.fw_config.addIcmpType(name, tuple(settings.settings)) else: path = self.fw_config.addIcmpType(name, tuple(settings)) return FirewallClientConfigIcmpType(self.bus, path) @handle_exceptions def policies(self): return self._policies @handle_exceptions def direct(self): return self._direct # helper @handle_exceptions def getHelperNames(self): return dbus_to_python(self.fw_config.getHelperNames()) @handle_exceptions def listHelpers(self): return dbus_to_python(self.fw_config.listHelpers()) @handle_exceptions def getHelper(self, path): return FirewallClientConfigHelper(self.bus, path) @handle_exceptions def getHelperByName(self, name): path = dbus_to_python(self.fw_config.getHelperByName(name)) return FirewallClientConfigHelper(self.bus, path) @handle_exceptions def addHelper(self, name, settings): if isinstance(settings, FirewallClientHelperSettings): path = self.fw_config.addHelper(name, tuple(settings.settings)) else: path = self.fw_config.addHelper(name, tuple(settings)) return FirewallClientConfigHelper(self.bus, path) # class FirewallClient(object): @handle_exceptions def __init__(self, bus=None, wait=0, quiet=True): if not bus: dbus.mainloop.glib.DBusGMainLoop(set_as_default=True) try: self.bus = dbus.SystemBus() except dbus.exceptions.DBusException as e: raise FirewallError(errors.DBUS_ERROR, e.get_dbus_message()) else: self.bus = bus self.bus.add_signal_receiver( handler_function=self._dbus_connection_changed, signal_name="NameOwnerChanged", dbus_interface="org.freedesktop.DBus", arg0=config.dbus.DBUS_INTERFACE) for interface in [ config.dbus.DBUS_INTERFACE, config.dbus.DBUS_INTERFACE_IPSET, config.dbus.DBUS_INTERFACE_ZONE, config.dbus.DBUS_INTERFACE_POLICY, config.dbus.DBUS_INTERFACE_DIRECT, config.dbus.DBUS_INTERFACE_POLICIES, config.dbus.DBUS_INTERFACE_CONFIG, config.dbus.DBUS_INTERFACE_CONFIG_IPSET, config.dbus.DBUS_INTERFACE_CONFIG_ZONE, config.dbus.DBUS_INTERFACE_CONFIG_POLICY, config.dbus.DBUS_INTERFACE_CONFIG_SERVICE, config.dbus.DBUS_INTERFACE_CONFIG_HELPER, config.dbus.DBUS_INTERFACE_CONFIG_DIRECT, config.dbus.DBUS_INTERFACE_CONFIG_ICMPTYPE, config.dbus.DBUS_INTERFACE_CONFIG_POLICIES ]: self.bus.add_signal_receiver(self._signal_receiver, dbus_interface=interface, interface_keyword='interface', member_keyword='member', path_keyword='path') # callbacks self._callback = { } self._callbacks = { # client callbacks "connection-changed": "connection-changed", "connection-established": "connection-established", "connection-lost": "connection-lost", # firewalld callbacks "log-denied-changed": "LogDeniedChanged", "default-zone-changed": "DefaultZoneChanged", "panic-mode-enabled": "PanicModeEnabled", "panic-mode-disabled": "PanicModeDisabled", "reloaded": "Reloaded", "service-added": "ServiceAdded", "service-removed": "ServiceRemoved", "port-added": "PortAdded", "port-removed": "PortRemoved", "source-port-added": "SourcePortAdded", "source-port-removed": "SourcePortRemoved", "protocol-added": "ProtocolAdded", "protocol-removed": "ProtocolRemoved", "masquerade-added": "MasqueradeAdded", "masquerade-removed": "MasqueradeRemoved", "forward-port-added": "ForwardPortAdded", "forward-port-removed": "ForwardPortRemoved", "icmp-block-added": "IcmpBlockAdded", "icmp-block-removed": "IcmpBlockRemoved", "icmp-block-inversion-added": "IcmpBlockInversionAdded", "icmp-block-inversion-removed": "IcmpBlockInversionRemoved", "richrule-added": "RichRuleAdded", "richrule-removed": "RichRuleRemoved", "interface-added": "InterfaceAdded", "interface-removed": "InterfaceRemoved", "zone-changed": "ZoneOfInterfaceChanged", # DEPRECATED, use zone-of-interface-changed instead "zone-of-interface-changed": "ZoneOfInterfaceChanged", "source-added": "SourceAdded", "source-removed": "SourceRemoved", "zone-of-source-changed": "ZoneOfSourceChanged", "zone-updated": "ZoneUpdated", "policy-updated": "PolicyUpdated", # ipset callbacks "ipset-entry-added": "EntryAdded", "ipset-entry-removed": "EntryRemoved", # direct callbacks "direct:chain-added": "ChainAdded", "direct:chain-removed": "ChainRemoved", "direct:rule-added": "RuleAdded", "direct:rule-removed": "RuleRemoved", "direct:passthrough-added": "PassthroughAdded", "direct:passthrough-removed": "PassthroughRemoved", "config:direct:updated": "config:direct:Updated", # policy callbacks "lockdown-enabled": "LockdownEnabled", "lockdown-disabled": "LockdownDisabled", "lockdown-whitelist-command-added": "LockdownWhitelistCommandAdded", "lockdown-whitelist-command-removed": "LockdownWhitelistCommandRemoved", "lockdown-whitelist-context-added": "LockdownWhitelistContextAdded", "lockdown-whitelist-context-removed": "LockdownWhitelistContextRemoved", "lockdown-whitelist-uid-added": "LockdownWhitelistUidAdded", "lockdown-whitelist-uid-removed": "LockdownWhitelistUidRemoved", "lockdown-whitelist-user-added": "LockdownWhitelistUserAdded", "lockdown-whitelist-user-removed": "LockdownWhitelistUserRemoved", # firewalld.config callbacks "config:policies:lockdown-whitelist-updated": "config:policies:LockdownWhitelistUpdated", "config:ipset-added": "config:IPSetAdded", "config:ipset-updated": "config:IPSetUpdated", "config:ipset-removed": "config:IPSetRemoved", "config:ipset-renamed": "config:IPSetRenamed", "config:zone-added": "config:ZoneAdded", "config:zone-updated": "config:ZoneUpdated", "config:zone-removed": "config:ZoneRemoved", "config:zone-renamed": "config:ZoneRenamed", "config:policy-added": "config:PolicyAdded", "config:policy-updated": "config:PolicyUpdated", "config:policy-removed": "config:PolicyRemoved", "config:policy-renamed": "config:PolicyRenamed", "config:service-added": "config:ServiceAdded", "config:service-updated": "config:ServiceUpdated", "config:service-removed": "config:ServiceRemoved", "config:service-renamed": "config:ServiceRenamed", "config:icmptype-added": "config:IcmpTypeAdded", "config:icmptype-updated": "config:IcmpTypeUpdated", "config:icmptype-removed": "config:IcmpTypeRemoved", "config:icmptype-renamed": "config:IcmpTypeRenamed", "config:helper-added": "config:HelperAdded", "config:helper-updated": "config:HelperUpdated", "config:helper-removed": "config:HelperRemoved", "config:helper-renamed": "config:HelperRenamed", } # initialize variables used for connection self._init_vars() self.quiet = quiet if wait > 0: # connect in one second GLib.timeout_add_seconds(wait, self._connection_established) else: self._connection_established() @handle_exceptions def _init_vars(self): self.fw = None self.fw_ipset = None self.fw_zone = None self.fw_policy = None self.fw_helper = None self.fw_direct = None self.fw_properties = None self._config = None self.connected = False @handle_exceptions def getExceptionHandler(self): return exception_handler @handle_exceptions def setExceptionHandler(self, handler): global exception_handler exception_handler = handler @handle_exceptions def getNotAuthorizedLoop(self): return not_authorized_loop @handle_exceptions def setNotAuthorizedLoop(self, enable): global not_authorized_loop not_authorized_loop = enable @handle_exceptions def connect(self, name, callback, *args): if name in self._callbacks: self._callback[self._callbacks[name]] = (callback, args) else: raise ValueError("Unknown callback name '%s'" % name) @handle_exceptions def _dbus_connection_changed(self, name, old_owner, new_owner): if name != config.dbus.DBUS_INTERFACE: return if new_owner: # connection established self._connection_established() else: # connection lost self._connection_lost() @handle_exceptions def _connection_established(self): try: self.dbus_obj = self.bus.get_object(config.dbus.DBUS_INTERFACE, config.dbus.DBUS_PATH) self.fw = dbus.Interface(self.dbus_obj, dbus_interface=config.dbus.DBUS_INTERFACE) self.fw_ipset = dbus.Interface( self.dbus_obj, dbus_interface=config.dbus.DBUS_INTERFACE_IPSET) self.fw_zone = dbus.Interface( self.dbus_obj, dbus_interface=config.dbus.DBUS_INTERFACE_ZONE) self.fw_policy = dbus.Interface( self.dbus_obj, dbus_interface=config.dbus.DBUS_INTERFACE_POLICY) self.fw_direct = dbus.Interface( self.dbus_obj, dbus_interface=config.dbus.DBUS_INTERFACE_DIRECT) self.fw_policies = dbus.Interface( self.dbus_obj, dbus_interface=config.dbus.DBUS_INTERFACE_POLICIES) self.fw_properties = dbus.Interface( self.dbus_obj, dbus_interface='org.freedesktop.DBus.Properties') except dbus.exceptions.DBusException as e: # ignore dbus errors if not self.quiet: print ("DBusException", e.get_dbus_message()) return except Exception as e: if not self.quiet: print ("Exception", e) return self._config = FirewallClientConfig(self.bus) self.connected = True self._signal_receiver(member="connection-established", interface=config.dbus.DBUS_INTERFACE) self._signal_receiver(member="connection-changed", interface=config.dbus.DBUS_INTERFACE) @handle_exceptions def _connection_lost(self): self._init_vars() self._signal_receiver(member="connection-lost", interface=config.dbus.DBUS_INTERFACE) self._signal_receiver(member="connection-changed", interface=config.dbus.DBUS_INTERFACE) @handle_exceptions def _signal_receiver(self, *args, **kwargs): if "member" not in kwargs or "interface" not in kwargs: return signal = kwargs["member"] interface = kwargs["interface"] # config signals need special treatment # pimp signal name if interface.startswith(config.dbus.DBUS_INTERFACE_CONFIG_ZONE): signal = "config:Zone" + signal if interface.startswith(config.dbus.DBUS_INTERFACE_CONFIG_POLICY): signal = "config:Policy" + signal elif interface.startswith(config.dbus.DBUS_INTERFACE_CONFIG_IPSET): signal = "config:IPSet" + signal elif interface.startswith(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE): signal = "config:Service" + signal elif interface.startswith(config.dbus.DBUS_INTERFACE_CONFIG_ICMPTYPE): signal = "config:IcmpType" + signal elif interface.startswith(config.dbus.DBUS_INTERFACE_CONFIG_HELPER): signal = "config:Helper" + signal elif interface == config.dbus.DBUS_INTERFACE_CONFIG: signal = "config:" + signal elif interface == config.dbus.DBUS_INTERFACE_CONFIG_POLICIES: signal = "config:policies:" + signal elif interface == config.dbus.DBUS_INTERFACE_CONFIG_DIRECT: signal = "config:direct:" + signal cb = None for callback in self._callbacks: if self._callbacks[callback] == signal and \ self._callbacks[callback] in self._callback: cb = self._callback[self._callbacks[callback]] if cb is None: return # call back with args converted to python types ... cb_args = [ dbus_to_python(arg) for arg in args ] try: if cb[1]: # add call data cb_args.extend(cb[1]) # call back cb[0](*cb_args) except Exception as msg: print(msg) @handle_exceptions def config(self): return self._config @handle_exceptions def reload(self): self.fw.reload() @handle_exceptions def resetToDefaults(self): self.fw.resetToDefaults() @handle_exceptions def complete_reload(self): self.fw.completeReload() @handle_exceptions def runtimeToPermanent(self): self.fw.runtimeToPermanent() @handle_exceptions def checkPermanentConfig(self): self.fw.checkPermanentConfig() @handle_exceptions def get_property(self, prop): return dbus_to_python(self.fw_properties.Get( config.dbus.DBUS_INTERFACE, prop)) @handle_exceptions def get_properties(self): return dbus_to_python(self.fw_properties.GetAll( config.dbus.DBUS_INTERFACE)) @handle_exceptions def set_property(self, prop, value): self.fw_properties.Set(config.dbus.DBUS_INTERFACE, prop, value) # panic mode @handle_exceptions def enablePanicMode(self): self.fw.enablePanicMode() @handle_exceptions def disablePanicMode(self): self.fw.disablePanicMode() @handle_exceptions def queryPanicMode(self): return dbus_to_python(self.fw.queryPanicMode()) # list functions @handle_exceptions def getZoneSettings(self, zone): return FirewallClientZoneSettings(dbus_to_python(self.fw_zone.getZoneSettings2(zone))) @handle_exceptions def getIPSets(self): return dbus_to_python(self.fw_ipset.getIPSets()) @handle_exceptions def getIPSetSettings(self, ipset): return FirewallClientIPSetSettings(list(dbus_to_python(\ self.fw_ipset.getIPSetSettings(ipset)))) @handle_exceptions def addEntry(self, ipset, entry): self.fw_ipset.addEntry(ipset, entry) @handle_exceptions def getEntries(self, ipset): return self.fw_ipset.getEntries(ipset) @handle_exceptions def setEntries(self, ipset, entries): return self.fw_ipset.setEntries(ipset, entries) @handle_exceptions def removeEntry(self, ipset, entry): self.fw_ipset.removeEntry(ipset, entry) @handle_exceptions def queryEntry(self, ipset, entry): return dbus_to_python(self.fw_ipset.queryEntry(ipset, entry)) @handle_exceptions def listServices(self): return dbus_to_python(self.fw.listServices()) @handle_exceptions def getServiceSettings(self, service): return FirewallClientServiceSettings(dbus_to_python( self.fw.getServiceSettings2(service))) @handle_exceptions def listIcmpTypes(self): return dbus_to_python(self.fw.listIcmpTypes()) @handle_exceptions def getIcmpTypeSettings(self, icmptype): return FirewallClientIcmpTypeSettings(list(dbus_to_python(\ self.fw.getIcmpTypeSettings(icmptype)))) @handle_exceptions def getHelpers(self): return dbus_to_python(self.fw.getHelpers()) @handle_exceptions def getHelperSettings(self, helper): return FirewallClientHelperSettings(list(dbus_to_python(\ self.fw.getHelperSettings(helper)))) # automatic helper setting @handle_exceptions def getAutomaticHelpers(self): return dbus_to_python(self.fw.getAutomaticHelpers()) @handle_exceptions def setAutomaticHelpers(self, value): self.fw.setAutomaticHelpers(value) # log denied @handle_exceptions def getLogDenied(self): return dbus_to_python(self.fw.getLogDenied()) @handle_exceptions def setLogDenied(self, value): self.fw.setLogDenied(value) # default zone @handle_exceptions def getDefaultZone(self): return dbus_to_python(self.fw.getDefaultZone()) @handle_exceptions def setDefaultZone(self, zone): self.fw.setDefaultZone(zone) # zone @handle_exceptions def setZoneSettings(self, zone, settings): self.fw_zone.setZoneSettings2(zone, settings.getRuntimeSettingsDbusDict()) @handle_exceptions def getZones(self): return dbus_to_python(self.fw_zone.getZones()) @handle_exceptions def getActiveZones(self): return dbus_to_python(self.fw_zone.getActiveZones()) @handle_exceptions def getZoneOfInterface(self, interface): return dbus_to_python(self.fw_zone.getZoneOfInterface(interface)) @handle_exceptions def getZoneOfSource(self, source): return dbus_to_python(self.fw_zone.getZoneOfSource(source)) @handle_exceptions def isImmutable(self, zone): return dbus_to_python(self.fw_zone.isImmutable(zone)) # policy @handle_exceptions def getPolicySettings(self, policy): return FirewallClientPolicySettings(dbus_to_python(self.fw_policy.getPolicySettings(policy))) @handle_exceptions def setPolicySettings(self, policy, settings): self.fw_policy.setPolicySettings(policy, settings.getRuntimeSettingsDbusDict()) @handle_exceptions def getPolicies(self): return dbus_to_python(self.fw_policy.getPolicies()) @handle_exceptions def getActivePolicies(self): return dbus_to_python(self.fw_policy.getActivePolicies()) @handle_exceptions def isPolicyImmutable(self, policy): return dbus_to_python(self.fw_policy.isImmutable(policy)) # interfaces @handle_exceptions def addInterface(self, zone, interface): return dbus_to_python(self.fw_zone.addInterface(zone, interface)) @handle_exceptions def changeZone(self, zone, interface): # DEPRECATED return dbus_to_python(self.fw_zone.changeZone(zone, interface)) @handle_exceptions def changeZoneOfInterface(self, zone, interface): return dbus_to_python(self.fw_zone.changeZoneOfInterface(zone, interface)) @handle_exceptions def getInterfaces(self, zone): return dbus_to_python(self.fw_zone.getInterfaces(zone)) @handle_exceptions def queryInterface(self, zone, interface): return dbus_to_python(self.fw_zone.queryInterface(zone, interface)) @handle_exceptions def removeInterface(self, zone, interface): return dbus_to_python(self.fw_zone.removeInterface(zone, interface)) # sources @handle_exceptions def addSource(self, zone, source): return dbus_to_python(self.fw_zone.addSource(zone, source)) @handle_exceptions def changeZoneOfSource(self, zone, source): return dbus_to_python(self.fw_zone.changeZoneOfSource(zone, source)) @handle_exceptions def getSources(self, zone): return dbus_to_python(self.fw_zone.getSources(zone)) @handle_exceptions def querySource(self, zone, source): return dbus_to_python(self.fw_zone.querySource(zone, source)) @handle_exceptions def removeSource(self, zone, source): return dbus_to_python(self.fw_zone.removeSource(zone, source)) # rich rules @handle_exceptions def addRichRule(self, zone, rule, timeout=0): return dbus_to_python(self.fw_zone.addRichRule(zone, rule, timeout)) @handle_exceptions def getRichRules(self, zone): return dbus_to_python(self.fw_zone.getRichRules(zone)) @handle_exceptions def queryRichRule(self, zone, rule): return dbus_to_python(self.fw_zone.queryRichRule(zone, rule)) @handle_exceptions def removeRichRule(self, zone, rule): return dbus_to_python(self.fw_zone.removeRichRule(zone, rule)) # services @handle_exceptions def addService(self, zone, service, timeout=0): return dbus_to_python(self.fw_zone.addService(zone, service, timeout)) @handle_exceptions def getServices(self, zone): return dbus_to_python(self.fw_zone.getServices(zone)) @handle_exceptions def queryService(self, zone, service): return dbus_to_python(self.fw_zone.queryService(zone, service)) @handle_exceptions def removeService(self, zone, service): return dbus_to_python(self.fw_zone.removeService(zone, service)) # ports @handle_exceptions def addPort(self, zone, port, protocol, timeout=0): return dbus_to_python(self.fw_zone.addPort(zone, port, protocol, timeout)) @handle_exceptions def getPorts(self, zone): return dbus_to_python(self.fw_zone.getPorts(zone)) @handle_exceptions def queryPort(self, zone, port, protocol): return dbus_to_python(self.fw_zone.queryPort(zone, port, protocol)) @handle_exceptions def removePort(self, zone, port, protocol): return dbus_to_python(self.fw_zone.removePort(zone, port, protocol)) # protocols @handle_exceptions def addProtocol(self, zone, protocol, timeout=0): return dbus_to_python(self.fw_zone.addProtocol(zone, protocol, timeout)) @handle_exceptions def getProtocols(self, zone): return dbus_to_python(self.fw_zone.getProtocols(zone)) @handle_exceptions def queryProtocol(self, zone, protocol): return dbus_to_python(self.fw_zone.queryProtocol(zone, protocol)) @handle_exceptions def removeProtocol(self, zone, protocol): return dbus_to_python(self.fw_zone.removeProtocol(zone, protocol)) # forward @handle_exceptions def addForward(self, zone): self.fw_zone.setZoneSettings2(zone, {"forward": True}) @handle_exceptions def queryForward(self, zone): return dbus_to_python(self.fw_zone.getZoneSettings2(zone))["forward"] @handle_exceptions def removeForward(self, zone): self.fw_zone.setZoneSettings2(zone, {"forward": False}) # masquerade @handle_exceptions def addMasquerade(self, zone, timeout=0): return dbus_to_python(self.fw_zone.addMasquerade(zone, timeout)) @handle_exceptions def queryMasquerade(self, zone): return dbus_to_python(self.fw_zone.queryMasquerade(zone)) @handle_exceptions def removeMasquerade(self, zone): return dbus_to_python(self.fw_zone.removeMasquerade(zone)) # forward ports @handle_exceptions def addForwardPort(self, zone, port, protocol, toport, toaddr, timeout=0): if toport is None: toport = "" if toaddr is None: toaddr = "" return dbus_to_python(self.fw_zone.addForwardPort(zone, port, protocol, toport, toaddr, timeout)) @handle_exceptions def getForwardPorts(self, zone): return dbus_to_python(self.fw_zone.getForwardPorts(zone)) @handle_exceptions def queryForwardPort(self, zone, port, protocol, toport, toaddr): if toport is None: toport = "" if toaddr is None: toaddr = "" return dbus_to_python(self.fw_zone.queryForwardPort(zone, port, protocol, toport, toaddr)) @handle_exceptions def removeForwardPort(self, zone, port, protocol, toport, toaddr): if toport is None: toport = "" if toaddr is None: toaddr = "" return dbus_to_python(self.fw_zone.removeForwardPort(zone, port, protocol, toport, toaddr)) # source ports @handle_exceptions def addSourcePort(self, zone, port, protocol, timeout=0): return dbus_to_python(self.fw_zone.addSourcePort(zone, port, protocol, timeout)) @handle_exceptions def getSourcePorts(self, zone): return dbus_to_python(self.fw_zone.getSourcePorts(zone)) @handle_exceptions def querySourcePort(self, zone, port, protocol): return dbus_to_python(self.fw_zone.querySourcePort(zone, port, protocol)) @handle_exceptions def removeSourcePort(self, zone, port, protocol): return dbus_to_python(self.fw_zone.removeSourcePort(zone, port, protocol)) # icmpblock @handle_exceptions def addIcmpBlock(self, zone, icmp, timeout=0): return dbus_to_python(self.fw_zone.addIcmpBlock(zone, icmp, timeout)) @handle_exceptions def getIcmpBlocks(self, zone): return dbus_to_python(self.fw_zone.getIcmpBlocks(zone)) @handle_exceptions def queryIcmpBlock(self, zone, icmp): return dbus_to_python(self.fw_zone.queryIcmpBlock(zone, icmp)) @handle_exceptions def removeIcmpBlock(self, zone, icmp): return dbus_to_python(self.fw_zone.removeIcmpBlock(zone, icmp)) # icmp block inversion @handle_exceptions def addIcmpBlockInversion(self, zone): return dbus_to_python(self.fw_zone.addIcmpBlockInversion(zone)) @handle_exceptions def queryIcmpBlockInversion(self, zone): return dbus_to_python(self.fw_zone.queryIcmpBlockInversion(zone)) @handle_exceptions def removeIcmpBlockInversion(self, zone): return dbus_to_python(self.fw_zone.removeIcmpBlockInversion(zone)) # direct chain @handle_exceptions def addChain(self, ipv, table, chain): self.fw_direct.addChain(ipv, table, chain) @handle_exceptions def removeChain(self, ipv, table, chain): self.fw_direct.removeChain(ipv, table, chain) @handle_exceptions def queryChain(self, ipv, table, chain): return dbus_to_python(self.fw_direct.queryChain(ipv, table, chain)) @handle_exceptions def getChains(self, ipv, table): return dbus_to_python(self.fw_direct.getChains(ipv, table)) @handle_exceptions def getAllChains(self): return dbus_to_python(self.fw_direct.getAllChains()) # direct rule @handle_exceptions def addRule(self, ipv, table, chain, priority, args): self.fw_direct.addRule(ipv, table, chain, priority, args) @handle_exceptions def removeRule(self, ipv, table, chain, priority, args): self.fw_direct.removeRule(ipv, table, chain, priority, args) @handle_exceptions def removeRules(self, ipv, table, chain): self.fw_direct.removeRules(ipv, table, chain) @handle_exceptions def queryRule(self, ipv, table, chain, priority, args): return dbus_to_python(self.fw_direct.queryRule(ipv, table, chain, priority, args)) @handle_exceptions def getRules(self, ipv, table, chain): return dbus_to_python(self.fw_direct.getRules(ipv, table, chain)) @handle_exceptions def getAllRules(self): return dbus_to_python(self.fw_direct.getAllRules()) # direct passthrough @handle_exceptions def passthrough(self, ipv, args): return dbus_to_python(self.fw_direct.passthrough(ipv, args)) # tracked passthrough @handle_exceptions def getAllPassthroughs(self): return dbus_to_python(self.fw_direct.getAllPassthroughs()) @handle_exceptions def removeAllPassthroughs(self): self.fw_direct.removeAllPassthroughs() @handle_exceptions def getPassthroughs(self, ipv): return dbus_to_python(self.fw_direct.getPassthroughs(ipv)) @handle_exceptions def addPassthrough(self, ipv, args): self.fw_direct.addPassthrough(ipv, args) @handle_exceptions def removePassthrough(self, ipv, args): self.fw_direct.removePassthrough(ipv, args) @handle_exceptions def queryPassthrough(self, ipv, args): return dbus_to_python(self.fw_direct.queryPassthrough(ipv, args)) # lockdown @handle_exceptions def enableLockdown(self): self.fw_policies.enableLockdown() @handle_exceptions def disableLockdown(self): self.fw_policies.disableLockdown() @handle_exceptions def queryLockdown(self): return dbus_to_python(self.fw_policies.queryLockdown()) # policies # lockdown white list commands @handle_exceptions def addLockdownWhitelistCommand(self, command): self.fw_policies.addLockdownWhitelistCommand(command) @handle_exceptions def getLockdownWhitelistCommands(self): return dbus_to_python(self.fw_policies.getLockdownWhitelistCommands()) @handle_exceptions def queryLockdownWhitelistCommand(self, command): return dbus_to_python(self.fw_policies.queryLockdownWhitelistCommand(command)) @handle_exceptions def removeLockdownWhitelistCommand(self, command): self.fw_policies.removeLockdownWhitelistCommand(command) # lockdown white list contexts @handle_exceptions def addLockdownWhitelistContext(self, context): self.fw_policies.addLockdownWhitelistContext(context) @handle_exceptions def getLockdownWhitelistContexts(self): return dbus_to_python(self.fw_policies.getLockdownWhitelistContexts()) @handle_exceptions def queryLockdownWhitelistContext(self, context): return dbus_to_python(self.fw_policies.queryLockdownWhitelistContext(context)) @handle_exceptions def removeLockdownWhitelistContext(self, context): self.fw_policies.removeLockdownWhitelistContext(context) # lockdown white list uids @handle_exceptions def addLockdownWhitelistUid(self, uid): self.fw_policies.addLockdownWhitelistUid(uid) @handle_exceptions def getLockdownWhitelistUids(self): return dbus_to_python(self.fw_policies.getLockdownWhitelistUids()) @handle_exceptions def queryLockdownWhitelistUid(self, uid): return dbus_to_python(self.fw_policies.queryLockdownWhitelistUid(uid)) @handle_exceptions def removeLockdownWhitelistUid(self, uid): self.fw_policies.removeLockdownWhitelistUid(uid) # lockdown white list users @handle_exceptions def addLockdownWhitelistUser(self, user): self.fw_policies.addLockdownWhitelistUser(user) @handle_exceptions def getLockdownWhitelistUsers(self): return dbus_to_python(self.fw_policies.getLockdownWhitelistUsers()) @handle_exceptions def queryLockdownWhitelistUser(self, user): return dbus_to_python(self.fw_policies.queryLockdownWhitelistUser(user)) @handle_exceptions def removeLockdownWhitelistUser(self, user): self.fw_policies.removeLockdownWhitelistUser(user) @handle_exceptions def authorizeAll(self): """ Authorize once for all polkit actions. """ self.fw.authorizeAll() __init__.py 0000644 00000000000 15025011705 0006637 0 ustar 00
| ver. 1.4 |
Github
|
.
| PHP 8.2.28 | Generation time: 0.05 |
proxy
|
phpinfo
|
Settings