File manager - Edit - /home/newsbmcs.com/public_html/static/img/logo/firewall.zip
Back
PK ���Z�9� � + config/__pycache__/__init__.cpython-310.pycnu �[��� o bhAb� � @ sN d dl Z z e �e jd� W n e jy' d dlZdejd< e �e jd� Y nw dZd dlZejed� ddl m Z dZ d Z d Z d e Ze d Zd ZdZg d�Ze�d�ZdZdd� Zed� dd� Zed� dZdZdZdZd Zd Z d d d d!d"d#d$d%d&d'� Z g d(�Z g d)�Z d*d+gZ d,Z!d-Z"d.Z#d/Z$d/Z%d.Z&d/Z'd0Z(d1Z)d*Z*d.Z+d.Z,d/Z-dS )2� N� �C�LC_ALL� firewalld)�domain� )�dbuszfirewall-configzfirewall-appletz /usr/share/z.gladez(C) 2010-2017 Red Hat, Inc.z1.1.1)z$Thomas Woerner <twoerner@redhat.com>z"Jiri Popelka <jpopelka@redhat.com>zEric Garver <e@erig.me>ac This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this program. If not, see <http://www.gnu.org/licenses/>.zhttp://www.firewalld.orgc C sP | a | d a| d a| d a| d a| d a| d a| d a| d a| d a d S ) Nz/firewalld.conf�/zones� /services� /icmptypes�/ipsets�/helpers� /policiesz /direct.xmlz/lockdown-whitelist.xml) � ETC_FIREWALLD�FIREWALLD_CONF�ETC_FIREWALLD_ZONES�ETC_FIREWALLD_SERVICES�ETC_FIREWALLD_ICMPTYPES�ETC_FIREWALLD_IPSETS�ETC_FIREWALLD_HELPERS�ETC_FIREWALLD_POLICIES�FIREWALLD_DIRECT�LOCKDOWN_WHITELIST��path� r �:/usr/lib/python3/dist-packages/firewall/config/__init__.py�set_system_config_paths@ s r z/etc/firewalldc C s8 | a | d a| d a| d a| d a| d a| d ad S )Nr r r r r r )�USR_LIB_FIREWALLD�FIREWALLD_ZONES�FIREWALLD_SERVICES�FIREWALLD_ICMPTYPES�FIREWALLD_IPSETS�FIREWALLD_HELPERS�FIREWALLD_POLICIESr r r r �set_default_config_pathsQ s r% z/usr/lib/firewalldz/var/log/firewalldz/var/run/firewalld.pidz/run/firewalldz/etc/sysconfigz /etc/sysconfig/network-scriptsz/etc/sysctl.confz/usr/sbin/iptablesz/usr/sbin/iptables-restorez/usr/sbin/ip6tablesz/usr/sbin/ip6tables-restorez/usr/sbin/ebtablesz/usr/sbin/ebtables-restorez/usr/sbin/ipsetz/sbin/modprobez /sbin/rmmod) �ipv4z ipv4-restore�ipv6z ipv6-restore�ebz eb-restore�ipset�modprobe�rmmod)�all�unicast� broadcast� multicast�off)�yes�no�system�nftables�iptables�public�d TFr0 r2 ).�locale� setlocaler �Error�os�environ�DOMAIN�gettext�installr r � DAEMON_NAME� CONFIG_NAME� APPLET_NAME�DATADIR�CONFIG_GLADE_NAME� COPYRIGHT�VERSION�AUTHORS�LICENSE�WEBSITEr r% �FIREWALLD_LOGFILE�FIREWALLD_PIDFILE�FIREWALLD_TEMPDIR� SYSCONFIGDIR�IFCFGDIR� SYSCTL_CONFIG�COMMANDS�LOG_DENIED_VALUES�AUTOMATIC_HELPERS_VALUES�FIREWALL_BACKEND_VALUES� FALLBACK_ZONE�FALLBACK_MINIMAL_MARK�FALLBACK_CLEANUP_ON_EXIT� FALLBACK_CLEANUP_MODULES_ON_EXIT�FALLBACK_LOCKDOWN�FALLBACK_IPV6_RPFILTER�FALLBACK_INDIVIDUAL_CALLS�FALLBACK_LOG_DENIED�FALLBACK_AUTOMATIC_HELPERS�FALLBACK_FIREWALL_BACKEND� FALLBACK_FLUSH_ALL_ON_RELOAD�FALLBACK_RFC3964_IPV4� FALLBACK_ALLOW_ZONE_DRIFTINGr r r r �<module> sx � � � PK ���Z}w{� ' config/__pycache__/dbus.cpython-310.pycnu �[��� o bhAb � @ s d Z dZde Zed Zed Zed Zed Zed Zed Zed Z ed Z ed Z ed Z ed Z ed Zed Zed Zd e Zed Zed Zed Zed Zed Zed Zed Zde Zed Zed Zed Z e d Z ed Z e d Z ed Z ed Z!dS )� � z org.fedoraproject.FirewallD%dz.zonez.policyz.directz .policiesz.ipsetz.configz.servicez .icmptypez.helperz /org/fedoraproject/FirewallD%dz/configz/config/icmptypez/config/servicez /config/zonez/config/policyz /config/ipsetz/config/helperz.infoz.allN)"�DBUS_INTERFACE_VERSION�DBUS_INTERFACE_REVISION�DBUS_INTERFACE�DBUS_INTERFACE_ZONE�DBUS_INTERFACE_POLICY�DBUS_INTERFACE_DIRECT�DBUS_INTERFACE_POLICIES�DBUS_INTERFACE_IPSET�DBUS_INTERFACE_CONFIG�DBUS_INTERFACE_CONFIG_ZONE� DBUS_INTERFACE_CONFIG_POLICY� DBUS_INTERFACE_CONFIG_SERVICE� DBUS_INTERFACE_CONFIG_ICMPTYPE� DBUS_INTERFACE_CONFIG_POLICIES� DBUS_INTERFACE_CONFIG_DIRECT�DBUS_INTERFACE_CONFIG_IPSET� DBUS_INTERFACE_CONFIG_HELPER� DBUS_PATH�DBUS_PATH_CONFIG�DBUS_PATH_CONFIG_ICMPTYPE�DBUS_PATH_CONFIG_SERVICE�DBUS_PATH_CONFIG_ZONE�DBUS_PATH_CONFIG_POLICY�DBUS_PATH_CONFIG_IPSET�DBUS_PATH_CONFIG_HELPER� _PK_ACTION�PK_ACTION_POLICIES�PK_ACTION_POLICIES_INFO�PK_ACTION_CONFIG�PK_ACTION_CONFIG_INFO�PK_ACTION_DIRECT�PK_ACTION_DIRECT_INFO�PK_ACTION_INFO� PK_ACTION_ALL� r% r% �6/usr/lib/python3/dist-packages/firewall/config/dbus.py�<module> sD PK ���Z��; config/dbus.pynu �[��� # -*- coding: utf-8 -*- # # Copyright (C) 2011,2016 Red Hat, Inc. # # Authors: # Thomas Woerner <twoerner@redhat.com> # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see <http://www.gnu.org/licenses/>. # DBUS_INTERFACE_VERSION = 1 DBUS_INTERFACE_REVISION = 15 DBUS_INTERFACE = "org.fedoraproject.FirewallD%d" % DBUS_INTERFACE_VERSION DBUS_INTERFACE_ZONE = DBUS_INTERFACE+".zone" DBUS_INTERFACE_POLICY = DBUS_INTERFACE+".policy" DBUS_INTERFACE_DIRECT = DBUS_INTERFACE+".direct" DBUS_INTERFACE_POLICIES = DBUS_INTERFACE+".policies" DBUS_INTERFACE_IPSET = DBUS_INTERFACE+".ipset" DBUS_INTERFACE_CONFIG = DBUS_INTERFACE+".config" DBUS_INTERFACE_CONFIG_ZONE = DBUS_INTERFACE_CONFIG+".zone" DBUS_INTERFACE_CONFIG_POLICY = DBUS_INTERFACE_CONFIG+".policy" DBUS_INTERFACE_CONFIG_SERVICE = DBUS_INTERFACE_CONFIG+".service" DBUS_INTERFACE_CONFIG_ICMPTYPE = DBUS_INTERFACE_CONFIG+".icmptype" DBUS_INTERFACE_CONFIG_POLICIES = DBUS_INTERFACE_CONFIG+".policies" DBUS_INTERFACE_CONFIG_DIRECT = DBUS_INTERFACE_CONFIG+".direct" DBUS_INTERFACE_CONFIG_IPSET = DBUS_INTERFACE_CONFIG+".ipset" DBUS_INTERFACE_CONFIG_HELPER = DBUS_INTERFACE_CONFIG+".helper" DBUS_PATH = "/org/fedoraproject/FirewallD%d" % DBUS_INTERFACE_VERSION DBUS_PATH_CONFIG = DBUS_PATH+"/config" DBUS_PATH_CONFIG_ICMPTYPE = DBUS_PATH+"/config/icmptype" DBUS_PATH_CONFIG_SERVICE = DBUS_PATH+"/config/service" DBUS_PATH_CONFIG_ZONE = DBUS_PATH+"/config/zone" DBUS_PATH_CONFIG_POLICY = DBUS_PATH+"/config/policy" DBUS_PATH_CONFIG_IPSET = DBUS_PATH+"/config/ipset" DBUS_PATH_CONFIG_HELPER = DBUS_PATH+"/config/helper" # Polkit actions _PK_ACTION = "org.fedoraproject.FirewallD%d" % DBUS_INTERFACE_VERSION PK_ACTION_POLICIES = _PK_ACTION+".policies" PK_ACTION_POLICIES_INFO = PK_ACTION_POLICIES+".info" PK_ACTION_CONFIG = _PK_ACTION+".config" PK_ACTION_CONFIG_INFO = PK_ACTION_CONFIG+".info" PK_ACTION_DIRECT = _PK_ACTION+".direct" PK_ACTION_DIRECT_INFO = PK_ACTION_DIRECT+".info" PK_ACTION_INFO = _PK_ACTION+".info" PK_ACTION_ALL = _PK_ACTION+".all" # implies all other actions PK ���Z`PR�� � config/__init__.pynu �[��� # -*- coding: utf-8 -*- # # Copyright (C) 2007-2016 Red Hat, Inc. # Authors: # Thomas Woerner <twoerner@redhat.com> # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see <http://www.gnu.org/licenses/>. # # translation import locale try: locale.setlocale(locale.LC_ALL, "") except locale.Error: import os os.environ['LC_ALL'] = 'C' locale.setlocale(locale.LC_ALL, "") DOMAIN = 'firewalld' import gettext gettext.install(domain=DOMAIN) from . import dbus # noqa: F401 # configuration DAEMON_NAME = 'firewalld' CONFIG_NAME = 'firewall-config' APPLET_NAME = 'firewall-applet' DATADIR = '/usr/share/' + DAEMON_NAME CONFIG_GLADE_NAME = CONFIG_NAME + '.glade' COPYRIGHT = '(C) 2010-2017 Red Hat, Inc.' VERSION = '1.1.1' AUTHORS = [ "Thomas Woerner <twoerner@redhat.com>", "Jiri Popelka <jpopelka@redhat.com>", "Eric Garver <e@erig.me>", ] LICENSE = gettext.gettext( "This program is free software; you can redistribute it and/or modify " "it under the terms of the GNU General Public License as published by " "the Free Software Foundation; either version 2 of the License, or " "(at your option) any later version.\n" "\n" "This program is distributed in the hope that it will be useful, " "but WITHOUT ANY WARRANTY; without even the implied warranty of " "MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the " "GNU General Public License for more details.\n" "\n" "You should have received a copy of the GNU General Public License " "along with this program. If not, see <http://www.gnu.org/licenses/>.") WEBSITE = 'http://www.firewalld.org' def set_system_config_paths(path): global ETC_FIREWALLD, FIREWALLD_CONF, ETC_FIREWALLD_ZONES, \ ETC_FIREWALLD_SERVICES, ETC_FIREWALLD_ICMPTYPES, \ ETC_FIREWALLD_IPSETS, ETC_FIREWALLD_HELPERS, \ FIREWALLD_DIRECT, LOCKDOWN_WHITELIST, ETC_FIREWALLD_POLICIES ETC_FIREWALLD = path FIREWALLD_CONF = path + '/firewalld.conf' ETC_FIREWALLD_ZONES = path + '/zones' ETC_FIREWALLD_SERVICES = path + '/services' ETC_FIREWALLD_ICMPTYPES = path + '/icmptypes' ETC_FIREWALLD_IPSETS = path + '/ipsets' ETC_FIREWALLD_HELPERS = path + '/helpers' ETC_FIREWALLD_POLICIES = path + '/policies' FIREWALLD_DIRECT = path + '/direct.xml' LOCKDOWN_WHITELIST = path + '/lockdown-whitelist.xml' set_system_config_paths('/etc/firewalld') def set_default_config_paths(path): global USR_LIB_FIREWALLD, FIREWALLD_ZONES, FIREWALLD_SERVICES, \ FIREWALLD_ICMPTYPES, FIREWALLD_IPSETS, FIREWALLD_HELPERS, \ FIREWALLD_POLICIES USR_LIB_FIREWALLD = path FIREWALLD_ZONES = path + '/zones' FIREWALLD_SERVICES = path + '/services' FIREWALLD_ICMPTYPES = path + '/icmptypes' FIREWALLD_IPSETS = path + '/ipsets' FIREWALLD_HELPERS = path + '/helpers' FIREWALLD_POLICIES = path + '/policies' set_default_config_paths('/usr/lib/firewalld') FIREWALLD_LOGFILE = '/var/log/firewalld' FIREWALLD_PIDFILE = "/var/run/firewalld.pid" FIREWALLD_TEMPDIR = '/run/firewalld' SYSCONFIGDIR = '/etc/sysconfig' IFCFGDIR = "/etc/sysconfig/network-scripts" SYSCTL_CONFIG = '/etc/sysctl.conf' # commands used by backends COMMANDS = { "ipv4": "/usr/sbin/iptables", "ipv4-restore": "/usr/sbin/iptables-restore", "ipv6": "/usr/sbin/ip6tables", "ipv6-restore": "/usr/sbin/ip6tables-restore", "eb": "/usr/sbin/ebtables", "eb-restore": "/usr/sbin/ebtables-restore", "ipset": "/usr/sbin/ipset", "modprobe": "/sbin/modprobe", "rmmod": "/sbin/rmmod", } LOG_DENIED_VALUES = [ "all", "unicast", "broadcast", "multicast", "off" ] AUTOMATIC_HELPERS_VALUES = [ "yes", "no", "system" ] FIREWALL_BACKEND_VALUES = [ "nftables", "iptables" ] # fallbacks: will be overloaded by firewalld.conf FALLBACK_ZONE = "public" FALLBACK_MINIMAL_MARK = 100 FALLBACK_CLEANUP_ON_EXIT = True FALLBACK_CLEANUP_MODULES_ON_EXIT = False FALLBACK_LOCKDOWN = False FALLBACK_IPV6_RPFILTER = True FALLBACK_INDIVIDUAL_CALLS = False FALLBACK_LOG_DENIED = "off" FALLBACK_AUTOMATIC_HELPERS = "no" FALLBACK_FIREWALL_BACKEND = "nftables" FALLBACK_FLUSH_ALL_ON_RELOAD = True FALLBACK_RFC3964_IPV4 = True FALLBACK_ALLOW_ZONE_DRIFTING = False PK ���Z���P�^ �^ command.pynu �[��� # -*- coding: utf-8 -*- # # Copyright (C) 2011-2016 Red Hat, Inc. # # Authors: # Thomas Woerner <twoerner@redhat.com> # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see <http://www.gnu.org/licenses/>. # """FirewallCommand class for command line client simplification""" __all__ = [ "FirewallCommand" ] import sys from firewall import errors from firewall.errors import FirewallError from dbus.exceptions import DBusException from firewall.functions import checkIPnMask, checkIP6nMask, check_mac, \ check_port, check_single_address class FirewallCommand(object): def __init__(self, quiet=False, verbose=False): self.quiet = quiet self.verbose = verbose self.__use_exception_handler = True self.fw = None def set_fw(self, fw): self.fw = fw def set_quiet(self, flag): self.quiet = flag def get_quiet(self): return self.quiet def set_verbose(self, flag): self.verbose = flag def get_verbose(self): return self.verbose def print_msg(self, msg=None): if msg is not None and not self.quiet: sys.stdout.write(msg + "\n") def print_error_msg(self, msg=None): if msg is not None and not self.quiet: sys.stderr.write(msg + "\n") def print_warning(self, msg=None): FAIL = '\033[91m' END = '\033[00m' if sys.stderr.isatty(): msg = FAIL + msg + END self.print_error_msg(msg) def print_and_exit(self, msg=None, exit_code=0): #OK = '\033[92m' #END = '\033[00m' if exit_code > 1: self.print_warning(msg) else: #if sys.stdout.isatty(): # msg = OK + msg + END self.print_msg(msg) sys.exit(exit_code) def fail(self, msg=None): self.print_and_exit(msg, 2) def print_if_verbose(self, msg=None): if msg is not None and self.verbose: sys.stdout.write(msg + "\n") def __cmd_sequence(self, cmd_type, option, action_method, query_method, # pylint: disable=W0613, R0913, R0914 parse_method, message, start_args=None, end_args=None, # pylint: disable=W0613 no_exit=False): if self.fw is not None: self.fw.authorizeAll() items = [ ] _errors = 0 _error_codes = [ ] for item in option: if parse_method is not None: try: item = parse_method(item) except Exception as msg: code = FirewallError.get_code(str(msg)) if len(option) > 1: self.print_warning("Warning: %s" % msg) else: self.print_and_exit("Error: %s" % msg, code) if code not in _error_codes: _error_codes.append(code) _errors += 1 continue items.append(item) for item in items: call_item = [ ] if start_args is not None: call_item += start_args if not isinstance(item, list) and not isinstance(item, tuple): call_item.append(item) else: call_item += item if end_args is not None: call_item += end_args self.deactivate_exception_handler() try: action_method(*call_item) except (DBusException, Exception) as msg: if isinstance(msg, DBusException): self.fail_if_not_authorized(msg.get_dbus_name()) msg = msg.get_dbus_message() else: msg = str(msg) code = FirewallError.get_code(msg) if code in [ errors.ALREADY_ENABLED, errors.NOT_ENABLED, errors.ZONE_ALREADY_SET, errors.ALREADY_SET ]: code = 0 if len(option) > 1: self.print_warning("Warning: %s" % msg) elif code == 0: self.print_warning("Warning: %s" % msg) return else: self.print_and_exit("Error: %s" % msg, code) if code not in _error_codes: _error_codes.append(code) _errors += 1 self.activate_exception_handler() if not no_exit: if len(option) > _errors or 0 in _error_codes: # There have been more options than errors or there # was at least one error code 0, return. return elif len(_error_codes) == 1: # Exactly one error code, use it. sys.exit(_error_codes[0]) elif len(_error_codes) > 1: # There is more than error, exit using # UNKNOWN_ERROR. This could happen within sequences # where parsing failed with different errors like # INVALID_PORT and INVALID_PROTOCOL. sys.exit(errors.UNKNOWN_ERROR) def add_sequence(self, option, action_method, query_method, parse_method, # pylint: disable=R0913 message, no_exit=False): self.__cmd_sequence("add", option, action_method, query_method, parse_method, message, no_exit=no_exit) def x_add_sequence(self, x, option, action_method, query_method, # pylint: disable=R0913 parse_method, message, no_exit=False): self.__cmd_sequence("add", option, action_method, query_method, parse_method, message, start_args=[x], no_exit=no_exit) def zone_add_timeout_sequence(self, zone, option, action_method, # pylint: disable=R0913 query_method, parse_method, message, timeout, no_exit=False): self.__cmd_sequence("add", option, action_method, query_method, parse_method, message, start_args=[zone], end_args=[timeout], no_exit=no_exit) def remove_sequence(self, option, action_method, query_method, # pylint: disable=R0913 parse_method, message, no_exit=False): self.__cmd_sequence("remove", option, action_method, query_method, parse_method, message, no_exit=no_exit) def x_remove_sequence(self, x, option, action_method, query_method, # pylint: disable=R0913 parse_method, message, no_exit=False): self.__cmd_sequence("remove", option, action_method, query_method, parse_method, message, start_args=[x], no_exit=no_exit) def __query_sequence(self, option, query_method, parse_method, message, # pylint: disable=R0913 start_args=None, no_exit=False): items = [ ] for item in option: if parse_method is not None: try: item = parse_method(item) except Exception as msg: if len(option) > 1: self.print_warning("Warning: %s" % msg) continue else: code = FirewallError.get_code(str(msg)) self.print_and_exit("Error: %s" % msg, code) items.append(item) for item in items: call_item = [ ] if start_args is not None: call_item += start_args if not isinstance(item, list) and not isinstance(item, tuple): call_item.append(item) else: call_item += item self.deactivate_exception_handler() try: res = query_method(*call_item) except DBusException as msg: self.fail_if_not_authorized(msg.get_dbus_name()) code = FirewallError.get_code(msg.get_dbus_message()) if len(option) > 1: self.print_warning("Warning: %s" % msg.get_dbus_message()) continue else: self.print_and_exit("Error: %s" % msg.get_dbus_message(), code) except Exception as msg: code = FirewallError.get_code(str(msg)) if len(option) > 1: self.print_warning("Warning: %s" % msg) else: self.print_and_exit("Error: %s" % msg, code) self.activate_exception_handler() if len(option) > 1: self.print_msg("%s: %s" % (message % item, ("no", "yes")[res])) else: self.print_query_result(res) if not no_exit: sys.exit(0) def query_sequence(self, option, query_method, parse_method, message, # pylint: disable=R0913 no_exit=False): self.__query_sequence(option, query_method, parse_method, message, no_exit=no_exit) def x_query_sequence(self, x, option, query_method, parse_method, # pylint: disable=R0913 message, no_exit=False): self.__query_sequence(option, query_method, parse_method, message, start_args=[x], no_exit=no_exit) def parse_source(self, value): if not checkIPnMask(value) and not checkIP6nMask(value) \ and not check_mac(value) and not \ (value.startswith("ipset:") and len(value) > 6): raise FirewallError(errors.INVALID_ADDR, "'%s' is no valid IPv4, IPv6 or MAC address, nor an ipset" % value) return value def parse_port(self, value, separator="/"): try: (port, proto) = value.split(separator) except ValueError: raise FirewallError(errors.INVALID_PORT, "bad port (most likely " "missing protocol), correct syntax is " "portid[-portid]%sprotocol" % separator) if not check_port(port): raise FirewallError(errors.INVALID_PORT, port) if proto not in [ "tcp", "udp", "sctp", "dccp" ]: raise FirewallError(errors.INVALID_PROTOCOL, "'%s' not in {'tcp'|'udp'|'sctp'|'dccp'}" % \ proto) return (port, proto) def parse_forward_port(self, value, compat=False): port = None protocol = None toport = None toaddr = None i = 0 while ("=" in value[i:]): opt = value[i:].split("=", 1)[0] i += len(opt) + 1 if "=" in value[i:]: val = value[i:].split(":", 1)[0] else: val = value[i:] i += len(val) + 1 if opt == "port": port = val elif opt == "proto": protocol = val elif opt == "toport": toport = val elif opt == "toaddr": toaddr = val elif opt == "if" and compat: # ignore if option in compat mode pass else: raise FirewallError(errors.INVALID_FORWARD, "invalid forward port arg '%s'" % (opt)) if not port: raise FirewallError(errors.INVALID_FORWARD, "missing port") if not protocol: raise FirewallError(errors.INVALID_FORWARD, "missing protocol") if not (toport or toaddr): raise FirewallError(errors.INVALID_FORWARD, "missing destination") if not check_port(port): raise FirewallError(errors.INVALID_PORT, port) if protocol not in [ "tcp", "udp", "sctp", "dccp" ]: raise FirewallError(errors.INVALID_PROTOCOL, "'%s' not in {'tcp'|'udp'|'sctp'|'dccp'}" % \ protocol) if toport and not check_port(toport): raise FirewallError(errors.INVALID_PORT, toport) if toaddr and not check_single_address("ipv4", toaddr): if compat or not check_single_address("ipv6", toaddr): raise FirewallError(errors.INVALID_ADDR, toaddr) return (port, protocol, toport, toaddr) def parse_ipset_option(self, value): args = value.split("=") if len(args) == 1: return (args[0], "") elif len(args) == 2: return args else: raise FirewallError(errors.INVALID_OPTION, "invalid ipset option '%s'" % (value)) def check_destination_ipv(self, value): ipvs = [ "ipv4", "ipv6", ] if value not in ipvs: raise FirewallError(errors.INVALID_IPV, "invalid argument: %s (choose from '%s')" % \ (value, "', '".join(ipvs))) return value def parse_service_destination(self, value): try: (ipv, destination) = value.split(":", 1) except ValueError: raise FirewallError(errors.INVALID_DESTINATION, "destination syntax is ipv:address[/mask]") return (self.check_destination_ipv(ipv), destination) def check_ipv(self, value): ipvs = [ "ipv4", "ipv6", "eb" ] if value not in ipvs: raise FirewallError(errors.INVALID_IPV, "invalid argument: %s (choose from '%s')" % \ (value, "', '".join(ipvs))) return value def check_helper_family(self, value): ipvs = [ "", "ipv4", "ipv6" ] if value not in ipvs: raise FirewallError(errors.INVALID_IPV, "invalid argument: %s (choose from '%s')" % \ (value, "', '".join(ipvs))) return value def check_module(self, value): if not value.startswith("nf_conntrack_"): raise FirewallError( errors.INVALID_MODULE, "'%s' does not start with 'nf_conntrack_'" % value) if len(value.replace("nf_conntrack_", "")) < 1: raise FirewallError(errors.INVALID_MODULE, "Module name '%s' too short" % value) return value def print_zone_policy_info(self, zone, settings, default_zone=None, extra_interfaces=[], isPolicy=True): # pylint: disable=R0914 target = settings.getTarget() services = settings.getServices() ports = settings.getPorts() protocols = settings.getProtocols() masquerade = settings.getMasquerade() forward_ports = settings.getForwardPorts() source_ports = settings.getSourcePorts() icmp_blocks = settings.getIcmpBlocks() rules = settings.getRichRules() description = settings.getDescription() short_description = settings.getShort() if isPolicy: ingress_zones = settings.getIngressZones() egress_zones = settings.getEgressZones() priority = settings.getPriority() else: icmp_block_inversion = settings.getIcmpBlockInversion() interfaces = sorted(set(settings.getInterfaces() + extra_interfaces)) sources = settings.getSources() forward = settings.getForward() def rich_rule_sorted_key(rule): priority = 0 search_str = "priority=" try: i = rule.index(search_str) except ValueError: pass else: i += len(search_str) priority = int(rule[i:i+(rule[i:].index(" "))].replace("\"", "")) return priority attributes = [] if default_zone is not None: if zone == default_zone: attributes.append("default") if (not isPolicy and (interfaces or sources)) or \ ( isPolicy and ingress_zones and egress_zones): attributes.append("active") if attributes: zone = zone + " (%s)" % ", ".join(attributes) self.print_msg(zone) if self.verbose: self.print_msg(" summary: " + short_description) self.print_msg(" description: " + description) if isPolicy: self.print_msg(" priority: " + str(priority)) self.print_msg(" target: " + target) if not isPolicy: self.print_msg(" icmp-block-inversion: %s" % \ ("yes" if icmp_block_inversion else "no")) if isPolicy: self.print_msg(" ingress-zones: " + " ".join(ingress_zones)) self.print_msg(" egress-zones: " + " ".join(egress_zones)) else: self.print_msg(" interfaces: " + " ".join(interfaces)) self.print_msg(" sources: " + " ".join(sources)) self.print_msg(" services: " + " ".join(sorted(services))) self.print_msg(" ports: " + " ".join(["%s/%s" % (port[0], port[1]) for port in ports])) self.print_msg(" protocols: " + " ".join(sorted(protocols))) if not isPolicy: self.print_msg(" forward: %s" % ("yes" if forward else "no")) self.print_msg(" masquerade: %s" % ("yes" if masquerade else "no")) self.print_msg(" forward-ports: " + ("\n\t" if forward_ports else "") + "\n\t".join(["port=%s:proto=%s:toport=%s:toaddr=%s" % \ (port, proto, toport, toaddr) for (port, proto, toport, toaddr) in \ forward_ports])) self.print_msg(" source-ports: " + " ".join(["%s/%s" % (port[0], port[1]) for port in source_ports])) self.print_msg(" icmp-blocks: " + " ".join(icmp_blocks)) self.print_msg(" rich rules: " + ("\n\t" if rules else "") + "\n\t".join(sorted(rules, key=rich_rule_sorted_key))) def print_zone_info(self, zone, settings, default_zone=None, extra_interfaces=[]): self.print_zone_policy_info(zone, settings, default_zone=default_zone, extra_interfaces=extra_interfaces, isPolicy=False) def print_policy_info(self, policy, settings, default_zone=None, extra_interfaces=[]): self.print_zone_policy_info(policy, settings, default_zone=default_zone, extra_interfaces=extra_interfaces, isPolicy=True) def print_service_info(self, service, settings): ports = settings.getPorts() protocols = settings.getProtocols() source_ports = settings.getSourcePorts() modules = settings.getModules() description = settings.getDescription() destinations = settings.getDestinations() short_description = settings.getShort() includes = settings.getIncludes() helpers = settings.getHelpers() self.print_msg(service) if self.verbose: self.print_msg(" summary: " + short_description) self.print_msg(" description: " + description) self.print_msg(" ports: " + " ".join(["%s/%s" % (port[0], port[1]) for port in ports])) self.print_msg(" protocols: " + " ".join(protocols)) self.print_msg(" source-ports: " + " ".join(["%s/%s" % (port[0], port[1]) for port in source_ports])) self.print_msg(" modules: " + " ".join(modules)) self.print_msg(" destination: " + " ".join(["%s:%s" % (k, v) for k, v in destinations.items()])) self.print_msg(" includes: " + " ".join(sorted(includes))) self.print_msg(" helpers: " + " ".join(sorted(helpers))) def print_icmptype_info(self, icmptype, settings): destinations = settings.getDestinations() description = settings.getDescription() short_description = settings.getShort() if len(destinations) == 0: destinations = [ "ipv4", "ipv6" ] self.print_msg(icmptype) if self.verbose: self.print_msg(" summary: " + short_description) self.print_msg(" description: " + description) self.print_msg(" destination: " + " ".join(destinations)) def print_ipset_info(self, ipset, settings): ipset_type = settings.getType() options = settings.getOptions() entries = settings.getEntries() description = settings.getDescription() short_description = settings.getShort() self.print_msg(ipset) if self.verbose: self.print_msg(" summary: " + short_description) self.print_msg(" description: " + description) self.print_msg(" type: " + ipset_type) self.print_msg(" options: " + " ".join(["%s=%s" % (k, v) if v else k for k, v in options.items()])) self.print_msg(" entries: " + " ".join(entries)) def print_helper_info(self, helper, settings): ports = settings.getPorts() module = settings.getModule() family = settings.getFamily() description = settings.getDescription() short_description = settings.getShort() self.print_msg(helper) if self.verbose: self.print_msg(" summary: " + short_description) self.print_msg(" description: " + description) self.print_msg(" family: " + family) self.print_msg(" module: " + module) self.print_msg(" ports: " + " ".join(["%s/%s" % (port[0], port[1]) for port in ports])) def print_query_result(self, value): if value: self.print_and_exit("yes") else: self.print_and_exit("no", 1) def exception_handler(self, exception_message): if not self.__use_exception_handler: raise self.fail_if_not_authorized(exception_message) code = FirewallError.get_code(str(exception_message)) if code in [ errors.ALREADY_ENABLED, errors.NOT_ENABLED, errors.ZONE_ALREADY_SET, errors.ALREADY_SET ]: self.print_warning("Warning: %s" % exception_message) else: self.print_and_exit("Error: %s" % exception_message, code) def fail_if_not_authorized(self, exception_message): if "NotAuthorizedException" in exception_message: msg = """Authorization failed. Make sure polkit agent is running or run the application as superuser.""" self.print_and_exit(msg, errors.NOT_AUTHORIZED) def deactivate_exception_handler(self): self.__use_exception_handler = False def activate_exception_handler(self): self.__use_exception_handler = True def get_ipset_entries_from_file(self, filename): entries = [ ] entries_set = set() f = open(filename) for line in f: if not line: break line = line.strip() if len(line) < 1 or line[0] in ['#', ';']: continue if line not in entries_set: entries.append(line) entries_set.add(line) f.close() return entries PK ���Z�6 �� � fw_types.pynu �[��� # -*- coding: utf-8 -*- # # Copyright (C) 2013-2016 Red Hat, Inc. # # Authors: # Thomas Woerner <twoerner@redhat.com> # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see <http://www.gnu.org/licenses/>. # __all__ = [ "LastUpdatedOrderedDict" ] class LastUpdatedOrderedDict(object): def __init__(self, x=None): self._dict = { } self._list = [ ] if x: self.update(x) def clear(self): del self._list[:] self._dict.clear() def update(self, x): for key,value in x.items(): self[key] = value def items(self): return [(key, self[key]) for key in self._list] def __delitem__(self, key): if key in self._dict: self._list.remove(key) del self._dict[key] def __repr__(self): return '%s([%s])' % (self.__class__.__name__, ', '.join( ['(%r, %r)' % (key, self[key]) for key in self._list])) def __setitem__(self, key, value): if key not in self._dict: self._list.append(key) self._dict[key] = value def __getitem__(self, key): if type(key) == int: return self._list[key] else: return self._dict[key] def __len__(self): return len(self._list) def copy(self): return LastUpdatedOrderedDict(self) def keys(self): return self._list[:] def values(self): return [ self[key] for key in self._list ] def setdefault(self, key, value=None): if key in self: return self[key] else: self[key] = value return value PK ���Z�f�� � $ __pycache__/__init__.cpython-310.pycnu �[��� o bhAb � @ s d S )N� r r r �3/usr/lib/python3/dist-packages/firewall/__init__.py�<module> s PK ���Z����� �� " __pycache__/client.cpython-310.pycnu �[��� o bhAb�� � @ s� d dl mZ d dlZd dlZd dlmZ d dlmZm Z m Z d dl m Z d dl mZ d dlmZmZmZ d dlmZ d d lmZ d dlZd dlZdad ad d � ZG d d� de�ZG dd� de�Z G dd� de�Z G dd� de�Z G dd� de�Z G dd� de�Z G dd� de�Z!G dd � d e�Z"G d d � d e�Z#G d d � d e�Z$G d!d"� d"e�Z%G d#d$� d$e�Z&G d%d&� d&e�Z'G d'd(� d(e�Z(G d)d*� d*e�Z)G d+d,� d,e�Z*G d-d.� d.e�Z+G d/d0� d0e�Z,dS )1� )�GLibN)�config)�DEFAULT_ZONE_TARGET�DEFAULT_POLICY_TARGET�DEFAULT_POLICY_PRIORITY��dbus_to_python)� Rich_Rule)�normalize_ipset_entry� check_entry_overlaps_existing� check_for_overlapping_entries)�errors)� FirewallErrorFc s t �� �� fdd��}|S )z#Decorator to handle exceptions c s d}|s�z� | i |��W S t jjyL } z2|�� }|�� }ts!� d|v r*td� nd|v r3t|� nd}|r<t|� ntt|�� W Y d }~n0d }~w tyf } ztsV� tt|�� W Y d }~nd }~w tyw tso� tt � � � Y nw t s|d S |rd S d S )NF�NotAuthorizedExceptionzorg.freedesktop.DBus.ErrorT) �dbus� exceptions� DBusException�get_dbus_message� get_dbus_name�exception_handler�strr � Exception� traceback� format_exc�not_authorized_loop)�args�kwargs� authorized�e� dbus_message� dbus_name��func� �1/usr/lib/python3/dist-packages/firewall/client.py�_impl- s> �� � �z handle_exceptions.<locals>._impl)� functools�wraps)r" r% r# r! r$ �handle_exceptions* s !r( c @ s� e Zd Zed�dd��Zedd� �Zedd� �Zedd � �Zed d � �Zed d � �Z edd� �Z edd� �Z edd� �Z edd� �Z edd� �Zedd� �Zedd� �Zed d � �Zed d � �Zed d!� �Zed"d#� �Zed$d%� �Zed&d'� �Zed(d)� �Zed*d+� �Zed,d-� �Zed.d/� �Zed0d1� �Zed2d3� �Z ed4d5� �Z ed6d7� �Z ed8d9� �Z ed:d;� �Z ed<d=� �Z!ed>d?� �Z"ed@dA� �Z#edBdC� �Z$edDdE� �Z%edFdG� �Z&edHdI� �Z'edJdK� �Z(edLdM� �Z)edNdO� �Z*edPdQ� �Z+edRdS� �Z,edTdU� �Z-edVdW� �Z.edXdY� �Z/edZd[� �Z0ed\d]� �Z1ed^d_� �Z2ed`da� �Z3edbdc� �Z4eddde� �Z5edfdg� �Z6edhdi� �Z7edjdk� �Z8edldm� �Z9edndo� �Z:edpdq� �Z;edrds� �Z<edtdu� �Z=edvdw� �Z>edxdy� �Z?edzd{� �Z@ed|d}� �ZAed~d� �ZBed�d�� �ZCed�d�� �ZDed�d�� �ZEed�d�� �ZFed�d�� �ZGed�d�� �ZHed�d�� �ZIed�d�� �ZJed�d�� �ZKed�d�� �ZLed�d�� �ZMed�d�� �ZNdS )��FirewallClientZoneSettingsNc C s� ddddt g g g dg g g g g g ddg| _g d�| _g d�| _|rAt|t�r5t|�D ] \}}|| | j|< q)t|t�rC| �|� d S d S d S )N� F)�version�short� description�UNUSED�target�services�ports� icmp_blocks� masquerade� forward_ports� interfaces�sources� rules_str� protocols� source_ports�icmp_block_inversion�forward)�sr< r< �br< r< �(ss)r< r= �(ssss)r< r< r< r< r> r= r= ) r �settings� settings_name�settings_dbus_type� isinstance�list� enumerate�dict�setSettingsDict��selfr@ �i�vr# r# r$ �__init__T s � �z#FirewallClientZoneSettings.__init__c C � d| j | jf S �Nz%s(%r)�� __class__r@ �rI r# r# r$ �__repr__k � z#FirewallClientZoneSettings.__repr__c C s2 i }t | j| j�D ] \}}|dkrq |||< q |S )Nr. ��ziprA r@ �rI r@ �key�valuer# r# r$ �getSettingsDicto s z*FirewallClientZoneSettings.getSettingsDictc C �$ |D ] }|| | j | j�|�< qd S �N�r@ rA �index�rI r@ rW r# r# r$ rG w � �z*FirewallClientZoneSettings.setSettingsDictc C sx i }t | j| j| j�D ].\}}}|dkrq t|�tu r%tj||d�||< q t|�tu r5tj ||d�||< q |||< q |S )Nr. �� signature� rU rA r@ rB �typerD r �ArrayrF � Dictionary�rI r@ rW rX �sigr# r# r$ �getSettingsDbusDict{ s z.FirewallClientZoneSettings.getSettingsDbusDictc C �$ | � � }|d= |d= |d= |d= |S �Nr+ r, r- r/ )rY �rI r@ r# r# r$ �getRuntimeSettingsDict� � z1FirewallClientZoneSettings.getRuntimeSettingsDictc C ri rj �rh rk r# r# r$ �getRuntimeSettingsDbusDict� rm z5FirewallClientZoneSettings.getRuntimeSettingsDbusDictc C � | j d S �Nr �r@ rQ r# r# r$ � getVersion� � z%FirewallClientZoneSettings.getVersionc C � || j d< d S rq rr �rI r+ r# r# r$ � setVersion� � z%FirewallClientZoneSettings.setVersionc C rp �N� rr rQ r# r# r$ �getShort� rt z#FirewallClientZoneSettings.getShortc C ru ry rr �rI r, r# r# r$ �setShort� rx z#FirewallClientZoneSettings.setShortc C rp �N� rr rQ r# r# r$ �getDescription� rt z)FirewallClientZoneSettings.getDescriptionc C ru r~ rr �rI r- r# r# r$ �setDescription� rx z)FirewallClientZoneSettings.setDescriptionc C s | j d tkr | j d S dS )N� �default)r@ r rQ r# r# r$ � getTarget� � z$FirewallClientZoneSettings.getTargetc C s |dkr|nt | jd< d S )Nr� r� )r r@ �rI r/ r# r# r$ � setTarget� � z$FirewallClientZoneSettings.setTargetc C rp �N� rr rQ r# r# r$ � getServices� rt z&FirewallClientZoneSettings.getServicesc C ru r� rr �rI r0 r# r# r$ � setServices� rx z&FirewallClientZoneSettings.setServicesc C �. || j d vr| j d �|� d S ttj|��r� �r@ �appendr r �ALREADY_ENABLED�rI �servicer# r# r$ � addService� � z%FirewallClientZoneSettings.addServicec C �. || j d v r| j d �|� d S ttj|��r� �r@ �remover r � NOT_ENABLEDr� r# r# r$ � removeService� r� z(FirewallClientZoneSettings.removeServicec C � || j d v S r� rr r� r# r# r$ � queryService� rx z'FirewallClientZoneSettings.queryServicec C rp �N� rr rQ r# r# r$ �getPorts� rt z#FirewallClientZoneSettings.getPortsc C ru r� rr �rI r1 r# r# r$ �setPorts� rx z#FirewallClientZoneSettings.setPortsc C �> ||f| j d vr| j d �||f� d S ttjd||f ���Nr� �'%s:%s'r� �rI �port�protocolr# r# r$ �addPort� � �z"FirewallClientZoneSettings.addPortc C �> ||f| j d v r| j d �||f� d S ttjd||f ��r� r� r� r# r# r$ � removePort� r� z%FirewallClientZoneSettings.removePortc C � ||f| j d v S r� rr r� r# r# r$ � queryPort� � z$FirewallClientZoneSettings.queryPortc C rp �N� rr rQ r# r# r$ � getProtocols� rt z'FirewallClientZoneSettings.getProtocolsc C ru r� rr �rI r8 r# r# r$ � setProtocols� rx z'FirewallClientZoneSettings.setProtocolsc C r� r� r� �rI r� r# r# r$ � addProtocol� r� z&FirewallClientZoneSettings.addProtocolc C r� r� r� r� r# r# r$ �removeProtocol� r� z)FirewallClientZoneSettings.removeProtocolc C r� r� rr r� r# r# r$ � queryProtocol� rx z(FirewallClientZoneSettings.queryProtocolc C rp �N� rr rQ r# r# r$ �getSourcePorts� rt z)FirewallClientZoneSettings.getSourcePortsc C ru r� rr r� r# r# r$ �setSourcePorts rx z)FirewallClientZoneSettings.setSourcePortsc C r� �Nr� r� r� r� r# r# r$ � addSourcePort r� z(FirewallClientZoneSettings.addSourcePortc C r� r� r� r� r# r# r$ �removeSourcePort r� z+FirewallClientZoneSettings.removeSourcePortc C r� r� rr r� r# r# r$ �querySourcePort r� z*FirewallClientZoneSettings.querySourcePortc C rp �N� rr rQ r# r# r$ � getIcmpBlocks rt z(FirewallClientZoneSettings.getIcmpBlocksc C ru r� rr �rI � icmpblocksr# r# r$ � setIcmpBlocks rx z(FirewallClientZoneSettings.setIcmpBlocksc C r� r� r� �rI �icmptyper# r# r$ � addIcmpBlock r� z'FirewallClientZoneSettings.addIcmpBlockc C r� r� r� r� r# r# r$ �removeIcmpBlock" r� z*FirewallClientZoneSettings.removeIcmpBlockc C r� r� rr r� r# r# r$ �queryIcmpBlock( rx z)FirewallClientZoneSettings.queryIcmpBlockc C rp �N� rr rQ r# r# r$ �getIcmpBlockInversion, rt z0FirewallClientZoneSettings.getIcmpBlockInversionc C ru r� rr )rI �flagr# r# r$ �setIcmpBlockInversion/ rx z0FirewallClientZoneSettings.setIcmpBlockInversionc C �( | j d s d| j d< d S ttjd� d S )Nr� T�icmp-block-inversion�r@ r r r� rQ r# r# r$ �addIcmpBlockInversion2 � z0FirewallClientZoneSettings.addIcmpBlockInversionc C �( | j d r d| j d< d S ttjd� d S )Nr� Fr� �r@ r r r� rQ r# r# r$ �removeIcmpBlockInversion8 r� z3FirewallClientZoneSettings.removeIcmpBlockInversionc C rp r� rr rQ r# r# r$ �queryIcmpBlockInversion> rt z2FirewallClientZoneSettings.queryIcmpBlockInversionc C rp �N� rr rQ r# r# r$ � getForwardB rt z%FirewallClientZoneSettings.getForwardc C ru r� rr �rI r; r# r# r$ � setForwardE rx z%FirewallClientZoneSettings.setForwardc C r� )Nr� Tr; r� rQ r# r# r$ � addForwardH r� z%FirewallClientZoneSettings.addForwardc C r� )Nr� Fr; r� rQ r# r# r$ � removeForwardN r� z(FirewallClientZoneSettings.removeForwardc C rp r� rr rQ r# r# r$ � queryForwardT rt z'FirewallClientZoneSettings.queryForwardc C rp �N� rr rQ r# r# r$ � getMasqueradeX rt z(FirewallClientZoneSettings.getMasqueradec C ru r� rr �rI r3 r# r# r$ � setMasquerade[ rx z(FirewallClientZoneSettings.setMasqueradec C r� )Nr� Tr3 r� rQ r# r# r$ � addMasquerade^ r� z(FirewallClientZoneSettings.addMasqueradec C r� )Nr� Fr3 r� rQ r# r# r$ �removeMasqueraded r� z+FirewallClientZoneSettings.removeMasqueradec C rp r� rr rQ r# r# r$ �queryMasqueradej rt z*FirewallClientZoneSettings.queryMasqueradec C rp �N� rr rQ r# r# r$ �getForwardPortsn rt z*FirewallClientZoneSettings.getForwardPortsc C ru r� rr r� r# r# r$ �setForwardPortsq rx z*FirewallClientZoneSettings.setForwardPortsc C �b |d u rd}|d u r d}||||f| j d vr%| j d �||||f� d S ttjd||||f ���Nr* r� � '%s:%s:%s:%s'r� �rI r� r� �to_port�to_addrr# r# r$ �addForwardPortt � �z)FirewallClientZoneSettings.addForwardPortc C �b |d u rd}|d u r d}||||f| j d v r%| j d �||||f� d S ttjd||||f ��r� r� r� r# r# r$ �removeForwardPort r� z,FirewallClientZoneSettings.removeForwardPortc C �. |d u rd}|d u r d}||||f| j d v S )Nr* r� rr r� r# r# r$ �queryForwardPort� � z+FirewallClientZoneSettings.queryForwardPortc C rp �N� rr rQ r# r# r$ � getInterfaces� rt z(FirewallClientZoneSettings.getInterfacesc C ru r� rr �rI r5 r# r# r$ � setInterfaces� rx z(FirewallClientZoneSettings.setInterfacesc C r� r� r� �rI � interfacer# r# r$ � addInterface� r� z'FirewallClientZoneSettings.addInterfacec C r� r� r� r r# r# r$ �removeInterface� r� z*FirewallClientZoneSettings.removeInterfacec C r� r� rr r r# r# r$ �queryInterface� rx z)FirewallClientZoneSettings.queryInterfacec C rp �N� rr rQ r# r# r$ � getSources� rt z%FirewallClientZoneSettings.getSourcesc C ru r rr �rI r6 r# r# r$ � setSources� rx z%FirewallClientZoneSettings.setSourcesc C r� r r� �rI �sourcer# r# r$ � addSource� r� z$FirewallClientZoneSettings.addSourcec C r� r r� r r# r# r$ � removeSource� r� z'FirewallClientZoneSettings.removeSourcec C r� r rr r r# r# r$ � querySource� rx z&FirewallClientZoneSettings.querySourcec C rp )N� rr rQ r# r# r$ � getRichRules� rt z'FirewallClientZoneSettings.getRichRulesc C � dd� |D �}|| j d< d S )Nc S � g | ] }t t|d ���qS ���rule_str�r r ��.0�rr# r# r$ � <listcomp>� � z;FirewallClientZoneSettings.setRichRules.<locals>.<listcomp>r rr �rI �rulesr# r# r$ � setRichRules� � z'FirewallClientZoneSettings.setRichRulesc C �< t t|d��}|| jd vr| jd �|� d S ttj|���Nr r �r r r@ r� r r r� �rI �ruler# r# r$ � addRichRule� � z&FirewallClientZoneSettings.addRichRulec C �< t t|d��}|| jd v r| jd �|� d S ttj|��r! �r r r@ r� r r r� r# r# r# r$ �removeRichRule� r& z)FirewallClientZoneSettings.removeRichRulec C � t t|d��}|| jd v S r! �r r r@ r# r# r# r$ � queryRichRule� r z(FirewallClientZoneSettings.queryRichRuler[ )O�__name__� __module__� __qualname__r( rL rR rY rG rh rl ro rs rw r{ r} r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r r r r r r r r r r r% r) r, r# r# r# r$ r) S s. r) c @ s� e Zd Zdd� Zedd� �Zedd� �Zedd� �Zed d � �Zed d � �Z ed d� �Z edd� �Z edd� �Z edd� �Z edd� �Zedd� �Zedd� �Zedd � �Zed d � �Zed d � �Zed!d"� �Zed#d$� �Zed%d&� �Zed'd(� �Zed)d*� �Zed+d,� �Zed-d.� �Zed/d0� �Zed1d2� �Z ed3d4� �Z ed5d6� �Z ed7d8� �Z ed9d:� �Z ed;d<� �Z!ed=d>� �Z"ed?d@� �Z#edAdB� �Z$edCdD� �Z%edEdF� �Z&edGdH� �Z'edIdJ� �Z(edKdL� �Z)edMdN� �Z*edOdP� �Z+edQdR� �Z,edSdT� �Z-edUdV� �Z.edWdX� �Z/edYdZ� �Z0ed[d\� �Z1ed]d^� �Z2ed_d`� �Z3edadb� �Z4edcdd� �Z5ededf� �Z6edgdh� �Z7edidj� �Z8edkdl� �Z9edmdn� �Z:edodp� �Z;edqdr� �Z<edsdt� �Z=edudv� �Z>edwdx� �Z?edydz� �Z@ed{d|� �ZAed}d~� �ZBedd�� �ZCed�d�� �ZDed�d�� �ZEed�d�� �ZFed�d�� �ZGed�d�� �ZHed�d�� �ZIed�d�� �ZJed�d�� �ZKed�d�� �ZLed�d�� �ZMed�d�� �ZNed�d�� �ZOed�d�� �ZPd�S )��FirewallClientConfigZonec C �L || _ || _| j �tjj|�| _tj| jtjjd�| _ tj| jdd�| _ d S �N��dbus_interface� org.freedesktop.DBus.Properties) �bus�path� get_objectr r �DBUS_INTERFACE�dbus_obj� Interface�DBUS_INTERFACE_CONFIG_ZONE�fw_zone� fw_properties�rI r6 r7 r# r# r$ rL � � � �z!FirewallClientConfigZone.__init__c C � t | j�tjj|��S r[ )r r> �Getr r r< �rI �propr# r# r$ � get_property� � �z%FirewallClientConfigZone.get_propertyc C � t | j�tjj��S r[ )r r> �GetAllr r r< rQ r# r# r$ �get_properties� � �z'FirewallClientConfigZone.get_propertiesc C � | j �tjj||� d S r[ )r> �Setr r r< �rI rD rX r# r# r$ � set_property� � �z%FirewallClientConfigZone.set_propertyc C � t t| j�� ��S r[ )r) r r= � getSettings2rQ r# r# r$ � getSettings� r� z$FirewallClientConfigZone.getSettingsc C � | j �|�� � d S r[ )r= �update2rh rk r# r# r$ �update� � z FirewallClientConfigZone.updatec C � | j �� d S r[ )r= � loadDefaultsrQ r# r# r$ rX � rx z%FirewallClientConfigZone.loadDefaultsc C rW r[ )r= r� rQ r# r# r$ r� rx z FirewallClientConfigZone.removec C � | j �|� d S r[ )r= �rename�rI �namer# r# r$ rZ rS z FirewallClientConfigZone.renamec C � | j �� S r[ )r= rs rQ r# r# r$ rs rt z#FirewallClientConfigZone.getVersionc C rY r[ )r= rw rv r# r# r$ rw rS z#FirewallClientConfigZone.setVersionc C r] r[ )r= r{ rQ r# r# r$ r{ rt z!FirewallClientConfigZone.getShortc C rY r[ )r= r} r| r# r# r$ r} rS z!FirewallClientConfigZone.setShortc C r] r[ )r= r� rQ r# r# r$ r� ! rt z'FirewallClientConfigZone.getDescriptionc C rY r[ )r= r� r� r# r# r$ r� % rS z'FirewallClientConfigZone.setDescriptionc C r] r[ )r= r� rQ r# r# r$ r� + rt z"FirewallClientConfigZone.getTargetc C rY r[ )r= r� r� r# r# r$ r� / rS z"FirewallClientConfigZone.setTargetc C r] r[ )r= r� rQ r# r# r$ r� 5 rt z$FirewallClientConfigZone.getServicesc C rY r[ )r= r� r� r# r# r$ r� 9 rS z$FirewallClientConfigZone.setServicesc C rY r[ )r= r� r� r# r# r$ r� = rS z#FirewallClientConfigZone.addServicec C rY r[ )r= r� r� r# r# r$ r� A rS z&FirewallClientConfigZone.removeServicec C � | j �|�S r[ )r= r� r� r# r# r$ r� E � z%FirewallClientConfigZone.queryServicec C r] r[ )r= r� rQ r# r# r$ r� K rt z!FirewallClientConfigZone.getPortsc C rY r[ )r= r� r� r# r# r$ r� O rS z!FirewallClientConfigZone.setPortsc C � | j �||� d S r[ )r= r� r� r# r# r$ r� S r� z FirewallClientConfigZone.addPortc C r` r[ )r= r� r� r# r# r$ r� W r� z#FirewallClientConfigZone.removePortc C � | j �||�S r[ )r= r� r� r# r# r$ r� [ rx z"FirewallClientConfigZone.queryPortc C r] r[ )r= r� rQ r# r# r$ r� a rt z%FirewallClientConfigZone.getProtocolsc C rY r[ )r= r� r� r# r# r$ r� e rS z%FirewallClientConfigZone.setProtocolsc C rY r[ )r= r� r� r# r# r$ r� i rS z$FirewallClientConfigZone.addProtocolc C rY r[ )r= r� r� r# r# r$ r� m rS z'FirewallClientConfigZone.removeProtocolc C r^ r[ )r= r� r� r# r# r$ r� q r_ z&FirewallClientConfigZone.queryProtocolc C r] r[ )r= r� rQ r# r# r$ r� w rt z'FirewallClientConfigZone.getSourcePortsc C rY r[ )r= r� r� r# r# r$ r� { rS z'FirewallClientConfigZone.setSourcePortsc C r` r[ )r= r� r� r# r# r$ r� r� z&FirewallClientConfigZone.addSourcePortc C r` r[ )r= r� r� r# r# r$ r� � r� z)FirewallClientConfigZone.removeSourcePortc C ra r[ )r= r� r� r# r# r$ r� � rx z(FirewallClientConfigZone.querySourcePortc C r] r[ )r= r� rQ r# r# r$ r� � rt z&FirewallClientConfigZone.getIcmpBlocksc C rY r[ )r= r� )rI � icmptypesr# r# r$ r� � rS z&FirewallClientConfigZone.setIcmpBlocksc C rY r[ )r= r� r� r# r# r$ r� � rS z%FirewallClientConfigZone.addIcmpBlockc C rY r[ )r= r� r� r# r# r$ r� � rS z(FirewallClientConfigZone.removeIcmpBlockc C r^ r[ )r= r� r� r# r# r$ r� � r_ z'FirewallClientConfigZone.queryIcmpBlockc C r] r[ )r= r� rQ r# r# r$ r� � rt z.FirewallClientConfigZone.getIcmpBlockInversionc C rY r[ )r= r� )rI � inversionr# r# r$ r� � rS z.FirewallClientConfigZone.setIcmpBlockInversionc C rW r[ )r= r� rQ r# r# r$ r� � rx z.FirewallClientConfigZone.addIcmpBlockInversionc C rW r[ )r= r� rQ r# r# r$ r� � rx z1FirewallClientConfigZone.removeIcmpBlockInversionc C r] r[ )r= r� rQ r# r# r$ r� � rt z0FirewallClientConfigZone.queryIcmpBlockInversionc C � | j �� d S �Nr; �r= rQ rQ r# r# r$ r� � rx z#FirewallClientConfigZone.getForwardc C s | j �d|i� d S re �r= rT r� r# r# r$ r� � rV z#FirewallClientConfigZone.setForwardc C � | j �ddi� d S �Nr; Trg rQ r# r# r$ r� � rV z#FirewallClientConfigZone.addForwardc C rh �Nr; Frg rQ r# r# r$ r� � rV z&FirewallClientConfigZone.removeForwardc C rd re rf rQ r# r# r$ r� � rx z%FirewallClientConfigZone.queryForwardc C r] r[ )r= r� rQ r# r# r$ r� � rt z&FirewallClientConfigZone.getMasqueradec C rY r[ )r= r� r� r# r# r$ r� � rS z&FirewallClientConfigZone.setMasqueradec C rW r[ )r= r� rQ r# r# r$ r� � rx z&FirewallClientConfigZone.addMasqueradec C rW r[ )r= r� rQ r# r# r$ r� � rx z)FirewallClientConfigZone.removeMasqueradec C r] r[ )r= r� rQ r# r# r$ r� � rt z(FirewallClientConfigZone.queryMasqueradec C r] r[ )r= r� rQ r# r# r$ r� � rt z(FirewallClientConfigZone.getForwardPortsc C rY r[ )r= r� r� r# r# r$ r� � rS z(FirewallClientConfigZone.setForwardPortsc C �. |d u rd}|d u r d}| j �||||� d S �Nr* )r= r� �rI r� r� �toport�toaddrr# r# r$ r� � r� z'FirewallClientConfigZone.addForwardPortc C rk rl )r= r� rm r# r# r$ r� � r� z*FirewallClientConfigZone.removeForwardPortc C s* |d u rd}|d u r d}| j �||||�S rl )r= r� rm r# r# r$ r� � s z)FirewallClientConfigZone.queryForwardPortc C r] r[ )r= r� rQ r# r# r$ r� rt z&FirewallClientConfigZone.getInterfacesc C rY r[ )r= r� r� r# r# r$ r� rS z&FirewallClientConfigZone.setInterfacesc C rY r[ )r= r r r# r# r$ r rS z%FirewallClientConfigZone.addInterfacec C rY r[ )r= r r r# r# r$ r rS z(FirewallClientConfigZone.removeInterfacec C r^ r[ )r= r r r# r# r$ r r_ z'FirewallClientConfigZone.queryInterfacec C r] r[ )r= r rQ r# r# r$ r rt z#FirewallClientConfigZone.getSourcesc C rY r[ )r= r r r# r# r$ r ! rS z#FirewallClientConfigZone.setSourcesc C rY r[ )r= r r r# r# r$ r % rS z"FirewallClientConfigZone.addSourcec C rY r[ )r= r r r# r# r$ r ) rS z%FirewallClientConfigZone.removeSourcec C r^ r[ )r= r r r# r# r$ r - r_ z$FirewallClientConfigZone.querySourcec C r] r[ )r= r rQ r# r# r$ r 3 rt z%FirewallClientConfigZone.getRichRulesc C rY r[ )r= r r r# r# r$ r 7 rS z%FirewallClientConfigZone.setRichRulesc C rY r[ )r= r% r# r# r# r$ r% ; rS z$FirewallClientConfigZone.addRichRulec C rY r[ )r= r) r# r# r# r$ r) ? rS z'FirewallClientConfigZone.removeRichRulec C r^ r[ )r= r, r# r# r# r$ r, C r_ z&FirewallClientConfigZone.queryRichRuleN)Qr- r. r/ rL r( rE rI rN rR rU rX r� rZ rs rw r{ r} r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r r r r r r r r r r r% r) r, r# r# r# r$ r0 � s4 r0 c @ s" e Zd Zed�dd��Zedd� �Zedd� �Zedd � �Zed d � �Zd d � Z edd� �Z edd� �Z edd� �Z edd� �Z edd� �Zedd� �Zedd� �Zed d � �Zed d � �Zed d!� �Zed"d#� �Zed$d%� �Zed&d'� �Zed(d)� �Zed*d+� �Zed,d-� �Zed.d/� �Zed0d1� �Zed2d3� �Z ed4d5� �Z ed6d7� �Z ed8d9� �Z ed:d;� �Z ed<d=� �Z!ed>d?� �Z"ed@dA� �Z#edBdC� �Z$edDdE� �Z%edFdG� �Z&edHdI� �Z'edJdK� �Z(edLdM� �Z)edNdO� �Z*edPdQ� �Z+edRdS� �Z,edTdU� �Z-edVdW� �Z.edXdY� �Z/edZd[� �Z0ed\d]� �Z1ed^d_� �Z2ed`da� �Z3edbdc� �Z4eddde� �Z5edfdg� �Z6edhdi� �Z7edjdk� �Z8edldm� �Z9edndo� �Z:edpdq� �Z;edrds� �Z<edtdu� �Z=edvdw� �Z>edxdy� �Z?edzd{� �Z@ed|d}� �ZAed~d� �ZBed�d�� �ZCed�d�� �ZDed�d�� �ZEdS )�� FirewallClientPolicySettingsNc C sF dg g g g dg t g g g dg tdd�| _g d�| _|r!| �|� d S d S )Nr* F)r- � egress_zonesr4 r2 � ingress_zonesr3 r1 �priorityr8 � rich_rulesr0 r, r9 r/ r+ )r< r< r? r< r< r= r> rJ r< r< r< r< r> r< r< )r r r@ rB rG rk r# r# r$ rL H s( � �z%FirewallClientPolicySettings.__init__c C rM rN rO rQ r# r# r$ rR b rS z%FirewallClientPolicySettings.__repr__c C � | j S r[ rr rQ r# r# r$ rY f � z,FirewallClientPolicySettings.getSettingsDictc C s |D ] }|| | j |< qd S r[ rr r^ r# r# r$ rG i s �z,FirewallClientPolicySettings.setSettingsDictc C sr i }t | j| j�D ]-\}}| j| }t|�tu r"tj||d�||< q t|�tu r2tj||d�||< q |||< q |S �Nr` ) rU r@ rB rc rD r rd rF re )rI r@ rW rg rX r# r# r$ rh m s z0FirewallClientPolicySettings.getSettingsDbusDictc C s | � � }dD ]}||= q|S )N)r+ r, r- r/ rn r^ r# r# r$ ro y s z7FirewallClientPolicySettings.getRuntimeSettingsDbusDictc C rp �Nr+ rr rQ r# r# r$ rs rt z'FirewallClientPolicySettings.getVersionc C ru rx rr rv r# r# r$ rw � rx z'FirewallClientPolicySettings.setVersionc C rp �Nr, rr rQ r# r# r$ r{ � rt z%FirewallClientPolicySettings.getShortc C ru ry rr r| r# r# r$ r} � rx z%FirewallClientPolicySettings.setShortc C rp �Nr- rr rQ r# r# r$ r� � rt z+FirewallClientPolicySettings.getDescriptionc C ru rz rr r� r# r# r$ r� � rx z+FirewallClientPolicySettings.setDescriptionc C rp �Nr/ rr rQ r# r# r$ r� � rt z&FirewallClientPolicySettings.getTargetc C ru r{ rr r� r# r# r$ r� � rx z&FirewallClientPolicySettings.setTargetc C rp �Nr0 rr rQ r# r# r$ r� � rt z(FirewallClientPolicySettings.getServicesc C ru r| rr r� r# r# r$ r� � rx z(FirewallClientPolicySettings.setServicesc C r� r| r� r� r# r# r$ r� � r� z'FirewallClientPolicySettings.addServicec C r� r| r� r� r# r# r$ r� � r� z*FirewallClientPolicySettings.removeServicec C r� r| rr r� r# r# r$ r� � rx z)FirewallClientPolicySettings.queryServicec C rp �Nr1 rr rQ r# r# r$ r� � rt z%FirewallClientPolicySettings.getPortsc C ru r} rr r� r# r# r$ r� � rx z%FirewallClientPolicySettings.setPortsc C r� �Nr1 r� r� r� r# r# r$ r� � r� z$FirewallClientPolicySettings.addPortc C r� r~ r� r� r# r# r$ r� � r� z'FirewallClientPolicySettings.removePortc C r� r} rr r� r# r# r$ r� � r� z&FirewallClientPolicySettings.queryPortc C rp �Nr8 rr rQ r# r# r$ r� � rt z)FirewallClientPolicySettings.getProtocolsc C ru r rr r� r# r# r$ r� � rx z)FirewallClientPolicySettings.setProtocolsc C r� r r� r� r# r# r$ r� � r� z(FirewallClientPolicySettings.addProtocolc C r� r r� r� r# r# r$ r� � r� z+FirewallClientPolicySettings.removeProtocolc C r� r rr r� r# r# r$ r� � rx z*FirewallClientPolicySettings.queryProtocolc C rp �Nr9 rr rQ r# r# r$ r� � rt z+FirewallClientPolicySettings.getSourcePortsc C ru r� rr r� r# r# r$ r� � rx z+FirewallClientPolicySettings.setSourcePortsc C r� �Nr9 r� r� r� r# r# r$ r� � r� z*FirewallClientPolicySettings.addSourcePortc C r� r� r� r� r# r# r$ r� � r� z-FirewallClientPolicySettings.removeSourcePortc C r� r� rr r� r# r# r$ r� � r� z,FirewallClientPolicySettings.querySourcePortc C rp �Nr2 rr rQ r# r# r$ r� � rt z*FirewallClientPolicySettings.getIcmpBlocksc C ru r� rr r� r# r# r$ r� � rx z*FirewallClientPolicySettings.setIcmpBlocksc C r� r� r� r� r# r# r$ r� � r� z)FirewallClientPolicySettings.addIcmpBlockc C r� r� r� r� r# r# r$ r� r� z,FirewallClientPolicySettings.removeIcmpBlockc C r� r� rr r� r# r# r$ r� rx z+FirewallClientPolicySettings.queryIcmpBlockc C rp �Nr3 rr rQ r# r# r$ r� rt z*FirewallClientPolicySettings.getMasqueradec C ru r� rr r� r# r# r$ r� rx z*FirewallClientPolicySettings.setMasqueradec C s( | j d s d| j d< d S ttjd� d S )Nr3 Tr� rQ r# r# r$ r� r� z*FirewallClientPolicySettings.addMasqueradec C s( | j d r d| j d< d S ttjd� d S )Nr3 Fr� rQ r# r# r$ r� r� z-FirewallClientPolicySettings.removeMasqueradec C rp r� rr rQ r# r# r$ r� rt z,FirewallClientPolicySettings.queryMasqueradec C rp �Nr4 rr rQ r# r# r$ r� # rt z,FirewallClientPolicySettings.getForwardPortsc C ru r� rr r� r# r# r$ r� & rx z,FirewallClientPolicySettings.setForwardPortsc C r� �Nr* r4 r� r� r� r# r# r$ r� ) r� z+FirewallClientPolicySettings.addForwardPortc C r� r� r� r� r# r# r$ r� 4 r� z.FirewallClientPolicySettings.removeForwardPortc C r� )Nr* r4 rr r� r# r# r$ r� ? r� z-FirewallClientPolicySettings.queryForwardPortc C rp )Nrt rr rQ r# r# r$ r G rt z)FirewallClientPolicySettings.getRichRulesc C r )Nc S r r r r r# r# r$ r L r z=FirewallClientPolicySettings.setRichRules.<locals>.<listcomp>rt rr r r# r# r$ r J r z)FirewallClientPolicySettings.setRichRulesc C r �Nr rt r" r# r# r# r$ r% N r& z(FirewallClientPolicySettings.addRichRulec C r' r� r( r# r# r# r$ r) U r& z+FirewallClientPolicySettings.removeRichRulec C r* r� r+ r# r# r# r$ r, \ r z*FirewallClientPolicySettings.queryRichRulec C rp �Nrr rr rQ r# r# r$ �getIngressZonesa rt z,FirewallClientPolicySettings.getIngressZonesc C ru r� rr )rI rr r# r# r$ �setIngressZonesd rx z,FirewallClientPolicySettings.setIngressZonesc C r� r� r� �rI � ingress_zoner# r# r$ �addIngressZoneg r� z+FirewallClientPolicySettings.addIngressZonec C r� r� r� r� r# r# r$ �removeIngressZonem r� z.FirewallClientPolicySettings.removeIngressZonec C r� r� rr r� r# r# r$ �queryIngressZones rx z-FirewallClientPolicySettings.queryIngressZonec C rp �Nrq rr rQ r# r# r$ �getEgressZonesw rt z+FirewallClientPolicySettings.getEgressZonesc C ru r� rr )rI rq r# r# r$ �setEgressZonesz rx z+FirewallClientPolicySettings.setEgressZonesc C r� r� r� �rI � egress_zoner# r# r$ � addEgressZone} r� z*FirewallClientPolicySettings.addEgressZonec C r� r� r� r� r# r# r$ �removeEgressZone� r� z-FirewallClientPolicySettings.removeEgressZonec C r� r� rr r� r# r# r$ �queryEgressZone� rx z,FirewallClientPolicySettings.queryEgressZonec C rp �Nrs rr rQ r# r# r$ � getPriority� rt z(FirewallClientPolicySettings.getPriorityc C s t |�| jd< d S r� )�intr@ )rI rs r# r# r$ � setPriority� r� z(FirewallClientPolicySettings.setPriorityr[ )Fr- r. r/ r( rL rR rY rG rh ro rs rw r{ r} r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r r r% r) r, r� r� r� r� r� r� r� r� r� r� r� r� r# r# r# r$ rp G s rp c @ st e Zd Zdd� Zedd� �Zedd� �Zedd� �Zed d � �Zed d � �Z ed d� �Z edd� �Z edd� �Z dS )�FirewallClientConfigPolicyc C r1 r2 ) r6 r7 r8 r r r9 r: r; � DBUS_INTERFACE_CONFIG_POLICY� fw_policyr> r? r# r# r$ rL � r@ z#FirewallClientConfigPolicy.__init__c C rA r[ )r r> rB r r r� rC r# r# r$ rE � rF z'FirewallClientConfigPolicy.get_propertyc C rG r[ )r r> rH r r r� rQ r# r# r$ rI � rJ z)FirewallClientConfigPolicy.get_propertiesc C rK r[ )r> rL r r r� rM r# r# r$ rN � rO z'FirewallClientConfigPolicy.set_propertyc C rP r[ )rp r r� rR rQ r# r# r$ rR � r� z&FirewallClientConfigPolicy.getSettingsc C rS r[ )r� rU rh rk r# r# r$ rU � rV z!FirewallClientConfigPolicy.updatec C rW r[ )r� rX rQ r# r# r$ rX � rx z'FirewallClientConfigPolicy.loadDefaultsc C rW r[ )r� r� rQ r# r# r$ r� � rx z!FirewallClientConfigPolicy.removec C rY r[ )r� rZ r[ r# r# r$ rZ � rS z!FirewallClientConfigPolicy.renameN) r- r. r/ rL r( rE rI rN rR rU rX r� rZ r# r# r# r$ r� � s$ r� c @ s8 e Zd Zed^dd��Zedd� �Zedd� �Zedd � �Zed d � �Zed d � �Z edd� �Z edd� �Z edd� �Z edd� �Z edd� �Zedd� �Zedd� �Zed d � �Zed d � �Zed d!� �Zed"d#� �Zed$d%� �Zed&d'� �Zed(d)� �Zed*d+� �Zed,d-� �Zed.d/� �Zed0d1� �Zed2d3� �Z ed4d5� �Z ed6d7� �Z ed8d9� �Z ed:d;� �Z ed<d=� �Z!ed>d?� �Z"ed@dA� �Z#edBdC� �Z$edDdE� �Z%ed^dFdG��Z&edHdI� �Z'edJdK� �Z(edLdM� �Z)edNdO� �Z*edPdQ� �Z+edRdS� �Z,edTdU� �Z-edVdW� �Z.edXdY� �Z/edZd[� �Z0ed\d]� �Z1dS )_� FirewallClientServiceSettingsNc C s� dddg g i g g g g g | _ g d�| _g d�| _|r>t|�tu r1t|�D ] \}}|| | j |< q#d S t|�tu r@| �|� d S d S d S )Nr* ) r+ r, r- r1 �modules� destinationr8 r9 �includes�helpers) r< r< r< r> r< �ssr< r> r< r< )r@ rA rB rc rD rE rF rG rH r# r# r$ rL � s � �z&FirewallClientServiceSettings.__init__c C rM rN rO rQ r# r# r$ rR � rS z&FirewallClientServiceSettings.__repr__c C s( i }t | j| j�D ]\}}|||< q |S r[ rT rV r# r# r$ rY � s z-FirewallClientServiceSettings.getSettingsDictc C rZ r[ r\ r^ r# r# r$ rG � r_ z-FirewallClientServiceSettings.setSettingsDictc C sn i }t | j| j| j�D ])\}}}t|�tu r tj||d�||< q t|�tu r0tj ||d�||< q |||< q |S rw rb rf r# r# r$ rh � s z1FirewallClientServiceSettings.getSettingsDbusDictc C rp rq rr rQ r# r# r$ rs � rt z(FirewallClientServiceSettings.getVersionc C ru rq rr rv r# r# r$ rw � rx z(FirewallClientServiceSettings.setVersionc C rp ry rr rQ r# r# r$ r{ � rt z&FirewallClientServiceSettings.getShortc C ru ry rr r| r# r# r$ r} � rx z&FirewallClientServiceSettings.setShortc C rp r~ rr rQ r# r# r$ r� � rt z,FirewallClientServiceSettings.getDescriptionc C ru r~ rr r� r# r# r$ r� rx z,FirewallClientServiceSettings.setDescriptionc C rp �N� rr rQ r# r# r$ r� rt z&FirewallClientServiceSettings.getPortsc C ru r� rr r� r# r# r$ r� rx z&FirewallClientServiceSettings.setPortsc C r� �Nr� r� r� r� r# r# r$ r� r� z%FirewallClientServiceSettings.addPortc C r� r� r� r� r# r# r$ r� r� z(FirewallClientServiceSettings.removePortc C r� r� rr r� r# r# r$ r� r� z'FirewallClientServiceSettings.queryPortc C rp r� rr rQ r# r# r$ r� rt z*FirewallClientServiceSettings.getProtocolsc C ru r� rr r� r# r# r$ r� rx z*FirewallClientServiceSettings.setProtocolsc C r� r� r� r� r# r# r$ r� " r� z)FirewallClientServiceSettings.addProtocolc C r� r� r� r� r# r# r$ r� ( r� z,FirewallClientServiceSettings.removeProtocolc C r� r� rr r� r# r# r$ r� . rx z+FirewallClientServiceSettings.queryProtocolc C rp r� rr rQ r# r# r$ r� 2 rt z,FirewallClientServiceSettings.getSourcePortsc C ru r� rr r� r# r# r$ r� 5 rx z,FirewallClientServiceSettings.setSourcePortsc C r� �Nr� r� r� r� r# r# r$ r� 8 r� z+FirewallClientServiceSettings.addSourcePortc C r� r� r� r� r# r# r$ r� ? r� z.FirewallClientServiceSettings.removeSourcePortc C r� r� rr r� r# r# r$ r� F r� z-FirewallClientServiceSettings.querySourcePortc C rp �Nr� rr rQ r# r# r$ � getModulesJ rt z(FirewallClientServiceSettings.getModulesc C ru r� rr �rI r� r# r# r$ � setModulesM rx z(FirewallClientServiceSettings.setModulesc C r� r� r� �rI �moduler# r# r$ � addModuleP r� z'FirewallClientServiceSettings.addModulec C r� r� r� r� r# r# r$ � removeModuleV r� z*FirewallClientServiceSettings.removeModulec C r� r� rr r� r# r# r$ � queryModule\ rx z)FirewallClientServiceSettings.queryModulec C rp r� rr rQ r# r# r$ �getDestinations` rt z-FirewallClientServiceSettings.getDestinationsc C ru r� rr �rI � destinationsr# r# r$ �setDestinationsc rx z-FirewallClientServiceSettings.setDestinationsc C sF || j d vs| j d | |kr|| j d |< d S ttjd||f ���Nr� r� r� �rI � dest_type�addressr# r# r$ �setDestinationf s �z,FirewallClientServiceSettings.setDestinationc C s\ || j d v r&|d ur | j d | |kr ttjd||f ��| j d |= d S ttjd| ��)Nr� r� z'%s'r� r� r# r# r$ �removeDestinationn s �z/FirewallClientServiceSettings.removeDestinationc C s || j d v o|| j d | kS r� rr r� r# r# r$ �queryDestinationw s �z.FirewallClientServiceSettings.queryDestinationc C rp r� rr rQ r# r# r$ � getIncludes| rt z)FirewallClientServiceSettings.getIncludesc C ru r� rr �rI r� r# r# r$ � setIncludes rx z)FirewallClientServiceSettings.setIncludesc C r� r� r� �rI �includer# r# r$ � addInclude� r� z(FirewallClientServiceSettings.addIncludec C r� r� r� r� r# r# r$ � removeInclude� r� z+FirewallClientServiceSettings.removeIncludec C r� r� rr r� r# r# r$ � queryInclude� rx z*FirewallClientServiceSettings.queryIncludec C rp r� rr rQ r# r# r$ � getHelpers� rt z(FirewallClientServiceSettings.getHelpersc C ru r� rr )rI r� r# r# r$ � setHelpers� rx z(FirewallClientServiceSettings.setHelpersc C r� r� r� �rI �helperr# r# r$ � addHelper� r� z'FirewallClientServiceSettings.addHelperc C r� r� r� r� r# r# r$ � removeHelper� r� z*FirewallClientServiceSettings.removeHelperc C r� r� rr r� r# r# r$ � queryHelper� rx z)FirewallClientServiceSettings.queryHelperr[ )2r- r. r/ r( rL rR rY rG rh rs rw r{ r} r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r# r# r# r$ r� � s� r� c @ s� e Zd Zed*dd��Zedd� �Zedd� �Zedd � �Zed d � �Zed d � �Z edd� �Z edd� �Z edd� �Z edd� �Z edd� �Zedd� �Zedd� �Zed d � �Zed d � �Zed d!� �Zed"d#� �Zed$d%� �Zed&d'� �Zed(d)� �ZdS )+�FirewallClientIPSetSettingsNc C s$ |r|| _ d S ddddi g g| _ d S rl rr rk r# r# r$ rL � � z$FirewallClientIPSetSettings.__init__c C rM rN rO rQ r# r# r$ rR � rS z$FirewallClientIPSetSettings.__repr__c C rp rq rr rQ r# r# r$ rs � rt z&FirewallClientIPSetSettings.getVersionc C ru rq rr rv r# r# r$ rw � rx z&FirewallClientIPSetSettings.setVersionc C rp ry rr rQ r# r# r$ r{ � rt z$FirewallClientIPSetSettings.getShortc C ru ry rr r| r# r# r$ r} � rx z$FirewallClientIPSetSettings.setShortc C rp r~ rr rQ r# r# r$ r� � rt z*FirewallClientIPSetSettings.getDescriptionc C ru r~ rr r� r# r# r$ r� � rx z*FirewallClientIPSetSettings.setDescriptionc C rp r� rr rQ r# r# r$ �getType� rt z#FirewallClientIPSetSettings.getTypec C ru r� rr )rI � ipset_typer# r# r$ �setType� rx z#FirewallClientIPSetSettings.setTypec C rp r� rr rQ r# r# r$ � getOptions� rt z&FirewallClientIPSetSettings.getOptionsc C ru r� rr )rI �optionsr# r# r$ � setOptions� rx z&FirewallClientIPSetSettings.setOptionsc C sP || j d vs| j d | |kr|| j d |< d S ttj|r%d||f ��|��)Nr� z'%s=%s'r� �rI rW rX r# r# r$ � addOption� s ��z%FirewallClientIPSetSettings.addOptionc C s* || j d v r| j d |= d S ttj|��r� r� )rI rW r# r# r$ � removeOption� s z(FirewallClientIPSetSettings.removeOptionc C s || j d v o| j d | |kS r� rr r� r# r# r$ � queryOption� s z'FirewallClientIPSetSettings.queryOptionc C rp r� rr rQ r# r# r$ � getEntries� rt z&FirewallClientIPSetSettings.getEntriesc C s@ d| j d v r| j d d dkrttj��t|� || j d< d S �N�timeoutr� �0r� )r@ r r �IPSET_WITH_TIMEOUTr �rI �entriesr# r# r$ � setEntries� � z&FirewallClientIPSetSettings.setEntriesc C sp d| j d v r| j d d dkrttj��t|�}|| j d vr2t|| j d � | j d �|� d S ttj|��r� )r@ r r r� r r r� r� �rI �entryr# r# r$ �addEntry� s z$FirewallClientIPSetSettings.addEntryc C s` d| j d v r| j d d dkrttj��t|�}|| j d v r*| j d �|� d S ttj|��r� )r@ r r r� r r� r� r� r# r# r$ � removeEntry� s z'FirewallClientIPSetSettings.removeEntryc C s@ d| j d v r| j d d dkrttj��t|�}|| j d v S r� )r@ r r r� r r� r# r# r$ � queryEntry r� z&FirewallClientIPSetSettings.queryEntryr[ )r- r. r/ r( rL rR rs rw r{ r} r� r� r� r� r� r� r� r� r� r� r� r� r� r� r# r# r# r$ r� � sR r� c @ � e Zd Zedd� �Zedd� �Zedd� �Zedd� �Zed d � �Zed d � �Z ed d� �Z edd� �Z edd� �Z edd� �Z edd� �Zedd� �Zedd� �Zedd � �Zed d � �Zed d � �Zed!d"� �Zed#d$� �Zed%d&� �Zed'd(� �Zd)S )*�FirewallClientConfigIPSetc C r1 r2 ) r6 r7 r8 r r r9 r: r; �DBUS_INTERFACE_CONFIG_IPSET�fw_ipsetr> r? r# r# r$ rL � � �z"FirewallClientConfigIPSet.__init__c C rA r[ )r r> rB r r r� rC r# r# r$ rE rF z&FirewallClientConfigIPSet.get_propertyc C rG r[ )r r> rH r r r� rQ r# r# r$ rI # rJ z(FirewallClientConfigIPSet.get_propertiesc C rK r[ )r> rL r r r� rM r# r# r$ rN ( rO z&FirewallClientConfigIPSet.set_propertyc C � t tt| j�� ���S r[ )r� rD r r� rR rQ r# r# r$ rR - � �z%FirewallClientConfigIPSet.getSettingsc C � | j �t|j�� d S r[ )r� rU �tupler@ rk r# r# r$ rU 2 � z FirewallClientConfigIPSet.updatec C rW r[ )r� rX rQ r# r# r$ rX 6 rx z&FirewallClientConfigIPSet.loadDefaultsc C rW r[ )r� r� rQ r# r# r$ r� : rx z FirewallClientConfigIPSet.removec C rY r[ )r� rZ r[ r# r# r$ rZ > rS z FirewallClientConfigIPSet.renamec C r] r[ )r� rs rQ r# r# r$ rs D rt z$FirewallClientConfigIPSet.getVersionc C rY r[ )r� rw rv r# r# r$ rw H rS z$FirewallClientConfigIPSet.setVersionc C r] r[ )r� r{ rQ r# r# r$ r{ N rt z"FirewallClientConfigIPSet.getShortc C rY r[ )r� r} r| r# r# r$ r} R rS z"FirewallClientConfigIPSet.setShortc C r] r[ )r� r� rQ r# r# r$ r� X rt z(FirewallClientConfigIPSet.getDescriptionc C rY r[ )r� r� r� r# r# r$ r� \ rS z(FirewallClientConfigIPSet.setDescriptionc C r] r[ �r� r� rQ r# r# r$ r� b rt z$FirewallClientConfigIPSet.getEntriesc C rY r[ �r� r� r� r# r# r$ r� f rS z$FirewallClientConfigIPSet.setEntriesc C rY r[ �r� r� r� r# r# r$ r� j rS z"FirewallClientConfigIPSet.addEntryc C rY r[ �r� r� r� r# r# r$ r� n rS z%FirewallClientConfigIPSet.removeEntryc C r^ r[ )r� r� r� r# r# r$ r� r r_ z$FirewallClientConfigIPSet.queryEntryN)r- r. r/ r( rL rE rI rN rR rU rX r� rZ rs rw r{ r} r� r� r� r� r� r� r� r# r# r# r$ r� �R r� c @ s� e Zd Zed$dd��Zedd� �Zedd� �Zedd � �Zed d � �Zed d � �Z edd� �Z edd� �Z edd� �Z edd� �Z edd� �Zedd� �Zedd� �Zed d � �Zed d � �Zed d!� �Zed"d#� �ZdS )%� FirewallClientHelperSettingsNc C s$ |r|| _ d S dddddg g| _ d S rl rr rk r# r# r$ rL y r� z%FirewallClientHelperSettings.__init__c C rM rN rO rQ r# r# r$ rR � rS z%FirewallClientHelperSettings.__repr__c C rp rq rr rQ r# r# r$ rs � rt z'FirewallClientHelperSettings.getVersionc C ru rq rr rv r# r# r$ rw � rx z'FirewallClientHelperSettings.setVersionc C rp ry rr rQ r# r# r$ r{ � rt z%FirewallClientHelperSettings.getShortc C ru ry rr r| r# r# r$ r} � rx z%FirewallClientHelperSettings.setShortc C rp r~ rr rQ r# r# r$ r� � rt z+FirewallClientHelperSettings.getDescriptionc C ru r~ rr r� r# r# r$ r� � rx z+FirewallClientHelperSettings.setDescriptionc C rp r� rr rQ r# r# r$ � getFamily� rt z&FirewallClientHelperSettings.getFamilyc C s |d u r d| j d< || j d< d S )Nr* r� rr �rI �ipvr# r# r$ � setFamily� s z&FirewallClientHelperSettings.setFamilyc C rp r� rr rQ r# r# r$ � getModule� rt z&FirewallClientHelperSettings.getModulec C ru r� rr r� r# r# r$ � setModule� rx z&FirewallClientHelperSettings.setModulec C rp r� rr rQ r# r# r$ r� � rt z%FirewallClientHelperSettings.getPortsc C ru r� rr r� r# r# r$ r� � rx z%FirewallClientHelperSettings.setPortsc C r� r� r� r� r# r# r$ r� � r� z$FirewallClientHelperSettings.addPortc C r� r� r� r� r# r# r$ r� � r� z'FirewallClientHelperSettings.removePortc C r� r� rr r� r# r# r$ r� � r� z&FirewallClientHelperSettings.queryPortr[ )r- r. r/ r( rL rR rs rw r{ r} r� r� r� r� r� r� r� r� r� r� r� r# r# r# r$ r� x sF r� c @ s, e Zd Zedd� �Zedd� �Zedd� �Zedd� �Zed d � �Zed d � �Z ed d� �Z edd� �Z edd� �Z edd� �Z edd� �Zedd� �Zedd� �Zedd � �Zed d � �Zed d � �Zed!d"� �Zed#d$� �Zed%d&� �Zed'd(� �Zed)d*� �Zed+d,� �Zed-d.� �Zed/d0� �Zd1S )2�FirewallClientConfigHelperc C r1 r2 ) r6 r7 r8 r r r9 r: r; � DBUS_INTERFACE_CONFIG_HELPER� fw_helperr> r? r# r# r$ rL � r� z#FirewallClientConfigHelper.__init__c C rA r[ )r r> rB r r r� rC r# r# r$ rE � rF z'FirewallClientConfigHelper.get_propertyc C rG r[ )r r> rH r r r� rQ r# r# r$ rI � rJ z)FirewallClientConfigHelper.get_propertiesc C rK r[ )r> rL r r r� rM r# r# r$ rN � rO z'FirewallClientConfigHelper.set_propertyc C r� r[ )r� rD r r� rR rQ r# r# r$ rR � r� z&FirewallClientConfigHelper.getSettingsc C r� r[ )r� rU r� r@ rk r# r# r$ rU � r� z!FirewallClientConfigHelper.updatec C rW r[ )r� rX rQ r# r# r$ rX � rx z'FirewallClientConfigHelper.loadDefaultsc C rW r[ )r� r� rQ r# r# r$ r� � rx z!FirewallClientConfigHelper.removec C rY r[ )r� rZ r[ r# r# r$ rZ � rS z!FirewallClientConfigHelper.renamec C r] r[ )r� rs rQ r# r# r$ rs � rt z%FirewallClientConfigHelper.getVersionc C rY r[ )r� rw rv r# r# r$ rw � rS z%FirewallClientConfigHelper.setVersionc C r] r[ )r� r{ rQ r# r# r$ r{ � rt z#FirewallClientConfigHelper.getShortc C rY r[ )r� r} r| r# r# r$ r} rS z#FirewallClientConfigHelper.setShortc C r] r[ )r� r� rQ r# r# r$ r� rt z)FirewallClientConfigHelper.getDescriptionc C rY r[ )r� r� r� r# r# r$ r� rS z)FirewallClientConfigHelper.setDescriptionc C r] r[ )r� r� rQ r# r# r$ r� rt z#FirewallClientConfigHelper.getPortsc C rY r[ )r� r� r� r# r# r$ r� rS z#FirewallClientConfigHelper.setPortsc C r` r[ )r� r� r� r# r# r$ r� r� z"FirewallClientConfigHelper.addPortc C r` r[ )r� r� r� r# r# r$ r� r� z%FirewallClientConfigHelper.removePortc C ra r[ )r� r� r� r# r# r$ r� # rx z$FirewallClientConfigHelper.queryPortc C r] r[ )r� r� rQ r# r# r$ r� ) rt z$FirewallClientConfigHelper.getFamilyc C s$ |d u r | j �d� | j �|� d S rl )r� r� r� r# r# r$ r� - s z$FirewallClientConfigHelper.setFamilyc C r] r[ )r� r� rQ r# r# r$ r� 5 rt z$FirewallClientConfigHelper.getModulec C rY r[ )r� r� r� r# r# r$ r� 9 rS z$FirewallClientConfigHelper.setModuleN) r- r. r/ r( rL rE rI rN rR rU rX r� rZ rs rw r{ r} r� r� r� r� r� r� r� r� r� r� r� r# r# r# r$ r� � sb r� c @ s6 e Zd Zedd� �Zedd� �Zedd� �Zedd� �Zed d � �Zed d � �Z ed d� �Z edd� �Z edd� �Z edd� �Z edd� �Zedd� �Zedd� �Zedd � �Zed d � �Zed d � �Zed!d"� �Zed#d$� �Zed%d&� �Zed'd(� �Zed)d*� �Zed+d,� �Zed-d.� �Zed/d0� �Zed1d2� �Z ed3d4� �Z ed5d6� �Z ed7d8� �Z ed9d:� �Z ed;d<� �Z!ed=d>� �Z"ed?d@� �Z#edAdB� �Z$edCdD� �Z%edEdF� �Z&edGdH� �Z'edIdJ� �Z(edKdL� �Z)edMdN� �Z*ed^dPdQ��Z+edRdS� �Z,edTdU� �Z-edVdW� �Z.edXdY� �Z/edZd[� �Z0ed\d]� �Z1dOS )_�FirewallClientConfigServicec C r1 r2 ) r6 r7 r8 r r r9 r: r; � DBUS_INTERFACE_CONFIG_SERVICE� fw_servicer> r? r# r# r$ rL @ r� z$FirewallClientConfigService.__init__c C rA r[ )r r> rB r r r� rC r# r# r$ rE K rF z(FirewallClientConfigService.get_propertyc C rG r[ )r r> rH r r r� rQ r# r# r$ rI P rJ z*FirewallClientConfigService.get_propertiesc C rK r[ )r> rL r r r� rM r# r# r$ rN U rO z(FirewallClientConfigService.set_propertyc C rP r[ )r� r r rQ rQ r# r# r$ rR Z s �z'FirewallClientConfigService.getSettingsc C rS r[ )r rT rh rk r# r# r$ rU _ rV z"FirewallClientConfigService.updatec C rW r[ )r rX rQ r# r# r$ rX c rx z(FirewallClientConfigService.loadDefaultsc C rW r[ )r r� rQ r# r# r$ r� g rx z"FirewallClientConfigService.removec C rY r[ )r rZ r[ r# r# r$ rZ k rS z"FirewallClientConfigService.renamec C r] r[ )r rs rQ r# r# r$ rs q rt z&FirewallClientConfigService.getVersionc C rY r[ )r rw rv r# r# r$ rw u rS z&FirewallClientConfigService.setVersionc C r] r[ )r r{ rQ r# r# r$ r{ { rt z$FirewallClientConfigService.getShortc C rY r[ )r r} r| r# r# r$ r} rS z$FirewallClientConfigService.setShortc C r] r[ )r r� rQ r# r# r$ r� � rt z*FirewallClientConfigService.getDescriptionc C rY r[ )r r� r� r# r# r$ r� � rS z*FirewallClientConfigService.setDescriptionc C r] r[ )r r� rQ r# r# r$ r� � rt z$FirewallClientConfigService.getPortsc C rY r[ )r r� r� r# r# r$ r� � rS z$FirewallClientConfigService.setPortsc C r` r[ )r r� r� r# r# r$ r� � r� z#FirewallClientConfigService.addPortc C r` r[ )r r� r� r# r# r$ r� � r� z&FirewallClientConfigService.removePortc C ra r[ )r r� r� r# r# r$ r� � rx z%FirewallClientConfigService.queryPortc C r] r[ )r r� rQ r# r# r$ r� � rt z(FirewallClientConfigService.getProtocolsc C rY r[ )r r� r� r# r# r$ r� � rS z(FirewallClientConfigService.setProtocolsc C rY r[ )r r� r� r# r# r$ r� � rS z'FirewallClientConfigService.addProtocolc C rY r[ )r r� r� r# r# r$ r� � rS z*FirewallClientConfigService.removeProtocolc C r^ r[ )r r� r� r# r# r$ r� � r_ z)FirewallClientConfigService.queryProtocolc C r] r[ )r r� rQ r# r# r$ r� � rt z*FirewallClientConfigService.getSourcePortsc C rY r[ )r r� r� r# r# r$ r� � rS z*FirewallClientConfigService.setSourcePortsc C r` r[ )r r� r� r# r# r$ r� � r� z)FirewallClientConfigService.addSourcePortc C r` r[ )r r� r� r# r# r$ r� � r� z,FirewallClientConfigService.removeSourcePortc C ra r[ )r r� r� r# r# r$ r� � rx z+FirewallClientConfigService.querySourcePortc C r] r[ )r r� rQ r# r# r$ r� � rt z&FirewallClientConfigService.getModulesc C rY r[ )r r� r� r# r# r$ r� � rS z&FirewallClientConfigService.setModulesc C rY r[ )r r� r� r# r# r$ r� � rS z%FirewallClientConfigService.addModulec C rY r[ )r r� r� r# r# r$ r� � rS z(FirewallClientConfigService.removeModulec C r^ r[ )r r� r� r# r# r$ r� � r_ z'FirewallClientConfigService.queryModulec C r] r[ )r r� rQ r# r# r$ r� � rt z+FirewallClientConfigService.getDestinationsc C rY r[ )r r� r� r# r# r$ r� � rS z+FirewallClientConfigService.setDestinationsc C r^ r[ )r �getDestination�rI r� r# r# r$ r � r_ z*FirewallClientConfigService.getDestinationc C r` r[ )r r� �rI r� r� r# r# r$ r� � r� z*FirewallClientConfigService.setDestinationNc C s: |d ur| � |�|krttjd||f ��| j�|� d S )Nr� )r r r r� r r� r r# r# r$ r� � s �z-FirewallClientConfigService.removeDestinationc C ra r[ )r r� r r# r# r$ r� � rx z,FirewallClientConfigService.queryDestinationc C r] r[ )r r� rQ r# r# r$ r� rt z'FirewallClientConfigService.getIncludesc C rY r[ )r r� r� r# r# r$ r� rS z'FirewallClientConfigService.setIncludesc C rY r[ )r r� r� r# r# r$ r� rS z&FirewallClientConfigService.addIncludec C rY r[ )r r� r� r# r# r$ r� rS z)FirewallClientConfigService.removeIncludec C r^ r[ )r r� r� r# r# r$ r� r_ z(FirewallClientConfigService.queryIncluder[ )2r- r. r/ r( rL rE rI rN rR rU rX r� rZ rs rw r{ r} r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r r� r� r� r� r� r� r� r� r# r# r# r$ r� ? s� r� c @ s� e Zd Zed dd��Zedd� �Zedd� �Zedd � �Zed d � �Zed d � �Z edd� �Z edd� �Z edd� �Z edd� �Z edd� �Zedd� �Zedd� �ZdS ) � FirewallClientIcmpTypeSettingsNc C s |r|| _ d S dddg g| _ d S rl rr rk r# r# r$ rL � z'FirewallClientIcmpTypeSettings.__init__c C rM rN rO rQ r# r# r$ rR # rS z'FirewallClientIcmpTypeSettings.__repr__c C rp rq rr rQ r# r# r$ rs ' rt z)FirewallClientIcmpTypeSettings.getVersionc C ru rq rr rv r# r# r$ rw * rx z)FirewallClientIcmpTypeSettings.setVersionc C rp ry rr rQ r# r# r$ r{ . rt z'FirewallClientIcmpTypeSettings.getShortc C ru ry rr r| r# r# r$ r} 1 rx z'FirewallClientIcmpTypeSettings.setShortc C rp r~ rr rQ r# r# r$ r� 5 rt z-FirewallClientIcmpTypeSettings.getDescriptionc C ru r~ rr r� r# r# r$ r� 8 rx z-FirewallClientIcmpTypeSettings.setDescriptionc C rp r� rr rQ r# r# r$ r� < rt z.FirewallClientIcmpTypeSettings.getDestinationsc C ru r� rr r� r# r# r$ r� ? rx z.FirewallClientIcmpTypeSettings.setDestinationsc C sD | j d s ttj|��|| j d vr | j d �|� d S ttj|��r� )r@ r r r� r� r r# r# r$ �addDestinationB s z-FirewallClientIcmpTypeSettings.addDestinationc C s\ || j d v r| j d �|� d S | j d s(| �ttddg�t|g� �� d S ttj|��)Nr� �ipv4�ipv6)r@ r� r� rD �setr r r� r r# r# r$ r� K s � z0FirewallClientIcmpTypeSettings.removeDestinationc C s | j d p || j d v S r� rr r r# r# r$ r� V s �z/FirewallClientIcmpTypeSettings.queryDestinationr[ )r- r. r/ r( rL rR rs rw r{ r} r� r� r� r� r r� r� r# r# r# r$ r s6 r c @ r� )*� FirewallClientConfigIcmpTypec C r1 r2 ) r6 r7 r8 r r r9 r: r; � DBUS_INTERFACE_CONFIG_ICMPTYPE� fw_icmptyper> r? r# r# r$ rL _ r� z%FirewallClientConfigIcmpType.__init__c C rA r[ )r r> rB r r r rC r# r# r$ rE j rF z)FirewallClientConfigIcmpType.get_propertyc C rG r[ )r r> rH r r r rQ r# r# r$ rI o rJ z+FirewallClientConfigIcmpType.get_propertiesc C rK r[ )r> rL r r r rM r# r# r$ rN t rO z)FirewallClientConfigIcmpType.set_propertyc C r� r[ )r rD r r rR rQ r# r# r$ rR y r� z(FirewallClientConfigIcmpType.getSettingsc C r� r[ )r rU r� r@ rk r# r# r$ rU ~ r� z#FirewallClientConfigIcmpType.updatec C rW r[ )r rX rQ r# r# r$ rX � rx z)FirewallClientConfigIcmpType.loadDefaultsc C rW r[ )r r� rQ r# r# r$ r� � rx z#FirewallClientConfigIcmpType.removec C rY r[ )r rZ r[ r# r# r$ rZ � rS z#FirewallClientConfigIcmpType.renamec C r] r[ )r rs rQ r# r# r$ rs � rt z'FirewallClientConfigIcmpType.getVersionc C rY r[ )r rw rv r# r# r$ rw � rS z'FirewallClientConfigIcmpType.setVersionc C r] r[ )r r{ rQ r# r# r$ r{ � rt z%FirewallClientConfigIcmpType.getShortc C rY r[ )r r} r| r# r# r$ r} � rS z%FirewallClientConfigIcmpType.setShortc C r] r[ )r r� rQ r# r# r$ r� � rt z+FirewallClientConfigIcmpType.getDescriptionc C rY r[ )r r� r� r# r# r$ r� � rS z+FirewallClientConfigIcmpType.setDescriptionc C r] r[ )r r� rQ r# r# r$ r� � rt z,FirewallClientConfigIcmpType.getDestinationsc C rY r[ )r r� r� r# r# r$ r� � rS z,FirewallClientConfigIcmpType.setDestinationsc C rY r[ )r r r r# r# r$ r � rS z+FirewallClientConfigIcmpType.addDestinationc C rY r[ )r r� r r# r# r$ r� � rS z.FirewallClientConfigIcmpType.removeDestinationc C r^ r[ )r r� r r# r# r$ r� � r_ z-FirewallClientConfigIcmpType.queryDestinationN)r- r. r/ r( rL rE rI rN rR rU rX r� rZ rs rw r{ r} r� r� r� r� r r� r� r# r# r# r$ r ^ r� r c @ � e Zd Zed.dd��Zedd� �Zedd� �Zedd � �Zed d � �Zed d � �Z edd� �Z edd� �Z edd� �Z edd� �Z edd� �Zedd� �Zedd� �Zed d � �Zed d � �Zed d!� �Zed"d#� �Zed$d%� �Zed&d'� �Zed(d)� �Zed*d+� �Zed,d-� �ZdS )/�'FirewallClientPoliciesLockdownWhitelistNc C s |r|| _ d S g g g g g| _ d S r[ rr rk r# r# r$ rL � r z0FirewallClientPoliciesLockdownWhitelist.__init__c C rM rN rO rQ r# r# r$ rR � rS z0FirewallClientPoliciesLockdownWhitelist.__repr__c C rp rq rr rQ r# r# r$ � getCommands� rt z3FirewallClientPoliciesLockdownWhitelist.getCommandsc C ru rq rr )rI �commandsr# r# r$ � setCommands� rx z3FirewallClientPoliciesLockdownWhitelist.setCommandsc C �& || j d vr| j d �|� d S d S rq �r@ r� �rI �commandr# r# r$ � addCommand� � �z2FirewallClientPoliciesLockdownWhitelist.addCommandc C �& || j d v r| j d �|� d S d S rq �r@ r� r r# r# r$ � removeCommand� r z5FirewallClientPoliciesLockdownWhitelist.removeCommandc C r� rq rr r r# r# r$ � queryCommand� rx z4FirewallClientPoliciesLockdownWhitelist.queryCommandc C rp ry rr rQ r# r# r$ � getContexts� rt z3FirewallClientPoliciesLockdownWhitelist.getContextsc C ru ry rr )rI �contextsr# r# r$ � setContexts� rx z3FirewallClientPoliciesLockdownWhitelist.setContextsc C r ry r �rI �contextr# r# r$ � addContext� r z2FirewallClientPoliciesLockdownWhitelist.addContextc C r ry r r r# r# r$ � removeContext� r z5FirewallClientPoliciesLockdownWhitelist.removeContextc C r� ry rr r r# r# r$ � queryContext� rx z4FirewallClientPoliciesLockdownWhitelist.queryContextc C rp r~ rr rQ r# r# r$ �getUsers� rt z0FirewallClientPoliciesLockdownWhitelist.getUsersc C ru r~ rr )rI �usersr# r# r$ �setUsers� rx z0FirewallClientPoliciesLockdownWhitelist.setUsersc C r r~ r �rI �userr# r# r$ �addUser� r z/FirewallClientPoliciesLockdownWhitelist.addUserc C r r~ r r' r# r# r$ � removeUser� r z2FirewallClientPoliciesLockdownWhitelist.removeUserc C r� r~ rr r' r# r# r$ � queryUser rx z1FirewallClientPoliciesLockdownWhitelist.queryUserc C rp r� rr rQ r# r# r$ �getUids rt z/FirewallClientPoliciesLockdownWhitelist.getUidsc C ru r� rr �rI �uidsr# r# r$ �setUids rx z/FirewallClientPoliciesLockdownWhitelist.setUidsc C r r� r �rI �uidr# r# r$ �addUid r z.FirewallClientPoliciesLockdownWhitelist.addUidc C r r� r r0 r# r# r$ � removeUid r z1FirewallClientPoliciesLockdownWhitelist.removeUidc C r� r� rr r0 r# r# r$ �queryUid rx z0FirewallClientPoliciesLockdownWhitelist.queryUidr[ )r- r. r/ r( rL rR r r r r r r r r! r" r# r$ r& r) r* r+ r, r/ r2 r3 r4 r# r# r# r$ r � sZ r c @ r� )*� FirewallClientConfigPoliciesc C �8 || _ | j �tjjtjj�| _tj| jtjjd�| _ d S �Nr3 ) r6 r8 r r r9 �DBUS_PATH_CONFIGr: r; � DBUS_INTERFACE_CONFIG_POLICIES� fw_policies�rI r6 r# r# r$ rL � � �z%FirewallClientConfigPolicies.__init__c C r� r[ )r rD r r: �getLockdownWhitelistrQ r# r# r$ r= % � �z1FirewallClientConfigPolicies.getLockdownWhitelistc C r� r[ )r: �setLockdownWhitelistr� r@ rk r# r# r$ r? * r� z1FirewallClientConfigPolicies.setLockdownWhitelistc C rY r[ �r: �addLockdownWhitelistCommandr r# r# r$ rA 0 rS z8FirewallClientConfigPolicies.addLockdownWhitelistCommandc C rY r[ �r: � removeLockdownWhitelistCommandr r# r# r$ rC 4 rS z;FirewallClientConfigPolicies.removeLockdownWhitelistCommandc C � t | j�|��S r[ �r r: � queryLockdownWhitelistCommandr r# r# r$ rF 8 rS z:FirewallClientConfigPolicies.queryLockdownWhitelistCommandc C � t | j�� �S r[ �r r: � getLockdownWhitelistCommandsrQ r# r# r$ rI < rx z9FirewallClientConfigPolicies.getLockdownWhitelistCommandsc C rY r[ �r: �addLockdownWhitelistContextr r# r# r$ rK B rS z8FirewallClientConfigPolicies.addLockdownWhitelistContextc C rY r[ �r: � removeLockdownWhitelistContextr r# r# r$ rM F rS z;FirewallClientConfigPolicies.removeLockdownWhitelistContextc C rD r[ �r r: � queryLockdownWhitelistContextr r# r# r$ rO J rS z:FirewallClientConfigPolicies.queryLockdownWhitelistContextc C rG r[ �r r: � getLockdownWhitelistContextsrQ r# r# r$ rQ N rx z9FirewallClientConfigPolicies.getLockdownWhitelistContextsc C rY r[ �r: �addLockdownWhitelistUserr' r# r# r$ rS T rS z5FirewallClientConfigPolicies.addLockdownWhitelistUserc C rY r[ �r: �removeLockdownWhitelistUserr' r# r# r$ rU X rS z8FirewallClientConfigPolicies.removeLockdownWhitelistUserc C rD r[ �r r: �queryLockdownWhitelistUserr' r# r# r$ rW \ rS z7FirewallClientConfigPolicies.queryLockdownWhitelistUserc C rG r[ �r r: �getLockdownWhitelistUsersrQ r# r# r$ rY ` rx z6FirewallClientConfigPolicies.getLockdownWhitelistUsersc C rG r[ �r r: �getLockdownWhitelistUidsrQ r# r# r$ r[ f rx z5FirewallClientConfigPolicies.getLockdownWhitelistUidsc C rY r[ )r: �setLockdownWhitelistUidsr- r# r# r$ r\ j rS z5FirewallClientConfigPolicies.setLockdownWhitelistUidsc C rY r[ �r: �addLockdownWhitelistUidr0 r# r# r$ r^ n rS z4FirewallClientConfigPolicies.addLockdownWhitelistUidc C rY r[ �r: �removeLockdownWhitelistUidr0 r# r# r$ r` r rS z7FirewallClientConfigPolicies.removeLockdownWhitelistUidc C rD r[ �r r: �queryLockdownWhitelistUidr0 r# r# r$ rb v rS z6FirewallClientConfigPolicies.queryLockdownWhitelistUidN)r- r. r/ r( rL r= r? rA rC rF rI rK rM rO rQ rS rU rW rY r[ r\ r^ r` rb r# r# r# r$ r5 sR r5 c @ r )/�FirewallClientDirectNc C s |r|| _ d S g g g g| _ d S r[ rr rk r# r# r$ rL } s z FirewallClientDirect.__init__c C rM rN rO rQ r# r# r$ rR � rS z FirewallClientDirect.__repr__c C rp rq rr rQ r# r# r$ � getAllChains� rt z!FirewallClientDirect.getAllChainsc s � �fdd�| j d D �S )Nc s, g | ]}|d � kr|d �kr|d �qS )r rz r r# �r r� �r� �tabler# r$ r � s �z2FirewallClientDirect.getChains.<locals>.<listcomp>r rr �rI r� rg r# rf r$ � getChains� r� z FirewallClientDirect.getChainsc C ru rq rr )rI �chainsr# r# r$ � setAllChains� rx z!FirewallClientDirect.setAllChainsc C s0 |||f}|| j d vr| j d �|� d S d S rq r �rI r� rg �chain�idxr# r# r$ �addChain� � �z FirewallClientDirect.addChainc C s0 |||f}|| j d v r| j d �|� d S d S rq r rl r# r# r$ � removeChain� rp z FirewallClientDirect.removeChainc C s |||f}|| j d v S rq rr rl r# r# r$ � queryChain� s z FirewallClientDirect.queryChainc C rp ry rr rQ r# r# r$ � getAllRules� rt z FirewallClientDirect.getAllRulesc s � ��fdd�| j d D �S )Nc s< g | ]}|d �kr |d �kr |d � kr|dd� �qS )r rz r r� Nr# re �rm r� rg r# r$ r � s �z1FirewallClientDirect.getRules.<locals>.<listcomp>rz rr �rI r� rg rm r# rt r$ �getRules� r� z FirewallClientDirect.getRulesc C ru ry rr r r# r# r$ � setAllRules� rx z FirewallClientDirect.setAllRulesc C s4 |||||f}|| j d vr| j d �|� d S d S ry r �rI r� rg rm rs r rn r# r# r$ �addRule� � �z FirewallClientDirect.addRulec C s4 |||||f}|| j d v r| j d �|� d S d S ry r rx r# r# r$ � removeRule� rz z FirewallClientDirect.removeRulec C sL t | jd �D ] }|d |kr#|d |kr#|d |kr#| jd �|� qd S )Nrz r r )rD r@ r� rl r# r# r$ � removeRules� s $��z FirewallClientDirect.removeRulesc C s |||||f}|| j d v S ry rr rx r# r# r$ � queryRule� r z FirewallClientDirect.queryRulec C rp r~ rr rQ r# r# r$ �getAllPassthroughs� rt z'FirewallClientDirect.getAllPassthroughsc C ru r~ rr )rI � passthroughsr# r# r$ �setAllPassthroughs� rx z'FirewallClientDirect.setAllPassthroughsc C s g | j d< d S r~ rr rQ r# r# r$ �removeAllPassthroughs� rx z*FirewallClientDirect.removeAllPassthroughsc s � fdd�| j d D �S )Nc s g | ] }|d � kr|d �qS )r rz r# re �r� r# r$ r � s �z8FirewallClientDirect.getPassthroughs.<locals>.<listcomp>r rr r� r# r� r$ �getPassthroughs� � z$FirewallClientDirect.getPassthroughsc C s. ||f}|| j d vr| j d �|� d S d S r~ r �rI r� r rn r# r# r$ �addPassthrough� � �z#FirewallClientDirect.addPassthroughc C s. ||f}|| j d v r| j d �|� d S d S r~ r r� r# r# r$ �removePassthrough� r� z&FirewallClientDirect.removePassthroughc C s ||f}|| j d v S r~ rr r� r# r# r$ �queryPassthrough� s z%FirewallClientDirect.queryPassthroughr[ )r- r. r/ r( rL rR rd ri rk ro rq rr rs rv rw ry r{ r| r} r~ r� r� r� r� r� r� r# r# r# r$ rc | sZ rc c @ s� e Zd Zedd� �Zedd� �Zedd� �Zedd� �Zed d � �Zed d � �Z ed d� �Z edd� �Z edd� �Z edd� �Z edd� �Zedd� �Zedd� �Zedd � �Zed d � �Zed d � �Zed!d"� �Zed#d$� �Zed%d&� �Zd'S )(�FirewallClientConfigDirectc C r6 r7 ) r6 r8 r r r9 r8 r: r; � DBUS_INTERFACE_CONFIG_DIRECT� fw_directr; r# r# r$ rL � r< z#FirewallClientConfigDirect.__init__c C r� r[ )rc rD r r� rR rQ r# r# r$ rR � r> z&FirewallClientConfigDirect.getSettingsc C r� r[ )r� rU r� r@ rk r# r# r$ rU � r� z!FirewallClientConfigDirect.updatec C � | j �|||� d S r[ �r� ro ru r# r# r$ ro � rV z#FirewallClientConfigDirect.addChainc C r� r[ �r� rq ru r# r# r$ rq � rV z&FirewallClientConfigDirect.removeChainc C � t | j�|||��S r[ �r r� rr ru r# r# r$ rr � rV z%FirewallClientConfigDirect.queryChainc C � t | j�||��S r[ �r r� ri rh r# r# r$ ri � r� z$FirewallClientConfigDirect.getChainsc C rG r[ �r r� rd rQ r# r# r$ rd rx z'FirewallClientConfigDirect.getAllChainsc C � | j �|||||� d S r[ �r� ry �rI r� rg rm rs r r# r# r$ ry r� z"FirewallClientConfigDirect.addRulec C r� r[ �r� r{ r� r# r# r$ r{ r� z%FirewallClientConfigDirect.removeRulec C r� r[ �r� r| ru r# r# r$ r| rV z&FirewallClientConfigDirect.removeRulesc C � t | j�|||||��S r[ �r r� r} r� r# r# r$ r} r� z$FirewallClientConfigDirect.queryRulec C r� r[ �r r� rv ru r# r# r$ rv rV z#FirewallClientConfigDirect.getRulesc C rG r[ �r r� rs rQ r# r# r$ rs rx z&FirewallClientConfigDirect.getAllRulesc C r` r[ �r� r� �rI r� r r# r# r$ r� # r� z)FirewallClientConfigDirect.addPassthroughc C r` r[ �r� r� r� r# r# r$ r� ' r� z,FirewallClientConfigDirect.removePassthroughc C r� r[ �r r� r� r� r# r# r$ r� + r� z+FirewallClientConfigDirect.queryPassthroughc C rD r[ �r r� r� r� r# r# r$ r� / rS z*FirewallClientConfigDirect.getPassthroughsc C rG r[ �r r� r~ rQ r# r# r$ r~ 3 rx z-FirewallClientConfigDirect.getAllPassthroughsN)r- r. r/ r( rL rR rU ro rq rr ri rd ry r{ r| r} rv rs r� r� r� r� r~ r# r# r# r$ r� � sN r� c @ s� e Zd Zedd� �Zedd� �Zedd� �Zedd� �Zed d � �Zed d � �Z ed d� �Z edd� �Z edd� �Z edd� �Z edd� �Zedd� �Zedd� �Zedd � �Zed d � �Zed d � �Zed!d"� �Zed#d$� �Zed%d&� �Zed'd(� �Zed)d*� �Zed+d,� �Zed-d.� �Zed/d0� �Zed1d2� �Z ed3d4� �Z ed5d6� �Z ed7d8� �Z ed9d:� �Z ed;d<� �Z!ed=d>� �Z"ed?d@� �Z#edAdB� �Z$edCdD� �Z%edEdF� �Z&edGdH� �Z'edIdJ� �Z(edKdL� �Z)dMS )N�FirewallClientConfigc C sb || _ | j �tjjtjj�| _tj| jtjjd�| _ tj| jdd�| _ t | j �| _ t | j �| _d S r2 )r6 r8 r r r9 r8 r: r; �DBUS_INTERFACE_CONFIG� fw_configr> r5 � _policiesr� �_directr; r# r# r$ rL : s ��� z FirewallClientConfig.__init__c C rA r[ )r r> rB r r r� rC r# r# r$ rE I rF z!FirewallClientConfig.get_propertyc C rG r[ )r r> rH r r r� rQ r# r# r$ rI N rJ z#FirewallClientConfig.get_propertiesc C rK r[ )r> rL r r r� rM r# r# r$ rN S r� z!FirewallClientConfig.set_propertyc C rG r[ )r r� � getIPSetNamesrQ r# r# r$ r� Y rx z"FirewallClientConfig.getIPSetNamesc C rG r[ )r r� � listIPSetsrQ r# r# r$ r� ] rx z FirewallClientConfig.listIPSetsc C � t | j|�S r[ )r� r6 �rI r7 r# r# r$ �getIPSeta r_ z FirewallClientConfig.getIPSetc C � t | j�|��}t| j|�S r[ )r r� �getIPSetByNamer� r6 �rI r\ r7 r# r# r$ r� e � z#FirewallClientConfig.getIPSetByNamec C �> t |t�r| j�|t|j��}n | j�|t|��}t| j|�S r[ )rC r� r� �addIPSetr� r@ r� r6 �rI r\ r@ r7 r# r# r$ r� j � z FirewallClientConfig.addIPSetc C rG r[ )r r� � getZoneNamesrQ r# r# r$ r� t rx z!FirewallClientConfig.getZoneNamesc C rG r[ )r r� � listZonesrQ r# r# r$ r� x rx z FirewallClientConfig.listZonesc C r� r[ )r0 r6 r� r# r# r$ �getZone| r_ z FirewallClientConfig.getZonec C r� r[ )r r� � getZoneByNamer0 r6 r� r# r# r$ r� � r� z"FirewallClientConfig.getZoneByNamec C rD r[ )r r� �getZoneOfInterface)rI �ifacer# r# r$ r� � rS z'FirewallClientConfig.getZoneOfInterfacec C rD r[ )r r� �getZoneOfSourcer r# r# r$ r� � rS z$FirewallClientConfig.getZoneOfSourcec C s^ t |t�r| j�||�� �}nt |t�r | j�||�}n | j�|t|d d� ��}t| j |�S r� ) rC r) r� �addZone2rh rF �addZoner� r0 r6 r� r# r# r$ r� � s z FirewallClientConfig.addZonec C rG r[ )r r� �getPolicyNamesrQ r# r# r$ r� � rx z#FirewallClientConfig.getPolicyNamesc C rG r[ )r r� � listPoliciesrQ r# r# r$ r� � rx z!FirewallClientConfig.listPoliciesc C r� r[ )r� r6 r� r# r# r$ � getPolicy� r_ z FirewallClientConfig.getPolicyc C r� r[ )r r� �getPolicyByNamer� r6 r� r# r# r$ r� � r� z$FirewallClientConfig.getPolicyByNamec C s8 t |t�r| j�||�� �}n| j�||�}t| j|�S r[ )rC rp r� � addPolicyrh r� r6 r� r# r# r$ r� � s z FirewallClientConfig.addPolicyc C rG r[ )r r� �getServiceNamesrQ r# r# r$ r� � rx z$FirewallClientConfig.getServiceNamesc C rG r[ )r r� � listServicesrQ r# r# r$ r� � rx z!FirewallClientConfig.listServicesc C r� r[ )r� r6 r� r# r# r$ � getService� r_ z FirewallClientConfig.getServicec C r� r[ )r r� �getServiceByNamer� r6 r� r# r# r$ r� � r� z%FirewallClientConfig.getServiceByNamec C s` t |t�r| j�||�� �}nt|�tu r | j�||�}n | j�|t|d d� ��}t | j |�S r� ) rC r� r� � addService2rh rc rF r� r� r� r6 r� r# r# r$ r� � s z FirewallClientConfig.addServicec C rG r[ )r r� �getIcmpTypeNamesrQ r# r# r$ r� � rx z%FirewallClientConfig.getIcmpTypeNamesc C rG r[ )r r� � listIcmpTypesrQ r# r# r$ r� � rx z"FirewallClientConfig.listIcmpTypesc C r� r[ )r r6 r� r# r# r$ � getIcmpType� r_ z FirewallClientConfig.getIcmpTypec C r� r[ )r r� �getIcmpTypeByNamer r6 r� r# r# r$ r� � r� z&FirewallClientConfig.getIcmpTypeByNamec C r� r[ )rC r r� � addIcmpTyper� r@ r r6 r� r# r# r$ r� � r� z FirewallClientConfig.addIcmpTypec C ru r[ )r� rQ r# r# r$ �policies� rv z FirewallClientConfig.policiesc C ru r[ )r� rQ r# r# r$ �direct� rv zFirewallClientConfig.directc C rG r[ )r r� �getHelperNamesrQ r# r# r$ r� � rx z#FirewallClientConfig.getHelperNamesc C rG r[ )r r� � listHelpersrQ r# r# r$ r� � rx z FirewallClientConfig.listHelpersc C r� r[ )r� r6 r� r# r# r$ � getHelper r_ z FirewallClientConfig.getHelperc C r� r[ )r r� �getHelperByNamer� r6 r� r# r# r$ r� r� z$FirewallClientConfig.getHelperByNamec C r� r[ )rC r� r� r� r� r@ r� r6 r� r# r# r$ r� r� z FirewallClientConfig.addHelperN)*r- r. r/ r( rL rE rI rN r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r# r# r# r$ r� 9 s� r� c @ s� e Zd Ze�ddd��Zedd� �Zedd � �Zed d � �Zed d � �Zedd� �Z edd� �Z edd� �Z edd� �Z edd� �Z edd� �Zedd� �Zed d � �Zed d � �Zed d!� �Zed"d#� �Zed$d%� �Zed&d'� �Zed(d)� �Zed*d+� �Zed,d-� �Zed.d/� �Zed0d1� �Zed2d3� �Zed4d5� �Z ed6d7� �Z ed8d9� �Z ed:d;� �Z ed<d=� �Z ed>d?� �Z!ed@dA� �Z"edBdC� �Z#edDdE� �Z$edFdG� �Z%edHdI� �Z&edJdK� �Z'edLdM� �Z(edNdO� �Z)edPdQ� �Z*edRdS� �Z+edTdU� �Z,edVdW� �Z-edXdY� �Z.edZd[� �Z/ed\d]� �Z0ed^d_� �Z1ed`da� �Z2edbdc� �Z3eddde� �Z4edfdg� �Z5edhdi� �Z6edjdk� �Z7edldm� �Z8edndo� �Z9edpdq� �Z:edrds� �Z;edtdu� �Z<edvdw� �Z=edxdy� �Z>edzd{� �Z?ed|d}� �Z@ed~d� �ZAed�d�� �ZBed�d�� �ZCe�dd�d���ZDed�d�� �ZEed�d�� �ZFed�d�� �ZGe�dd�d���ZHed�d�� �ZIed�d�� �ZJed�d�� �ZKe�dd�d���ZLed�d�� �ZMed�d�� �ZNed�d�� �ZOe�dd�d���ZPed�d�� �ZQed�d�� �ZRed�d�� �ZSed�d�� �ZTed�d�� �ZUed�d�� �ZVe�dd�d���ZWed�d�� �ZXed�d�� �ZYe �dd�d���ZZed�d�� �Z[ed�d�� �Z\ed�d�� �Z]e�dd�d���Z^ed�d�� �Z_ed�d�� �Z`ed�d�� �Zae�dd�d���Zbed�dÄ �Zced�dń �Zded�dDŽ �Zeed�dɄ �Zfed�d˄ �Zged�d̈́ �Zhed�dτ �Zied�dф �Zjed�dӄ �Zked�dՄ �Zled�dׄ �Zmed�dل �Zned�dۄ �Zoed�d݄ �Zped�d߄ �Zqed�d� �Zred�d� �Zsed�d� �Zted�d� �Zued�d� �Zved�d� �Zwed�d� �Zxed�d� �Zyed�d� �Zzed�d� �Z{ed�d�� �Z|ed�d�� �Z}ed�d�� �Z~ed�d�� �Zed�d�� �Z�ed�d�� �Z�e�d �d� �Z�e�d�d� �Z�e�d�d� �Z�e�d�d� �Z�e�d�d � �Z�e�d �d � �Z�e�d �d � �Z�e�d�d� �Z�e�d�d� �Z�e�d�d� �Z�e�d�d� �Z�e�d�d� �Z�e�d�d� �Z�dS ( �FirewallClientNr Tc C s� |s(t jjjdd� zt �� | _W n t jjy' } ztt j |� � ��d }~ww || _| jj | j ddtj jd� tj jtj jtj jtj jtj jtj jtj jtj jtj jtj jtj jtj jtj jtj j tj j fD ]}| jj | j |dddd � qgi | _ i d d �d d �d d �d d�dd�dd�dd�dd�dd�dd�dd �d d �d d �d!d"�d#d$�d%d&�d'd(�i d)d*�d+d,�d-d.�d/d0�d1d2�d3d4�d5d6�d7d8�d9d:�d;d<�d=d>�d?d@�dAd@�dBdC�dDdE�dFdG�dHdI��i dJdK�dLdM�dNdO�dPdQ�dRdS�dTdU�dVdW�dXdY�dZd[�d\d]�d^d_�d`da�dbdc�ddde�dfdg�dhdi�djdk��i dldm�dndo�dpdq�drds�dtdu�dvdw�dxdy�dzd{�d|d}�d~d�d�d��d�d��d�d��d�d��d�d��d�d��d�d���d�d�d�d�d�d�d�d�d�d�d�d�� �| _ | �!� || _"|d�k�rqt#�$|| j%� d S | �%� d S )�NT)�set_as_default�NameOwnerChangedzorg.freedesktop.DBus)�handler_function� signal_namer4 �arg0r �memberr7 )r4 �interface_keyword�member_keyword� path_keyword�connection-changed�connection-established�connection-lostzlog-denied-changed�LogDeniedChangedzdefault-zone-changed�DefaultZoneChangedzpanic-mode-enabled�PanicModeEnabledzpanic-mode-disabled�PanicModeDisabled�reloaded�Reloadedz service-added� ServiceAddedzservice-removed�ServiceRemovedz port-added� PortAddedz port-removed� PortRemovedzsource-port-added�SourcePortAddedzsource-port-removed�SourcePortRemovedzprotocol-added� ProtocolAddedzprotocol-removed�ProtocolRemovedzmasquerade-added�MasqueradeAddedzmasquerade-removed�MasqueradeRemovedzforward-port-added�ForwardPortAddedzforward-port-removed�ForwardPortRemovedzicmp-block-added�IcmpBlockAddedzicmp-block-removed�IcmpBlockRemovedzicmp-block-inversion-added�IcmpBlockInversionAddedz icmp-block-inversion-removed�IcmpBlockInversionRemovedzrichrule-added� RichRuleAddedzrichrule-removed�RichRuleRemovedzinterface-added�InterfaceAddedzinterface-removed�InterfaceRemovedz zone-changed�ZoneOfInterfaceChangedzzone-of-interface-changedz source-added� SourceAddedzsource-removed� SourceRemovedzzone-of-source-changed�ZoneOfSourceChangedz zone-updated� ZoneUpdatedzpolicy-updated� PolicyUpdatedzipset-entry-added� EntryAddedzipset-entry-removed� EntryRemovedzdirect:chain-added� ChainAddedzdirect:chain-removed� ChainRemovedzdirect:rule-added� RuleAddedzdirect:rule-removed� RuleRemovedzdirect:passthrough-added�PassthroughAddedzdirect:passthrough-removed�PassthroughRemovedzconfig:direct:updatedzconfig:direct:Updatedzlockdown-enabled�LockdownEnabledzlockdown-disabled�LockdownDisabledz lockdown-whitelist-command-added� LockdownWhitelistCommandAddedz"lockdown-whitelist-command-removed� LockdownWhitelistCommandRemovedz lockdown-whitelist-context-added� LockdownWhitelistContextAddedz"lockdown-whitelist-context-removed� LockdownWhitelistContextRemovedz lockdown-whitelist-uid-added�LockdownWhitelistUidAddedz lockdown-whitelist-uid-removed�LockdownWhitelistUidRemovedz lockdown-whitelist-user-added�LockdownWhitelistUserAddedz lockdown-whitelist-user-removed� LockdownWhitelistUserRemovedz*config:policies:lockdown-whitelist-updatedz(config:policies:LockdownWhitelistUpdatedzconfig:ipset-addedzconfig:IPSetAddedzconfig:ipset-updatedzconfig:IPSetUpdatedzconfig:ipset-removedzconfig:IPSetRemovedzconfig:ipset-renamedzconfig:IPSetRenamedzconfig:zone-addedzconfig:ZoneAddedzconfig:zone-updatedzconfig:ZoneUpdatedzconfig:zone-removedzconfig:ZoneRemovedzconfig:zone-renamedzconfig:ZoneRenamedzconfig:policy-addedzconfig:PolicyAddedzconfig:policy-updatedzconfig:PolicyUpdatedzconfig:policy-removedzconfig:PolicyRemovedzconfig:policy-renamedzconfig:PolicyRenamedzconfig:service-addedzconfig:ServiceAddedzconfig:ServiceUpdatedzconfig:ServiceRemovedzconfig:ServiceRenamedzconfig:IcmpTypeAddedzconfig:IcmpTypeUpdatedzconfig:IcmpTypeRemovedzconfig:IcmpTypeRenamedzconfig:HelperAddedzconfig:HelperUpdatedzconfig:HelperRemovedzconfig:HelperRenamed) zconfig:service-updatedzconfig:service-removedzconfig:service-renamedzconfig:icmptype-addedzconfig:icmptype-updatedzconfig:icmptype-removedzconfig:icmptype-renamedzconfig:helper-addedzconfig:helper-updatedzconfig:helper-removedzconfig:helper-renamedr )&r �mainloop�glib� DBusGMainLoop� SystemBusr6 r r r r � DBUS_ERRORr �add_signal_receiver�_dbus_connection_changedr r9 �DBUS_INTERFACE_IPSET�DBUS_INTERFACE_ZONE�DBUS_INTERFACE_POLICY�DBUS_INTERFACE_DIRECT�DBUS_INTERFACE_POLICIESr� r� r< r� r� r� r� r r9 �_signal_receiver� _callback� _callbacks� _init_vars�quietr �timeout_add_seconds�_connection_established)rI r6 �waitr# r r r# r# r$ rL s� ����� ������� � � � � ��������������� � � � � �!�"�#�$�%�'�(�*�+�,�-�.�/�0�2�3�4�5�6�7�8�9�:�;�=�>�?�@�A�B�C�D�E�F�G�H�I�J�K �Y zFirewallClient.__init__c C s: d | _ d | _d | _d | _d | _d | _d | _d | _d| _d S )NF) �fwr� r= r� r� r� r> �_config� connectedrQ r# r# r$ r" � s zFirewallClient._init_varsc C � t S r[ �r rQ r# r# r$ �getExceptionHandler� � z"FirewallClient.getExceptionHandlerc C � |a d S r[ r+ )rI �handlerr# r# r$ �setExceptionHandler� � z"FirewallClient.setExceptionHandlerc C r* r[ �r rQ r# r# r$ �getNotAuthorizedLoop� r- z#FirewallClient.getNotAuthorizedLoopc C r. r[ r2 )rI �enabler# r# r$ �setNotAuthorizedLoop� r1 z#FirewallClient.setNotAuthorizedLoopc G s. || j v r||f| j| j | < d S td| ��)NzUnknown callback name '%s')r! r � ValueError)rI r\ �callbackr r# r# r$ �connect� s zFirewallClient.connectc C s, |t jjkrd S |r| �� d S | �� d S r[ )r r r9 r% �_connection_lost)rI r\ � old_owner� new_ownerr# r# r$ r � s z'FirewallClient._dbus_connection_changedc C s` zY| j �tjjtjj�| _tj| jtjjd�| _tj| jtjj d�| _ tj| jtjj d�| _ tj| jtjj d�| _tj| jtjjd�| _tj| jtjjd�| _tj| jdd�| _W n9 tjjyx } z| jsmtd|�� � W Y d }~d S d }~w ty� } z| js�td|� W Y d }~d S d }~ww t| j �| _d| _ | j dtjjd� | j dtjjd� d S ) Nr3 r5 r r Tr� �r� r r� ) r6 r8 r r r9 � DBUS_PATHr: r; r' r r� r r= r r� r r� r r: r> r r r# �printr r r� r( r) r )rI r r# r# r$ r% � s^ �� ��� �� �� �� � �z&FirewallClient._connection_establishedc C s0 | � � | jdtjjd� | jdtjjd� d S )Nr� r< r� )r" r r r r9 rQ r# r# r$ r9 � s � �z FirewallClient._connection_lostc O s� d|vsd|vr d S |d }|d }|� tjj�r d| }|� tjj�r)d| }nP|� tjj�r5d| }nD|� tjj�rAd| }n8|� tjj�rMd| }n,|� tjj�rYd| }n |tjj krdd | }n|tjj krod | }n |tjj kryd | }d }| j D ]}| j | |kr�| j | | j v r�| j | j | }q~|d u r�d S d d � |D �}z|d r�|�|d � |d |� W d S ty� } z t|� W Y d }~d S d }~ww )Nr� r z config:Zonez config:Policyz config:IPSetzconfig:Servicezconfig:IcmpTypez config:Helperzconfig:zconfig:policies:zconfig:direct:c S s g | ]}t |��qS r# r )r �argr# r# r$ r % s z3FirewallClient._signal_receiver.<locals>.<listcomp>rz r )� startswithr r r< r� r� r� r r� r� r9 r� r! r �extendr r> ) rI r r �signalr �cbr7 �cb_args�msgr# r# r$ r � sN ���z FirewallClient._signal_receiverc C ru r[ )r( rQ r# r# r$ r / rv zFirewallClient.configc C rW r[ )r' �reloadrQ r# r# r$ rF 3 rx zFirewallClient.reloadc C rW r[ )r' �completeReloadrQ r# r# r$ �complete_reload7 rx z FirewallClient.complete_reloadc C rW r[ )r' �runtimeToPermanentrQ r# r# r$ rI ; rx z!FirewallClient.runtimeToPermanentc C rW r[ )r' �checkPermanentConfigrQ r# r# r$ rJ ? rx z#FirewallClient.checkPermanentConfigc C rA r[ )r r> rB r r r9 rC r# r# r$ rE C rF zFirewallClient.get_propertyc C rG r[ )r r> rH r r r9 rQ r# r# r$ rI H rJ z FirewallClient.get_propertiesc C rK r[ )r> rL r r r9 rM r# r# r$ rN M r� zFirewallClient.set_propertyc C rW r[ )r' �enablePanicModerQ r# r# r$ rK S rx z FirewallClient.enablePanicModec C rW r[ )r' �disablePanicModerQ r# r# r$ rL W rx z FirewallClient.disablePanicModec C rG r[ )r r' �queryPanicModerQ r# r# r$ rM [ rx z FirewallClient.queryPanicModec C � t t| j�|���S r[ )r) r r= �getZoneSettings2�rI �zoner# r# r$ �getZoneSettingsa rV z FirewallClient.getZoneSettingsc C rG r[ )r r� � getIPSetsrQ r# r# r$ rS e rx zFirewallClient.getIPSetsc C � t tt| j�|����S r[ )r� rD r r� �getIPSetSettings�rI �ipsetr# r# r$ rU i � �z FirewallClient.getIPSetSettingsc C r` r[ r� �rI rW r� r# r# r$ r� n r� zFirewallClient.addEntryc C r^ r[ r� rV r# r# r$ r� r r_ zFirewallClient.getEntriesc C ra r[ r� )rI rW r� r# r# r$ r� v rx zFirewallClient.setEntriesc C r` r[ r� rY r# r# r$ r� z r� zFirewallClient.removeEntryc C r� r[ )r r� r� rY r# r# r$ r� ~ r� zFirewallClient.queryEntryc C rG r[ )r r' r� rQ r# r# r$ r� � rx zFirewallClient.listServicesc C rN r[ )r� r r' �getServiceSettings2r� r# r# r$ �getServiceSettings� s �z!FirewallClient.getServiceSettingsc C rG r[ )r r' r� rQ r# r# r$ r� � rx z FirewallClient.listIcmpTypesc C rT r[ )r rD r r' �getIcmpTypeSettingsr� r# r# r$ r\ � rX z"FirewallClient.getIcmpTypeSettingsc C rG r[ )r r' r� rQ r# r# r$ r� � rx zFirewallClient.getHelpersc C rT r[ )r� rD r r' �getHelperSettingsr� r# r# r$ r] � rX z FirewallClient.getHelperSettingsc C rG r[ )r r' �getAutomaticHelpersrQ r# r# r$ r^ � rx z"FirewallClient.getAutomaticHelpersc C rY r[ )r' �setAutomaticHelpers�rI rX r# r# r$ r_ � rS z"FirewallClient.setAutomaticHelpersc C rG r[ )r r' � getLogDeniedrQ r# r# r$ ra � rx zFirewallClient.getLogDeniedc C rY r[ )r' � setLogDeniedr` r# r# r$ rb � rS zFirewallClient.setLogDeniedc C rG r[ )r r' �getDefaultZonerQ r# r# r$ rc � rx z FirewallClient.getDefaultZonec C rY r[ )r' �setDefaultZonerP r# r# r$ rd � rS z FirewallClient.setDefaultZonec C � | j �||�� � d S r[ )r= �setZoneSettings2ro )rI rQ r@ r# r# r$ �setZoneSettings� r� z FirewallClient.setZoneSettingsc C rG r[ )r r= �getZonesrQ r# r# r$ rh � rx zFirewallClient.getZonesc C rG r[ )r r= �getActiveZonesrQ r# r# r$ ri � rx z FirewallClient.getActiveZonesc C rD r[ )r r= r� r r# r# r$ r� � rS z!FirewallClient.getZoneOfInterfacec C rD r[ )r r= r� r r# r# r$ r� � rS z FirewallClient.getZoneOfSourcec C rD r[ )r r= � isImmutablerP r# r# r$ rj � rS zFirewallClient.isImmutablec C rN r[ )rp r r� �getPolicySettings�rI �policyr# r# r$ rk � rV z FirewallClient.getPolicySettingsc C re r[ )r� �setPolicySettingsro )rI rm r@ r# r# r$ rn � r� z FirewallClient.setPolicySettingsc C rG r[ )r r� � getPoliciesrQ r# r# r$ ro � rx zFirewallClient.getPoliciesc C rG r[ )r r� �getActivePoliciesrQ r# r# r$ rp � rx z FirewallClient.getActivePoliciesc C rD r[ )r r� rj rl r# r# r$ �isPolicyImmutable� rS z FirewallClient.isPolicyImmutablec C r� r[ )r r= r �rI rQ r r# r# r$ r � r� zFirewallClient.addInterfacec C r� r[ )r r= � changeZonerr r# r# r$ rs � r� zFirewallClient.changeZonec C r� r[ )r r= �changeZoneOfInterfacerr r# r# r$ rt � s �z$FirewallClient.changeZoneOfInterfacec C rD r[ )r r= r� rP r# r# r$ r� � rS z FirewallClient.getInterfacesc C r� r[ )r r= r rr r# r# r$ r � r� z FirewallClient.queryInterfacec C r� r[ )r r= r rr r# r# r$ r r� z FirewallClient.removeInterfacec C r� r[ )r r= r �rI rQ r r# r# r$ r r� zFirewallClient.addSourcec C r� r[ )r r= �changeZoneOfSourceru r# r# r$ rv r� z!FirewallClient.changeZoneOfSourcec C rD r[ )r r= r rP r# r# r$ r rS zFirewallClient.getSourcesc C r� r[ )r r= r ru r# r# r$ r r� zFirewallClient.querySourcec C r� r[ )r r= r ru r# r# r$ r r� zFirewallClient.removeSourcec C r� r[ )r r= r% )rI rQ r$ r� r# r# r$ r% rV zFirewallClient.addRichRulec C rD r[ )r r= r rP r# r# r$ r " rS zFirewallClient.getRichRulesc C r� r[ )r r= r, �rI rQ r$ r# r# r$ r, & r� z FirewallClient.queryRichRulec C r� r[ )r r= r) rw r# r# r$ r) * r� z FirewallClient.removeRichRulec C r� r[ )r r= r� )rI rQ r� r� r# r# r$ r� 0 rV zFirewallClient.addServicec C rD r[ )r r= r� rP r# r# r$ r� 4 rS zFirewallClient.getServicesc C r� r[ )r r= r� �rI rQ r� r# r# r$ r� 8 r� zFirewallClient.queryServicec C r� r[ )r r= r� rx r# r# r$ r� < r� z FirewallClient.removeServicec C � t | j�||||��S r[ )r r= r� �rI rQ r� r� r� r# r# r$ r� B r� zFirewallClient.addPortc C rD r[ )r r= r� rP r# r# r$ r� F rS zFirewallClient.getPortsc C r� r[ )r r= r� �rI rQ r� r� r# r# r$ r� J rV zFirewallClient.queryPortc C r� r[ )r r= r� r{ r# r# r$ r� N rV zFirewallClient.removePortc C r� r[ )r r= r� )rI rQ r� r� r# r# r$ r� T rV zFirewallClient.addProtocolc C rD r[ )r r= r� rP r# r# r$ r� X rS zFirewallClient.getProtocolsc C r� r[ )r r= r� �rI rQ r� r# r# r$ r� \ r� z FirewallClient.queryProtocolc C r� r[ )r r= r� r| r# r# r$ r� ` r� z FirewallClient.removeProtocolc C � | j �|ddi� d S ri �r= rf rP r# r# r$ r� f r� zFirewallClient.addForwardc C s t | j�|��d S re )r r= rO rP r# r# r$ r� j rV zFirewallClient.queryForwardc C r} rj r~ rP r# r# r$ r� n r� z FirewallClient.removeForwardc C r� r[ )r r= r� )rI rQ r� r# r# r$ r� t r� z FirewallClient.addMasqueradec C rD r[ )r r= r� rP r# r# r$ r� x rS z FirewallClient.queryMasqueradec C rD r[ )r r= r� rP r# r# r$ r� | rS z FirewallClient.removeMasqueradec C s2 |d u rd}|d u r d}t | j�||||||��S rl )r r= r� )rI rQ r� r� rn ro r� r# r# r$ r� � s �z FirewallClient.addForwardPortc C rD r[ )r r= r� rP r# r# r$ r� � rS z FirewallClient.getForwardPortsc C �0 |d u rd}|d u r d}t | j�|||||��S rl )r r= r� �rI rQ r� r� rn ro r# r# r$ r� � � �z FirewallClient.queryForwardPortc C r rl )r r= r� r� r# r# r$ r� � r� z FirewallClient.removeForwardPortc C ry r[ )r r= r� rz r# r# r$ r� � s �z FirewallClient.addSourcePortc C rD r[ )r r= r� rP r# r# r$ r� � rS z FirewallClient.getSourcePortsc C r� r[ )r r= r� r{ r# r# r$ r� � rV z FirewallClient.querySourcePortc C r� r[ )r r= r� r{ r# r# r$ r� � s �z FirewallClient.removeSourcePortc C r� r[ )r r= r� )rI rQ �icmpr� r# r# r$ r� � rV zFirewallClient.addIcmpBlockc C rD r[ )r r= r� rP r# r# r$ r� � rS z FirewallClient.getIcmpBlocksc C r� r[ )r r= r� �rI rQ r� r# r# r$ r� � r� z FirewallClient.queryIcmpBlockc C r� r[ )r r= r� r� r# r# r$ r� � r� z FirewallClient.removeIcmpBlockc C rD r[ )r r= r� rP r# r# r$ r� � rS z$FirewallClient.addIcmpBlockInversionc C rD r[ )r r= r� rP r# r# r$ r� � rS z&FirewallClient.queryIcmpBlockInversionc C rD r[ )r r= r� rP r# r# r$ r� � rS z'FirewallClient.removeIcmpBlockInversionc C r� r[ r� ru r# r# r$ ro � rV zFirewallClient.addChainc C r� r[ r� ru r# r# r$ rq � rV zFirewallClient.removeChainc C r� r[ r� ru r# r# r$ rr � rV zFirewallClient.queryChainc C r� r[ r� rh r# r# r$ ri � r� zFirewallClient.getChainsc C rG r[ r� rQ r# r# r$ rd � rx zFirewallClient.getAllChainsc C r� r[ r� r� r# r# r$ ry � r� zFirewallClient.addRulec C r� r[ r� r� r# r# r$ r{ � r� zFirewallClient.removeRulec C r� r[ r� ru r# r# r$ r| � rV zFirewallClient.removeRulesc C r� r[ r� r� r# r# r$ r} � r� zFirewallClient.queryRulec C r� r[ r� ru r# r# r$ rv rV zFirewallClient.getRulesc C rG r[ r� rQ r# r# r$ rs rx zFirewallClient.getAllRulesc C r� r[ )r r� � passthroughr� r# r# r$ r� r� zFirewallClient.passthroughc C rG r[ r� rQ r# r# r$ r~ rx z!FirewallClient.getAllPassthroughsc C rW r[ )r� r� rQ r# r# r$ r� rx z$FirewallClient.removeAllPassthroughsc C rD r[ r� r� r# r# r$ r� rS z FirewallClient.getPassthroughsc C r` r[ r� r� r# r# r$ r� r� z FirewallClient.addPassthroughc C r` r[ r� r� r# r# r$ r� ! r� z FirewallClient.removePassthroughc C r� r[ r� r� r# r# r$ r� % r� z FirewallClient.queryPassthroughc C rW r[ )r: �enableLockdownrQ r# r# r$ r� + rx z FirewallClient.enableLockdownc C rW r[ )r: �disableLockdownrQ r# r# r$ r� / rx z FirewallClient.disableLockdownc C rG r[ )r r: � queryLockdownrQ r# r# r$ r� 3 rx z FirewallClient.queryLockdownc C rY r[ r@ r r# r# r$ rA ; rS z*FirewallClient.addLockdownWhitelistCommandc C rG r[ rH rQ r# r# r$ rI ? rx z+FirewallClient.getLockdownWhitelistCommandsc C rD r[ rE r r# r# r$ rF C rS z,FirewallClient.queryLockdownWhitelistCommandc C rY r[ rB r r# r# r$ rC G rS z-FirewallClient.removeLockdownWhitelistCommandc C rY r[ rJ r r# r# r$ rK M rS z*FirewallClient.addLockdownWhitelistContextc C rG r[ rP rQ r# r# r$ rQ Q rx z+FirewallClient.getLockdownWhitelistContextsc C rD r[ rN r r# r# r$ rO U rS z,FirewallClient.queryLockdownWhitelistContextc C rY r[ rL r r# r# r$ rM Y rS z-FirewallClient.removeLockdownWhitelistContextc C rY r[ r] r0 r# r# r$ r^ _ rS z&FirewallClient.addLockdownWhitelistUidc C rG r[ rZ rQ r# r# r$ r[ c rx z'FirewallClient.getLockdownWhitelistUidsc C rD r[ ra r0 r# r# r$ rb g rS z(FirewallClient.queryLockdownWhitelistUidc C rY r[ r_ r0 r# r# r$ r` k rS z)FirewallClient.removeLockdownWhitelistUidc C rY r[ rR r' r# r# r$ rS q rS z'FirewallClient.addLockdownWhitelistUserc C rG r[ rX rQ r# r# r$ rY u rx z(FirewallClient.getLockdownWhitelistUsersc C rD r[ rV r' r# r# r$ rW y rS z)FirewallClient.queryLockdownWhitelistUserc C rY r[ rT r' r# r# r$ rU } rS z*FirewallClient.removeLockdownWhitelistUserc C s | j �� dS )z( Authorize once for all polkit actions. N)r' � authorizeAllrQ r# r# r$ r� � s zFirewallClient.authorizeAll)Nr T)r )�r- r. r/ r( rL r" r, r0 r3 r5 r8 r r% r9 r r rF rH rI rJ rE rI rN rK rL rM rR rS rU r� r� r� r� r� r� r[ r� r\ r� r] r^ r_ ra rb rc rd rg rh ri r� r� rj rk rn ro rp rq r rs rt r� r r r rv r r r r% r r, r) r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� ro rq rr ri rd ry r{ r| r} rv rs r� r~ r� r� r� r� r� r� r� r� rA rI rF rC rK rQ rO rM r^ r[ rb r` rS rY rW rU r� r# r# r# r$ r� s2 % / � r� )-� gi.repositoryr �dbus.mainloop.glibr r& �firewallr �firewall.core.baser r r �firewall.dbus_utilsr �firewall.core.richr �firewall.core.ipsetr r r r �firewall.errorsr r r r r( �objectr) r0 rp r� r� r� r� r� r� r� r r r r5 rc r� r� r� r# r# r# r$ �<module> sV ) n O0 ghfK| ]CgVab[ [PK ���Z ;A] & __pycache__/dbus_utils.cpython-310.pycnu �[��� o bhAb�$ � @ s� g d �Z ddlZddlZddlmZ ddlmZ dd� Zdd� Zd d � Z d d � Z d d� Z dd� Z dd� Z d dd�Zdd� Zd dd�Zdd� Zdd � ZdS ) ) �command_of_pid� pid_of_sender� uid_of_sender� user_of_uid�context_of_sender�command_of_sender�user_of_sender�dbus_to_python�dbus_signature�%dbus_introspection_prepare_properties�!dbus_introspection_add_properties� N)�minidom)�logc C sf z(t d| d��}|�� d �dd��� }W d � W |S 1 s!w Y W |S ty2 Y dS w )z Get command for pid from /proc z/proc/%d/cmdline�rr � � N)�open� readlines�replace�strip� Exception)�pid�f�cmd� r �5/usr/lib/python3/dist-packages/firewall/dbus_utils.pyr " s �� ��r c C �B | � dd�}t�|d�}z t|�|��}W |S ty Y dS w )zW Get pid from sender string using org.freedesktop.DBus.GetConnectionUnixProcessID �org.freedesktop.DBus�/org/freedesktop/DBusN)� get_object�dbus� Interface�int�GetConnectionUnixProcessID� ValueError)�bus�sender�dbus_obj� dbus_ifacer r r r r + � ��r c C r )zV Get user id from sender string using org.freedesktop.DBus.GetConnectionUnixUser r r N)r r r! r" �GetConnectionUnixUserr$ )r% r& r' r( �uidr r r r 8 r) r c C s* z t �| �}W |d S ty Y dS w )z Get user for uid from pwd Nr )�pwd�getpwuidr )r+ �pwsr r r r E s ��r c C sP | � dd�}t�|d�}z|�|�}W n ty Y dS w d�ttt|���S )zl Get SELinux context from sender string using org.freedesktop.DBus.GetConnectionSELinuxSecurityContext r r N� ) r r r! �#GetConnectionSELinuxSecurityContextr �join�map�chrr )r% r& r' r( �contextr r r r N s �r c C � t t| |��S )z Return command of D-Bus sender )r r �r% r& r r r r \ s r c C r5 �N)r r r6 r r r r a s r c C s: | d u r| }n�t | tj�rt| �}n�t | tj�r t| �}n�t | tj�r(t| �}n�t | tj�sRt | tj�sRt | tj �sRt | tj �sRt | tj �sRt | tj �sRt | tj �rWt| �}nlt | tj�rbt| �}nat | tj�rpdd� | D �}nSt | tj�r�tdd� | D ��}nCt | tj�r�dd� | �� D �}n3t | t�s�t | t�s�t | t�s�t | t�s�t | t�s�t | t�s�t | t�s�t | t�r�| }ntdt| � ��|d u�r|tkr�t |t��r|tkr�t |t��r|tkr�t |t��r|tkr�t |t��r|tkr�t |t��r|tk�rt |t��r|tk�rt |t��std|t|�|f ��|S )Nc S � g | ]}t |��qS r �r ��.0�xr r r � <listcomp>x � z"dbus_to_python.<locals>.<listcomp>c S r8 r r9 r: r r r r= z r> c S s i | ] \}}t |�t |��qS r r9 )r; �k�vr r r � <dictcomp>| s z"dbus_to_python.<locals>.<dictcomp>� Unhandled %sz%s is %s, expected %s) � isinstancer �Boolean�bool�String�str� ObjectPath�Byte�Int16�Int32�Int64�UInt16�UInt32�UInt64r" �Double�float�Array�Struct�tuple� Dictionary�items�bytes�list�dict� TypeError�repr�type)�obj� expected_type� python_objr r r r d sr � � � � � � ������� r c C s t | tj�rdS t | tj�rdS t | tj�rdS t | tj�r dS t | tj�r(dS t | tj�r0dS t | tj�r8dS t | tj �r@dS t | tj �rHd S t | tj �rPd S t | tj �rXd S t | tj �rot| j�d krjd | j S d| j S t | tj�rzd| j S t | tj�r�d| j S tdt| � ��)N�b�s�o�y�n�ir< �q�u�t�d� za(%s)za%sz(%s)za{%s}rB )rC r rD rF rH rI rJ rK rL rM rN rO rP rR �len� signaturerS rU rZ r[ )r] r r r r � s> r c C s� |d u ri }t | d�st| di � t| d�}i ||< z| �|�}W n ty, i }Y nw |�� D ]%\}}dt|�i|| |< ||v rN|| || | d< q1d|| | d< q1d S )N�_fw_dbus_propertiesr\ �access�read)�hasattr�setattr�getattr�GetAllr rV r )r] � interfacern �dip�_dict�key�valuer r r r � s" ��r c C s� t �|�}t| d�rY|�d�D ]I}|�d�rX|�d�|krXi }t| d�r)t| d�}||v rX|| �� D ]$\}}|�d�}|� d|� |� d|d � |� d|d � |� |� q3qt � |� � � |� � } |�� | S )Nrm rt �name�propertyr\ rn )r � parseStringrp �getElementsByTagName� hasAttribute� getAttributerr rV � createElement� setAttribute� appendChildr �debug10�toxml�unlink) r] �datart �doc�noderu rw rx �prop�new_datar r r r � s( �r c C s< t �|�}||v rI|�d�D ]:}|�d�rH|�d�|krH|�d�D ]&}|�d�rG|�d�|| v rG|�d�}|�dd� |�dd� |�|� q!q||v r�|�d�D ]:}|�d�r�|�d�|kr�|�d�D ]&} | �d�r�| �d�|| v r�|�d�}|�dd� |�dd� | �|� qeqRt� |� � � |� � }|� � |S ) Nrt ry �method� annotationz org.freedesktop.DBus.Deprecatedrx �true�signal) r r{ r| r} r~ r r� r� r r� r� r� ) r] r� rt �deprecated_methods�deprecated_signalsr� r� � method_noder� � signal_noder r r �!dbus_introspection_add_deprecated� s: � �r� r7 )�__all__r r, �xml.domr �firewall.core.loggerr r r r r r r r r r r r r� r r r r �<module> s" . # PK ���Z� ��� � " __pycache__/errors.cpython-310.pycnu �[��� o bhAb4 � @ s� d Z dZdZdZdZdZdZdZdZd Z d Z d Z d Z d Z dZdZdZdZdZdZdZdZdZdZdZdZdZdZd Z d Z d Z d Z d Z d!Z!d"Z"d#Z#d$Z$d%Z%d&Z&d'Z'd(Z(d)Z)d*Z*d+Z+d,Z,d-Z-d.Z.d/Z/d0Z0d1Z1d2Z2d3Z3d4Z4d5Z5d6Z6d7Z7d8Z8d9Z9d:Z:d;Z;d<Z<d=Z=d>Z>d?Z?d@Z@dAZAdBZBdCZCdDZDdEZEdFZFdGZGdHZHdIZIdJZJdKZKdLZLdMZMdNZNdOZOdPZPdQZQdRZRdSZSdTdUlTZTG dVdW� dWeU�ZVeTjWeVjX ZYdXdY� eZeY�D �eV_[dZdY� eVj[D �eV_\dUS )[� � � � � � � � � � � � � � � � � � � � � � �! �" �# �$ �% �& �d �e �f �g �h �i �j �k �l �m �n �o �p �q �r �s �t �u �v �w �x �y �z �{ �| �} �~ � � � � � � � � � � � � � � � � � �� �� �� �� �� �� �� �� � � � � � Nc @ s6 e Zd Zd dd�Zdd� Zdd� Zdd � Zee�ZdS ) � FirewallErrorNc C sP || _ |d ur#tjdk r#zt|�}W n ty" t|��d�}Y nw || _d S )N�3�unicode_escape)�code�sys�version�str�UnicodeEncodeError�unicode�encode�msg)�selfrY r` �x� rc �1/usr/lib/python3/dist-packages/firewall/errors.py�__init__q s � zFirewallError.__init__c C s d| j | j| jf S )Nz %s(%r, %r))� __class__rY r` �ra rc rc rd �__repr__| s zFirewallError.__repr__c C s( | j rd| j| j | j f S | j| j S )Nz%s: %s)r` �errorsrY rg rc rc rd �__str__ s zFirewallError.__str__c C sN d| v r| � d�}| d |� }n| }ztj| }W |S ty& t}Y |S w )N�:)�indexrV �codes�KeyError� UNKNOWN_ERROR)r` �idx�ecoderY rc rc rd �get_code� s ��zFirewallError.get_code)N)�__name__� __module__� __qualname__re rh rj rr � staticmethodrc rc rc rd rV p s rV c C s4 i | ]}|� d �sttt|��tkrtt|�|�qS )�_)� startswith�type�getattr�mod�int)�.0�varnamerc rc rd � <dictcomp>� s � �r c C s i | ]}t j| |�qS rc )rV ri )r} rY rc rc rd r � s �)]�ALREADY_ENABLED� NOT_ENABLED�COMMAND_FAILED� NO_IPV6_NAT� PANIC_MODE�ZONE_ALREADY_SET�UNKNOWN_INTERFACE� ZONE_CONFLICT� BUILTIN_CHAIN�EBTABLES_NO_REJECT�NOT_OVERLOADABLE� NO_DEFAULTS� BUILTIN_ZONE�BUILTIN_SERVICE�BUILTIN_ICMPTYPE� NAME_CONFLICT� NAME_MISMATCH� PARSE_ERROR� ACCESS_DENIED�UNKNOWN_SOURCE�RT_TO_PERM_FAILED�IPSET_WITH_TIMEOUT� BUILTIN_IPSET� ALREADY_SET�MISSING_IMPORT� DBUS_ERROR�BUILTIN_HELPER� NOT_APPLIED�INVALID_ACTION�INVALID_SERVICE� INVALID_PORT�INVALID_PROTOCOL�INVALID_INTERFACE� INVALID_ADDR�INVALID_FORWARD�INVALID_ICMPTYPE� INVALID_TABLE� INVALID_CHAIN�INVALID_TARGET� INVALID_IPV� INVALID_ZONE�INVALID_PROPERTY� INVALID_VALUE�INVALID_OBJECT� INVALID_NAME�INVALID_FILENAME�INVALID_DIRECTORY� INVALID_TYPE�INVALID_SETTING�INVALID_DESTINATION� INVALID_RULE� INVALID_LIMIT�INVALID_FAMILY�INVALID_LOG_LEVEL�INVALID_AUDIT_TYPE� INVALID_MARK�INVALID_CONTEXT�INVALID_COMMAND� INVALID_USER� INVALID_UID�INVALID_MODULE�INVALID_PASSTHROUGH� INVALID_MAC� INVALID_IPSET� INVALID_ENTRY�INVALID_OPTION�INVALID_HELPER�INVALID_PRIORITY�INVALID_POLICY�INVALID_LOG_PREFIX�INVALID_NFLOG_GROUP�INVALID_NFLOG_QUEUE� MISSING_TABLE� MISSING_CHAIN� MISSING_PORT�MISSING_PROTOCOL� MISSING_ADDR� MISSING_NAME�MISSING_SETTING�MISSING_FAMILY�RUNNING_BUT_FAILED� NOT_RUNNING�NOT_AUTHORIZEDro rZ � ExceptionrV �modulesrt r{ �dirri rm rc rc rc rd �<module> s� $� �PK ���Z..�.UD UD # __pycache__/command.cpython-310.pycnu �[��� o bhAb�^ � @ sf d Z dgZddlZddlmZ ddlmZ ddlmZ ddl m Z m Z m Z m Z mZ G dd� de�ZdS ) z<FirewallCommand class for command line client simplification�FirewallCommand� N)�errors)� FirewallError)� DBusException)� checkIPnMask� checkIP6nMask� check_mac� check_port�check_single_addressc @ s� e Zd Zd\dd�Zdd� Zdd� Zdd � Zd d � Zd d � Zd]dd�Z d]dd�Z d]dd�Z d^dd�Z d]dd�Z d]dd�Z d_d d �Z d`d d �Z d`d d!�Z d`d"d#�Z d`d$d%�Z d`d&d'�Z dad(d)�Z d`d*d+�Z d`d,d-�Zd.d/� Zdbd1d2�Zd`d3d4�Zd5d6� Zd7d8� Z d9d:� Z d;d<� Z d=d>� Z d?d@� Z dg dAfdBdC�Z!dg fdDdE�Z"dg fdFdG�Z#dHdI� Z$dJdK� Z%dLdM� Z&dNdO� Z'dPdQ� Z(dRdS� Z)dTdU� Z*dVdW� Z+dXdY� Z,dZd[� Z-dS )cr Fc C s || _ || _d| _d | _d S �NT)�quiet�verbose�'_FirewallCommand__use_exception_handler�fw)�selfr r � r �2/usr/lib/python3/dist-packages/firewall/command.py�__init__# s zFirewallCommand.__init__c C � || _ d S �N)r )r r r r r �set_fw) � zFirewallCommand.set_fwc C r r �r �r �flagr r r � set_quiet, r zFirewallCommand.set_quietc C � | j S r r �r r r r � get_quiet/ � zFirewallCommand.get_quietc C r r �r r r r r � set_verbose2 r zFirewallCommand.set_verbosec C r r r r r r r � get_verbose5 r zFirewallCommand.get_verboseNc C �* |d ur| j stj�|d � d S d S d S �N� )r �sys�stdout�write�r �msgr r r � print_msg8 � �zFirewallCommand.print_msgc C r# r$ )r r& �stderrr( r) r r r �print_error_msg< r, z FirewallCommand.print_error_msgc C s, d}d}t j�� r|| | }| �|� d S )Nz[91mz[00m)r& r- �isattyr. )r r* �FAIL�ENDr r r � print_warning@ s z FirewallCommand.print_warningr c C s, |dkr | � |� n| �|� t�|� d S )N� )r2 r+ r& �exit)r r* � exit_coder r r �print_and_exitG s z FirewallCommand.print_and_exitc C s | � |d� d S )N� �r6 r) r r r �failR s zFirewallCommand.failc C s* |d ur| j rtj�|d � d S d S d S r$ )r r& r' r( r) r r r �print_if_verboseU r, z FirewallCommand.print_if_verbosec C s� | j d ur | j �� g } d} g } |D ]N} |d ur[z|| �} W n< tyZ } z0t�t|��}t|�dkr;| �d| � n| �d| |� || vrL| � |� | d7 } W Y d }~qd }~ww | � | � q| D ]�} g }|d uro||7 }t | t �st | t �s|� | � n|| 7 }|d ur�||7 }| � � z||� W ns ttf�y } zdt |t�r�| �|�� � |�� }nt|�}t�|�}|tjtjtjtjfv r�d}t|�dkr�| �d| � n|dkr�| �d| � W Y d }~ d S | �d| |� || vr�| � |� | d7 } W Y d }~nd }~ww | �� qc| �s>t|�| k�s d| v �r d S t| �dk�r/t�| d � d S t| �dk�r@t�tj� d S d S d S )Nr r3 � Warning: %s� Error: %s)r � authorizeAll� Exceptionr �get_code�str�lenr2 r6 �append� isinstance�list�tuple� deactivate_exception_handlerr �fail_if_not_authorized� get_dbus_name�get_dbus_messager �ALREADY_ENABLED� NOT_ENABLED�ZONE_ALREADY_SET� ALREADY_SET�activate_exception_handlerr& r4 � UNKNOWN_ERROR)r �cmd_type�option� action_method� query_method� parse_method�message� start_args�end_args�no_exit�items�_errors� _error_codes�itemr* �code� call_itemr r r �__cmd_sequenceY s� �� � �� �z FirewallCommand.__cmd_sequencec C � | j d||||||d� d S )N�add�rX �� _FirewallCommand__cmd_sequence�r rQ rR rS rT rU rX r r r � add_sequence� � �z FirewallCommand.add_sequencec C � | j d||||||g|d� d S )Nra �rV rX rc �r �xrQ rR rS rT rU rX r r r �x_add_sequence� � �z FirewallCommand.x_add_sequencec C s$ | j d||||||g|g|d� d S )Nra )rV rW rX rc ) r �zonerQ rR rS rT rU �timeoutrX r r r �zone_add_timeout_sequence� s �z)FirewallCommand.zone_add_timeout_sequencec C r` )N�removerb rc re r r r �remove_sequence� rg z FirewallCommand.remove_sequencec C rh )Nrq ri rc rj r r r �x_remove_sequence� rm z!FirewallCommand.x_remove_sequencec C s g }|D ]F}|d urEz||�}W n4 t yD } z(t|�dkr+| �d| � W Y d } ~ qt�t| ��} | �d| | � W Y d } ~ nd } ~ ww |�|� q|D ]�}g } |d urY| |7 } t|t �sit|t �si| �|� n| |7 } | � � z|| � } W nm t y� } z3| � | �� � t�| �� �} t|�dkr�| �d| �� � W Y d } ~ qM| �d| �� | � W Y d } ~ n3d } ~ w t y� } z#t�t| ��} t|�dkr�| �d| � n| �d| | � W Y d } ~ nd } ~ ww | �� t|�dkr�| �d|| d| f � qM| �| � qM|�s t�d� d S d S )Nr3 r; r< z%s: %s)�no�yesr )r> rA r2 r r? r@ r6 rB rC rD rE rF r rG rH rI rN r+ �print_query_resultr& r4 ) r rQ rS rT rU rV rX rY r\ r* r] r^ �resr r r �__query_sequence� s` �� �� �� �z FirewallCommand.__query_sequencec C s | j |||||d� d S )Nrb �� _FirewallCommand__query_sequence)r rQ rS rT rU rX r r r �query_sequence� s �z FirewallCommand.query_sequencec C s | j |||||g|d� d S )Nri ry )r rk rQ rS rT rU rX r r r �x_query_sequence� s �z FirewallCommand.x_query_sequencec C sB t |�s t|�s t|�s |�d�rt|�dks ttjd| ��|S )Nzipset:� z8'%s' is no valid IPv4, IPv6 or MAC address, nor an ipset)r r r � startswithrA r r � INVALID_ADDR�r �valuer r r � parse_source� s �� �z FirewallCommand.parse_source�/c C sf z |� |�\}}W n ty ttjd| ��w t|�s#ttj|��|dvr/ttjd| ��||fS )NzTbad port (most likely missing protocol), correct syntax is portid[-portid]%sprotocol��tcp�udp�sctp�dccp�''%s' not in {'tcp'|'udp'|'sctp'|'dccp'})�split� ValueErrorr r � INVALID_PORTr �INVALID_PROTOCOL)r r� � separator�port�protor r r � parse_port s �� ��zFirewallCommand.parse_portc C s� d }d }d }d }d}d||d � v r|||d � � dd�d }|t|�d 7 }d||d � v r;||d � � dd�d } n||d � } |t| �d 7 }|dkrP| }n$|dkrW| }n |dkr^| }n|dkre| }n|d krl|rlnttjd | ��d||d � v s|s�ttjd ��|s�ttjd ��|s�|s�ttjd ��t|�s�ttj|��|dvr�ttjd| ��|r�t|�s�ttj|��|r�td|�s�|s�td|�s�ttj |��||||fS )Nr �=r3 �:r� r� �toport�toaddr�ifz invalid forward port arg '%s'z missing portzmissing protocolzmissing destinationr� r� �ipv4�ipv6) r� rA r r �INVALID_FORWARDr r� r� r r ) r r� �compatr� �protocolr� r� �i�opt�valr r r �parse_forward_port s\ �� �� z"FirewallCommand.parse_forward_portc C sB |� d�}t|�dkr|d dfS t|�dkr|S ttjd| ��)Nr� r3 r � r7 zinvalid ipset option '%s')r� rA r r �INVALID_OPTION)r r� �argsr r r �parse_ipset_optionH s �z"FirewallCommand.parse_ipset_optionc C s. ddg}||vrt tjd|d�|�f ��|S )Nr� r� �'invalid argument: %s (choose from '%s')�', '�r r � INVALID_IPV�join�r r� �ipvsr r r �check_destination_ipvR � ��z%FirewallCommand.check_destination_ipvc C s> z |� dd�\}}W n ty ttjd��w | �|�|fS )Nr� r3 z(destination syntax is ipv:address[/mask])r� r� r r �INVALID_DESTINATIONr� )r r� �ipv� destinationr r r �parse_service_destinationZ s ��z)FirewallCommand.parse_service_destinationc C �. g d�}||vrt tjd|d�|�f ��|S )N)r� r� �ebr� r� r� r� r r r � check_ipvb r� zFirewallCommand.check_ipvc C r� )N)r� r� r� r� r� r� r� r r r �check_helper_familyj r� z#FirewallCommand.check_helper_familyc C sB |� d�s ttjd| ��t|�dd��dk r ttjd| ��|S )N� nf_conntrack_z('%s' does not start with 'nf_conntrack_'r� r3 zModule name '%s' too short)r~ r r �INVALID_MODULErA �replacer� r r r � check_moduler s ��z FirewallCommand.check_moduleTc C s� |� � }|�� }|�� }|�� } |�� } |�� } |�� } |�� } |�� }|� � }|� � }|r;|� � }|� � }|� � }n|�� }tt|�� | ��}|�� }|�� }dd� }g }|d urd||krd|�d� |sj|sp|sp|ru|ru|ru|�d� |r�|dd�|� }| �|� | jr�| �d| � | �d| � |r�| �d t|� � | �d | � |s�| �d |r�d nd � |r�| �dd�|� � | �dd�|� � n| �dd�|� � | �dd�|� � | �dd�t|�� � | �dd�dd� |D �� � | �dd�t| �� � |�s| �d|�rd nd � | �d| �r d nd � | �d| �r*dnd d�d d� | D �� � | �d d�d d� | D �� � | �d d�| � � | �d!|�rYdnd d�t||d"�� � d S )#Nc S sf d}d}z| � |�}W n ty Y |S w |t|�7 }t| ||| |d � � d� � �dd��}|S )Nr z priority=� �"r� )�indexr� rA �intr� )�rule�priority� search_strr� r r r �rich_rule_sorted_key� s � *zDFirewallCommand.print_zone_policy_info.<locals>.rich_rule_sorted_key�default�activez (%s)z, � summary: � description: z priority: z target: z icmp-block-inversion: %sru rt z ingress-zones: r� z egress-zones: z interfaces: z sources: z services: � ports: c S � g | ] }d |d |d f �qS �z%s/%sr r3 r ��.0r� r r r � <listcomp>� � �z:FirewallCommand.print_zone_policy_info.<locals>.<listcomp>� protocols: z forward: %sz masquerade: %sz forward-ports: z r� c S s$ g | ]\}}}}d ||||f �qS )z$port=%s:proto=%s:toport=%s:toaddr=%sr )r� r� r� r� r� r r r r� � s � �� source-ports: c S r� r� r r� r r r r� � r� z icmp-blocks: z rich rules: )�key)� getTarget� getServices�getPorts� getProtocols� getMasquerade�getForwardPorts�getSourcePorts� getIcmpBlocks� getRichRules�getDescription�getShort�getIngressZones�getEgressZones� getPriority�getIcmpBlockInversion�sorted�set� getInterfaces� getSources� getForwardrB r� r+ r r@ )r rn �settings� default_zone�extra_interfaces�isPolicy�target�services�ports� protocols� masquerade� forward_ports� source_ports� icmp_blocks�rules� description�short_description� ingress_zones� egress_zonesr� �icmp_block_inversion� interfaces�sources�forwardr� � attributesr r r �print_zone_policy_info| s� ��� � � �� �� �z&FirewallCommand.print_zone_policy_infoc C � | j ||||dd� d S )NF�r� r� r� �r� )r rn r� r� r� r r r �print_zone_info� � z FirewallCommand.print_zone_infoc C r� )NTr� r� )r �policyr� r� r� r r r �print_policy_info� r� z!FirewallCommand.print_policy_infoc C s. |� � }|�� }|�� }|�� }|�� }|�� }|�� } |�� } |�� } | � |� | j r:| � d| � | � d| � | � dd� dd� |D �� � | � dd� |� � | � dd� d d� |D �� � | � d d� |� � | � d d� d d� |� � D �� � | � d d� t | �� � | � dd� t | �� � d S )Nr� r� r� r� c S r� r� r r� r r r r� � r� z6FirewallCommand.print_service_info.<locals>.<listcomp>r� r� c S r� r� r r� r r r r� � r� z modules: � destination: c S s g | ] \}}d ||f �qS )z%s:%sr �r� �k�vr r r r� � s �z includes: z helpers: )r� r� r� � getModulesr� �getDestinationsr� � getIncludes� getHelpersr+ r r� rY r� ) r �servicer� r� r� r� �modulesr� � destinationsr� �includes�helpersr r r �print_service_info� s< � �� �� z"FirewallCommand.print_service_infoc C sp |� � }|�� }|�� }t|�dkrddg}| �|� | jr,| �d| � | �d| � | �dd�|� � d S )Nr r� r� r� r� r r� )r r� r� rA r+ r r� )r �icmptyper� r r� r� r r r �print_icmptype_info� s z#FirewallCommand.print_icmptype_infoc C s� |� � }|�� }|�� }|�� }|�� }| �|� | jr*| �d| � | �d| � | �d| � | �dd�dd� |�� D �� � | �dd�|� � d S ) Nr� r� z type: z options: r� c S s$ g | ]\}}|rd ||f n|�qS )z%s=%sr r r r r r� s �z4FirewallCommand.print_ipset_info.<locals>.<listcomp>z entries: ) �getType� getOptions� getEntriesr� r� r+ r r� rY )r �ipsetr� � ipset_type�options�entriesr� r� r r r �print_ipset_info� s �z FirewallCommand.print_ipset_infoc C s� |� � }|�� }|�� }|�� }|�� }| �|� | jr*| �d| � | �d| � | �d| � | �d| � | �dd�dd� |D �� � d S ) Nr� r� z family: z module: r� r� c S r� r� r r� r r r r� r� z5FirewallCommand.print_helper_info.<locals>.<listcomp>)r� � getModule� getFamilyr� r� r+ r r� )r �helperr� r� �module�familyr� r� r r r �print_helper_info s �z!FirewallCommand.print_helper_infoc C s" |r | � d� d S | � dd� d S )Nru rt r3 r8 r� r r r rv s z"FirewallCommand.print_query_resultc C s^ | j s� | �|� t�t|��}|tjtjtjtj fv r%| � d| � d S | � d| |� d S )Nr; r< ) r rG r r? r@ r rJ rK rL rM r2 r6 )r �exception_messager] r r r �exception_handler s �z!FirewallCommand.exception_handlerc C s" d|v rd}| � |tj� d S d S )N�NotAuthorizedExceptionz`Authorization failed. Make sure polkit agent is running or run the application as superuser.)r6 r �NOT_AUTHORIZED)r r r* r r r rG ' s �z&FirewallCommand.fail_if_not_authorizedc C � d| _ d S �NF�r r r r r rF - r z,FirewallCommand.deactivate_exception_handlerc C r# r r% r r r r rN 0 r z*FirewallCommand.activate_exception_handlerc C sn g }t � }t|�}|D ]%}|s n |�� }t|�dk s!|d dv r"q ||vr0|�|� |�|� q |�� |S )Nr3 r )�#�;)r� �open�striprA rB ra �close)r �filenamer � entries_set�f�liner r r �get_ipset_entries_from_file3 s �z+FirewallCommand.get_ipset_entries_from_file)FFr )Nr )NNF)Fr$ )r� ).�__name__� __module__� __qualname__r r r r r! r" r+ r. r2 r6 r9 r: rd rf rl rp rr rs rz r{ r| r� r� r� r� r� r� r� r� r� r� r� r r r r r rv r rG rF rN r/ r r r r r " sl �L � � � � � �3 � � 2 O )�__doc__�__all__r& �firewallr �firewall.errorsr �dbus.exceptionsr �firewall.functionsr r r r r �objectr r r r r �<module> s PK ���Z�5�?�; �; % __pycache__/functions.cpython-310.pycnu �[��� o bhAb>J � @ s� g d �Z ddlZddlZddlZddlZddlZddlZddlZddlm Z ddl m Z m Z dd� e dd�D �Zdd � Zd d � ZdUd d�Zdd� Zdd� Zdd� Zdd� Zdd� Zdd� Zdd � Zd d � Zd d � Zd!d"� Zd#d$� Z d%d&� Z d'd(� Z d)d*� Z d+d,� Z d-d.� Z!d/d0� Z"d1d2� Z#d3d4� Z$d5d6� Z%d7d8� Z&d9d:� Z'd;d<� Z(d=d>� Z)d?d@� Z*dAdB� Z+dCdD� Z,dEdF� Z-dGdH� Z.dIdJ� Z/dKdL� Z0dMdN� Z1dOdP� Z2dQdR� Z3dSdT� Z4dS )V)!� getPortID� getPortRange�portStr�getServiceName�checkIP�checkIP6� checkIPnMask� checkIP6nMask� checkProtocol�checkInterface� checkUINT16� checkUINT32�firewalld_is_active�tempFile�readfile� writefile�enable_ip_forwarding� check_port� check_address�check_single_address� check_mac�uniqify� ppid_of_pid�max_zone_name_len� checkUser�checkUid� checkCommand� checkContext�joinArgs� splitArgs�max_policy_name_len�checkTcpMssClamp�stripNonPrintableCharacters� N)�log)�FIREWALLD_TEMPDIR�FIREWALLD_PIDFILEc C s" i | ] }|d kr |dk s|d�qS )� � N� )�.0�ir( r( �4/usr/lib/python3/dist-packages/firewall/functions.py� <dictcomp>+ s r, � c C st t | t�r| }n*| r| �� } zt| �}W n ty1 zt�| �}W n tjy. Y Y dS w Y nw |dkr8dS |S )z� Check and Get port id from port string or port id using socket.getservbyname @param port port string or port id @return Port id if valid, -1 if port can not be found and -2 if port is too big ���� ���)� isinstance�int�strip� ValueError�socket� getservbyname�error)�port�_idr( r( r+ r 4 s" ���r c C s� t | t�s t | t�r | S t | t�s| �� r"t| �}|dkr |fS |S | �d�}t|�dkr`|d �� r`|d �� r`t|d �}t|d �}|dkr`|dkr`||k rU||fS ||kr]||fS |fS g }tt|�dd�D ]Y}td� |d|� ��}d� ||d� �}t|�dkr�t|�}|dkr�|dkr�||k r�|� ||f� qj||kr�|� ||f� qj|� |f� qj|dkr�|� |f� |t|�kr� nqjt|�dk r�dS t|�dkr�dS |d S )aI Get port range for port range string or single port id @param ports an integer or port string or port range string @return Array containing start and end port id for a valid range or -1 if port can not be found and -2 if port is too big for integer input or -1 for invalid ranges or None if the range is ambiguous. r" �-� � r. N) r1 �tuple�listr2 �isdigitr �split�len�range�join�append)�ports�id1�splits�id2�matchedr* �port2r( r( r+ r K sP $ � � r �:c C sT | dkrdS t | �}t|t�r|dk rdS t|�dkr d| S d|d ||d f S )a Create port and port range string @param port port or port range int or [int, int] @param delimiter of the output string for port ranges, default ':' @return Port or port range string, empty string if port isn't specified, None if port or port range is not valid � r" Nr< z%sz%s%s%s)r r1 r2 rA )r8 � delimiter�_ranger( r( r+ r � s r c C s t | �}t |�}t|�dkrBt|�dkr t|d �t|d �kS t|�dkr@t|d �t|d �kr@t|d �t|d �kr@dS dS t|�dkr�t|�dkr�t|d �t|d �kr�t|d �t|d �kr�t|d �t|d �kr�t|d �t|d �kr�dS dS )Nr< r" r; TF)r rA r )r8 rB �_portrN r( r( r+ �portInPortRange� s 0 � 00rP c C sN t | �}t|�dkr|d |d f}tt |�}ttdd� |�dd� d�}g }|D ]c}|d |d kr@|d |d kr@|�|� q(|d |d krf|d |d k rf|d |d krf|�|� |d |d f}q(|d |d kr�|d |d kr�|d |d kr�|�|� |d |d f}q(ttdd� |��}|d |d kr�|d f}|g|fS )z� Coalesce a port range with existing list of port ranges @param new_range tuple/list/string @param ranges list of tuple/list/string @return tuple of (list of ranges added after coalescing, list of removed original ranges) r< r" c S � t | �dkr| d | d fS | S �Nr< r" �rA ��xr( r( r+ �<lambda>� � z#coalescePortRange.<locals>.<lambda>c S � | d S �Nr" r( rT r( r( r+ rV � � ��keyc S � | d | d kr | d fS | S �Nr" r< r( rT r( r( r+ rV � � �r rA �map�sortedrD r> )� new_range�ranges�coalesced_range�_ranges�removed_rangesrB r( r( r+ �coalescePortRange� s, � rh c C s� t | �} t| �dkr| d | d f} tt |�}ttdd� |�dd� d�}g }g }|D ]�}| d |d krB| d |d krB|�|� q*| d |d krm| d |d k rm| d |d krm|�|� |�| d d |d f� q*| d |d kr�| d |d kr�| d |d kr�|�|� |�|d | d d f� q*| d |d kr�| d |d k r�|�|� |�|d | d d f� |�| d d |d f� q*ttdd� |��}ttdd� |��}||fS ) z� break a port range from existing list of port ranges @param remove_range tuple/list/string @param ranges list of tuple/list/string @return tuple of (list of ranges added after breaking up, list of removed original ranges) r< r" c S rQ rR rS rT r( r( r+ rV � rW z breakPortRange.<locals>.<lambda>c S rX rY r( rT r( r( r+ rV � rZ r[ c S r] r^ r( rT r( r( r+ rV � r_ c S r] r^ r( rT r( r( r+ rV � r_ r` )� remove_rangerd rf rg � added_rangesrB r( r( r+ �breakPortRange� s4 �rk c C s. z t �t| �|�}W |S t jy Y dS w )z� Check and Get service name from port and proto string combination using socket.getservbyport @param port string or id @param protocol string @return Service name if port and protocol are valid, else None N)r5 � getservbyportr2 r7 )r8 �proto�namer( r( r+ r � s ��r c C s, z t �t j| � W dS t jy Y dS w )zl Check IPv4 address. @param ip address string @return True if address is valid, else False FT)r5 � inet_pton�AF_INETr7 ��ipr( r( r+ r s ��r c C s | � d�S )z� Normalize the IPv6 address This is mostly about converting URL-like IPv6 address to normal ones. e.g. [1234::4321] --> 1234:4321 z[])r3 rq r( r( r+ � normalizeIP6 s rs c C s0 z t �t jt| �� W dS t jy Y dS w )zl Check IPv6 address. @param ip address string @return True if address is valid, else False FT)r5 ro �AF_INET6rs r7 rq r( r( r+ r s ��r c C s� d| v r'| d | � d�� }| | � d�d d � }t|�dk s$t|�dk r&dS n| }d }t|�s1dS |rVd|v r;t|�S zt|�}W n tyK Y dS w |dk sT|dkrVdS dS )N�/r< F�.r" � T)�indexrA r r2 r4 �rr �addr�maskr* r( r( r+ r * s* � �r c C s | � t�S �N)� translate�NOPRINT_TRANS_TABLE)�rule_strr( r( r+ r! A � r! c C s� d| v r'| d | � d�� }| | � d�d d � }t|�dk s$t|�dk r&dS n| }d }t|�s1dS |rNzt|�}W n tyC Y dS w |dk sL|dkrNdS dS )Nru r< Fr" � T)rx rA r r2 r4 ry r( r( r+ r D s& � �r c C s` zt | �}W n ty# z t�| � W Y dS tjy" Y Y dS w w |dk s,|dkr.dS dS )NFr" � T)r2 r4 r5 �getprotobynamer7 )�protocolr* r( r( r+ r Y s ���r c C s< | r | � � rt| �dk rdS dS | dkrdS | dkr dS dS )Ni F�NoneT�pmtu)r? r2 )�tcp_mss_clamp_valuer( r( r+ r h s �r c C s0 | rt | �dkr dS dD ] }|| v r dS q dS )z� Check interface string @param interface string @return True if interface is valid (maximum 16 chars and does not contain ' ', '/', '!', ':', '*'), else False � F)� ru �!�*TrS )�iface�chr( r( r+ r s s �r c C �< zt | d�}W n ty Y dS w |dkr |dkr dS dS )Nr" Fr/ T�r2 r4 ��valrU r( r( r+ r � � �r c C r� )Nr" Fl �� Tr� r� r( r( r+ r � r� r c C s� t j�t�sdS zttd�� } | �� }W d � n1 s w Y W n ty- Y dS w t j�d| �s8dS z td| d�� } | �� }W d � n1 sOw Y W n ty_ Y dS w d|v rfdS dS )zv Check if firewalld is active @return True if there is a firewalld pid file and the pid is used by firewalld F�rNz/proc/%sz/proc/%s/cmdline� firewalldT)�os�path�existsr% �open�readline� Exception)�fd�pid�cmdliner( r( r+ r � s. �� � �� �r c C sV zt j�t�s t �td� tjddtdd�W S ty* } zt� d| � � d } ~ ww )Ni� �wtztemp.F)�mode�prefix�dir�deletez#Failed to create temporary file: %s) r� r� r� r$ �mkdir�tempfile�NamedTemporaryFiler� r# r7 )�msgr( r( r+ r � s ���r c C st z t | d�� }|�� W d � W S 1 sw Y W d S ty9 } zt�d| |f � W Y d }~d S d }~ww )Nr� z Failed to read file "%s": %s)r� � readlinesr� r# r7 )�filename�f�er( r( r+ r � s $�� ��r c C sx z t | d��}|�|� W d � W dS 1 sw Y W dS ty; } zt�d| |f � W Y d }~dS d }~ww )N�wz Failed to write to file "%s": %sFT)r� �writer� r# r7 )r� �liner� r� r( r( r+ r � s �����r c C s( | dkr t dd�S | dkrt dd�S dS )N�ipv4z /proc/sys/net/ipv4/ip_forwardz1 �ipv6z&/proc/sys/net/ipv6/conf/all/forwardingF)r )�ipvr( r( r+ r � s r c C s | � dd�� dd�S )N�_r: z nf-conntrack-rL )�replace)�moduler( r( r+ �get_nf_conntrack_short_name� s r� c C s� t | �}|dks |dks |d u s t|�dkr\|d |d kr\|dkr+t�d| � d S |dkr8t�d| � d S |d u rEt�d| � d S t|�dkrZ|d |d krZt�d | � d S d S ) Nr0 r. r; r" r< z'%s': port > 65535z'%s': port is invalidz'%s': port is ambiguousz'%s': range start >= endFT)r rA r# �debug2)r8 rN r( r( r+ r � s �� �r c C �$ | dkrt |�S | dkrt|�S dS �Nr� r� F)r r �r� �sourcer( r( r+ r � � r c C r� r� )r r r� r( r( r+ r � r� r c C sN t | �dkr%dD ] }| | dkr dS qdD ] }| | tjvr" dS qdS dS )N� )r; � � � � rK F) r" r< � � � � � � � � � r� T)rA �string� hexdigits)�macr* r( r( r+ r � s ��r c C s$ g }| D ] }||vr|� |� q|S r| )rD )�_list�outputrU r( r( r+ r s �r c C sF zt �d| �}t|�� d �� �} |�� W | S ty" Y dS w )z Get parent for pid z ps -o ppid -h -p %d 2>/dev/nullr" N)r� �popenr2 r� r3 �closer� )r� r� r( r( r+ r s ��r c C sB ddl m} ddlm} ttt|�� ��}d|t| � td� S )z� iptables limits length of chain to (currently) 28 chars. The longest chain we create is POST_<policy>_allow, which leaves 28 - 11 = 17 chars for <policy>. r" )�POLICY_CHAIN_PREFIX�� SHORTCUTS� �_allow)�firewall.core.ipXtablesr� �firewall.core.baser� �maxra rA �values)r� r� �longest_shortcutr( r( r+ r s r c C s. ddl m} ttt| �� ��}d|td� S )z� Netfilter limits length of chain to (currently) 28 chars. The longest chain we create is POST_<zone>_allow, which leaves 28 - 11 = 17 chars for <zone>. r" r� r� �__allow)r� r� r� ra rA r� )r� r� r( r( r+ r & s r c C sR t | �dk st | �t�d�krdS | D ]}|tjvr&|tjvr&|dvr& dS qdS )Nr< �SC_LOGIN_NAME_MAXF)rv r: r� �$T)rA r� �sysconfr� � ascii_letters�digits)�user�cr( r( r+ r 0 s �r c C sD t | t�rzt| �} W n ty Y dS w | dkr | dkr dS dS )NFr" i���T)r1 �strr2 r4 )�uidr( r( r+ r : s �r c C sH t | �dk s t | �dkrdS dD ] }|| v r dS q| d dkr"dS dS )Nr< i F)�|� � r" ru TrS )�commandr� r( r( r+ r D s � r c C s� | � d�}t|�dvr dS |d dkr |d dd � dkr dS |d dd � d kr+dS |d dd � d kr7dS t|d �dk rAdS d S )NrK )r� r� Fr" �rootr0 �_ur< �_rr; �_tr� T)r@ rA )�contextrG r( r( r+ r N s r c C s4 dt t�v rd�dd� | D ��S d�dd� | D ��S )N�quoter� c s � � | ]}t �|�V qd S r| )�shlexr� �r) �ar( r( r+ � <genexpr>b � � zjoinArgs.<locals>.<genexpr>c s r� r| )�pipesr� r� r( r( r+ r� d r� )r� r� rC )�argsr( r( r+ r ` s r c C s t �| �S r| )r� r@ )�_stringr( r( r+ r f r� r )rK )5�__all__r5 r� �os.pathr� r� r� r� �firewall.core.loggerr# �firewall.configr$ r% rB r~ r r r rP rh rk r r rs r r r! r r r r r r r r r r r r� r r r r r r r r r r r r r r r( r( r( r+ �<module> sf � :&+ PK ���Z�غ�� � $ __pycache__/fw_types.cpython-310.pycnu �[��� o bhAb� � @ s d gZ G dd � d e�ZdS )�LastUpdatedOrderedDictc @ sx e Zd Zd dd�Zdd� Zdd� Zdd � Zd d � Zd d � Zdd� Z dd� Z dd� Z dd� Z dd� Z dd� Zd dd�ZdS ) r Nc C s" i | _ g | _|r| �|� d S d S �N)�_dict�_list�update)�self�x� r �3/usr/lib/python3/dist-packages/firewall/fw_types.py�__init__ s �z LastUpdatedOrderedDict.__init__c C s | j d d �= | j�� d S r )r r �clear�r r r r r s z LastUpdatedOrderedDict.clearc C s |� � D ]\}}|| |< qd S r )�items)r r �key�valuer r r r # s �z LastUpdatedOrderedDict.updatec � � fdd�� j D �S )Nc s g | ]}|� | f�qS r r ��.0r r r r � <listcomp>( s z0LastUpdatedOrderedDict.items.<locals>.<listcomp>�r r r r r r ' � z LastUpdatedOrderedDict.itemsc C s& || j v r| j�|� | j |= d S d S r )r r �remove�r r r r r � __delitem__* s �z"LastUpdatedOrderedDict.__delitem__c s& d� j jd�� fdd�� jD ��f S )Nz%s([%s])z, c s g | ] }d |� | f �qS )z(%r, %r)r r r r r r 1 s z3LastUpdatedOrderedDict.__repr__.<locals>.<listcomp>)� __class__�__name__�joinr r r r r �__repr__/ s �z LastUpdatedOrderedDict.__repr__c C s$ || j vr | j�|� || j |< d S r )r r �append�r r r r r r � __setitem__3 s z"LastUpdatedOrderedDict.__setitem__c C s t |�tkr | j| S | j| S r )�type�intr r r r r r � __getitem__8 s z"LastUpdatedOrderedDict.__getitem__c C s t | j�S r )�lenr r r r r �__len__> s z LastUpdatedOrderedDict.__len__c C s t | �S r )r r r r r �copyA s zLastUpdatedOrderedDict.copyc C s | j d d � S r r r r r r �keysD s zLastUpdatedOrderedDict.keysc r )Nc s g | ]}� | �qS r r r r r r r H s z1LastUpdatedOrderedDict.values.<locals>.<listcomp>r r r r r �valuesG r z LastUpdatedOrderedDict.valuesc C s || v r| | S || |< |S r r r r r r � setdefaultJ s z!LastUpdatedOrderedDict.setdefaultr )r � __module__� __qualname__r r r r r r r r" r$ r% r& r' r( r r r r r s N)�__all__�objectr r r r r �<module> s PK ���Z��l>J >J functions.pynu �[��� # -*- coding: utf-8 -*- # # Copyright (C) 2007,2008,2011,2012 Red Hat, Inc. # # Authors: # Thomas Woerner <twoerner@redhat.com> # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see <http://www.gnu.org/licenses/>. # __all__ = [ "getPortID", "getPortRange", "portStr", "getServiceName", "checkIP", "checkIP6", "checkIPnMask", "checkIP6nMask", "checkProtocol", "checkInterface", "checkUINT16", "checkUINT32", "firewalld_is_active", "tempFile", "readfile", "writefile", "enable_ip_forwarding", "check_port", "check_address", "check_single_address", "check_mac", "uniqify", "ppid_of_pid", "max_zone_name_len", "checkUser", "checkUid", "checkCommand", "checkContext", "joinArgs", "splitArgs", "max_policy_name_len", "checkTcpMssClamp", "stripNonPrintableCharacters"] import socket import os import os.path import shlex import pipes import string import tempfile from firewall.core.logger import log from firewall.config import FIREWALLD_TEMPDIR, FIREWALLD_PIDFILE NOPRINT_TRANS_TABLE = { # Limit to C0 and C1 code points. Building entries for all unicode code # points requires too much memory. # C0 = [0, 31] # C1 = [127, 159] # i: None for i in range(0, 160) if not (i > 31 and i < 127) } def getPortID(port): """ Check and Get port id from port string or port id using socket.getservbyname @param port port string or port id @return Port id if valid, -1 if port can not be found and -2 if port is too big """ if isinstance(port, int): _id = port else: if port: port = port.strip() try: _id = int(port) except ValueError: try: _id = socket.getservbyname(port) except socket.error: return -1 if _id > 65535: return -2 return _id def getPortRange(ports): """ Get port range for port range string or single port id @param ports an integer or port string or port range string @return Array containing start and end port id for a valid range or -1 if port can not be found and -2 if port is too big for integer input or -1 for invalid ranges or None if the range is ambiguous. """ # (port, port) or [port, port] case if isinstance(ports, tuple) or isinstance(ports, list): return ports # "<port-id>" case if isinstance(ports, int) or ports.isdigit(): id1 = getPortID(ports) if id1 >= 0: return (id1,) return id1 splits = ports.split("-") # "<port-id>-<port-id>" case if len(splits) == 2 and splits[0].isdigit() and splits[1].isdigit(): id1 = getPortID(splits[0]) id2 = getPortID(splits[1]) if id1 >= 0 and id2 >= 0: if id1 < id2: return (id1, id2) elif id1 > id2: return (id2, id1) else: # ids are the same return (id1,) # everything else "<port-str>[-<port-str>]" matched = [ ] for i in range(len(splits), 0, -1): id1 = getPortID("-".join(splits[:i])) port2 = "-".join(splits[i:]) if len(port2) > 0: id2 = getPortID(port2) if id1 >= 0 and id2 >= 0: if id1 < id2: matched.append((id1, id2)) elif id1 > id2: matched.append((id2, id1)) else: matched.append((id1, )) else: if id1 >= 0: matched.append((id1,)) if i == len(splits): # full match, stop here break if len(matched) < 1: return -1 elif len(matched) > 1: return None return matched[0] def portStr(port, delimiter=":"): """ Create port and port range string @param port port or port range int or [int, int] @param delimiter of the output string for port ranges, default ':' @return Port or port range string, empty string if port isn't specified, None if port or port range is not valid """ if port == "": return "" _range = getPortRange(port) if isinstance(_range, int) and _range < 0: return None elif len(_range) == 1: return "%s" % _range else: return "%s%s%s" % (_range[0], delimiter, _range[1]) def portInPortRange(port, range): _port = getPortRange(port) _range = getPortRange(range) if len(_port) == 1: if len(_range) == 1: return getPortID(_port[0]) == getPortID(_range[0]) if len(_range) == 2 and \ getPortID(_port[0]) >= getPortID(_range[0]) and getPortID(_port[0]) <= getPortID(_range[1]): return True elif len(_port) == 2: if len(_range) == 2 and \ getPortID(_port[0]) >= getPortID(_range[0]) and getPortID(_port[0]) <= getPortID(_range[1]) and \ getPortID(_port[1]) >= getPortID(_range[0]) and getPortID(_port[1]) <= getPortID(_range[1]): return True return False def coalescePortRange(new_range, ranges): """ Coalesce a port range with existing list of port ranges @param new_range tuple/list/string @param ranges list of tuple/list/string @return tuple of (list of ranges added after coalescing, list of removed original ranges) """ coalesced_range = getPortRange(new_range) # normalize singleton ranges, e.g. (x,) --> (x,x) if len(coalesced_range) == 1: coalesced_range = (coalesced_range[0], coalesced_range[0]) _ranges = map(getPortRange, ranges) _ranges = sorted(map(lambda x: (x[0],x[0]) if len(x) == 1 else x, _ranges), key=lambda x: x[0]) removed_ranges = [] for range in _ranges: if coalesced_range[0] <= range[0] and coalesced_range[1] >= range[1]: # new range covers this removed_ranges.append(range) elif coalesced_range[0] <= range[0] and coalesced_range[1] < range[1] and \ coalesced_range[1] >= range[0]: # expand beginning of range removed_ranges.append(range) coalesced_range = (coalesced_range[0], range[1]) elif coalesced_range[0] > range[0] and coalesced_range[1] >= range[1] and \ coalesced_range[0] <= range[1]: # expand end of range removed_ranges.append(range) coalesced_range = (range[0], coalesced_range[1]) # normalize singleton ranges, e.g. (x,x) --> (x,) removed_ranges = list(map(lambda x: (x[0],) if x[0] == x[1] else x, removed_ranges)) if coalesced_range[0] == coalesced_range[1]: coalesced_range = (coalesced_range[0],) return ([coalesced_range], removed_ranges) def breakPortRange(remove_range, ranges): """ break a port range from existing list of port ranges @param remove_range tuple/list/string @param ranges list of tuple/list/string @return tuple of (list of ranges added after breaking up, list of removed original ranges) """ remove_range = getPortRange(remove_range) # normalize singleton ranges, e.g. (x,) --> (x,x) if len(remove_range) == 1: remove_range = (remove_range[0], remove_range[0]) _ranges = map(getPortRange, ranges) _ranges = sorted(map(lambda x: (x[0],x[0]) if len(x) == 1 else x, _ranges), key=lambda x: x[0]) removed_ranges = [] added_ranges = [] for range in _ranges: if remove_range[0] <= range[0] and remove_range[1] >= range[1]: # remove entire range removed_ranges.append(range) elif remove_range[0] <= range[0] and remove_range[1] < range[1] and \ remove_range[1] >= range[0]: # remove from beginning of range removed_ranges.append(range) added_ranges.append((remove_range[1] + 1, range[1])) elif remove_range[0] > range[0] and remove_range[1] >= range[1] and \ remove_range[0] <= range[1]: # remove from end of range removed_ranges.append(range) added_ranges.append((range[0], remove_range[0] - 1)) elif remove_range[0] > range[0] and remove_range[1] < range[1]: # remove inside range removed_ranges.append(range) added_ranges.append((range[0], remove_range[0] - 1)) added_ranges.append((remove_range[1] + 1, range[1])) # normalize singleton ranges, e.g. (x,x) --> (x,) removed_ranges = list(map(lambda x: (x[0],) if x[0] == x[1] else x, removed_ranges)) added_ranges = list(map(lambda x: (x[0],) if x[0] == x[1] else x, added_ranges)) return (added_ranges, removed_ranges) def getServiceName(port, proto): """ Check and Get service name from port and proto string combination using socket.getservbyport @param port string or id @param protocol string @return Service name if port and protocol are valid, else None """ try: name = socket.getservbyport(int(port), proto) except socket.error: return None return name def checkIP(ip): """ Check IPv4 address. @param ip address string @return True if address is valid, else False """ try: socket.inet_pton(socket.AF_INET, ip) except socket.error: return False return True def normalizeIP6(ip): """ Normalize the IPv6 address This is mostly about converting URL-like IPv6 address to normal ones. e.g. [1234::4321] --> 1234:4321 """ return ip.strip("[]") def checkIP6(ip): """ Check IPv6 address. @param ip address string @return True if address is valid, else False """ try: socket.inet_pton(socket.AF_INET6, normalizeIP6(ip)) except socket.error: return False return True def checkIPnMask(ip): if "/" in ip: addr = ip[:ip.index("/")] mask = ip[ip.index("/")+1:] if len(addr) < 1 or len(mask) < 1: return False else: addr = ip mask = None if not checkIP(addr): return False if mask: if "." in mask: return checkIP(mask) else: try: i = int(mask) except ValueError: return False if i < 0 or i > 32: return False return True def stripNonPrintableCharacters(rule_str): return rule_str.translate(NOPRINT_TRANS_TABLE) def checkIP6nMask(ip): if "/" in ip: addr = ip[:ip.index("/")] mask = ip[ip.index("/")+1:] if len(addr) < 1 or len(mask) < 1: return False else: addr = ip mask = None if not checkIP6(addr): return False if mask: try: i = int(mask) except ValueError: return False if i < 0 or i > 128: return False return True def checkProtocol(protocol): try: i = int(protocol) except ValueError: # string try: socket.getprotobyname(protocol) except socket.error: return False else: if i < 0 or i > 255: return False return True def checkTcpMssClamp(tcp_mss_clamp_value): if tcp_mss_clamp_value: if tcp_mss_clamp_value.isdigit(): if int(tcp_mss_clamp_value) < 536: return False elif tcp_mss_clamp_value == "None": return True elif tcp_mss_clamp_value != "pmtu": return False return True def checkInterface(iface): """ Check interface string @param interface string @return True if interface is valid (maximum 16 chars and does not contain ' ', '/', '!', ':', '*'), else False """ if not iface or len(iface) > 16: return False for ch in [ ' ', '/', '!', '*' ]: # !:* are limits for iptables <= 1.4.5 if ch in iface: return False # disabled old iptables check #if iface == "+": # # limit for iptables <= 1.4.5 # return False return True def checkUINT16(val): try: x = int(val, 0) except ValueError: return False else: if x >= 0 and x <= 65535: return True return False def checkUINT32(val): try: x = int(val, 0) except ValueError: return False else: if x >= 0 and x <= 4294967295: return True return False def firewalld_is_active(): """ Check if firewalld is active @return True if there is a firewalld pid file and the pid is used by firewalld """ if not os.path.exists(FIREWALLD_PIDFILE): return False try: with open(FIREWALLD_PIDFILE, "r") as fd: pid = fd.readline() except Exception: return False if not os.path.exists("/proc/%s" % pid): return False try: with open("/proc/%s/cmdline" % pid, "r") as fd: cmdline = fd.readline() except Exception: return False if "firewalld" in cmdline: return True return False def tempFile(): try: if not os.path.exists(FIREWALLD_TEMPDIR): os.mkdir(FIREWALLD_TEMPDIR, 0o750) return tempfile.NamedTemporaryFile(mode='wt', prefix="temp.", dir=FIREWALLD_TEMPDIR, delete=False) except Exception as msg: log.error("Failed to create temporary file: %s" % msg) raise return None def readfile(filename): try: with open(filename, "r") as f: return f.readlines() except Exception as e: log.error('Failed to read file "%s": %s' % (filename, e)) return None def writefile(filename, line): try: with open(filename, "w") as f: f.write(line) except Exception as e: log.error('Failed to write to file "%s": %s' % (filename, e)) return False return True def enable_ip_forwarding(ipv): if ipv == "ipv4": return writefile("/proc/sys/net/ipv4/ip_forward", "1\n") elif ipv == "ipv6": return writefile("/proc/sys/net/ipv6/conf/all/forwarding", "1\n") return False def get_nf_conntrack_short_name(module): return module.replace("_","-").replace("nf-conntrack-", "") def check_port(port): _range = getPortRange(port) if _range == -2 or _range == -1 or _range is None or \ (len(_range) == 2 and _range[0] >= _range[1]): if _range == -2: log.debug2("'%s': port > 65535" % port) elif _range == -1: log.debug2("'%s': port is invalid" % port) elif _range is None: log.debug2("'%s': port is ambiguous" % port) elif len(_range) == 2 and _range[0] >= _range[1]: log.debug2("'%s': range start >= end" % port) return False return True def check_address(ipv, source): if ipv == "ipv4": return checkIPnMask(source) elif ipv == "ipv6": return checkIP6nMask(source) else: return False def check_single_address(ipv, source): if ipv == "ipv4": return checkIP(source) elif ipv == "ipv6": return checkIP6(source) else: return False def check_mac(mac): if len(mac) == 12+5: # 0 1 : 3 4 : 6 7 : 9 10 : 12 13 : 15 16 for i in (2, 5, 8, 11, 14): if mac[i] != ":": return False for i in (0, 1, 3, 4, 6, 7, 9, 10, 12, 13, 15, 16): if mac[i] not in string.hexdigits: return False return True return False def uniqify(_list): # removes duplicates from list, whilst preserving order output = [] for x in _list: if x not in output: output.append(x) return output def ppid_of_pid(pid): """ Get parent for pid """ try: f = os.popen("ps -o ppid -h -p %d 2>/dev/null" % pid) pid = int(f.readlines()[0].strip()) f.close() except Exception: return None return pid def max_policy_name_len(): """ iptables limits length of chain to (currently) 28 chars. The longest chain we create is POST_<policy>_allow, which leaves 28 - 11 = 17 chars for <policy>. """ from firewall.core.ipXtables import POLICY_CHAIN_PREFIX from firewall.core.base import SHORTCUTS longest_shortcut = max(map(len, SHORTCUTS.values())) return 28 - (longest_shortcut + len(POLICY_CHAIN_PREFIX) + len("_allow")) def max_zone_name_len(): """ Netfilter limits length of chain to (currently) 28 chars. The longest chain we create is POST_<zone>_allow, which leaves 28 - 11 = 17 chars for <zone>. """ from firewall.core.base import SHORTCUTS longest_shortcut = max(map(len, SHORTCUTS.values())) return 28 - (longest_shortcut + len("__allow")) def checkUser(user): if len(user) < 1 or len(user) > os.sysconf('SC_LOGIN_NAME_MAX'): return False for c in user: if c not in string.ascii_letters and \ c not in string.digits and \ c not in [ ".", "-", "_", "$" ]: return False return True def checkUid(uid): if isinstance(uid, str): try: uid = int(uid) except ValueError: return False if uid >= 0 and uid <= 2**31-1: return True return False def checkCommand(command): if len(command) < 1 or len(command) > 1024: return False for ch in [ "|", "\n", "\0" ]: if ch in command: return False if command[0] != "/": return False return True def checkContext(context): splits = context.split(":") if len(splits) not in [4, 5]: return False # user ends with _u if not root if splits[0] != "root" and splits[0][-2:] != "_u": return False # role ends with _r if splits[1][-2:] != "_r": return False # type ends with _t if splits[2][-2:] != "_t": return False # level might also contain : if len(splits[3]) < 1: return False return True def joinArgs(args): if "quote" in dir(shlex): return " ".join(shlex.quote(a) for a in args) else: return " ".join(pipes.quote(a) for a in args) def splitArgs(_string): return shlex.split(_string) PK ���Zs�ԯ*D *D server/config_helper.pynu �[��� # -*- coding: utf-8 -*- # # Copyright (C) 2010-2016 Red Hat, Inc. # # Authors: # Thomas Woerner <twoerner@redhat.com> # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see <http://www.gnu.org/licenses/>. import dbus import dbus.service from firewall import config from firewall.dbus_utils import dbus_to_python, \ dbus_introspection_prepare_properties, \ dbus_introspection_add_properties from firewall.core.io.helper import Helper from firewall.core.logger import log from firewall.server.dbus import DbusServiceObject from firewall.server.decorators import handle_exceptions, \ dbus_handle_exceptions, dbus_service_method, \ dbus_polkit_require_auth from firewall import errors from firewall.errors import FirewallError ############################################################################ # # class FirewallDConfig # ############################################################################ class FirewallDConfigHelper(DbusServiceObject): """FirewallD main class""" persistent = True """ Make FirewallD persistent. """ default_polkit_auth_required = config.dbus.PK_ACTION_CONFIG """ Use PK_ACTION_INFO as a default """ @handle_exceptions def __init__(self, parent, conf, helper, item_id, *args, **kwargs): super(FirewallDConfigHelper, self).__init__(*args, **kwargs) self.parent = parent self.config = conf self.obj = helper self.item_id = item_id self.busname = args[0] self.path = args[1] self._log_prefix = "config.helper.%d" % self.item_id dbus_introspection_prepare_properties( self, config.dbus.DBUS_INTERFACE_CONFIG_HELPER) @dbus_handle_exceptions def __del__(self): pass @dbus_handle_exceptions def unregister(self): self.remove_from_connection() # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # P R O P E R T I E S @dbus_handle_exceptions def _get_property(self, property_name): if property_name == "name": return dbus.String(self.obj.name) elif property_name == "filename": return dbus.String(self.obj.filename) elif property_name == "path": return dbus.String(self.obj.path) elif property_name == "default": return dbus.Boolean(self.obj.default) elif property_name == "builtin": return dbus.Boolean(self.obj.builtin) else: raise dbus.exceptions.DBusException( "org.freedesktop.DBus.Error.InvalidArgs: " "Property '%s' does not exist" % property_name) @dbus_service_method(dbus.PROPERTIES_IFACE, in_signature='ss', out_signature='v') @dbus_handle_exceptions def Get(self, interface_name, property_name, sender=None): # pylint: disable=W0613 # get a property interface_name = dbus_to_python(interface_name, str) property_name = dbus_to_python(property_name, str) log.debug1("%s.Get('%s', '%s')", self._log_prefix, interface_name, property_name) if interface_name != config.dbus.DBUS_INTERFACE_CONFIG_HELPER: raise dbus.exceptions.DBusException( "org.freedesktop.DBus.Error.UnknownInterface: " "Interface '%s' does not exist" % interface_name) return self._get_property(property_name) @dbus_service_method(dbus.PROPERTIES_IFACE, in_signature='s', out_signature='a{sv}') @dbus_handle_exceptions def GetAll(self, interface_name, sender=None): # pylint: disable=W0613 interface_name = dbus_to_python(interface_name, str) log.debug1("%s.GetAll('%s')", self._log_prefix, interface_name) if interface_name != config.dbus.DBUS_INTERFACE_CONFIG_HELPER: raise dbus.exceptions.DBusException( "org.freedesktop.DBus.Error.UnknownInterface: " "Interface '%s' does not exist" % interface_name) ret = { } for x in [ "name", "filename", "path", "default", "builtin" ]: ret[x] = self._get_property(x) return dbus.Dictionary(ret, signature="sv") @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG) @dbus_service_method(dbus.PROPERTIES_IFACE, in_signature='ssv') @dbus_handle_exceptions def Set(self, interface_name, property_name, new_value, sender=None): interface_name = dbus_to_python(interface_name, str) property_name = dbus_to_python(property_name, str) new_value = dbus_to_python(new_value) log.debug1("%s.Set('%s', '%s', '%s')", self._log_prefix, interface_name, property_name, new_value) self.parent.accessCheck(sender) if interface_name != config.dbus.DBUS_INTERFACE_CONFIG_HELPER: raise dbus.exceptions.DBusException( "org.freedesktop.DBus.Error.UnknownInterface: " "Interface '%s' does not exist" % interface_name) raise dbus.exceptions.DBusException( "org.freedesktop.DBus.Error.PropertyReadOnly: " "Property '%s' is read-only" % property_name) @dbus.service.signal(dbus.PROPERTIES_IFACE, signature='sa{sv}as') def PropertiesChanged(self, interface_name, changed_properties, invalidated_properties): interface_name = dbus_to_python(interface_name, str) changed_properties = dbus_to_python(changed_properties) invalidated_properties = dbus_to_python(invalidated_properties) log.debug1("%s.PropertiesChanged('%s', '%s', '%s')", self._log_prefix, interface_name, changed_properties, invalidated_properties) @dbus_polkit_require_auth(config.dbus.PK_ACTION_INFO) @dbus_service_method(dbus.INTROSPECTABLE_IFACE, out_signature='s') @dbus_handle_exceptions def Introspect(self, sender=None): # pylint: disable=W0613 log.debug2("%s.Introspect()", self._log_prefix) data = super(FirewallDConfigHelper, self).Introspect( self.path, self.busname.get_bus()) return dbus_introspection_add_properties( self, data, config.dbus.DBUS_INTERFACE_CONFIG_HELPER) # S E T T I N G S @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_HELPER, out_signature=Helper.DBUS_SIGNATURE) @dbus_handle_exceptions def getSettings(self, sender=None): # pylint: disable=W0613 """get settings for helper """ log.debug1("%s.getSettings()", self._log_prefix) return self.config.get_helper_config(self.obj) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_HELPER, in_signature=Helper.DBUS_SIGNATURE) @dbus_handle_exceptions def update(self, settings, sender=None): """update settings for helper """ settings = dbus_to_python(settings) log.debug1("%s.update('...')", self._log_prefix) self.parent.accessCheck(sender) self.obj = self.config.set_helper_config(self.obj, settings) self.Updated(self.obj.name) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_HELPER) @dbus_handle_exceptions def loadDefaults(self, sender=None): """load default settings for builtin helper """ log.debug1("%s.loadDefaults()", self._log_prefix) self.parent.accessCheck(sender) self.obj = self.config.load_helper_defaults(self.obj) self.Updated(self.obj.name) @dbus.service.signal(config.dbus.DBUS_INTERFACE_CONFIG_HELPER, signature='s') @dbus_handle_exceptions def Updated(self, name): log.debug1("%s.Updated('%s')" % (self._log_prefix, name)) # R E M O V E @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_HELPER) @dbus_handle_exceptions def remove(self, sender=None): """remove helper """ log.debug1("%s.removeHelper()", self._log_prefix) self.parent.accessCheck(sender) self.config.remove_helper(self.obj) self.parent.removeHelper(self.obj) @dbus.service.signal(config.dbus.DBUS_INTERFACE_CONFIG_HELPER, signature='s') @dbus_handle_exceptions def Removed(self, name): log.debug1("%s.Removed('%s')" % (self._log_prefix, name)) # R E N A M E @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_HELPER, in_signature='s') @dbus_handle_exceptions def rename(self, name, sender=None): """rename helper """ name = dbus_to_python(name, str) log.debug1("%s.rename('%s')", self._log_prefix, name) self.parent.accessCheck(sender) self.obj = self.config.rename_helper(self.obj, name) self.Renamed(name) @dbus.service.signal(config.dbus.DBUS_INTERFACE_CONFIG_HELPER, signature='s') @dbus_handle_exceptions def Renamed(self, name): log.debug1("%s.Renamed('%s')" % (self._log_prefix, name)) # version @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_HELPER, out_signature='s') @dbus_handle_exceptions def getVersion(self, sender=None): # pylint: disable=W0613 log.debug1("%s.getVersion()", self._log_prefix) return self.getSettings()[0] @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_HELPER, in_signature='s') @dbus_handle_exceptions def setVersion(self, version, sender=None): version = dbus_to_python(version, str) log.debug1("%s.setVersion('%s')", self._log_prefix, version) self.parent.accessCheck(sender) settings = list(self.getSettings()) settings[0] = version self.update(settings) # short @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_HELPER, out_signature='s') @dbus_handle_exceptions def getShort(self, sender=None): # pylint: disable=W0613 log.debug1("%s.getShort()", self._log_prefix) return self.getSettings()[1] @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_HELPER, in_signature='s') @dbus_handle_exceptions def setShort(self, short, sender=None): short = dbus_to_python(short, str) log.debug1("%s.setShort('%s')", self._log_prefix, short) self.parent.accessCheck(sender) settings = list(self.getSettings()) settings[1] = short self.update(settings) # description @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_HELPER, out_signature='s') @dbus_handle_exceptions def getDescription(self, sender=None): # pylint: disable=W0613 log.debug1("%s.getDescription()", self._log_prefix) return self.getSettings()[2] @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_HELPER, in_signature='s') @dbus_handle_exceptions def setDescription(self, description, sender=None): description = dbus_to_python(description, str) log.debug1("%s.setDescription('%s')", self._log_prefix, description) self.parent.accessCheck(sender) settings = list(self.getSettings()) settings[2] = description self.update(settings) # family @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_HELPER, out_signature='s') @dbus_handle_exceptions def getFamily(self, sender=None): log.debug1("%s.getFamily()", self._log_prefix) self.parent.accessCheck(sender) settings = list(self.getSettings()) return settings[3] @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_HELPER, in_signature='s') @dbus_handle_exceptions def setFamily(self, ipv, sender=None): ipv = dbus_to_python(ipv, str) log.debug1("%s.setFamily('%s')", self._log_prefix, ipv) self.parent.accessCheck(sender) settings = list(self.getSettings()) if settings[3] == ipv: raise FirewallError(errors.ALREADY_ENABLED, "'%s'" % ipv) settings[3] = ipv self.update(settings) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_HELPER, in_signature='s', out_signature='b') @dbus_handle_exceptions def queryFamily(self, ipv, sender=None): # pylint: disable=W0613 ipv = dbus_to_python(ipv, str) log.debug1("%s.queryFamily('%s')", self._log_prefix, ipv) settings = self.getSettings() return (settings[3] == ipv) # module @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_HELPER, out_signature='s') @dbus_handle_exceptions def getModule(self, sender=None): log.debug1("%s.getModule()", self._log_prefix) self.parent.accessCheck(sender) settings = list(self.getSettings()) return settings[4] @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_HELPER, in_signature='s') @dbus_handle_exceptions def setModule(self, module, sender=None): module = dbus_to_python(module, str) log.debug1("%s.setModule('%s')", self._log_prefix, module) self.parent.accessCheck(sender) settings = list(self.getSettings()) if settings[4] == module: raise FirewallError(errors.ALREADY_ENABLED, "'%s'" % module) settings[4] = module self.update(settings) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_HELPER, in_signature='s', out_signature='b') @dbus_handle_exceptions def queryModule(self, module, sender=None): # pylint: disable=W0613 module = dbus_to_python(module, str) log.debug1("%s.queryModule('%s')", self._log_prefix, module) settings = self.getSettings() return (settings[4] == module) # port @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_HELPER, out_signature='a(ss)') @dbus_handle_exceptions def getPorts(self, sender=None): # pylint: disable=W0613 log.debug1("%s.getPorts()", self._log_prefix) return self.getSettings()[5] @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_HELPER, in_signature='a(ss)') @dbus_handle_exceptions def setPorts(self, ports, sender=None): _ports = [ ] # convert embedded lists to tuples for port in dbus_to_python(ports, list): if isinstance(port, list): _ports.append(tuple(port)) else: _ports.append(port) ports = _ports log.debug1("%s.setPorts('[%s]')", self._log_prefix, ",".join("('%s, '%s')" % (port[0], port[1]) for port in ports)) self.parent.accessCheck(sender) settings = list(self.getSettings()) settings[5] = ports self.update(settings) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_HELPER, in_signature='ss') @dbus_handle_exceptions def addPort(self, port, protocol, sender=None): port = dbus_to_python(port, str) protocol = dbus_to_python(protocol, str) log.debug1("%s.addPort('%s', '%s')", self._log_prefix, port, protocol) self.parent.accessCheck(sender) settings = list(self.getSettings()) if (port,protocol) in settings[5]: raise FirewallError(errors.ALREADY_ENABLED, "%s:%s" % (port, protocol)) settings[5].append((port,protocol)) self.update(settings) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_HELPER, in_signature='ss') @dbus_handle_exceptions def removePort(self, port, protocol, sender=None): port = dbus_to_python(port, str) protocol = dbus_to_python(protocol, str) log.debug1("%s.removePort('%s', '%s')", self._log_prefix, port, protocol) self.parent.accessCheck(sender) settings = list(self.getSettings()) if (port,protocol) not in settings[5]: raise FirewallError(errors.NOT_ENABLED, "%s:%s" % (port, protocol)) settings[5].remove((port,protocol)) self.update(settings) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_HELPER, in_signature='ss', out_signature='b') @dbus_handle_exceptions def queryPort(self, port, protocol, sender=None): # pylint: disable=W0613 port = dbus_to_python(port, str) protocol = dbus_to_python(protocol, str) log.debug1("%s.queryPort('%s', '%s')", self._log_prefix, port, protocol) return (port,protocol) in self.getSettings()[5] PK ���Z���ە � server/decorators.pynu �[��� # -*- coding: utf-8 -*- # # Copyright (C) 2012-2016 Red Hat, Inc. # # Authors: # Thomas Woerner <twoerner@redhat.com> # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see <http://www.gnu.org/licenses/>. """This module contains decorators for use with and without D-Bus""" __all__ = ["handle_exceptions", "dbus_handle_exceptions", "dbus_service_method"] import dbus import dbus.service import traceback import functools import inspect from dbus.exceptions import DBusException from firewall.errors import FirewallError from firewall import errors from firewall.core.logger import log from firewall.server.dbus import FirewallDBusException, NotAuthorizedException from firewall.dbus_utils import uid_of_sender ############################################################################ # # Exception handler decorators # ############################################################################ def handle_exceptions(func): """Decorator to handle exceptions and log them. Used if not conneced to D-Bus. """ @functools.wraps(func) def _impl(*args, **kwargs): try: return func(*args, **kwargs) except FirewallError as error: log.debug1(traceback.format_exc()) log.error(error) except Exception: # pylint: disable=W0703 log.exception() return _impl def dbus_handle_exceptions(func): """Decorator to handle exceptions, log and report them into D-Bus :Raises DBusException: on a firewall error code problems. """ @functools.wraps(func) def _impl(*args, **kwargs): try: return func(*args, **kwargs) except FirewallError as error: code = FirewallError.get_code(str(error)) if code in [ errors.ALREADY_ENABLED, errors.NOT_ENABLED, errors.ZONE_ALREADY_SET, errors.ALREADY_SET ]: log.warning(str(error)) else: log.debug1(traceback.format_exc()) log.error(str(error)) raise FirewallDBusException(str(error)) except DBusException as ex: # only log DBusExceptions once raise ex except Exception as ex: log.exception() raise FirewallDBusException(str(ex)) # HACK: functools.wraps() does not copy the function signature and # dbus-python doesn't support varargs. As such we need to copy the # signature from the function to the newly decorated function otherwise the # decorators in dbus-python will manipulate the arg stack and fail # miserably. # # Note: This can be removed if we ever stop using dbus-python. # # Ref: https://gitlab.freedesktop.org/dbus/dbus-python/-/issues/12 # _impl.__signature__ = inspect.signature(func) return _impl def dbus_service_method(*args, **kwargs): """Add sender argument for D-Bus""" kwargs.setdefault("sender_keyword", "sender") return dbus.service.method(*args, **kwargs) class dbus_service_method_deprecated: """Decorator that maintains a list of deprecated methods in dbus interfaces. """ deprecated = {} def __init__(self, interface=None): self.interface = interface if self.interface: if self.interface not in self.deprecated: self.deprecated[self.interface] = set() def __call__(self, func): if self.interface: self.deprecated[self.interface].add(func.__name__) @functools.wraps(func) def _impl(*args, **kwargs): return func(*args, **kwargs) return _impl class dbus_service_signal_deprecated(dbus_service_method_deprecated): """Decorator that maintains a list of deprecated signals in dbus interfaces. """ pass class dbus_polkit_require_auth: """Decorator factory that checks if the interface/method can be used by the sender/user. Assumes wrapped function is a method inside a class derived from DbusServiceObject. """ _polkit_name = "org.freedesktop.PolicyKit1" _polkit_path = "/org/freedesktop/PolicyKit1/Authority" _polkit_interface = "org.freedesktop.PolicyKit1.Authority" _bus = None _bus_signal_receiver = None _interface_polkit = None def __init__(self, polkit_auth_required): self._polkit_auth_required = polkit_auth_required @classmethod def _polkit_name_owner_changed(cls, name, old_owner, new_owner): cls._bus.remove_signal_receiver(cls._bus_signal_receiver) cls._bus_signal_receiver = None cls._interface_polkit = None pass def __call__(self, func): @functools.wraps(func) def _impl(*args, **kwargs): if not type(self)._bus: type(self)._bus = dbus.SystemBus() if not type(self)._bus_signal_receiver: type(self)._bus_signal_receiver = type(self)._bus.add_signal_receiver( handler_function=type(self)._polkit_name_owner_changed, signal_name="NameOwnerChanged", dbus_interface="org.freedesktop.DBus", arg0=self._polkit_name) if not type(self)._interface_polkit: try: type(self)._interface_polkit = dbus.Interface(type(self)._bus.get_object( type(self)._polkit_name, type(self)._polkit_path), type(self)._polkit_interface) except dbus.DBusException: # polkit must not be available pass action_id = self._polkit_auth_required if not action_id: raise dbus.DBusException("Not Authorized: No action_id specified.") sender = kwargs.get("sender") if sender: # use polkit if it's available if type(self)._interface_polkit: (result, _, _) = type(self)._interface_polkit.CheckAuthorization( ("system-bus-name", {"name": sender}), action_id, {}, 1, "") if not result: raise NotAuthorizedException(action_id, "polkit") # fallback to checking UID else: uid = uid_of_sender(type(self)._bus, sender) if uid != 0: raise NotAuthorizedException(action_id, "uid") return func(*args, **kwargs) _impl._polkit_auth_required = self._polkit_auth_required return _impl PK ���Z��5� � - server/__pycache__/decorators.cpython-310.pycnu �[��� o bhAb� � @ s� d Z g d�ZddlZddlZddlZddlZddlZddlmZ ddl m Z ddl m Z ddl mZ ddlmZmZ dd lmZ d d � Zd d � Zdd� ZG dd� d�ZG dd� de�ZG dd� d�ZdS )z>This module contains decorators for use with and without D-Bus)�handle_exceptions�dbus_handle_exceptions�dbus_service_method� N)� DBusException)� FirewallError)�errors)�log)�FirewallDBusException�NotAuthorizedException)� uid_of_senderc s t �� �� fdd��}|S )zTDecorator to handle exceptions and log them. Used if not conneced to D-Bus. c sj z� | i |��W S t y' } zt�t�� � t�|� W Y d }~d S d }~w ty4 t�� Y d S w �N)r r �debug1� traceback� format_exc�error� Exception� exception)�args�kwargsr ��func� �</usr/lib/python3/dist-packages/firewall/server/decorators.py�_impl0 s � �z handle_exceptions.<locals>._impl)� functools�wraps�r r r r r r , s r c s& t �� �� fdd��}t�� �|_|S )z�Decorator to handle exceptions, log and report them into D-Bus :Raises DBusException: on a firewall error code problems. c s� z� | i |��W S t yC } z/t �t|��}|tjtjtjtjfv r+t� t|�� nt� t � � � t� t|�� tt|���d }~w tyP } z|�d }~w tye } z t�� tt|���d }~ww r )r �get_code�strr �ALREADY_ENABLED� NOT_ENABLED�ZONE_ALREADY_SET� ALREADY_SETr �warningr r r r r r r r )r r r �code�exr r r r @ s( � �� ��z%dbus_handle_exceptions.<locals>._impl)r r �inspect� signature� __signature__r r r r r ; s r c O s |� dd� tjj| i |��S )z Add sender argument for D-Bus�sender_keyword�sender)� setdefault�dbus�service�method�r r r r r r ` s r c @ s& e Zd ZdZi Zddd�Zdd� ZdS )� dbus_service_method_deprecatedzRDecorator that maintains a list of deprecated methods in dbus interfaces. Nc C s2 || _ | j r| j | jvrt� | j| j < d S d S d S r )� interface� deprecated�set)�selfr1 r r r �__init__k s �z'dbus_service_method_deprecated.__init__c s4 | j r | j| j �� j� t�� �� fdd��}|S )Nc s � | i |��S r r r/ r r r r u s z6dbus_service_method_deprecated.__call__.<locals>._impl)r1 r2 �add�__name__r r �r4 r r r r r �__call__q s z'dbus_service_method_deprecated.__call__r )r7 � __module__� __qualname__�__doc__r2 r5 r9 r r r r r0 e s r0 c @ s e Zd ZdZdS )� dbus_service_signal_deprecatedzRDecorator that maintains a list of deprecated signals in dbus interfaces. N)r7 r: r; r< r r r r r= z s r= c @ sD e Zd ZdZdZdZdZdZdZdZ dd� Z e dd � �Z d d � Z dS ) �dbus_polkit_require_authz�Decorator factory that checks if the interface/method can be used by the sender/user. Assumes wrapped function is a method inside a class derived from DbusServiceObject. zorg.freedesktop.PolicyKit1z%/org/freedesktop/PolicyKit1/Authorityz$org.freedesktop.PolicyKit1.AuthorityNc C s || _ d S r )�_polkit_auth_required)r4 �polkit_auth_requiredr r r r5 � s z!dbus_polkit_require_auth.__init__c C s | j �| j� d | _d | _d S r )�_bus�remove_signal_receiver�_bus_signal_receiver�_interface_polkit)�cls�name� old_owner� new_ownerr r r �_polkit_name_owner_changed� s z3dbus_polkit_require_auth._polkit_name_owner_changedc s$ t �� �� �fdd��}�j|_|S )Nc s0 t ��js t�� t ��_t ��js$t ��jjt ��jdd�jd�t ��_t ��jsOzt� t ��j� t ��jt ��j �t ��j �t ��_W n tj yN Y nw �j}|sYt� d��|�d�}|r�t ��jr�t ��j�dd|if|i dd �\}}}|st|d ��ntt ��j|�}|d kr�t|d ��� | i |��S ) N�NameOwnerChangedzorg.freedesktop.DBus)�handler_function� signal_name�dbus_interface�arg0z'Not Authorized: No action_id specified.r* zsystem-bus-namerF � � �polkitr �uid)�typerA r, � SystemBusrC �add_signal_receiverrI � _polkit_namerD � Interface� get_object� _polkit_path�_polkit_interfacer r? �get�CheckAuthorizationr r )r r � action_idr* �result�_rR �r r4 r r r � sJ � ��� � � z0dbus_polkit_require_auth.__call__.<locals>._impl)r r r? r8 r r` r r9 � s +z!dbus_polkit_require_auth.__call__)r7 r: r; r< rV rY rZ rA rC rD r5 � classmethodrI r9 r r r r r> � s r> )r< �__all__r, � dbus.servicer r r& �dbus.exceptionsr �firewall.errorsr �firewallr �firewall.core.loggerr �firewall.server.dbusr r �firewall.dbus_utilsr r r r r0 r= r> r r r r �<module> s& %PK ���ZP>�d� � , server/__pycache__/firewalld.cpython-310.pycnu �[��� o bhAb�� � @ sB d gZ ddlmZ ddlZddlZddlZddlmZ ddlm Z ddl m Z ddl m Z ddlmZ dd lmZmZ dd lmZmZmZmZmZmZ dd lmZ dd l m Z m Z m Z m Z m!Z!m"Z"m#Z#m$Z$ dd l%m&Z& ddl'm(Z( ddl)m*Z* ddl+m,Z, ddl-m.Z.m/Z/ ddl0m1Z1 ddlm2Z2 ddl3m4Z4 G dd � d e�Z5dS )� FirewallD� )�GLibN)�config)�Firewall)� Rich_Rule)�log)�FirewallClientZoneSettings)�FirewallDBusException�DbusServiceObject)�dbus_handle_exceptions�dbus_service_method�handle_exceptions� dbus_service_method_deprecated� dbus_service_signal_deprecated�dbus_polkit_require_auth)�FirewallDConfig)�dbus_to_python�command_of_sender�context_of_sender� uid_of_sender� user_of_uid�%dbus_introspection_prepare_properties�!dbus_introspection_add_properties�!dbus_introspection_add_deprecated)�check_on_disk_config)�IPSet)�IcmpType)�Helper)� nm_get_connection_of_interface�nm_set_zone_of_connection)�ifcfg_set_zone_of_interface)�errors)� FirewallErrorc s� e Zd ZdZdZ ejjZ e � fdd��Z dd� Z e dd� �Z e d d � �Z ed d � �Zed d� �Zedd� �Zedd� �Zedd� �Zeejddd�e�d�dd���Zeejdd d�e�d�d d ���Zeejj�eejd d �e�d�d!d"����Zejjejd#d$�d%d&� �Z eejj �eej dd'�e�d�� fd(d)� ���Z eejj�eejj d*d*d�e�d�d+d,����Z!eejj�eejj d*d*d�e�d�d-d.����Z"ej�ejj �ed/d0� ��Z#eejj�eejj d*d*d�e�d�d1d2����Z$eejj�eejj d*d*d�e�d�d3d4����Z%eejj&�eejj'd*d*d�e�d�d5d6����Z(eejj&�eejj'd*d*d�e�d�d7d8����Z)eejj*�eejj'd*d9d�e�d�d:d;����Z+ejjejj'd*d$�ed<d=� ��Z,ejjejj'd*d$�ed>d?� ��Z-eejj&�eejj'dd*d�e�d�d@dA����Z.eejj&�eejj'dd*d�e�d�dBdC����Z/eejj*�eejj'dd9d�e�d�dDdE����Z0eejj*�eejj'd*dFd�e�d�dGdH����Z1ejjejj'dd$�edIdJ� ��Z2ejjejj'dd$�edKdL� ��Z3eejj&�eejj'dMd*d�e�d�dNdO����Z4eejj&�eejj'dMd*d�e�d�dPdQ����Z5eejj*�eejj'dMd9d�e�d�dRdS����Z6eejj*�eejj'd*dTd�e�d�dUdV����Z7ejjejj'dMd$�edWdX� ��Z8ejjejj'dMd$�edYdZ� ��Z9eejj&�eejj'dd*d�e�d�d[d\����Z:eejj&�eejj'dd*d�e�d�d]d^����Z;eejj*�eejj'dd9d�e�d�d_d`����Z<eejj*�eejj'd*dFd�e�d�dadb����Z=ejjejj'dd$�edcdd� ��Z>ejjejj'dd$�ededf� ��Z?eejj&�eejj'dd*d�e�d�dgdh����Z@eejj&�eejj'dd*d�e�d�didj����ZAeejj*�eejj'dd9d�e�d�dkdl����ZBeejj*�eejj'd*dFd�e�d�dmdn����ZCejjejj'dd$�edodp� ��ZDejjejj'dd$�edqdr� ��ZEeejj�eejj d*d*d�e�d�dsdt����ZFeejj�eejj d*d*d�e�d�dudv����ZGeejj �eejj d*d9d�e�d�dwdx����ZHejjejj d*d$�edydz� ��ZIejjejj d*d$�ed{d|� ��ZJeejjK�eejj dd}d�e�d�d~d����ZLeejjK�eejjMdd d�e�d�d�d�����ZNeejjK�eejjMd�d �e�d�d�d�����ZOejjejjMd�d$�ed�d�� ��ZPeejjK�eejjQdd d�e�d�d�d�����ZReejjK�eejjQd�d �e�d�d�d�����ZSejjejjQd�d$�ed�d�� ��ZTeejj �eejj d*dFd�e�d�d�d�����ZUeejjK�eejj dd�d�e�d�d�d�����ZVeejjK�eejj dd d�e�d�d�d�����ZWeejj �eejj d*dFd�e�d�d�d�����ZXeejjK�eejj deYjZd�e�d�d�d�����Z[eejjK�eejj d*dd�e�d�d�d�����Z\eejj�eejj dd*d�e�d�d�d�����Z]ejjejj dd$�ed�d�� ��Z^eejjK�eejj d*dd�e�d�d�d�����Z_eejj�eejj dd*d�e�d�d�d�����Z`ejjejj dd$�ed�d�� ��Zaeejj �eejj d*dd�e�d�d�d�����Zbeejj�eejj dd*d�e�d�d�d�����Zcejjejj dd$�ed�d�� ��Zdeejj �eejjQd*dFd�e�d�d�d�����Zeeejj �eejjQd*d�d�e�d�d�d�����Zfeejj �eejjMd*dFd�e�d�d�d�����Zgeejj �eejjMd*d�d�e�d�d�d�����Zheejj �eejjMddd�e�d�d�d�����Zieejj �eejjMddd�e�d�d�d�����ZjeejjK�eejjMdd9d�e�d�d�d�����Zkeejj�eejjMddd�e�d�d�d�����Zleejj�eejjMddd�e�d�d�d�����Zmeejj�eejjMddd�e�d�d�d�����Zneejj�eejjMddd�e�d�d�d�����ZoeejjK�eejjMdd9d�e�d�d�d���ZpeejjK�eejjMddFd�e�d�d�dĄ���ZqejjejjMdd$�ed�dƄ ��ZrejjejjMdd$�ed�dȄ ��ZsejjejjMdd$�ed�dʄ ��ZtejjejjMdd$�ed�d̄ ��Zueejj�eejjMddd�e�d�d�d΄���Zveejj�eejjMddd�e�d�d�dЄ���Zweejj�eejjMddd�e�d�d�d҄���ZxeejjK�eejjMdd9d�e�d�d�dԄ���ZyeejjK�eejjMddFd�e�d�d�dք���ZzejjejjMdd$�ed�d ��Z{ejjejjMdd$�ed�dڄ ��Z|ejjejjMdd$�ed�d܄ ��Z}ed�dބ �Z~eejj�eejjMd�dd�e�d�d�d����Zeejj�eejjMddd�e�d�d�d����Z�eejjK�eejjMdd9d�e�d�d�d����Z�eejjK�eejjMddFd�e�d�d�d����Z�ejjejjMd�d$�ed�d� ��Z�ejjejjMdd$�ed�d� ��Z�ed�d� �Z�eejj�eejjMd�dd�e�d�d�d����Z�eejj�eejjMddd�e�d�d�d����Z�eejjK�eejjMdd9d�e�d�d�d����Z�eejjK�eejjMddFd�e�d�d�d�����Z�ejjejjMd�d$�ed�d�� ��Z�ejjejjMdd$�ed�d�� ��Z�ed�d�� �Z�eejj�eejjMd�dd�e�d�d�d�����Z�eejj�eejjMd�dd�e�d��d �d����Z�eejjK�eejjMd�d9d�e�d��d�d����Z�eejjK�eejjMd�dd�e�d��d�d����Z�ejjejjMd�d$�e�d��d�d ���Z�ejjejjMd�d$�e�d �d � ��Z�e�d �d � �Z�eejj�eejjMd�dd�e�d��d�d����Z�eejj�eejjMddd�e�d��d�d����Z�eejjK�eejjMdd9d�e�d��d�d����Z�eejjK�eejjMddFd�e�d��d�d����Z�ejjejjMd�d$�e�d��d�d���Z�ejjejjMdd$�e�d�d� ��Z�e�d�d� �Z�eejj�eejjMd�dd�e�d��d �d ����Z�eejj�eejjMd�dd�e�d��d �d ����Z�eejjK�eejjMd�d9d�e�d��d �d!����Z�eejjK�eejjMd�dd�e�d��d"�d#����Z�ejjejjMd�d$�e�d��d$�d%���Z�ejjejjMd�d$�e�d&�d'� ��Z�e�d(�d)� �Z�eejj�eejjM�d*dd�e�d��d+�d,����Z�eejj�eejjMddd�e�d��d-�d.����Z�eejjK�eejjMdd9d�e�d��d/�d0����Z�ejjejjM�d*d$�e�d��d1�d2���Z�ejjejjMdd$�e�d3�d4� ��Z�e�d5�d6� �Z�eejj�eejjM�d7dd�e �d��d8�d9����Z�eejj�eejjM�d:dd�e �d��d;�d<����Z�eejjK�eejjM�d:d9d�e �d��d=�d>����Z�eejjK�eejjMd�dd�e�d��d?�d@����Z�ejjejjM�d7d$�e� �d��dA�dB���Z�ejjejjM�d:d$�e�dC�dD� ��Z�e�dE�dF� �Z�eejj�eejjMd�dd�e�d��dG�dH����Z�eejj�eejjMddd�e�d��dI�dJ����Z�eejjK�eejjMdd9d�e�d��dK�dL����Z�eejjK�eejjMddFd�e�d��dM�dN����Z�ejjejjMd�d$�e�d��dO�dP���Z�ejjejjMdd$�e�dQ�dR� ��Z�eejj�eejjMddd�e�d��dS�dT����Z�eejj�eejjMddd�e�d��dU�dV����Z�eejjK�eejjMdd9d�e�d��dW�dX����Z�ejjejjMdd$�e�dY�dZ� ��Z�ejjejjMdd$�e�d[�d\� ��Z�eejj��e�ejj��eejj�d�d*d�e�d��d]�d^�����Z�eejj��e�ejj��eejj�d�d*d�e�d��d_�d`�����Z�eejj��e�ejj��eejj�d�d9d�e�d��da�db�����Z�eejj��e�ejj��eejj�ddFd�e�d��dc�dd�����Z�eejj��e�ejj��eejj�d*�ded�e�d��df�dg�����Z�e�ejj��ejjejj�d�d$�e�dh�di� ���Z�e�ejj��ejjejj�d�d$�e�dj�dk� ���Z�eejj��e�ejj��eejj��dld*d�e�d��dm�dn�����Z�eejj��e�ejj��eejj��dld*d�e�d��do�dp�����Z�eejj��e�ejj��eejj�d�d*d�e�d��dq�dr�����Z�eejj��e�ejj��eejj��dld9d�e�d��ds�dt�����Z�eejj��e�ejj��eejj�d��dud�e�d��dv�dw�����Z�eejj��e�ejj��eejj�d*�dxd�e�d��dy�dz�����Z�e�ejj��ejjejj��dld$�e�d{�d|� ���Z�e�ejj��ejjejj��dld$�e�d}�d~� ���Z�eejj��e�ejj��eejj��ddd�e�d��d��d������Z�eejj��e�ejj��eejj��dd*d�e�d��d��d������Z�eejj��e�ejj��eejj��dd*d�e�d��d��d������Z�eejj��e�ejj��eejj��dd9d�e�d��d��d������Z�eejj��e�ejj��eejj�d*�d�d�e�d��d��d������Z�eejj��e�ejj��eejj�d*d*d�e�d��d��d������Z�eejj��e�ejj��eejj�d�dd�e�d��d��d������Z�e�ejj��ejjejj��dd$�e�d��d�� ���Z�e�ejj��ejjejj��dd$�e�d��d�� ���Z�eejj׃eejj d*d*d�e�d��d��d�����Z�eejj �eejj�dd9d�e�d��d��d�����Z�eejj �eejj�d*dFd�e�d��d��d�����Z�eejjK�eejj�de�jZd�e�d��d��d�����Z�eejj�eejj�dd*d�e�d��d��d�����Z�eejj�eejj�dd*d�e�d��d��d�����Z�eejj �eejj�dd9d�e�d��d��d�����Z�eejj �eejj�ddFd�e�d��d��d�����Z�eejj�eejjِdd �e�d��d��d�����Z�ejjejj�dd$�e�d��d�� ��Z�ejjejj�dd$�e�d��d�� ��Z�eejj �eejj d*dFd�e�d��d��d�����Z�eejjK�eejj de�jZd�e�d��d��d�����Z� Z�S (� r zFirewallD main classTc sd t t| �j|i |�� t� | _|d | _|d | _| �� t| t j j � t | jj | jt j j �| _ d S )Nr � )�superr �__init__r �fw�busname�path�startr r �dbus�DBUS_INTERFACEr �DBUS_PATH_CONFIG)�self�args�kwargs�� __class__� �;/usr/lib/python3/dist-packages/firewall/server/firewalld.pyr% G s �zFirewallD.__init__c C s | � � d S �N)�stop�r- r2 r2 r3 �__del__R s zFirewallD.__del__c C s t �d� i | _| j�� S )Nzstart())r �debug1� _timeoutsr& r) r6 r2 r2 r3 r) U s zFirewallD.startc C � t �d� | j�� S )Nzstop())r r8 r& r5 r6 r2 r2 r3 r5 ] s zFirewallD.stopc C s� | j j�� rV|d u rt�d� d S t�� }t||�}| j j�d|�r$d S t ||�}| j j�d|�r3d S t |�}| j j�d|�rAd S t ||�}| j j�d|�rPd S t t jd��d S )Nz&Lockdown not possible, sender not set.�context�uid�user�commandzlockdown is enabled)r& �policies�query_lockdownr �errorr* � SystemBusr � access_checkr r r r" r! � ACCESS_DENIED)r- �sender�busr; r< r= r> r2 r2 r3 � accessCheckf s& �zFirewallD.accessCheckc C s& || j vr i | j |< || j | |< d S r4 )r9 )r- �zone�x�tagr2 r2 r3 � addTimeout} s zFirewallD.addTimeoutc C sD || j v r || j | v r t�| j | | � | j | |= d S d S d S r4 )r9 r � source_remove�r- rH rI r2 r2 r3 � removeTimeout� s �zFirewallD.removeTimeoutc C sL | j D ]}| j | D ] }t�| j | | � q | j | �� q| j �� d S r4 )r9 r rL �clearrM r2 r2 r3 �cleanup_timeouts� s zFirewallD.cleanup_timeoutsc C sV |dkr t �tj�S |dkrt �dtj jtj jf �S |dkr't �| j�� �S |dkr4t �| j� d��S |dkr@t � | jj d�S |d krMt �| j� d ��S |d krXt �| jj �S |d krdt � | jj d�S |d krot �| jj�S |dkrzt �| jj�S |dkr�t � | jjd�S |dkr�t �d�S |dkr�t �i d�S |dkr�t �i d�S t j�d| ��)N�version�interface_versionz%d.%d�state�IPv4�ipv4� IPv4ICMPTypes�s�IPv6�ipv6� IPv6_rpfilter� IPv6ICMPTypes�BRIDGEr � IPSetTypes�nf_conntrack_helper_settingF�nf_conntrack_helpers�sas�nf_nat_helpers�Dorg.freedesktop.DBus.Error.InvalidArgs: Property '%s' does not exist)r* �Stringr �VERSION�DBUS_INTERFACE_VERSION�DBUS_INTERFACE_REVISIONr& � get_state�Boolean�is_ipv_enabled�Array�ipv4_supported_icmp_types�ipv6_rpfilter_enabled�ipv6_supported_icmp_types�ebtables_enabled� ipset_enabled�ipset_supported_types� Dictionary� exceptions� DBusException)r- �propr2 r2 r3 � _get_property� sF � ��zFirewallD._get_property�ss�v)� in_signature� out_signatureNc C sx t |t�}t |t�}t�d||� |tjjkr | �|�S |tjjtjj tjj tjj fv r4tj � d| ��tj � d| ��)NzGet('%s', '%s')rb �Jorg.freedesktop.DBus.Error.UnknownInterface: Interface '%s' does not exist)r �strr r8 r r* r+ ru �DBUS_INTERFACE_ZONE�DBUS_INTERFACE_DIRECT�DBUS_INTERFACE_POLICIES�DBUS_INTERFACE_IPSETrr rs )r- �interface_name� property_namerE r2 r2 r3 �Get� s( �����z FirewallD.GetrW za{sv}c C s� t |t�}t�d|� i }|tjjkr dD ] }| �|�||< qn|tjjtjj tjj tjj fv r1ntj � d| ��tj|dd�S )Nz GetAll('%s')�rQ rR rS rT rX rZ r\ r r] r^ r_ ra rV r[ rz �sv�� signature)r r{ r r8 r r* r+ ru r| r} r~ r rr rs rq )r- r� rE �retrI r2 r2 r3 �GetAll� s& ����zFirewallD.GetAll�ssv)rx c C s� t |t�}t |t�}t |�}t�d|||� | �|� |tjjkr5|dv r-tj� d| ��tj� d| ��|tjj tjj tjj tjj fv rMtj� d| ��tj� d| ��)NzSet('%s', '%s', '%s')r� zGorg.freedesktop.DBus.Error.PropertyReadOnly: Property '%s' is read-onlyrb rz )r r{ r r8 rG r r* r+ rr rs r| r} r~ r )r- r� r� � new_valuerE r2 r2 r3 �Set� sD � ���������z FirewallD.Setzsa{sv}asr� c C s. t |t�}t |�}t |�}t�d|||� d S )Nz#PropertiesChanged('%s', '%s', '%s'))r r{ r r8 )r- r� �changed_properties�invalidated_propertiesr2 r2 r3 �PropertiesChanged s �zFirewallD.PropertiesChanged)ry c s` t �d� tt| ��| j| j�� �}t| |t j j �}t j j fD ]}t | ||t� jt� j�}q |S )Nz Introspect())r �debug2r$ r � Introspectr( r' �get_busr r r* r+ r} r r � deprecatedr )r- rE �data� interfacer0 r2 r3 r� $ s ���zFirewallD.Introspect� c C s* t �d� | j�� | j�� | �� dS )z#Reload the firewall rules. zreload()N�r r8 r& �reloadr �Reloaded�r- rE r2 r2 r3 r� : s zFirewallD.reloadc C s, t �d� | j�d� | j�� | �� dS )z�Completely reload the firewall. Completely reload the firewall: Stops firewall, unloads modules and starts the firewall again. zcompleteReload()TNr� r� r2 r2 r3 �completeReloadI s zFirewallD.completeReloadc C � t �d� d S )Nz Reloaded()�r r8 r6 r2 r2 r3 r� Y � zFirewallD.Reloadedc C s t �d� t| j� dS )z&Check permanent configuration zcheckPermanentConfig()N)r r8 r r& r� r2 r2 r3 �checkPermanentConfig^ s z FirewallD.checkPermanentConfigc C s~ t �d� d}| j�� }| jj�� D ]Y}| �|�}z5||v r?| j�|�}|� � |kr7t �d| � |� |� nt �d| � nt �d| � | j� ||� W q t yk } zt � d||f � d}W Y d}~qd}~ww | j�� }| jj�� D ]Y}| �|�}z5||v r�| j�|�}|� � |kr�t �d | � |� |� nt �d | � nt �d | � | j�||� W qw t y� } zt � d ||f � d}W Y d}~qwd}~ww | j�� }| jj�� D ]\}z<| �|�}||v �r | j�|�}|� � |k�rt �d | � |� |� nt �d| � nt �d| � | j�||� W q� t �y8 } zt � d||f � d}W Y d}~q�d}~ww | j�� }| jj� � D ]�}| � |�}t |�}d} | jj D ]} t �d|| f � |� | � d} �qU|�!� D ]$} zt"| �} | �r�t#|| ��r�|� | � d} W �qm t �y� Y �qmw | �r�|�$� }|�!� D ]} t%|| � �q�z)||v �r�| j�&|�}t �d| � |�'|� nt �d| � | j�(||� W �qD t �y� } zt � d||f � d}W Y d}~�qDd}~ww | j�)� }| jj*�+� D ]H}| �,|�}z"||v �r| j�-|�}|� |� nt �d| � | j�.||� W �q� t �yB } zt � d||f � d}W Y d}~�q�d}~ww | j�/� }| jj0�1� D ]^}| �2|�}z8||v �r}| j�3|�}|� � |k�rut �d| � |� |� nt �d| � nt �d| � | j�4||� W �qN t �y� } zt � d||f � d}W Y d}~�qNd}~ww | jj5�6� | jj5�7� | jj5�8� f}z| j� � |k�r�t �d� | j� |� nt �d � W n t �y� } zt � d | � d}W Y d}~nd}~ww | jj9j:�;� }z| j� � |k�rt �d � | j�<|� nt �d � W n t �y4 } zt � d | � d}W Y d}~nd}~ww |�r=t=t>j?��dS )!z-Make runtime configuration permanent zcopyRuntimeToPermanent()Fz Copying service '%s' settingsz$Service '%s' is identical, ignoring.zCreating service '%s'z/Runtime To Permanent failed on service '%s': %sTNz Copying icmptype '%s' settingsz%IcmpType '%s' is identical, ignoring.zCreating icmptype '%s'z0Runtime To Permanent failed on icmptype '%s': %szCopying ipset '%s' settingsz"IPSet '%s' is identical, ignoring.zCreating ipset '%s'z-Runtime To Permanent failed on ipset '%s': %szEZone '%s': interface binding for '%s' has been added by NM, ignoring.zCopying zone '%s' settingszCreating zone '%s'z,Runtime To Permanent failed on zone '%s': %szCreating policy '%s'z.Runtime To Permanent failed on policy '%s': %sz Copying helper '%s' settingsz#Helper '%s' is identical, ignoring.zCreating helper '%s'z.Runtime To Permanent failed on helper '%s': %sz Copying direct configurationz,Direct configuration is identical, ignoring.z7Runtime To Permanent failed on direct configuration: %sz Copying policies configurationz.Policies configuration is identical, ignoring.z9Runtime To Permanent failed on policies configuration: %s)@r r8 r �getServiceNamesr& �service� get_services�getServiceSettings�getServiceByName� getSettings�update� addService� Exception�warning�getIcmpTypeNames�icmptype� get_icmptypes�getIcmpTypeSettings�getIcmpTypeByName� addIcmpType� getIPSetNames�ipset� get_ipsets�getIPSetSettings�getIPSetByName�addIPSet� getZoneNamesrH � get_zones�getZoneSettings2r �_nm_assigned_interfaces�removeInterface� getInterfacesr r �getSettingsDictr � getZoneByName�update2�addZone2�getPolicyNames�policy�"get_policies_not_derived_from_zone�getPolicySettings�getPolicyByName� addPolicy�getHelperNames�helper� get_helpers�getHelperSettings�getHelperByName� addHelper�direct�get_all_chains� get_all_rules�get_all_passthroughsr? �lockdown_whitelist� export_config�setLockdownWhitelistr" r! �RT_TO_PERM_FAILED) r- rE rA � config_names�name�conf�conf_obj�e�settings�changedr� � connectionr2 r2 r3 �runtimeToPermanentj sr ����� ����� ����� �� ����� ����� ����� � ���� ����� �z FirewallD.runtimeToPermanentc C �, t �d� | �|� | jj�� | �� dS )z!Enable lockdown policies zpolicies.enableLockdown()N)r r8 rG r& r? �enable_lockdown�LockdownEnabledr� r2 r2 r3 �enableLockdown4 � zFirewallD.enableLockdownc C r� )z"Disable lockdown policies zpolicies.disableLockdown()N)r r8 rG r& r? �disable_lockdown�LockdownDisabledr� r2 r2 r3 �disableLockdown@ r� zFirewallD.disableLockdown�bc C � t �d� | jj�� S )z+Retuns True if lockdown is enabled zpolicies.queryLockdown())r r8 r& r? r@ r� r2 r2 r3 � queryLockdownL s zFirewallD.queryLockdownc C r� )NzLockdownEnabled()r� r6 r2 r2 r3 r� W r� zFirewallD.LockdownEnabledc C r� )NzLockdownDisabled()r� r6 r2 r2 r3 r� \ r� zFirewallD.LockdownDisabledc C �@ t |t�}t�d| � | �|� | jjj�|� | � |� dS )� Add lockdown command z*policies.addLockdownWhitelistCommand('%s')N) r r{ r r8 rG r& r? r� � add_command� LockdownWhitelistCommandAdded�r- r> rE r2 r2 r3 �addLockdownWhitelistCommande � z%FirewallD.addLockdownWhitelistCommandc C r� )z Remove lockdown command z-policies.removeLockdownWhitelistCommand('%s')N) r r{ r r8 rG r& r? r� �remove_command� LockdownWhitelistCommandRemovedr� r2 r2 r3 � removeLockdownWhitelistCommandr r� z(FirewallD.removeLockdownWhitelistCommandc C �( t |t�}t�d| � | jjj�|�S )z Query lockdown command z,policies.queryLockdownWhitelistCommand('%s'))r r{ r r8 r& r? r� � has_commandr� r2 r2 r3 � queryLockdownWhitelistCommand � z'FirewallD.queryLockdownWhitelistCommand�asc C � t �d� | jjj�� S )r� z'policies.getLockdownWhitelistCommands())r r8 r& r? r� � get_commandsr� r2 r2 r3 � getLockdownWhitelistCommands� � z&FirewallD.getLockdownWhitelistCommandsc C � t �d| � d S )Nz#LockdownWhitelistCommandAdded('%s')r� �r- r> r2 r2 r3 r� � � z'FirewallD.LockdownWhitelistCommandAddedc C r� )Nz%LockdownWhitelistCommandRemoved('%s')r� r� r2 r2 r3 r� � r� z)FirewallD.LockdownWhitelistCommandRemoved�ic C r� )�Add lockdown uid z&policies.addLockdownWhitelistUid('%s')N) r �intr r8 rG r& r? r� �add_uid�LockdownWhitelistUidAdded�r- r< rE r2 r2 r3 �addLockdownWhitelistUid� r� z!FirewallD.addLockdownWhitelistUidc C r� )z Remove lockdown uid z)policies.removeLockdownWhitelistUid('%s')N) r r� r r8 rG r& r? r� � remove_uid�LockdownWhitelistUidRemovedr r2 r2 r3 �removeLockdownWhitelistUid� r� z$FirewallD.removeLockdownWhitelistUidc C r� )zQuery lockdown uid z(policies.queryLockdownWhitelistUid('%s'))r r� r r8 r& r? r� �has_uidr r2 r2 r3 �queryLockdownWhitelistUid� r� z#FirewallD.queryLockdownWhitelistUid�aic C r� )r� z#policies.getLockdownWhitelistUids())r r8 r& r? r� �get_uidsr� r2 r2 r3 �getLockdownWhitelistUids� r� z"FirewallD.getLockdownWhitelistUidsc C r� )Nz LockdownWhitelistUidAdded(%d)r� �r- r< r2 r2 r3 r � r� z#FirewallD.LockdownWhitelistUidAddedc C r� )Nz LockdownWhitelistUidRemoved(%d)r� r r2 r2 r3 r � r� z%FirewallD.LockdownWhitelistUidRemovedc C r� )�Add lockdown user z'policies.addLockdownWhitelistUser('%s')N) r r{ r r8 rG r& r? r� �add_user�LockdownWhitelistUserAdded�r- r= rE r2 r2 r3 �addLockdownWhitelistUser� r� z"FirewallD.addLockdownWhitelistUserc C r� )z Remove lockdown user z*policies.removeLockdownWhitelistUser('%s')N) r r{ r r8 rG r& r? r� � remove_user� LockdownWhitelistUserRemovedr r2 r2 r3 �removeLockdownWhitelistUser� r� z%FirewallD.removeLockdownWhitelistUserc C r� )z Query lockdown user z)policies.queryLockdownWhitelistUser('%s'))r r{ r r8 r& r? r� �has_userr r2 r2 r3 �queryLockdownWhitelistUser� r� z$FirewallD.queryLockdownWhitelistUserc C r� )r z$policies.getLockdownWhitelistUsers())r r8 r& r? r� � get_usersr� r2 r2 r3 �getLockdownWhitelistUsers r� z#FirewallD.getLockdownWhitelistUsersc C r� )Nz LockdownWhitelistUserAdded('%s')r� �r- r= r2 r2 r3 r r� z$FirewallD.LockdownWhitelistUserAddedc C r� )Nz"LockdownWhitelistUserRemoved('%s')r� r r2 r2 r3 r r� z&FirewallD.LockdownWhitelistUserRemovedc C r� )� Add lockdown context z*policies.addLockdownWhitelistContext('%s')N) r r{ r r8 rG r& r? r� � add_context� LockdownWhitelistContextAdded�r- r; rE r2 r2 r3 �addLockdownWhitelistContext r� z%FirewallD.addLockdownWhitelistContextc C r� )z Remove lockdown context z-policies.removeLockdownWhitelistContext('%s')N) r r{ r r8 rG r& r? r� �remove_context� LockdownWhitelistContextRemovedr r2 r2 r3 � removeLockdownWhitelistContext) r� z(FirewallD.removeLockdownWhitelistContextc C r� )z Query lockdown context z,policies.queryLockdownWhitelistContext('%s'))r r{ r r8 r& r? r� � has_contextr r2 r2 r3 � queryLockdownWhitelistContext6 r� z'FirewallD.queryLockdownWhitelistContextc C r� )r z'policies.getLockdownWhitelistContexts())r r8 r& r? r� � get_contextsr� r2 r2 r3 � getLockdownWhitelistContextsB r� z&FirewallD.getLockdownWhitelistContextsc C r� )Nz#LockdownWhitelistContextAdded('%s')r� �r- r; r2 r2 r3 r M r� z'FirewallD.LockdownWhitelistContextAddedc C r� )Nz%LockdownWhitelistContextRemoved('%s')r� r& r2 r2 r3 r R r� z)FirewallD.LockdownWhitelistContextRemovedc C �* t �d� | �|� | j�� | �� dS )znEnable panic mode. All ingoing and outgoing connections and packets will be blocked. zenablePanicMode()N)r r8 rG r& �enable_panic_mode�PanicModeEnabledr� r2 r2 r3 �enablePanicMode[ s zFirewallD.enablePanicModec C r' )z�Disable panic mode. Enables normal mode: Allowed ingoing and outgoing connections will not be blocked anymore zdisablePanicMode()N)r r8 rG r& �disable_panic_mode�PanicModeDisabledr� r2 r2 r3 �disablePanicModei s zFirewallD.disablePanicModec C r: )NzqueryPanicMode())r r8 r& �query_panic_moder� r2 r2 r3 �queryPanicModex � zFirewallD.queryPanicModec C r� )NzPanicModeEnabled()r� r6 r2 r2 r3 r) � r� zFirewallD.PanicModeEnabledc C r� )NzPanicModeDisabled()r� r6 r2 r2 r3 r, � r� zFirewallD.PanicModeDisabledz&(sssbsasa(ss)asba(ssss)asasasasa(ss)b)c C �$ t |t�}t�d|� | jj�|�S )NzgetZoneSettings(%s))r r{ r r8 r& rH �get_config_with_settings�r- rH rE r2 r2 r3 �getZoneSettings� s zFirewallD.getZoneSettingsc C r1 )NzgetZoneSettings2(%s))r r{ r r8 r& rH � get_config_with_settings_dictr3 r2 r2 r3 r� � � zFirewallD.getZoneSettings2zsa{sv}c C �F t |t�}t�d|� | �|� | jj�|t |�|� | �||� d S )NzsetZoneSettings2(%s)) r r{ r r8 rG r& rH � set_config_with_settings_dict� ZoneUpdated)r- rH r� rE r2 r2 r3 �setZoneSettings2� � zFirewallD.setZoneSettings2c C � t �d||f � d S )Nz zone.ZoneUpdated('%s', '%s')r� )r- rH r� r2 r2 r3 r9 � � zFirewallD.ZoneUpdatedc C r1 )Nz policy.getPolicySettings(%s))r r{ r r8 r& r� r5 )r- r� rE r2 r2 r3 r� � r6 zFirewallD.getPolicySettingsc C r7 )Nz policy.setPolicySettings(%s)) r r{ r r8 rG r& r� r8 � PolicyUpdated)r- r� r� rE r2 r2 r3 �setPolicySettings� r; zFirewallD.setPolicySettingsc C r< )Nz policy.PolicyUpdated('%s', '%s')r� )r- r� r� r2 r2 r3 r> � r= zFirewallD.PolicyUpdatedc C r� )NzlistServices())r r8 r& r� r� r� r2 r2 r3 � listServices� � zFirewallD.listServicesz(sssa(ss)asa{ss}asa(ss))c C s� t |t�}t�d|� | jj�|�}|�� }g }td�D ](}|j | d |vr8|� t � t ||j | d ��� q |� ||j | d � q t|�S )NzgetServiceSettings(%s)� r )r r{ r r8 r& r� � get_service�export_config_dict�range�IMPORT_EXPORT_STRUCTURE�append�copy�deepcopy�getattr�tuple)r- r� rE �obj� conf_dict� conf_listr� r2 r2 r3 r� � s "z FirewallD.getServiceSettingsc C s, t |t�}t�d|� | jj�|�}|�� S )NzgetServiceSettings2(%s))r r{ r r8 r& r� rC rD )r- r� rE rL r2 r2 r3 �getServiceSettings2� s z FirewallD.getServiceSettings2c C r� )NzlistIcmpTypes())r r8 r& r� r� r� r2 r2 r3 � listIcmpTypes� rA zFirewallD.listIcmpTypesc C �( t |t�}t�d|� | jj�|��� S )NzgetIcmpTypeSettings(%s))r r{ r r8 r& r� � get_icmptyper� )r- r� rE r2 r2 r3 r� � � z FirewallD.getIcmpTypeSettingsc C r: )NzgetLogDenied())r r8 r& �get_log_deniedr� r2 r2 r3 � getLogDenied r0 zFirewallD.getLogDeniedc C sX t |t�}t�d| � | �|� | j�|� | �|� | j�� | j �� | � � d S )NzsetLogDenied('%s')) r r{ r r8 rG r& �set_log_denied�LogDeniedChangedr� r r� �r- �valuerE r2 r2 r3 � setLogDenied s zFirewallD.setLogDeniedc C r� )NzLogDeniedChanged('%s')r� �r- rY r2 r2 r3 rW $ r� zFirewallD.LogDeniedChangedc C s t �d� dS )NzgetAutomaticHelpers()�nor� r� r2 r2 r3 �getAutomaticHelpers- s z FirewallD.getAutomaticHelpersc C s& t |t�}t�d| � | �|� d S )NzsetAutomaticHelpers('%s'))r r{ r r8 rG rX r2 r2 r3 �setAutomaticHelpers8 � z FirewallD.setAutomaticHelpersc C r� )Nz AutomaticHelpersChanged('%s')r� r[ r2 r2 r3 �AutomaticHelpersChangedD r� z!FirewallD.AutomaticHelpersChangedc C r: )NzgetDefaultZone())r r8 r& �get_default_zoner� r2 r2 r3 �getDefaultZoneM r0 zFirewallD.getDefaultZonec C s< t |t�}t�d| � | �|� | j�|� | �|� d S )NzsetDefaultZone('%s'))r r{ r r8 rG r& �set_default_zone�DefaultZoneChangedr3 r2 r2 r3 �setDefaultZoneV s zFirewallD.setDefaultZonec C r� )NzDefaultZoneChanged('%s')r� �r- rH r2 r2 r3 rd b r� z FirewallD.DefaultZoneChangedc C r� )Nzpolicy.getPolicies())r r8 r& r� r� r� r2 r2 r3 � getPoliciesm s zFirewallD.getPoliciesz a{sa{sas}}c C sX t �d� i }| jj�� D ] }i ||< | jj�|�|| d< | jj�|�|| d< q |S )Nzpolicy.getActivePolicies()� ingress_zones� egress_zones)r r8 r& r� �)get_active_policies_not_derived_from_zone�list_ingress_zones�list_egress_zones)r- rE r? r� r2 r2 r3 �getActivePoliciesu s zFirewallD.getActivePoliciesc C r� )Nzzone.getZones())r r8 r& rH r� r� r2 r2 r3 �getZones� � zFirewallD.getZonesc C s� t �d� i }| jj�� D ]6}| jj�|�}| jj�|�}t|�t|� dkrCi ||< t|�dkr7||| d< t|�dkrC||| d< q |S )Nzzone.getActiveZones()r � interfaces�sources)r r8 r& rH r� �list_interfaces� list_sources�len)r- rE �zonesrH rp rq r2 r2 r3 �getActiveZones� s �zFirewallD.getActiveZonesc C �2 t |t�}t�d| � | jj�|�}|r|S dS )z�Return the zone an interface belongs to. :Parameters: `interface` : str Name of the interface :Returns: str. The name of the zone. z zone.getZoneOfInterface('%s')r� )r r{ r r8 r& rH �get_zone_of_interface)r- r� rE rH r2 r2 r3 �getZoneOfInterface� s z FirewallD.getZoneOfInterfacec C rw )Nzzone.getZoneOfSource('%s')r� )r r{ r r8 r& rH �get_zone_of_source)r- �sourcerE rH r2 r2 r3 �getZoneOfSource� s zFirewallD.getZoneOfSourcec C � dS )NFr2 r3 r2 r2 r3 � isImmutable� s zFirewallD.isImmutablec C �R t |t�}t |t�}t�d||f � | �|� | jj�|||�}| �||� |S )zPAdd an interface to a zone. If zone is empty, use default zone. z zone.addInterface('%s', '%s')) r r{ r r8 rG r& rH � add_interface�InterfaceAdded�r- rH r� rE �_zoner2 r2 r3 � addInterface� � zFirewallD.addInterfacec C s" t |t�}t |t�}| �|||�S )z�Change a zone an interface is part of. If zone is empty, use default zone. This function is deprecated, use changeZoneOfInterface instead )r r{ �changeZoneOfInterface�r- rH r� rE r2 r2 r3 � changeZone� s zFirewallD.changeZonec C r )z[Change a zone an interface is part of. If zone is empty, use default zone. z&zone.changeZoneOfInterface('%s', '%s')) r r{ r r8 rG r& rH �change_zone_of_interface�ZoneOfInterfaceChangedr� r2 r2 r3 r� � r� z FirewallD.changeZoneOfInterfacec C �P t |t�}t |t�}t�d||f � | �|� | jj�||�}| �||� |S )zkRemove interface from a zone. If zone is empty, remove from zone the interface belongs to. z zone.removeInterface('%s', '%s')) r r{ r r8 rG r& rH �remove_interface�InterfaceRemovedr� r2 r2 r3 r� � zFirewallD.removeInterfacec C �6 t |t�}t |t�}t�d||f � | jj�||�S )z^Return true if an interface is in a zone. If zone is empty, use default zone. z zone.queryInterface('%s', '%s'))r r{ r r8 r& rH �query_interfacer� r2 r2 r3 �queryInterface � zFirewallD.queryInterfacec C �& t |t�}t�d| � | jj�|�S )z]Return the list of interfaces of a zone. If zone is empty, use default zone. zzone.getInterfaces('%s'))r r{ r r8 r& rH rr r3 r2 r2 r3 r� � zFirewallD.getInterfacesc C r< )Nz zone.InterfaceAdded('%s', '%s')r� �r- rH r� r2 r2 r3 r� - r= zFirewallD.InterfaceAddedc C s t �d||f � dS )z, This signal is deprecated. z zone.ZoneChanged('%s', '%s')Nr� r� r2 r2 r3 � ZoneChanged2 s zFirewallD.ZoneChangedc C s" t �d||f � | �||� d S )Nz'zone.ZoneOfInterfaceChanged('%s', '%s'))r r8 r� r� r2 r2 r3 r� : s �z FirewallD.ZoneOfInterfaceChangedc C r< )Nz!zone.InterfaceRemoved('%s', '%s')r� r� r2 r2 r3 r� A r= zFirewallD.InterfaceRemovedc C r )zLAdd a source to a zone. If zone is empty, use default zone. zzone.addSource('%s', '%s')) r r{ r r8 rG r& rH � add_source� SourceAdded�r- rH r{ rE r� r2 r2 r3 � addSourceJ r� zFirewallD.addSourcec C r )zXChange a zone an source is part of. If zone is empty, use default zone. z#zone.changeZoneOfSource('%s', '%s')) r r{ r r8 rG r& rH �change_zone_of_source�ZoneOfSourceChangedr� r2 r2 r3 �changeZoneOfSource[ r� z FirewallD.changeZoneOfSourcec C r� )zeRemove source from a zone. If zone is empty, remove from zone the source belongs to. z zone.removeSource('%s', '%s')) r r{ r r8 rG r& rH � remove_source� SourceRemovedr� r2 r2 r3 � removeSourcel r� zFirewallD.removeSourcec C r� )z[Return true if an source is in a zone. If zone is empty, use default zone. z zone.querySource('%s', '%s'))r r{ r r8 r& rH � query_source)r- rH r{ rE r2 r2 r3 � querySource} r� zFirewallD.querySourcec C r� )zZReturn the list of sources of a zone. If zone is empty, use default zone. zzone.getSources('%s'))r r{ r r8 r& rH rs r3 r2 r2 r3 � getSources� r� zFirewallD.getSourcesc C r< )Nz zone.SourceAdded('%s', '%s')r� �r- rH r{ r2 r2 r3 r� � r= zFirewallD.SourceAddedc C r< )Nz$zone.ZoneOfSourceChanged('%s', '%s')r� r� r2 r2 r3 r� � r= z FirewallD.ZoneOfSourceChangedc C r< )Nz zone.SourceRemoved('%s', '%s')r� r� r2 r2 r3 r� � r= zFirewallD.SourceRemovedc C sH t �d||f � | j| |= t|d�}| jj�||� | �||� d S )Nz%zone.disableTimedRichRule('%s', '%s')��rule_str)r r8 r9 r r& rH � remove_rule�RichRuleRemoved)r- rH �rulerL r2 r2 r3 �disableTimedRichRule� s z FirewallD.disableTimedRichRule�ssic C s� t |t�}t |t�}t |t�}t�d||f � t|d�}| jj�|||�}|dkr:t � || j ||�}| � |||� | � |||� |S )Nz zone.addRichRule('%s', '%s')r� r )r r{ r� r r8 r r& rH �add_ruler �timeout_add_secondsr� rK � RichRuleAdded)r- rH r� �timeoutrE rL r� rJ r2 r2 r3 � addRichRule� s �zFirewallD.addRichRulec C s\ t |t�}t |t�}t�d||f � t|d�}| jj�||�}| �||� | � ||� |S )Nz zone.removeRichRule('%s', '%s')r� ) r r{ r r8 r r& rH r� rN r� )r- rH r� rE rL r� r2 r2 r3 �removeRichRule� s zFirewallD.removeRichRulec C s@ t |t�}t |t�}t�d||f � t|d�}| jj�||�S )Nz zone.queryRichRule('%s', '%s')r� )r r{ r r8 r r& rH � query_rule)r- rH r� rE rL r2 r2 r3 � queryRichRule� s zFirewallD.queryRichRulec C r� )Nzzone.getRichRules('%s'))r r{ r r8 r& rH � list_rulesr3 r2 r2 r3 � getRichRules� � zFirewallD.getRichRulesc C � t �d|||f � d S )Nz"zone.RichRuleAdded('%s', '%s', %d)r� )r- rH r� r� r2 r2 r3 r� � s zFirewallD.RichRuleAddedc C r< )Nz zone.RichRuleRemoved('%s', '%s')r� )r- rH r� r2 r2 r3 r� � r= zFirewallD.RichRuleRemovedc C �> t �d||f � | j| |= | jj�||� | �||� d S )Nz$zone.disableTimedService('%s', '%s'))r r8 r9 r& rH �remove_service�ServiceRemoved�r- rH r� r2 r2 r3 �disableTimedService� � z FirewallD.disableTimedServicec C s� t |t�}t |t�}t |t�}t�d|||f � | �|� | jj�||||�}|dkr<t � || j ||�}| � |||� | � |||� |S )Nz zone.addService('%s', '%s', %d)r )r r{ r� r r8 rG r& rH � add_servicer r� r� rK � ServiceAdded)r- rH r� r� rE r� rJ r2 r2 r3 r� s �zFirewallD.addServicec C �\ t |t�}t |t�}t�d||f � | �|� | jj�||�}| �||� | � ||� |S )Nz zone.removeService('%s', '%s')) r r{ r r8 rG r& rH r� rN r� )r- rH r� rE r� r2 r2 r3 � removeService s zFirewallD.removeServicec C r� )Nz zone.queryService('%s', '%s'))r r{ r r8 r& rH � query_service)r- rH r� rE r2 r2 r3 � queryService( � zFirewallD.queryServicec C r� )Nzzone.getServices('%s'))r r{ r r8 r& rH � list_servicesr3 r2 r2 r3 � getServices3 r� zFirewallD.getServicesc C r� )Nz!zone.ServiceAdded('%s', '%s', %d)r� )r- rH r� r� r2 r2 r3 r� ? � �zFirewallD.ServiceAddedc C r< )Nz zone.ServiceRemoved('%s', '%s')r� r� r2 r2 r3 r� E r= zFirewallD.ServiceRemovedc C sH t �d|||f � | j| ||f= | jj�|||� | �|||� d S )Nz'zone.disableTimedPort('%s', '%s', '%s'))r r8 r9 r& rH � remove_port� PortRemoved�r- rH �port�protocolr2 r2 r3 �disableTimedPortN s �zFirewallD.disableTimedPort�sssic C s� t |t�}t |t�}t |t�}t |t�}t�d|||f � | �|� | jj�|||||�}|dkrEt � || j |||�}| � |||f|� | � ||||� |S )Nz zone.addPort('%s', '%s', '%s')r )r r{ r� r r8 rG r& rH �add_portr r� r� rK � PortAdded�r- rH r� r� r� rE r� rJ r2 r2 r3 �addPortV s � �zFirewallD.addPort�sssc C sp t |t�}t |t�}t |t�}t�d|||f � | �|� | jj�|||�}| �|||f� | � |||� |S )Nz!zone.removePort('%s', '%s', '%s')) r r{ r r8 rG r& rH r� rN r� �r- rH r� r� rE r� r2 r2 r3 � removePortm s � zFirewallD.removePortc C �D t |t�}t |t�}t |t�}t�d|||f � | jj�|||�S )Nz zone.queryPort('%s', '%s', '%s'))r r{ r r8 r& rH � query_port�r- rH r� r� rE r2 r2 r3 � queryPort s zFirewallD.queryPort�aasc C r� )Nzzone.getPorts('%s'))r r{ r r8 r& rH � list_portsr3 r2 r2 r3 �getPorts� r� zFirewallD.getPortsr c C � t �d||||f � d S )Nz$zone.PortAdded('%s', '%s', '%s', %d)r� �r- rH r� r� r� r2 r2 r3 r� � � �zFirewallD.PortAddedc C r� )Nz"zone.PortRemoved('%s', '%s', '%s')r� r� r2 r2 r3 r� � r� zFirewallD.PortRemovedc C r� )Nz%zone.disableTimedProtocol('%s', '%s'))r r8 r9 r& rH �remove_protocol�ProtocolRemoved�r- rH r� r2 r2 r3 �disableTimedProtocol� r� z FirewallD.disableTimedProtocolc C s� t |t�}t |t�}t |t�}t�d||f � | �|� | jj�||||�}|dkr;t � || j ||�}| � |||� | � |||� |S )Nz zone.enableProtocol('%s', '%s')r )r r{ r� r r8 rG r& rH � add_protocolr r� r� rK � ProtocolAdded)r- rH r� r� rE r� rJ r2 r2 r3 � addProtocol� s �zFirewallD.addProtocolc C r� )Nz zone.removeProtocol('%s', '%s')) r r{ r r8 rG r& rH r� rN r� )r- rH r� rE r� r2 r2 r3 �removeProtocol� � zFirewallD.removeProtocolc C r� )Nz zone.queryProtocol('%s', '%s'))r r{ r r8 r& rH �query_protocol)r- rH r� rE r2 r2 r3 � queryProtocol� r� zFirewallD.queryProtocolc C r� )Nzzone.getProtocols('%s'))r r{ r r8 r& rH �list_protocolsr3 r2 r2 r3 � getProtocols� r� zFirewallD.getProtocolsc C r� )Nz"zone.ProtocolAdded('%s', '%s', %d)r� )r- rH r� r� r2 r2 r3 r� � r� zFirewallD.ProtocolAddedc C r< )Nz zone.ProtocolRemoved('%s', '%s')r� r� r2 r2 r3 r� � r= zFirewallD.ProtocolRemovedc C sJ t �d|||f � | j| d||f= | jj�|||� | �|||� d S )Nz-zone.disableTimedSourcePort('%s', '%s', '%s')�sport)r r8 r9 r& rH �remove_source_port�SourcePortRemovedr� r2 r2 r3 �disableTimedSourcePort� s �z FirewallD.disableTimedSourcePortc C s� t |t�}t |t�}t |t�}t |t�}t�d|||f � | �|� | jj�|||||�}|dkrFt � || j |||�}| � |d||f|� | � ||||� |S )Nz$zone.addSourcePort('%s', '%s', '%s')r r� )r r{ r� r r8 rG r& rH �add_source_portr r� r� rK �SourcePortAddedr� r2 r2 r3 � addSourcePort s$ � � �zFirewallD.addSourcePortc C sr t |t�}t |t�}t |t�}t�d|||f � | �|� | jj�|||�}| �|d||f� | � |||� |S )Nz'zone.removeSourcePort('%s', '%s', '%s')r� ) r r{ r r8 rG r& rH r� rN r� r� r2 r2 r3 �removeSourcePort s � zFirewallD.removeSourcePortc C r� )Nz&zone.querySourcePort('%s', '%s', '%s'))r r{ r r8 r& rH �query_source_portr� r2 r2 r3 �querySourcePort+ s �zFirewallD.querySourcePortc C r� )Nzzone.getSourcePorts('%s'))r r{ r r8 r& rH �list_source_portsr3 r2 r2 r3 �getSourcePorts8 r� zFirewallD.getSourcePortsc C r� )Nz*zone.SourcePortAdded('%s', '%s', '%s', %d)r� r� r2 r2 r3 r� D r� zFirewallD.SourcePortAddedc C r� )Nz(zone.SourcePortRemoved('%s', '%s', '%s')r� r� r2 r2 r3 r� J s �zFirewallD.SourcePortRemovedc C s( | j | d= | jj�|� | �|� d S )N� masquerade)r9 r& rH �remove_masquerade�MasqueradeRemovedrf r2 r2 r3 �disableTimedMasqueradeT s z FirewallD.disableTimedMasquerade�sic C st t |t�}t |t�}t�d| � | �|� | jj�|||�}|dkr2t � || j |�}| � |d|� | � ||� |S )Nzzone.addMasquerade('%s')r r� )r r{ r� r r8 rG r& rH �add_masquerader r� r� rK �MasqueradeAdded)r- rH r� rE r� rJ r2 r2 r3 � addMasqueradeZ s � zFirewallD.addMasqueradec C sJ t |t�}t�d| � | �|� | jj�|�}| �|d� | � |� |S )Nzzone.removeMasquerade('%s')r� ) r r{ r r8 rG r& rH r� rN r� �r- rH rE r� r2 r2 r3 �removeMasqueraden s zFirewallD.removeMasqueradec C r� )Nzzone.queryMasquerade('%s'))r r{ r r8 r& rH �query_masquerader3 r2 r2 r3 �queryMasquerade} r_ zFirewallD.queryMasqueradec C r< )Nz zone.MasqueradeAdded('%s', %d)r� )r- rH r� r2 r2 r3 r� � r= zFirewallD.MasqueradeAddedc C r� )Nz zone.MasqueradeRemoved('%s')r� rf r2 r2 r3 r� � r� zFirewallD.MasqueradeRemovedc C s@ | j | ||||f= | jj�|||||� | �|||||� d S r4 )r9 r& rH �remove_forward_port�ForwardPortRemoved�r- rH r� r� �toport�toaddrr2 r2 r3 �disable_forward_port� s z FirewallD.disable_forward_port�sssssic C s� t |t�}t |t�}t |t�}t |t�}t |t�}t |t�}t�d|||||f � | �|� | jj�|||||||�}|dkrWt � || j |||||�} | � |||||f| � | � ||||||� |S )Nz1zone.addForwardPort('%s', '%s', '%s', '%s', '%s')r )r r{ r� r r8 rG r& rH �add_forward_portr r� r rK �ForwardPortAdded) r- rH r� r� r r r� rE r� rJ r2 r2 r3 �addForwardPort� s, � ��zFirewallD.addForwardPort�sssssc C s� t |t�}t |t�}t |t�}t |t�}t |t�}t�d|||||f � | �|� | jj�|||||�}| �|||||f� | � |||||� |S )Nz4zone.removeForwardPort('%s', '%s', '%s', '%s', '%s')) r r{ r r8 rG r& rH r rN r )r- rH r� r� r r rE r� r2 r2 r3 �removeForwardPort� s � �zFirewallD.removeForwardPortc C s` t |t�}t |t�}t |t�}t |t�}t |t�}t�d|||||f � | jj�|||||�S )Nz3zone.queryForwardPort('%s', '%s', '%s', '%s', '%s'))r r{ r r8 r& rH �query_forward_port)r- rH r� r� r r rE r2 r2 r3 �queryForwardPort� s ��zFirewallD.queryForwardPortc C r� )Nzzone.getForwardPorts('%s'))r r{ r r8 r& rH �list_forward_portsr3 r2 r2 r3 �getForwardPorts� r� zFirewallD.getForwardPortsc C s t �d||||||f � d S )Nz7zone.ForwardPortAdded('%s', '%s', '%s', '%s', '%s', %d)r� )r- rH r� r� r r r� r2 r2 r3 r � s �zFirewallD.ForwardPortAddedc C s t �d|||||f � d S )Nz5zone.ForwardPortRemoved('%s', '%s', '%s', '%s', '%s')r� r r2 r2 r3 r � s �z FirewallD.ForwardPortRemovedc C r� )Nz&zone.disableTimedIcmpBlock('%s', '%s'))r r8 r9 r& rH �remove_icmp_block�IcmpBlockRemoved�r- rH �icmprE r2 r2 r3 �disableTimedIcmpBlock� r� z FirewallD.disableTimedIcmpBlockc C s� t |t�}t |t�}t |t�}t�d||f � | �|� | jj�||||�}|dkr<t � || j |||�}| � |||� | � |||� |S )Nz zone.enableIcmpBlock('%s', '%s')r )r r{ r� r r8 rG r& rH �add_icmp_blockr r� r rK �IcmpBlockAdded)r- rH r r� rE r� rJ r2 r2 r3 � addIcmpBlock s �zFirewallD.addIcmpBlockc C r� )Nz zone.removeIcmpBlock('%s', '%s')) r r{ r r8 rG r& rH r rN r )r- rH r rE r� r2 r2 r3 �removeIcmpBlock r� zFirewallD.removeIcmpBlockc C r� )Nz zone.queryIcmpBlock('%s', '%s'))r r{ r r8 r& rH �query_icmp_blockr r2 r2 r3 �queryIcmpBlock( r� zFirewallD.queryIcmpBlockc C r� )Nzzone.getIcmpBlocks('%s'))r r{ r r8 r& rH �list_icmp_blocksr3 r2 r2 r3 � getIcmpBlocks3 r� zFirewallD.getIcmpBlocksc C r� )Nz#zone.IcmpBlockAdded('%s', '%s', %d)r� )r- rH r r� r2 r2 r3 r ? r� zFirewallD.IcmpBlockAddedc C r< )Nz!zone.IcmpBlockRemoved('%s', '%s')r� )r- rH r r2 r2 r3 r E r= zFirewallD.IcmpBlockRemovedc C s@ t |t�}t�d| � | �|� | jj�||�}| �|� |S )Nz zone.addIcmpBlockInversion('%s')) r r{ r r8 rG r& rH �add_icmp_block_inversion�IcmpBlockInversionAddedr r2 r2 r3 �addIcmpBlockInversionN s z FirewallD.addIcmpBlockInversionc C s> t |t�}t�d| � | �|� | jj�|�}| �|� |S )Nz#zone.removeIcmpBlockInversion('%s')) r r{ r r8 rG r& rH �remove_icmp_block_inversion�IcmpBlockInversionRemovedr r2 r2 r3 �removeIcmpBlockInversion\ s z"FirewallD.removeIcmpBlockInversionc C r� )Nz"zone.queryIcmpBlockInversion('%s'))r r{ r r8 r& rH �query_icmp_block_inversionr3 r2 r2 r3 �queryIcmpBlockInversionj r_ z!FirewallD.queryIcmpBlockInversionc C r� )Nz"zone.IcmpBlockInversionAdded('%s')r� rf r2 r2 r3 r# t r� z!FirewallD.IcmpBlockInversionAddedc C r� )Nz$zone.IcmpBlockInversionRemoved('%s')r� rf r2 r2 r3 r& y r� z#FirewallD.IcmpBlockInversionRemovedc C �` t |t�}t |t�}t |t�}t�d|||f � | �|� | jj�|||� | �|||� d S )Nz!direct.addChain('%s', '%s', '%s')) r r{ r r8 rG r& r� � add_chain� ChainAdded�r- �ipv�table�chainrE r2 r2 r3 �addChain� � zFirewallD.addChainc C r* )Nz$direct.removeChain('%s', '%s', '%s')) r r{ r r8 rG r& r� � remove_chain� ChainRemovedr- r2 r2 r3 � removeChain� r2 zFirewallD.removeChainc C r� )Nz#direct.queryChain('%s', '%s', '%s'))r r{ r r8 r& r� � query_chainr- r2 r2 r3 � queryChain� � zFirewallD.queryChainc C r� )Nz direct.getChains('%s', '%s'))r r{ r r8 r& r� � get_chains)r- r. r/ rE r2 r2 r3 � getChains� s zFirewallD.getChainsza(sss)c C r� )Nzdirect.getAllChains())r r8 r& r� r� r� r2 r2 r3 � getAllChains� ro zFirewallD.getAllChainsc C r� )Nz#direct.ChainAdded('%s', '%s', '%s')r� �r- r. r/ r0 r2 r2 r3 r, � s zFirewallD.ChainAddedc C r� )Nz%direct.ChainRemoved('%s', '%s', '%s')r� r< r2 r2 r3 r4 � s �zFirewallD.ChainRemoved�sssiasc C � t |t�}t |t�}t |t�}t |t�}tdd� |D ��}t�d||||d�|�f � | �|� | jj � |||||� | � |||||� d S )Nc s � � | ]}t |t�V qd S r4 �r r{ ��.0r� r2 r2 r3 � <genexpr>� � � z$FirewallD.addRule.<locals>.<genexpr>z*direct.addRule('%s', '%s', '%s', %d, '%s')�',') r r{ r� rK r r8 �joinrG r& r� r� � RuleAdded�r- r. r/ r0 �priorityr. rE r2 r2 r3 �addRule� � � zFirewallD.addRulec C r> )Nc s r? r4 r@ rA r2 r2 r3 rC � rD z'FirewallD.removeRule.<locals>.<genexpr>z-direct.removeRule('%s', '%s', '%s', %d, '%s')rE ) r r{ r� rK r r8 rF rG r& r� r� � RuleRemovedrH r2 r2 r3 � removeRule� rK zFirewallD.removeRulec C s� t |t�}t |t�}t |t�}t�d|||f � | �|� | jj�|||�D ]\}}| jj�|||||� | � |||||� q'd S )Nz$direct.removeRules('%s', '%s', '%s')) r r{ r r8 rG r& r� � get_rulesr� rL )r- r. r/ r0 rE rI r. r2 r2 r3 � removeRules� s �zFirewallD.removeRulesc C sn t |t�}t |t�}t |t�}t |t�}tdd� |D ��}t�d||||d�|�f � | jj� |||||�S )Nc s r? r4 r@ rA r2 r2 r3 rC rD z&FirewallD.queryRule.<locals>.<genexpr>z,direct.queryRule('%s', '%s', '%s', %d, '%s')rE ) r r{ r� rK r r8 rF r& r� r� rH r2 r2 r3 � queryRule s �zFirewallD.queryRuleza(ias)c C r� )Nz!direct.getRules('%s', '%s', '%s'))r r{ r r8 r& r� rN r- r2 r2 r3 �getRules r8 zFirewallD.getRulesz a(sssias)c C r� )Nzdirect.getAllRules())r r8 r& r� r� r� r2 r2 r3 � getAllRules' ro zFirewallD.getAllRulesc C �" t �d||||d�|�f � d S )Nz,direct.RuleAdded('%s', '%s', '%s', %d, '%s')rE �r r8 rF �r- r. r/ r0 rI r. r2 r2 r3 rG 1 � �zFirewallD.RuleAddedc C rS )Nz.direct.RuleRemoved('%s', '%s', '%s', %d, '%s')rE rT rU r2 r2 r3 rL 8 rV zFirewallD.RuleRemovedr` c C s� t |t�}tdd� |D ��}t�d|d�|�f � | �|� z | jj� ||�W S t yc } z/|dv r;t g d��}nt ddg�}t|�}|j t jkr^tt |�|@ �d krZt�|� t|��� d }~ww ) Nc s r? r4 r@ rA r2 r2 r3 rC K rD z(FirewallD.passthrough.<locals>.<genexpr>z direct.passthrough('%s', '%s')rE )rU rY )z-Cz--check�-L�--listrW rX r )r r{ rK r r8 rF rG r& r� � passthroughr" �set�coder! �COMMAND_FAILEDrt r� r )r- r. r. rE rA � query_args�msgr2 r2 r3 rY C s$ ��zFirewallD.passthroughc C �\ t |�}tdd� |D ��}t�d|d�|�f � | �|� | jj�||� | � ||� d S )Nc s � � | ]}t |�V qd S r4 �r rA r2 r2 r3 rC g � � z+FirewallD.addPassthrough.<locals>.<genexpr>z!direct.addPassthrough('%s', '%s')rE ) r rK r r8 rF rG r& r� �add_passthrough�PassthroughAdded�r- r. r. rE r2 r2 r3 �addPassthrough_ � � zFirewallD.addPassthroughc C r_ )Nc s r` r4 ra rA r2 r2 r3 rC v rb z.FirewallD.removePassthrough.<locals>.<genexpr>z$direct.removePassthrough('%s', '%s')rE ) r rK r r8 rF rG r& r� �remove_passthrough�PassthroughRemovedre r2 r2 r3 �removePassthroughn rg zFirewallD.removePassthroughc C sB t |�}tdd� |D ��}t�d|d�|�f � | jj�||�S )Nc s r` r4 ra rA r2 r2 r3 rC � rb z-FirewallD.queryPassthrough.<locals>.<genexpr>z#direct.queryPassthrough('%s', '%s')rE )r rK r r8 rF r& r� �query_passthroughre r2 r2 r3 �queryPassthrough} s �zFirewallD.queryPassthroughza(sas)c C r� )Nzdirect.getAllPassthroughs())r r8 r& r� r� r� r2 r2 r3 �getAllPassthroughs� ro z FirewallD.getAllPassthroughsc C s* t �d� t| �� �D ]}| j|� q d S )Nz direct.removeAllPassthroughs())r r8 �reversedrm rj )r- rE rY r2 r2 r3 �removeAllPassthroughs� s �z FirewallD.removeAllPassthroughsc C s" t |�}t�d|� | jj�|�S )Nz direct.getPassthroughs('%s'))r r r8 r& r� �get_passthroughs)r- r. rE r2 r2 r3 �getPassthroughs� s zFirewallD.getPassthroughsc C � t �d|d�|�f � d S )Nz#direct.PassthroughAdded('%s', '%s')rE rT �r- r. r. r2 r2 r3 rd � � �zFirewallD.PassthroughAddedc C rr )Nz%direct.PassthroughRemoved('%s', '%s')rE rT rs r2 r2 r3 ri � rt z FirewallD.PassthroughRemovedc C r} )z� PK_ACTION_ALL implies all other actions, i.e. once a subject is authorized for PK_ACTION_ALL it's also authorized for any other action. Use-case is GUI (RHBZ#994729). Nr2 r� r2 r2 r3 � authorizeAll� s zFirewallD.authorizeAllc C �$ t |�}t�d| � | jj�|�S )Nzipset.queryIPSet('%s'))r r r8 r& r� � query_ipset�r- r� rE r2 r2 r3 � queryIPSet� � zFirewallD.queryIPSetc C r� )Nzipsets.getIPSets())r r8 r& r� r� r� r2 r2 r3 � getIPSets� � zFirewallD.getIPSetsc C rQ )NzgetIPSetSettings(%s))r r{ r r8 r& r� � get_ipsetr� rx r2 r2 r3 r� � rS zFirewallD.getIPSetSettingsc C �L t |�}t |�}t�d||f � | �|� | jj�||� | �||� d S )Nzipset.addEntry('%s', '%s'))r r r8 rG r& r� � add_entry� EntryAdded�r- r� �entryrE r2 r2 r3 �addEntry� � zFirewallD.addEntryc C r~ )Nz ipset.removeEntry('%s', '%s'))r r r8 rG r& r� � remove_entry� EntryRemovedr� r2 r2 r3 � removeEntry� r� zFirewallD.removeEntryc C s2 t |�}t |�}t�d||f � | jj�||�S )Nz ipset.queryEntry('%s', '%s'))r r r8 r& r� � query_entryr� r2 r2 r3 � queryEntry s zFirewallD.queryEntryc C rv )Nzipset.getEntries('%s'))r r r8 r& r� � get_entriesrx r2 r2 r3 � getEntries rz zFirewallD.getEntriesc C s� t |�}t |t�}t�d|d�|�� | jj�|�}| jj�||� t |�}t |�}|| D ]}| � ||� q.|| D ]}| � ||� q;d S )Nz ipset.setEntries('%s', '[%s]')�,) r �listr r8 rF r& r� r� � set_entriesrZ r� r� )r- r� �entriesrE � old_entries�old_entries_set� entries_setr� r2 r2 r3 � setEntries s �zFirewallD.setEntriesc C �& t |�}t |�}t�d||f � d S )Nz ipset.EntryAdded('%s', '%s')�r r r8 �r- r� r� r2 r2 r3 r� ) � zFirewallD.EntryAddedc C r� )Nz ipset.EntryRemoved('%s', '%s')r� r� r2 r2 r3 r� 0 r� zFirewallD.EntryRemovedc C r� )Nzhelpers.getHelpers())r r8 r& r� r� r� r2 r2 r3 � getHelpers; r| zFirewallD.getHelpersc C rQ )NzgetHelperSettings(%s))r r{ r r8 r& r� � get_helperr� )r- r� rE r2 r2 r3 r� D rS zFirewallD.getHelperSettingsr4 )r )��__name__� __module__� __qualname__�__doc__� persistentr r* �PK_ACTION_CONFIG� default_polkit_auth_requiredr r% r7 r) r5 r rG rK rN rP ru r �PROPERTIES_IFACEr� r� r r� r� �signalr� �PK_ACTION_INFO�INTROSPECTABLE_IFACEr� r+ r� r� r� r� r� �PK_ACTION_POLICIESr~ r� r� �PK_ACTION_POLICIES_INFOr� r� r� r� r� r� r� r� r� r r r r r r r r r r r r r r! r# r% r r r* r- r/ r) r, �PK_ACTION_CONFIG_INFOr4 r| r� r: r9 �DBUS_INTERFACE_POLICYr� r? r> r@ r� rO rP r �DBUS_SIGNATUREr� rU rZ rW r] r^ r` rb re rd rg rm rn rv ry r| r~ r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r r r r� r� r r r r r r r r r r r r! r r r$ r' r) r# r& �PK_ACTION_DIRECTr r} r1 r5 �PK_ACTION_DIRECT_INFOr7 r: r; r r, r4 rJ rM rO rP rQ rR rG rL rY rf rj rl rm ro rq rd ri � PK_ACTION_ALLru r ry r{ r r� r� r� r� r� r� r� r� r� r r� � __classcell__r2 r2 r0 r3 r ? s� /�� " � � � � G � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � �� �� �� �� � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � )6�__all__� gi.repositoryr rH r* � dbus.service�firewallr �firewall.core.fwr �firewall.core.richr �firewall.core.loggerr �firewall.clientr �firewall.server.dbusr r �firewall.server.decoratorsr r r r r r �firewall.server.configr �firewall.dbus_utilsr r r r r r r r �firewall.core.io.functionsr �firewall.core.io.ipsetr �firewall.core.io.icmptyper �firewall.core.io.helperr �firewall.core.fw_nmr r �firewall.core.fw_ifcfgr r! �firewall.errorsr" r r2 r2 r2 r3 �<module> s. ( PK ���Z�(�u' u' 2 server/__pycache__/config_icmptype.cpython-310.pycnu �[��� o bhAb�9 � @ s� d dl Z d dlZ d dlmZ d dlmZmZmZ d dlm Z d dl m Z d dl m Z d dlmZmZmZmZ d dlmZ d d lmZ G d d � d e �ZdS ) � N)�config)�dbus_to_python�%dbus_introspection_prepare_properties�!dbus_introspection_add_properties)�IcmpType)�log)�DbusServiceObject)�handle_exceptions�dbus_handle_exceptions�dbus_service_method�dbus_polkit_require_auth)�errors)� FirewallErrorc s@ e Zd ZdZdZ ejjZ e � fdd��Z e dd� �Z e dd� �Z e d d � �Zeejd d d �e dHdd���Zeejddd �e dHdd���Zeejj�eejdd�e dHdd����Zejjejdd�dd � �Zeejj�eejdd �e dH� fd d � ���Zeejje j d �e dHd d!���Z eejje j d�e dHd"d#���Z eejj�e dHd$d%���Z ejjejjdd�e d&d'� ��Z!eejj�e dHd(d)���Z"ejjejjdd�e d*d+� ��Z#eejjdd�e dHd,d-���Z$ejjejjdd�e d.d/� ��Z%eejjdd �e dHd0d1���Z&eejjdd�e dHd2d3���Z'eejjdd �e dHd4d5���Z(eejjdd�e dHd6d7���Z)eejjdd �e dHd8d9���Z*eejjdd�e dHd:d;���Z+eejjd<d �e dHd=d>���Z,eejjd<d�e dHd?d@���Z-eejjdd�e dHdAdB���Z.eejjdd�e dHdCdD���Z/eejjddEd �e dHdFdG���Z0� Z1S )I�FirewallDConfigIcmpTypezFirewallD main classTc s` t t| �j|i |�� || _|| _|| _|| _|d | _|d | _d| j | _ t | tj j � d S )Nr � zconfig.icmptype.%d) �superr �__init__�parentr �obj�item_id�busname�path� _log_prefixr �dbus� DBUS_INTERFACE_CONFIG_ICMPTYPE)�selfr �conf�icmptyper �args�kwargs�� __class__� �A/usr/lib/python3/dist-packages/firewall/server/config_icmptype.pyr 3 s �z FirewallDConfigIcmpType.__init__c C s d S �Nr" �r r" r" r# �__del__@ s z FirewallDConfigIcmpType.__del__c C s | � � d S r$ )�remove_from_connectionr% r" r" r# � unregisterD s z"FirewallDConfigIcmpType.unregisterc C s~ |dkr t �| jj�S |dkrt �| jj�S |dkr!t �| jj�S |dkr,t �| jj�S |dkr7t �| jj�S t j � d| ��)N�name�filenamer �default�builtinzDorg.freedesktop.DBus.Error.InvalidArgs: Property '%s' does not exist) r �Stringr r) r* r �Booleanr+ r, � exceptions� DBusException)r � property_namer" r" r# � _get_propertyL s ��z%FirewallDConfigIcmpType._get_property�ss�v)� in_signature� out_signatureNc C sL t |t�}t |t�}t�d| j||� |tjjkr!tj� d| ��| � |�S )Nz%s.Get('%s', '%s')�Jorg.freedesktop.DBus.Error.UnknownInterface: Interface '%s' does not exist) r �strr �debug1r r r r r/ r0 r2 )r �interface_namer1 �senderr" r" r# �Get] s � �� zFirewallDConfigIcmpType.Get�sza{sv}c C s` t |t�}t�d| j|� |tjjkrtj� d| ��i }dD ] }| � |�||< q tj |dd�S )Nz%s.GetAll('%s')r7 )r) r* r r+ r, �sv�� signature) r r8 r r9 r r r r r/ r0 r2 � Dictionary)r r: r; �ret�xr" r" r# �GetAlln s ��z FirewallDConfigIcmpType.GetAll�ssv)r5 c C sh t |t�}t |t�}t |�}t�d| j|||� | j�|� |tjj kr,tj � d| ��tj � d| ��)Nz%s.Set('%s', '%s', '%s')r7 zGorg.freedesktop.DBus.Error.PropertyReadOnly: Property '%s' is read-only) r r8 r r9 r r � accessCheckr r r r/ r0 )r r: r1 � new_valuer; r" r" r# �Set s$ � ����zFirewallDConfigIcmpType.Setzsa{sv}asr? c C s2 t |t�}t |�}t |�}t�d| j|||� d S )Nz&%s.PropertiesChanged('%s', '%s', '%s'))r r8 r r9 r )r r: �changed_properties�invalidated_propertiesr" r" r# �PropertiesChanged� s �z)FirewallDConfigIcmpType.PropertiesChanged)r6 c s8 t �d| j� tt| ��| j| j�� �}t | |t j j �S )Nz%s.Introspect()) r �debug2r r r � Introspectr r �get_busr r r r )r r; �datar r" r# rM � s � �z"FirewallDConfigIcmpType.Introspectc C s t �d| j� | j�| j�S )z"get settings for icmptype z%s.getSettings())r r9 r r �get_icmptype_configr �r r; r" r" r# � getSettings� s z#FirewallDConfigIcmpType.getSettingsc C sF t |�}t�d| j� | j�|� | j�| j|�| _| � | jj � dS )z%update settings for icmptype z%s.update('...')N) r r r9 r r rF r �set_icmptype_configr �Updatedr) )r �settingsr; r" r" r# �update� s z FirewallDConfigIcmpType.updatec C s< t �d| j� | j�|� | j�| j�| _| �| jj � dS )z3load default settings for builtin icmptype z%s.loadDefaults()N) r r9 r r rF r �load_icmptype_defaultsr rT r) rQ r" r" r# � loadDefaults� s z$FirewallDConfigIcmpType.loadDefaultsc C � t �d| j|f � d S )Nz%s.Updated('%s')�r r9 r �r r) r" r" r# rT � � z FirewallDConfigIcmpType.Updatedc C s: t �d| j� | j�|� | j�| j� | j�| j� dS )zremove icmptype z%s.removeIcmpType()N) r r9 r r rF r �remove_icmptyper �removeIcmpTyperQ r" r" r# �remove� s z FirewallDConfigIcmpType.removec C rY )Nz%s.Removed('%s')rZ r[ r" r" r# �Removed� r\ z FirewallDConfigIcmpType.Removedc C sF t |t�}t�d| j|� | j�|� | j�| j |�| _ | � |� dS )zrename icmptype z%s.rename('%s')N) r r8 r r9 r r rF r �rename_icmptyper �Renamed)r r) r; r" r" r# �rename� s z FirewallDConfigIcmpType.renamec C rY )Nz%s.Renamed('%s')rZ r[ r" r" r# rb � r\ z FirewallDConfigIcmpType.Renamedc C � t �d| j� | �� d S )Nz%s.getVersion()r �r r9 r rR rQ r" r" r# � getVersion� � z"FirewallDConfigIcmpType.getVersionc C �H t |t�}t�d| j|� | j�|� t| �� �}||d< | � |� d S )Nz%s.setVersion('%s')r � r r8 r r9 r r rF �listrR rV )r �versionr; rU r" r" r# � setVersion� � z"FirewallDConfigIcmpType.setVersionc C rd )Nz %s.getShort()r re rQ r" r" r# �getShort rg z FirewallDConfigIcmpType.getShortc C rh )Nz%s.setShort('%s')r ri )r �shortr; rU r" r" r# �setShort rm z FirewallDConfigIcmpType.setShortc C rd )Nz%s.getDescription()� re rQ r" r" r# �getDescription rg z&FirewallDConfigIcmpType.getDescriptionc C rh )Nz%s.setDescription('%s')rq ri )r � descriptionr; rU r" r" r# �setDescription& s � z&FirewallDConfigIcmpType.setDescription�asc C s t �d| j� t| �� d �S )Nz%s.getDestinations()� )r r9 r �sortedrR rQ r" r" r# �getDestinations4 s z'FirewallDConfigIcmpType.getDestinationsc C sN t |t�}t�d| jd�|�� | j�|� t| �� �}||d< | � |� d S )Nz%s.setDestinations('[%s]')�,rv ) r rj r r9 r �joinr rF rR rV )r � destinationsr; rU r" r" r# �setDestinations; s � z'FirewallDConfigIcmpType.setDestinationsc C sf t |t�}t�d| j|� | j�|� t| �� �}||d v r%t t j |��|d � |� | � |� d S )Nz%s.addDestination('%s')rv )r r8 r r9 r r rF rj rR r r �ALREADY_ENABLED�appendrV �r � destinationr; rU r" r" r# �addDestinationG s � z&FirewallDConfigIcmpType.addDestinationc C s� t |t�}t�d| j|� | j�|� t| �� �}|d r1||d vr)t t j |��|d � |� ntt ddg�t |g� �|d< | �|� d S )Nz%s.removeDestination('%s')rv �ipv4�ipv6)r r8 r r9 r r rF rj rR r r � NOT_ENABLEDr_ �setrV r r" r" r# �removeDestinationU s � �z)FirewallDConfigIcmpType.removeDestination�bc C s8 t |t�}t�d| j|� | �� }|d p||d v S )Nz%s.queryDestination('%s')rv )r r8 r r9 r rR r r" r" r# �queryDestinationh s � �z(FirewallDConfigIcmpType.queryDestinationr$ )2�__name__� __module__� __qualname__�__doc__� persistentr r �PK_ACTION_CONFIG� default_polkit_auth_requiredr r r r& r( r2 r �PROPERTIES_IFACEr< rD r rH �service�signalrK �PK_ACTION_INFO�INTROSPECTABLE_IFACErM r r �DBUS_SIGNATURErR rV rX rT r_ r` rc rb rf rl rn rp rr rt rx r| r� r� r� � __classcell__r" r" r r# r + s� �� �� � � � � �� �� �� �� � ��r )r � dbus.service�firewallr �firewall.dbus_utilsr r r �firewall.core.io.icmptyper �firewall.core.loggerr �firewall.server.dbusr �firewall.server.decoratorsr r r r r �firewall.errorsr r r" r" r" r# �<module> s PK ���Z�H��- �- 0 server/__pycache__/config_helper.cpython-310.pycnu �[��� o bhAb*D � @ s� d dl Z d dlZ d dlmZ d dlmZmZmZ d dlm Z d dl m Z d dl m Z d dlmZmZmZmZ d dlmZ d d lmZ G d d � d e �ZdS ) � N)�config)�dbus_to_python�%dbus_introspection_prepare_properties�!dbus_introspection_add_properties)�Helper)�log)�DbusServiceObject)�handle_exceptions�dbus_handle_exceptions�dbus_service_method�dbus_polkit_require_auth)�errors)� FirewallErrorc s� e Zd ZdZdZ ejjZ e � fdd��Z e dd� �Z e dd� �Z e d d � �Zeejd d d �e dTdd���Zeejddd �e dTdd���Zeejj�eejdd�e dTdd����Zejjejdd�dd � �Zeejj�eejdd �e dT� fd d � ���Zeejje j d �e dTd d!���Z eejje j d�e dTd"d#���Z eejj�e dTd$d%���Z ejjejjdd�e d&d'� ��Z!eejj�e dTd(d)���Z"ejjejjdd�e d*d+� ��Z#eejjdd�e dTd,d-���Z$ejjejjdd�e d.d/� ��Z%eejjdd �e dTd0d1���Z&eejjdd�e dTd2d3���Z'eejjdd �e dTd4d5���Z(eejjdd�e dTd6d7���Z)eejjdd �e dTd8d9���Z*eejjdd�e dTd:d;���Z+eejjdd �e dTd<d=���Z,eejjdd�e dTd>d?���Z-eejjdd@d �e dTdAdB���Z.eejjdd �e dTdCdD���Z/eejjdd�e dTdEdF���Z0eejjdd@d �e dTdGdH���Z1eejjdId �e dTdJdK���Z2eejjdId�e dTdLdM���Z3eejjd d�e dTdNdO���Z4eejjd d�e dTdPdQ���Z5eejjd d@d �e dTdRdS���Z6� Z7S )U�FirewallDConfigHelperzFirewallD main classTc s` t t| �j|i |�� || _|| _|| _|| _|d | _|d | _d| j | _ t | tj j � d S )Nr � zconfig.helper.%d) �superr �__init__�parentr �obj�item_id�busname�path� _log_prefixr �dbus� DBUS_INTERFACE_CONFIG_HELPER)�selfr �conf�helperr �args�kwargs�� __class__� �?/usr/lib/python3/dist-packages/firewall/server/config_helper.pyr 3 s �z FirewallDConfigHelper.__init__c C s d S �Nr" �r r" r" r# �__del__@ s z FirewallDConfigHelper.__del__c C s | � � d S r$ )�remove_from_connectionr% r" r" r# � unregisterD s z FirewallDConfigHelper.unregisterc C s~ |dkr t �| jj�S |dkrt �| jj�S |dkr!t �| jj�S |dkr,t �| jj�S |dkr7t �| jj�S t j � d| ��)N�name�filenamer �default�builtinzDorg.freedesktop.DBus.Error.InvalidArgs: Property '%s' does not exist) r �Stringr r) r* r �Booleanr+ r, � exceptions� DBusException)r � property_namer" r" r# � _get_propertyL s ��z#FirewallDConfigHelper._get_property�ss�v)� in_signature� out_signatureNc C sL t |t�}t |t�}t�d| j||� |tjjkr!tj� d| ��| � |�S )Nz%s.Get('%s', '%s')�Jorg.freedesktop.DBus.Error.UnknownInterface: Interface '%s' does not exist) r �strr �debug1r r r r r/ r0 r2 )r �interface_namer1 �senderr" r" r# �Get] s � �� zFirewallDConfigHelper.Get�sza{sv}c C s` t |t�}t�d| j|� |tjjkrtj� d| ��i }dD ] }| � |�||< q tj |dd�S )Nz%s.GetAll('%s')r7 )r) r* r r+ r, �sv�� signature) r r8 r r9 r r r r r/ r0 r2 � Dictionary)r r: r; �ret�xr" r" r# �GetAlln s ��z FirewallDConfigHelper.GetAll�ssv)r5 c C sh t |t�}t |t�}t |�}t�d| j|||� | j�|� |tjj kr,tj � d| ��tj � d| ��)Nz%s.Set('%s', '%s', '%s')r7 zGorg.freedesktop.DBus.Error.PropertyReadOnly: Property '%s' is read-only) r r8 r r9 r r � accessCheckr r r r/ r0 )r r: r1 � new_valuer; r" r" r# �Set s$ � ����zFirewallDConfigHelper.Setzsa{sv}asr? c C s2 t |t�}t |�}t |�}t�d| j|||� d S )Nz&%s.PropertiesChanged('%s', '%s', '%s'))r r8 r r9 r )r r: �changed_properties�invalidated_propertiesr" r" r# �PropertiesChanged� s �z'FirewallDConfigHelper.PropertiesChanged)r6 c s8 t �d| j� tt| ��| j| j�� �}t | |t j j �S )Nz%s.Introspect()) r �debug2r r r � Introspectr r �get_busr r r r )r r; �datar r" r# rM � s � �z FirewallDConfigHelper.Introspectc C s t �d| j� | j�| j�S )z get settings for helper z%s.getSettings())r r9 r r �get_helper_configr �r r; r" r" r# � getSettings� s z!FirewallDConfigHelper.getSettingsc C sF t |�}t�d| j� | j�|� | j�| j|�| _| � | jj � dS )z#update settings for helper z%s.update('...')N) r r r9 r r rF r �set_helper_configr �Updatedr) )r �settingsr; r" r" r# �update� s z FirewallDConfigHelper.updatec C s< t �d| j� | j�|� | j�| j�| _| �| jj � dS )z1load default settings for builtin helper z%s.loadDefaults()N) r r9 r r rF r �load_helper_defaultsr rT r) rQ r" r" r# � loadDefaults� s z"FirewallDConfigHelper.loadDefaultsc C � t �d| j|f � d S )Nz%s.Updated('%s')�r r9 r �r r) r" r" r# rT � � z FirewallDConfigHelper.Updatedc C s: t �d| j� | j�|� | j�| j� | j�| j� dS )zremove helper z%s.removeHelper()N) r r9 r r rF r � remove_helperr � removeHelperrQ r" r" r# �remove� s z FirewallDConfigHelper.removec C rY )Nz%s.Removed('%s')rZ r[ r" r" r# �Removed� r\ z FirewallDConfigHelper.Removedc C sF t |t�}t�d| j|� | j�|� | j�| j |�| _ | � |� dS )zrename helper z%s.rename('%s')N) r r8 r r9 r r rF r � rename_helperr �Renamed)r r) r; r" r" r# �rename� s z FirewallDConfigHelper.renamec C rY )Nz%s.Renamed('%s')rZ r[ r" r" r# rb � r\ z FirewallDConfigHelper.Renamedc C � t �d| j� | �� d S )Nz%s.getVersion()r �r r9 r rR rQ r" r" r# � getVersion� � z FirewallDConfigHelper.getVersionc C �H t |t�}t�d| j|� | j�|� t| �� �}||d< | � |� d S )Nz%s.setVersion('%s')r � r r8 r r9 r r rF �listrR rV )r �versionr; rU r" r" r# � setVersion� � z FirewallDConfigHelper.setVersionc C rd )Nz %s.getShort()r re rQ r" r" r# �getShort rg z FirewallDConfigHelper.getShortc C rh )Nz%s.setShort('%s')r ri )r �shortr; rU r" r" r# �setShort rm z FirewallDConfigHelper.setShortc C rd )Nz%s.getDescription()� re rQ r" r" r# �getDescription rg z$FirewallDConfigHelper.getDescriptionc C rh )Nz%s.setDescription('%s')rq ri )r � descriptionr; rU r" r" r# �setDescription& s � z$FirewallDConfigHelper.setDescriptionc C �. t �d| j� | j�|� t| �� �}|d S )Nz%s.getFamily()� �r r9 r r rF rj rR �r r; rU r" r" r# � getFamily4 � z FirewallDConfigHelper.getFamilyc C �d t |t�}t�d| j|� | j�|� t| �� �}|d |kr't t j d| ��||d< | � |� d S )Nz%s.setFamily('%s')rv �'%s'� r r8 r r9 r r rF rj rR r r �ALREADY_ENABLEDrV �r �ipvr; rU r" r" r# � setFamily= � z FirewallDConfigHelper.setFamily�bc C �. t |t�}t�d| j|� | �� }|d |kS )Nz%s.queryFamily('%s')rv �r r8 r r9 r rR r r" r" r# � queryFamilyJ � z!FirewallDConfigHelper.queryFamilyc C ru )Nz%s.getModule()� rw rx r" r" r# � getModuleU rz z FirewallDConfigHelper.getModulec C r{ )Nz%s.setModule('%s')r� r| r} �r �moduler; rU r" r" r# � setModule^ r� z FirewallDConfigHelper.setModulec C r� )Nz%s.queryModule('%s')r� r� r� r" r" r# � queryModulek r� z!FirewallDConfigHelper.queryModuleza(ss)c C rd )Nz %s.getPorts()� re rQ r" r" r# �getPortsv rg z FirewallDConfigHelper.getPortsc C s� g }t |t�D ]}t|t�r|�t|�� q|�|� q|}t�d| jd�dd� |D ��� | j � |� t| � � �}||d< | � |� d S )Nz%s.setPorts('[%s]')�,c s s$ � | ] }d |d |d f V qdS )z ('%s, '%s')r r Nr" )�.0�portr" r" r# � <genexpr>� s �" z1FirewallDConfigHelper.setPorts.<locals>.<genexpr>r� ) r rj � isinstance�append�tupler r9 r �joinr rF rR rV )r �portsr; �_portsr� rU r" r" r# �setPorts} s � z FirewallDConfigHelper.setPortsc C s� t |t�}t |t�}t�d| j||� | j�|� t| �� �}||f|d v r1t t j d||f ��|d � ||f� | � |� d S )Nz%s.addPort('%s', '%s')r� �%s:%s)r r8 r r9 r r rF rj rR r r r~ r� rV �r r� �protocolr; rU r" r" r# �addPort� s � �z FirewallDConfigHelper.addPortc C s� t |t�}t |t�}t�d| j||� | j�|� t| �� �}||f|d vr1t t j d||f ��|d � ||f� | � |� d S )Nz%s.removePort('%s', '%s')r� r� )r r8 r r9 r r rF rj rR r r � NOT_ENABLEDr_ rV r� r" r" r# � removePort� s � z FirewallDConfigHelper.removePortc C s: t |t�}t |t�}t�d| j||� ||f| �� d v S )Nz%s.queryPort('%s', '%s')r� r� )r r� r� r; r" r" r# � queryPort� s �z FirewallDConfigHelper.queryPortr$ )8�__name__� __module__� __qualname__�__doc__� persistentr r �PK_ACTION_CONFIG� default_polkit_auth_requiredr r r r& r( r2 r �PROPERTIES_IFACEr< rD r rH �service�signalrK �PK_ACTION_INFO�INTROSPECTABLE_IFACErM r r �DBUS_SIGNATURErR rV rX rT r_ r` rc rb rf rl rn rp rr rt ry r� r� r� r� r� r� r� r� r� r� � __classcell__r" r" r r# r + s6 �� �� � � � � �� �� �� �� ��� ���� � �r )r � dbus.service�firewallr �firewall.dbus_utilsr r r �firewall.core.io.helperr �firewall.core.loggerr �firewall.server.dbusr �firewall.server.decoratorsr r r r r �firewall.errorsr r r" r" r" r# �<module> s PK ���Zھ�> ) server/__pycache__/server.cpython-310.pycnu �[��� o bhAbY � @ st d gZ ddlZddlmZ ddlZddlZddlZddlmZ ddl m Z ddl m Z dd� Z d d � Zd d d �ZdS )� run_server� N)�GLib)�config)�log)� FirewallDc C s | � � dS )NT)�reload)�service� r �8/usr/lib/python3/dist-packages/firewall/server/server.py�sighup0 s r c C s | � � d S )N)�quit)�mainloopr r r �sigterm4 s r Fc sd d}| r#ddl m� ddl� � �� � �� j� d�� ���fdd��zMtjjj dd� t� � }tj j t jj|d �}t|t jj�}t�� }| rMt���� ttd �rVtj}ntj}|tjtjt|� |tjtjt |� |� � W n7 t y~ t � d � Y n* t!y� t �"d � Y n t#y� } zt �"d |j$j%t&|�� W Y d}~nd}~ww |r�|�'� dS dS )zI Main function for firewall server. Handles D-Bus and GLib mainloop. Nr )�pformat� c sn � � � t� j�dkr/td� tdt� j� � � jD ]} tt| �d� t�| �� qtd� t���� d S )Nr zP >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> zGARBAGE OBJECTS (%d): z zP <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<< )�collect�len�garbage�print�typer �timeout_add_seconds)�x��gc� gc_collect� gc_timeoutr r r r H s z run_server.<locals>.gc_collectT)�set_as_default)�bus�unix_signal_addz Stopping..z Raising SystemExit in run_serverzException %s: %s)(�pprintr r �enable� set_debug� DEBUG_LEAK�dbusr �glib� DBusGMainLoop� SystemBusr �BusNamer �DBUS_INTERFACEr � DBUS_PATHr �MainLoopr �hasattrr �unix_signal_add_full� PRIORITY_HIGH�signal�SIGHUPr �SIGTERMr �run�KeyboardInterruptr �debug1� SystemExit�error� Exception� __class__�__name__�str�stop)�debug_gcr r �namer r �er r r r = sJ � � "�� �)F)�__all__r. � gi.repositoryr r# � dbus.service�dbus.mainloop.glib�firewallr �firewall.core.loggerr �firewall.server.firewalldr r r r r r r r �<module> s PK ���Z?X�� � + server/__pycache__/__init__.cpython-310.pycnu �[��� o bhAb � @ s d S )N� r r r �:/usr/lib/python3/dist-packages/firewall/server/__init__.py�<module> s PK ���Z�~t�J �J 1 server/__pycache__/config_service.cpython-310.pycnu �[��� o bhAb_u � @ s� d dl Z d dlZ d dlmZ d dlmZmZmZ d dlm Z d dl m Z d dl m Z mZmZmZ d dlmZ d dlmZ G d d � d e �ZdS ) � N)�config)�dbus_to_python�%dbus_introspection_prepare_properties�!dbus_introspection_add_properties)�log)�DbusServiceObject)�handle_exceptions�dbus_handle_exceptions�dbus_service_method�dbus_polkit_require_auth)�errors)� FirewallErrorc s� e Zd ZdZdZ ejjZ e � fdd��Z e dd� �Z e dd� �Z e d d � �Zeejd d d �e d�dd���Zeejddd �e d�dd���Zeejj�eejdd�e d�dd����Zejjejdd�dd � �Zeejj�eejdd �e d�� fd d � ���Zeejjd d �e d�d!d"���Z eejjdd �e d�d#d$���Z eejjd d�e d�d%d&���Z eejjdd�e d�d'd(���Z eejj�e d�d)d*���Z ejjejjdd�e d+d,� ��Z!eejj�e d�d-d.���Z"ejjejjdd�e d/d0� ��Z#eejjdd�e d�d1d2���Z$ejjejjdd�e d3d4� ��Z%eejjdd �e d�d5d6���Z&eejjdd�e d�d7d8���Z'eejjdd �e d�d9d:���Z(eejjdd�e d�d;d<���Z)eejjdd �e d�d=d>���Z*eejjdd�e d�d?d@���Z+eejjdAd �e d�dBdC���Z,eejjdAd�e d�dDdE���Z-eejjd d�e d�dFdG���Z.eejjd d�e d�dHdI���Z/eejjd dJd �e d�dKdL���Z0eejjdMd �e d�dNdO���Z1eejjdMd�e d�dPdQ���Z2eejjdd�e d�dRdS���Z3eejjdd�e d�dTdU���Z4eejjddJd �e d�dVdW���Z5eejjdAd �e d�dXdY���Z6eejjdAd�e d�dZd[���Z7eejjd d�e d�d\d]���Z8eejjd d�e d�d^d_���Z9eejjd dJd �e d�d`da���Z:eejjdMd �e d�dbdc���Z;eejjdMd�e d�ddde���Z<eejjdd�e d�dfdg���Z=eejjdd�e d�dhdi���Z>eejjddJd �e d�djdk���Z?eejjdld �e d�dmdn���Z@eejjdld�e d�dodp���ZAeejjddd �e d�dqdr���ZBeejjd d�e d�dsdt���ZCeejjdd�e d�dudv���ZDeejjd dJd �e d�dwdx���ZEeejjdMd �e d�dydz���ZFeejjdMd�e d�d{d|���ZGeejjdd�e d�d}d~���ZHeejjdd�e d�dd����ZIeejjddJd �e d�d�d����ZJ� ZKS )��FirewallDConfigServicezFirewallD main classTc s` t t| �j|i |�� || _|| _|| _|| _|d | _|d | _d| j | _ t | tj j � d S )Nr � zconfig.service.%d) �superr �__init__�parentr �obj�item_id�busname�path� _log_prefixr �dbus� DBUS_INTERFACE_CONFIG_SERVICE)�selfr �conf�servicer �args�kwargs�� __class__� �@/usr/lib/python3/dist-packages/firewall/server/config_service.pyr 2 s �z FirewallDConfigService.__init__c C s d S �Nr! �r r! r! r" �__del__? s z FirewallDConfigService.__del__c C s | � � d S r# )�remove_from_connectionr$ r! r! r" � unregisterC s z!FirewallDConfigService.unregisterc C s~ |dkr t �| jj�S |dkrt �| jj�S |dkr!t �| jj�S |dkr,t �| jj�S |dkr7t �| jj�S t j � d| ��)N�name�filenamer �default�builtinzDorg.freedesktop.DBus.Error.InvalidArgs: Property '%s' does not exist) r �Stringr r( r) r �Booleanr* r+ � exceptions� DBusException)r � property_namer! r! r" � _get_propertyK s ��z$FirewallDConfigService._get_property�ss�v)� in_signature� out_signatureNc C sL t |t�}t |t�}t�d| j||� |tjjkr!tj� d| ��| � |�S )Nz%s.Get('%s', '%s')�Jorg.freedesktop.DBus.Error.UnknownInterface: Interface '%s' does not exist) r �strr �debug1r r r r r. r/ r1 )r �interface_namer0 �senderr! r! r" �Get\ s � �� zFirewallDConfigService.Get�sza{sv}c C s` t |t�}t�d| j|� |tjjkrtj� d| ��i }dD ] }| � |�||< q tj |dd�S )Nz%s.GetAll('%s')r6 )r( r) r r* r+ �sv�� signature) r r7 r r8 r r r r r. r/ r1 � Dictionary)r r9 r: �ret�xr! r! r" �GetAllm s ��z FirewallDConfigService.GetAll�ssv)r4 c C sh t |t�}t |t�}t |�}t�d| j|||� | j�|� |tjj kr,tj � d| ��tj � d| ��)Nz%s.Set('%s', '%s', '%s')r6 zGorg.freedesktop.DBus.Error.PropertyReadOnly: Property '%s' is read-only) r r7 r r8 r r � accessCheckr r r r. r/ )r r9 r0 � new_valuer: r! r! r" �Set~ s$ � ����zFirewallDConfigService.Setzsa{sv}asr> c C s2 t |t�}t |�}t |�}t�d| j|||� d S )Nz&%s.PropertiesChanged('%s', '%s', '%s'))r r7 r r8 r )r r9 �changed_properties�invalidated_propertiesr! r! r" �PropertiesChanged� s �z(FirewallDConfigService.PropertiesChanged)r5 c s8 t �d| j� tt| ��| j| j�� �}t | |t j j �S )Nz%s.Introspect()) r �debug2r r r � Introspectr r �get_busr r r r )r r: �datar r! r" rL � s � �z!FirewallDConfigService.Introspectz(sssa(ss)asa{ss}asa(ss))c C � t �d| j� | j�| j�S )�!get settings for service z%s.getSettings())r r8 r r �get_service_configr �r r: r! r! r" � getSettings� � z"FirewallDConfigService.getSettingsc C rO )rP z%s.getSettings2())r r8 r r �get_service_config_dictr rR r! r! r" � getSettings2� rT z#FirewallDConfigService.getSettings2c C sF t |�}t�d| j� | j�|� | j�| j|�| _| � | jj � dS )z$update settings for service z%s.update('...')N) r r r8 r r rE r �set_service_configr �Updatedr( �r �settingsr: r! r! r" �update� s z FirewallDConfigService.updatec C sF t |�}t�d| j� | j�|� | j�| j|�| _| � | jj � d S )Nz%s.update2('...')) r r r8 r r rE r �set_service_config_dictr rX r( rY r! r! r" �update2� s z FirewallDConfigService.update2c C s< t �d| j� | j�|� | j�| j�| _| �| jj � dS )z2load default settings for builtin service z%s.loadDefaults()N) r r8 r r rE r �load_service_defaultsr rX r( rR r! r! r" � loadDefaults� s z#FirewallDConfigService.loadDefaultsc C � t �d| j|f � d S )Nz%s.Updated('%s')�r r8 r �r r( r! r! r" rX � � z FirewallDConfigService.Updatedc C s: t �d| j� | j�|� | j�| j� | j�| j� dS )zremove service z%s.removeService()N) r r8 r r rE r �remove_servicer � removeServicerR r! r! r" �remove� s z FirewallDConfigService.removec C r` )Nz%s.Removed('%s')ra rb r! r! r" �Removed� rc z FirewallDConfigService.Removedc C sF t |t�}t�d| j|� | j�|� | j�| j |�| _ | � |� dS )zrename service z%s.rename('%s')N) r r7 r r8 r r rE r �rename_servicer �Renamed)r r( r: r! r! r" �rename� s z FirewallDConfigService.renamec C r` )Nz%s.Renamed('%s')ra rb r! r! r" ri rc z FirewallDConfigService.Renamedc C � t �d| j� | �� d S )Nz%s.getVersion()r �r r8 r rS rR r! r! r" � getVersion � z!FirewallDConfigService.getVersionc C �H t |t�}t�d| j|� | j�|� t| �� �}||d< | � |� d S )Nz%s.setVersion('%s')r � r r7 r r8 r r rE �listrS r[ )r �versionr: rZ r! r! r" � setVersion � z!FirewallDConfigService.setVersionc C rk )Nz %s.getShort()r rl rR r! r! r" �getShort rn z FirewallDConfigService.getShortc C ro )Nz%s.setShort('%s')r rp )r �shortr: rZ r! r! r" �setShort$ rt z FirewallDConfigService.setShortc C rk )Nz%s.getDescription()� rl rR r! r! r" �getDescription1 rn z%FirewallDConfigService.getDescriptionc C ro )Nz%s.setDescription('%s')rx rp )r � descriptionr: rZ r! r! r" �setDescription8 s � z%FirewallDConfigService.setDescriptionza(ss)c C rk )Nz %s.getPorts()� rl rR r! r! r" �getPortsF rn z FirewallDConfigService.getPortsc C � g }t |t�D ]}t|t�r|�t|�� q|�|� q|}t�d| jd�dd� |D ��� | j � |� t| � � �}||d< | � |� d S )Nz%s.setPorts('[%s]')�,c s �$ � | ] }d |d |d f V qdS �z ('%s, '%s')r r Nr! ��.0�portr! r! r" � <genexpr>Z � �" z2FirewallDConfigService.setPorts.<locals>.<genexpr>r| � r rq � isinstance�append�tupler r8 r �joinr rE rS r[ �r �portsr: �_portsr� rZ r! r! r" �setPortsM � � z FirewallDConfigService.setPortsc C � t |t�}t |t�}t�d| j||� | j�|� t| �� �}||f|d v r1t t j d||f ��|d � ||f� | � |� d S )Nz%s.addPort('%s', '%s')r| �%s:%s�r r7 r r8 r r rE rq rS r r �ALREADY_ENABLEDr� r[ �r r� �protocolr: rZ r! r! r" �addPort` � � �z FirewallDConfigService.addPortc C � t |t�}t |t�}t�d| j||� | j�|� t| �� �}||f|d vr1t t j d||f ��|d � ||f� | � |� d S )Nz%s.removePort('%s', '%s')r| r� �r r7 r r8 r r rE rq rS r r � NOT_ENABLEDrf r[ r� r! r! r" � removePortp � � z!FirewallDConfigService.removePort�bc C �: t |t�}t |t�}t�d| j||� ||f| �� d v S )Nz%s.queryPort('%s', '%s')r| �r r7 r r8 r rS �r r� r� r: r! r! r" � queryPort � �z FirewallDConfigService.queryPort�asc C rk )Nz%s.getProtocols()� rl rR r! r! r" � getProtocols� rn z#FirewallDConfigService.getProtocolsc C sN t |t�}t�d| jd�|�� | j�|� t| �� �}||d< | � |� d S )Nz%s.setProtocols('[%s]')r r� ) r rq r r8 r r� r rE rS r[ )r � protocolsr: rZ r! r! r" � setProtocols� s � z#FirewallDConfigService.setProtocolsc C sf t |t�}t�d| j|� | j�|� t| �� �}||d v r%t t j |��|d � |� | � |� d S )Nz%s.addProtocol('%s')r� r� �r r� r: rZ r! r! r" � addProtocol� � z"FirewallDConfigService.addProtocolc C sf t |t�}t�d| j|� | j�|� t| �� �}||d vr%t t j |��|d � |� | � |� d S )Nz%s.removeProtocol('%s')r� r� r� r! r! r" �removeProtocol� r� z%FirewallDConfigService.removeProtocolc C s* t |t�}t�d| j|� || �� d v S )Nz%s.queryProtocol(%s')r� r� )r r� r: r! r! r" � queryProtocol� s z$FirewallDConfigService.queryProtocolc C rk )Nz%s.getSourcePorts()� rl rR r! r! r" �getSourcePorts� rn z%FirewallDConfigService.getSourcePortsc C r~ )Nz%s.setSourcePorts('[%s]')r c s r� r� r! r� r! r! r" r� � r� z8FirewallDConfigService.setSourcePorts.<locals>.<genexpr>r� r� r� r! r! r" �setSourcePorts� r� z%FirewallDConfigService.setSourcePortsc C r� )Nz %s.addSourcePort('%s', '%s')r� r� r� r� r! r! r" � addSourcePort� r� z$FirewallDConfigService.addSourcePortc C r� )Nz %s.removeSourcePort('%s', '%s')r� r� r� r� r! r! r" �removeSourcePort� r� z'FirewallDConfigService.removeSourcePortc C r� )Nz %s.querySourcePort('%s', '%s')r� r� r� r! r! r" �querySourcePort� r� z&FirewallDConfigService.querySourcePortc C rk )Nz%s.getModules()� rl rR r! r! r" � getModules rn z!FirewallDConfigService.getModulesc C s� t |t�}g }|D ] }|�d�r |�dd�}d|v r |�dd�}|�|� q |}t�d| jd�|�� | j � |� t| � � �}||d< | � |� d S )N� nf_conntrack_� �_�-z%s.setModules('[%s]')r r� ) r rq � startswith�replacer� r r8 r r� r rE rS r[ )r �modulesr: �_modules�modulerZ r! r! r" � setModules s � z!FirewallDConfigService.setModulesc C s� t |t�}|�d�r|�dd�}d|v r|�dd�}t�d| j|� | j�|� t | � � �}||d v r:t t j |��|d �|� | �|� d S )Nr� r� r� r� z%s.addModule('%s')r� )r r7 r� r� r r8 r r rE rq rS r r r� r� r[ �r r� r: rZ r! r! r" � addModule" � z FirewallDConfigService.addModulec C s� t |t�}|�d�r|�dd�}d|v r|�dd�}t�d| j|� | j�|� t | � � �}||d vr:t t j |��|d �|� | �|� d S )Nr� r� r� r� z%s.removeModule('%s')r� )r r7 r� r� r r8 r r rE rq rS r r r� rf r[ r� r! r! r" � removeModule3 r� z#FirewallDConfigService.removeModulec C sT t |t�}|�d�r|�dd�}d|v r|�dd�}t�d| j|� || �� d v S )Nr� r� r� r� z%s.queryModule('%s')r� )r r7 r� r� r r8 r rS )r r� r: r! r! r" � queryModuleD s z"FirewallDConfigService.queryModuleza{ss}c C rk )Nz%s.getDestinations()� rl rR r! r! r" �getDestinationsR rn z&FirewallDConfigService.getDestinationsc C sV t |t�}t�d| j|�d�|�d�� | j�|� t| � � �}||d< | � |� d S )Nz*%s.setDestinations({ipv4:'%s', ipv6:'%s'})�ipv4�ipv6r� ) r �dictr r8 r �getr rE rq rS r[ )r � destinationsr: rZ r! r! r" �setDestinationsY s � z&FirewallDConfigService.setDestinationsc C sV t |t�}t�d| j|� | j�|� t| �� �}||d vr%t t j |��|d | S )Nz%s.getDestination('%s')r� ) r r7 r r8 r r rE rq rS r r r� �r �familyr: rZ r! r! r" �getDestinationf s � z%FirewallDConfigService.getDestinationc C s� t |t�}t |t�}t�d| j||� | j�|� t| �� �}||d v r7|d | |kr7t t j d||f ��||d |< | � |� d S )Nz %s.setDestination('%s', '%s')r� z '%s': '%s') r r7 r r8 r r rE rq rS r r r� r[ �r r� �addressr: rZ r! r! r" �setDestinations s � � z%FirewallDConfigService.setDestinationc C sb t |t�}t�d| j|� | j�|� t| �� �}||d vr%t t j |��|d |= | � |� d S )Nz%s.removeDestination('%s')r� ) r r7 r r8 r r rE rq rS r r r� r[ r� r! r! r" �removeDestination� s � z(FirewallDConfigService.removeDestinationc C sJ t |t�}t |t�}t�d| j||� | �� }||d v o$||d | kS )Nz %s.queryDestination('%s', '%s')r� r� r� r! r! r" �queryDestination� s � �z'FirewallDConfigService.queryDestinationc C s< t �d| j� | j�|� | j�| j�}d|v r |d S g S )Nz%s.getIncludes()�includes)r r8 r r rE r rU r )r r: rZ r! r! r" � getIncludes� s z"FirewallDConfigService.getIncludesc C sZ t |t�}t�d| j|� | j�|� d|d d � i}| j�| j |�| _ | � | j j � d S )Nz%s.setIncludes('%s')r� ) r rq r r8 r r rE r r\ r rX r( )r r� r: rZ r! r! r" � setIncludes� s z"FirewallDConfigService.setIncludesc C sj t |t�}t�d| j|� | j�|� | j�| j �}|� dg �� |� | j� | j |�| _ | � | j j� d S )Nz%s.addInclude('%s')r� )r r7 r r8 r r rE r rU r � setdefaultr� r\ rX r( �r �includer: rZ r! r! r" � addInclude� s z!FirewallDConfigService.addIncludec C sf t |t�}t�d| j|� | j�|� | j�| j �}|d � |� | j� | j |�| _ | � | j j � d S )Nz%s.removeInclude('%s')r� )r r7 r r8 r r rE r rU r rf r\ rX r( r� r! r! r" � removeInclude� s z$FirewallDConfigService.removeIncludec C s@ t |t�}t�d| j|� | j�| j�}d|v r ||d v S dS )Nz%s.queryInclude('%s')r� F)r r7 r r8 r r rU r r� r! r! r" � queryInclude� s z#FirewallDConfigService.queryIncluder# )L�__name__� __module__� __qualname__�__doc__� persistentr r �PK_ACTION_CONFIG� default_polkit_auth_requiredr r r r% r' r1 r �PROPERTIES_IFACEr; rC r rG r �signalrJ �PK_ACTION_INFO�INTROSPECTABLE_IFACErL r rS rV r[ r] r_ rX rf rg rj ri rm rs ru rw ry r{ r} r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� � __classcell__r! r! r r" r * s �� ��� � � � � � �� �� �� ��� � � �� � � ���� � � ����� �� � � � � ��� � �r )r � dbus.service�firewallr �firewall.dbus_utilsr r r �firewall.core.loggerr �firewall.server.dbusr �firewall.server.decoratorsr r r r r �firewall.errorsr r r! r! r! r" �<module> s PK ���Z�ku 0 server/__pycache__/config_policy.cpython-310.pycnu �[��� o bhAb� � @ st d dl Z d dlZ d dlmZ d dlmZmZmZ d dlm Z d dl m Z d dl m Z mZmZmZ G dd� de �ZdS ) � N)�config)�dbus_to_python�%dbus_introspection_prepare_properties�!dbus_introspection_add_properties)�log)�DbusServiceObject)�handle_exceptions�dbus_handle_exceptions�dbus_service_method�dbus_polkit_require_authc s� e Zd ZdZejjZe� fdd��Z e dd� �Z e dd� �Z e dd � �Z eejd d d �e d/dd���Zeejddd �e d/dd���Zeejj�eejdd�e d/dd����Zejjejdd�dd� �Zeejj�eejdd �e d/� fd d � ���Zeejjdd �e d/d d ���Zeejjdd�e d/d!d"���Z eejj�e d/d#d$���Z ejjejjdd�e d%d&� ��Z eejj�e d/d'd(���Z ejjejjdd�e d)d*� ��Z eejjdd�e d/d+d,���Z!ejjejjdd�e d-d.� ��Z"� Z#S )0�FirewallDConfigPolicyTc s` t t| �j|i |�� || _|| _|| _|| _|d | _|d | _d| j | _ t | tj j � d S )Nr � zconfig.policy.%d) �superr �__init__�parentr �obj�item_id�busname�path� _log_prefixr �dbus� DBUS_INTERFACE_CONFIG_POLICY)�selfr �conf�policyr �args�kwargs�� __class__� �?/usr/lib/python3/dist-packages/firewall/server/config_policy.pyr s �z FirewallDConfigPolicy.__init__c C s d S �Nr �r r r r �__del__# s z FirewallDConfigPolicy.__del__c C s | � � d S r! )�remove_from_connectionr" r r r � unregister' s z FirewallDConfigPolicy.unregisterc C s~ |dkr t �| jj�S |dkrt �| jj�S |dkr!t �| jj�S |dkr,t �| jj�S |dkr7t �| jj�S t j � d| ��)N�name�filenamer �default�builtinzDorg.freedesktop.DBus.Error.InvalidArgs: Property '%s' does not exist) r �Stringr r& r' r �Booleanr( r) � exceptions� DBusException)r � property_namer r r � _get_property/ s ��z#FirewallDConfigPolicy._get_property�ss�v)� in_signature� out_signatureNc C sL t |t�}t |t�}t�d| j||� |tjjkr!tj� d| ��| � |�S )Nz%s.Get('%s', '%s')�Jorg.freedesktop.DBus.Error.UnknownInterface: Interface '%s' does not exist) r �strr �debug1r r r r r, r- r/ )r �interface_namer. �senderr r r �Get@ s � �� zFirewallDConfigPolicy.Get�sza{sv}c C s` t |t�}t�d| j|� |tjjkrtj� d| ��i }dD ] }| � |�||< q tj |dd�S )Nz%s.GetAll('%s')r4 )r& r' r r( r) �sv�� signature) r r5 r r6 r r r r r, r- r/ � Dictionary)r r7 r8 �ret�xr r r �GetAllQ s ��z FirewallDConfigPolicy.GetAll�ssv)r2 c C sh t |t�}t |t�}t |�}t�d| j|||� | j�|� |tjj kr,tj � d| ��tj � d| ��)Nz%s.Set('%s', '%s', '%s')r4 zGorg.freedesktop.DBus.Error.PropertyReadOnly: Property '%s' is read-only) r r5 r r6 r r � accessCheckr r r r, r- )r r7 r. � new_valuer8 r r r �Setb s$ � ����zFirewallDConfigPolicy.Setzsa{sv}asr< c C s2 t |t�}t |�}t |�}t�d| j|||� d S )Nz&%s.PropertiesChanged('%s', '%s', '%s'))r r5 r r6 r )r r7 �changed_properties�invalidated_propertiesr r r �PropertiesChangedv s �z'FirewallDConfigPolicy.PropertiesChanged)r3 c s8 t �d| j� tt| ��| j| j�� �}t | |t j j �S )Nz%s.Introspect()) r �debug2r r r � Introspectr r �get_busr r r r )r r8 �datar r r rJ s � �z FirewallDConfigPolicy.Introspectc C s t �d| j� | j�| j�}|S )z get settings for policy z%s.getSettings())r r6 r r � get_policy_object_config_dictr )r r8 �settingsr r r � getSettings� s z!FirewallDConfigPolicy.getSettingsc C sF t |�}t�d| j� | j�|� | j�| j|�| _| � | jj � dS )z#update settings for policy z%s.update('...')N) r r r6 r r rC r � set_policy_object_config_dictr �Updatedr& )r rN r8 r r r �update� s z FirewallDConfigPolicy.updatec C s< t �d| j� | j�|� | j�| j�| _| �| jj � dS )z1load default settings for builtin policy z%s.loadDefaults()N) r r6 r r rC r �load_policy_object_defaultsr rQ r& �r r8 r r r � loadDefaults� s z"FirewallDConfigPolicy.loadDefaultsc C � t �d| j|f � d S )Nz%s.Updated('%s')�r r6 r �r r& r r r rQ � � z FirewallDConfigPolicy.Updatedc C s: t �d| j� | j�|� | j�| j� | j�| j� dS )zremove policy z%s.removePolicy()N) r r6 r r rC r �remove_policy_objectr � removePolicyrT r r r �remove� s z FirewallDConfigPolicy.removec C rV )Nz%s.Removed('%s')rW rX r r r �Removed� rY z FirewallDConfigPolicy.Removedc C sF t |t�}t�d| j|� | j�|� | j�| j |�| _ | � |� dS )zrename policy z%s.rename('%s')N) r r5 r r6 r r rC r �rename_policy_objectr �Renamed)r r& r8 r r r �rename� s z FirewallDConfigPolicy.renamec C rV )Nz%s.Renamed('%s')rW rX r r r r_ � rY z FirewallDConfigPolicy.Renamedr! )$�__name__� __module__� __qualname__� persistentr r �PK_ACTION_CONFIG� default_polkit_auth_requiredr r r r# r% r/ r �PROPERTIES_IFACEr9 rA r rE �service�signalrH �PK_ACTION_INFO�INTROSPECTABLE_IFACErJ r rO rR rU rQ r\ r] r` r_ � __classcell__r r r r r sz �� �� � r )r � dbus.service�firewallr �firewall.dbus_utilsr r r �firewall.core.loggerr �firewall.server.dbusr �firewall.server.decoratorsr r r r r r r r r �<module> s PK ���Zi[� ?l ?l . server/__pycache__/config_zone.cpython-310.pycnu �[��� o bhAb�� � @ s� d dl Z d dlZ d dlmZ d dlmZmZmZ d dlm Z d dl m Z d dl m Z d dlmZ d dlmZ d d lmZ d d lmZmZmZmZ d d lmZ d d lmZ d d l m Z m Z m Z m Z G dd� de�Z!dS )� N)�config)�dbus_to_python�%dbus_introspection_prepare_properties�!dbus_introspection_add_properties)�Zone)�ifcfg_set_zone_of_interface)�DEFAULT_ZONE_TARGET)� Rich_Rule)�log)�DbusServiceObject)�handle_exceptions�dbus_handle_exceptions�dbus_service_method�dbus_polkit_require_auth)�errors)� FirewallError)�portStr�portInPortRange�coalescePortRange�breakPortRangec s� e Zd ZdZdZ ejjZ e � fdd��Z e dd� �Z e dd� �Z e d d � �Zeejd d d �e d�dd���Zeejddd �e d�dd���Zeejj�eejdd�e d�dd����Zejjejdd�dd � �Zeejj�eejdd �e d�� fd d � ���Zeejjd d �e d�d!d"���Z eejjdd �e d�d#d$���Z d%d&� Z eejjd d�e d�d'd(���Z eejjdd�e d�d)d*���Z eejj�e d�d+d,���Z!ejjejjdd�e d-d.� ��Z"eejj�e d�d/d0���Z#ejjejjdd�e d1d2� ��Z$eejjdd�e d�d3d4���Z%ejjejjdd�e d5d6� ��Z&eejjdd �e d�d7d8���Z'eejjdd�e d�d9d:���Z(eejjdd �e d�d;d<���Z)eejjdd�e d�d=d>���Z*eejjdd �e d�d?d@���Z+eejjdd�e d�dAdB���Z,eejjdd �e d�dCdD���Z-eejjdd�e d�dEdF���Z.eejjdGd �e d�dHdI���Z/eejjdGd�e d�dJdK���Z0eejjdd�e d�dLdM���Z1eejjdd�e d�dNdO���Z2eejjddPd �e d�dQdR���Z3eejjdSd �e d�dTdU���Z4eejjdSd�e d�dVdW���Z5eejjd d�e d�dXdY���Z6eejjd d�e d�dZd[���Z7eejjd dPd �e d�d\d]���Z8eejjdGd �e d�d^d_���Z9eejjdGd�e d�d`da���Z:eejjdd�e d�dbdc���Z;eejjdd�e d�ddde���Z<eejjddPd �e d�dfdg���Z=eejjdSd �e d�dhdi���Z>eejjdSd�e d�djdk���Z?eejjd d�e d�dldm���Z@eejjd d�e d�dndo���ZAeejjd dPd �e d�dpdq���ZBeejjdGd �e d�drds���ZCeejjdGd�e d�dtdu���ZDeejjdd�e d�dvdw���ZEeejjdd�e d�dxdy���ZFeejjddPd �e d�dzd{���ZGeejjdPd �e d�d|d}���ZHeejjdPd�e d�d~d���ZIeejj�e d�d�d����ZJeejj�e d�d�d����ZKeejjdPd �e d�d�d����ZLeejjdPd �e d�d�d����ZMeejjdPd�e d�d�d����ZNeejj�e d�d�d����ZOeejj�e d�d�d����ZPeejjdPd �e d�d�d����ZQeejjd�d �e d�d�d����ZReejjd�d�e d�d�d����ZSeejjd�d�e d�d�d����ZTeejjd�d�e d�d�d����ZUeejjd�dPd �e d�d�d����ZVeejjdGd �e d�d�d����ZWeejjdGd�e d�d�d����ZXeejjdd�e d�d�d����ZYeejjdd�e d�d�d����ZZeejjddPd �e d�d�d����Z[eejjdGd �e d�d�d����Z\eejjdGd�e d�d�d����Z]eejjdd�e d�d�d����Z^eejjdd�e d�d�d����Z_eejjddPd �e d�d�d����Z`eejjdGd �e d�d�d����ZaeejjdGd�e d�d�d����Zbeejjdd�e d�d�d����Zceejjdd�e d�d�d����ZdeejjddPd �e d�d�d����Ze� ZfS )��FirewallDConfigZonezFirewallD main classTc s` t t| �j|i |�� || _|| _|| _|| _|d | _|d | _d| j | _ t | tj j � d S )Nr � zconfig.zone.%d) �superr �__init__�parentr �obj�item_id�busname�path� _log_prefixr �dbus�DBUS_INTERFACE_CONFIG_ZONE)�selfr �conf�zoner �args�kwargs�� __class__� �=/usr/lib/python3/dist-packages/firewall/server/config_zone.pyr 8 s �z FirewallDConfigZone.__init__c C s d S �Nr) �r" r) r) r* �__del__E s zFirewallDConfigZone.__del__c C s | � � d S r+ )�remove_from_connectionr, r) r) r* � unregisterI s z FirewallDConfigZone.unregisterc C s~ |dkr t �| jj�S |dkrt �| jj�S |dkr!t �| jj�S |dkr,t �| jj�S |dkr7t �| jj�S t j � d| ��)N�name�filenamer �default�builtinzDorg.freedesktop.DBus.Error.InvalidArgs: Property '%s' does not exist) r �Stringr r0 r1 r �Booleanr2 r3 � exceptions� DBusException)r" � property_namer) r) r* � _get_propertyQ s ��z!FirewallDConfigZone._get_property�ss�v)� in_signature� out_signatureNc C sL t |t�}t |t�}t�d| j||� |tjjkr!tj� d| ��| � |�S )Nz%s.Get('%s', '%s')�Jorg.freedesktop.DBus.Error.UnknownInterface: Interface '%s' does not exist) r �strr �debug1r r r r! r6 r7 r9 )r" �interface_namer8 �senderr) r) r* �Getb s � �� zFirewallDConfigZone.Get�sza{sv}c C s` t |t�}t�d| j|� |tjjkrtj� d| ��i }dD ] }| � |�||< q tj |dd�S )Nz%s.GetAll('%s')r> )r0 r1 r r2 r3 �sv�� signature) r r? r r@ r r r r! r6 r7 r9 � Dictionary)r" rA rB �ret�xr) r) r* �GetAlls s ��zFirewallDConfigZone.GetAll�ssv)r< c C sh t |t�}t |t�}t |�}t�d| j|||� | j�|� |tjj kr,tj � d| ��tj � d| ��)Nz%s.Set('%s', '%s', '%s')r> zGorg.freedesktop.DBus.Error.PropertyReadOnly: Property '%s' is read-only) r r? r r@ r r � accessCheckr r r! r6 r7 )r" rA r8 � new_valuerB r) r) r* �Set� s$ � ����zFirewallDConfigZone.Setzsa{sv}asrF c C s2 t |t�}t |�}t |�}t�d| j|||� d S )Nz&%s.PropertiesChanged('%s', '%s', '%s'))r r? r r@ r )r" rA �changed_properties�invalidated_propertiesr) r) r* �PropertiesChanged� s �z%FirewallDConfigZone.PropertiesChanged)r= c s8 t �d| j� tt| ��| j| j�� �}t | |t j j �S )Nz%s.Introspect()) r �debug2r r r � Introspectr r �get_busr r r r! )r" rB �datar' r) r* rT � s � �z FirewallDConfigZone.Introspectz&(sssbsasa(ss)asba(ssss)asasasasa(ss)b)c C sD t �d| j� | j�| j�}|d tkr t|�}d|d< t|�}|S )� get settings for zone z%s.getSettings()� r2 ) r r@ r r �get_zone_configr r �list�tuple)r" rB �settings� _settingsr) r) r* � getSettings� s z FirewallDConfigZone.getSettingsc C s4 t �d| j� | j�| j�}|d tkrd|d< |S )rW z%s.getSettings2()�targetr2 )r r@ r r �get_zone_config_dictr r �r" rB r\ r) r) r* � getSettings2� s z FirewallDConfigZone.getSettings2c C s | j �| j�}d|v rt|d �nt� }d|v r t|d �nt� }t|t�r=t|t�d� �| }t|t�d� �| }n"d|v rGt|d �nt� }d|v rTt|d �nt� }|| }|| }|D ]} | j� | �rot t j | ��qa|D ]} | j� | �r�t t j | ��qrdS )a Assignment of interfaces/sources to zones is different from other zone settings in the sense that particular interface/zone can be part of only one zone. So make sure added interfaces/sources have not already been bound to another zone.� interfaces�sourcesN)r r` r �set� isinstancer[ r �index_ofr �getZoneOfInterfacer r � ZONE_CONFLICT�getZoneOfSource) r" r\ � old_settings� old_ifaces� old_sources� added_ifaces� added_sources� new_ifaces� new_sources�iface�sourcer) r) r* � _checkDuplicateInterfacesSources� s& � ��z4FirewallDConfigZone._checkDuplicateInterfacesSourcesc C st t |�}t�d| j� | j�|� |d dkr#t|�}t|d< t|�}| � |� | j � | j |�| _ | � | j j� dS )�!update settings for zone z%s.update('...')rX r2 N)r r r@ r r rM rZ r r[ rt r �set_zone_configr �Updatedr0 )r" r\ rB r] r) r) r* �update� s zFirewallDConfigZone.updatec C sl t |�}t�d| j� | j�|� d|v r |d dkr t|d< | �|� | j� | j |�| _ | � | j j � dS )ru z%s.update2('...')r_ r2 N) r r r@ r r rM r rt r �set_zone_config_dictr rw r0 )r" r\ rB r) r) r* �update2� s zFirewallDConfigZone.update2c C s< t �d| j� | j�|� | j�| j�| _| �| jj � dS )z/load default settings for builtin zone z%s.loadDefaults()N) r r@ r r rM r �load_zone_defaultsr rw r0 �r" rB r) r) r* � loadDefaults s z FirewallDConfigZone.loadDefaultsc C � t �d| j|f � d S )Nz%s.Updated('%s')�r r@ r �r" r0 r) r) r* rw � zFirewallDConfigZone.Updatedc C s: t �d| j� | j�|� | j�| j� | j�| j� dS )zremove zone z%s.removeZone()N) r r@ r r rM r � remove_zoner � removeZoner| r) r) r* �remove s zFirewallDConfigZone.removec C r~ )Nz%s.Removed('%s')r r� r) r) r* �Removed r� zFirewallDConfigZone.Removedc C sF t |t�}t�d| j|� | j�|� | j�| j |�| _ | � |� dS )zrename zone z%s.rename('%s')N) r r? r r@ r r rM r � rename_zoner �Renamed)r" r0 rB r) r) r* �rename% s zFirewallDConfigZone.renamec C r~ )Nz%s.Renamed('%s')r r� r) r) r* r� 1 r� zFirewallDConfigZone.Renamedc C � t �d| j� | �� d S )Nz%s.getVersion()r �r r@ r r^ r| r) r) r* � getVersion8 � z FirewallDConfigZone.getVersionc C �H t |t�}t�d| j|� | j�|� t| �� �}||d< | � |� d S )Nz%s.setVersion('%s')r � r r? r r@ r r rM rZ r^ rx )r" �versionrB r\ r) r) r* � setVersion? � z FirewallDConfigZone.setVersionc C r� )Nz %s.getShort()r r� r| r) r) r* �getShortL r� z FirewallDConfigZone.getShortc C r� )Nz%s.setShort('%s')r r� )r" �shortrB r\ r) r) r* �setShortS r� z FirewallDConfigZone.setShortc C r� )Nz%s.getDescription()� r� r| r) r) r* �getDescription` r� z"FirewallDConfigZone.getDescriptionc C r� )Nz%s.setDescription('%s')r� r� )r" � descriptionrB r\ r) r) r* �setDescriptiong r� z"FirewallDConfigZone.setDescriptionc C s. t �d| j� | �� }|d tkr|d S dS )Nz%s.getTarget()rX r2 )r r@ r r^ r ra r) r) r* � getTargetw s z FirewallDConfigZone.getTargetc C sT t |t�}t�d| j|� | j�|� t| �� �}|dkr |nt |d< | � |� d S )Nz%s.setTarget('%s')r2 rX ) r r? r r@ r r rM rZ r^ r rx )r" r_ rB r\ r) r) r* � setTarget s z FirewallDConfigZone.setTarget�asc C r� )Nz%s.getServices()� r� r| r) r) r* � getServices� r� z FirewallDConfigZone.getServicesc C �N t |t�}t�d| jd�|�� | j�|� t| �� �}||d< | � |� d S )Nz%s.setServices('[%s]')�,r� � r rZ r r@ r �joinr rM r^ rx )r" �servicesrB r\ r) r) r* � setServices� � � z FirewallDConfigZone.setServicesc C �f t |t�}t�d| j|� | j�|� t| �� �}||d v r%t t j |��|d � |� | � |� d S )Nz%s.addService('%s')r� �r r? r r@ r r rM rZ r^ r r �ALREADY_ENABLED�appendrx �r" �servicerB r\ r) r) r* � addService� � z FirewallDConfigZone.addServicec C �f t |t�}t�d| j|� | j�|� t| �� �}||d vr%t t j |��|d � |� | � |� d S )Nz%s.removeService('%s')r� �r r? r r@ r r rM rZ r^ r r � NOT_ENABLEDr� rx r� r) r) r* � removeService� r� z!FirewallDConfigZone.removeService�bc C �* t |t�}t�d| j|� || �� d v S )Nz%s.queryService('%s')r� �r r? r r@ r r^ )r" r� rB r) r) r* � queryService� � z FirewallDConfigZone.queryServiceza(ss)c C r� )Nz %s.getPorts()� r� r| r) r) r* �getPorts� r� z FirewallDConfigZone.getPortsc C � g }t |t�D ]}t|t�r|�t|�� q|�|� q|}t�d| jd�dd� |D ��� | j � |� t| � � �}||d< | � |� d S )Nz%s.setPorts('[%s]')r� c s �$ � | ] }d |d |d f V qdS �z ('%s, '%s')r r Nr) ��.0�portr) r) r* � <genexpr>� � �" z/FirewallDConfigZone.setPorts.<locals>.<genexpr>r� � r rZ rf r� r[ r r@ r r� r rM r^ rx �r" �portsrB �_portsr� r\ r) r) r* �setPorts� � � z FirewallDConfigZone.setPortsc �� t |t�}t � t�� t�d| j|� � | j�|� t| �� �}tt � fdd�|d ��}|D ]}t ||d �rAt t j d|� f ��q.t|dd� |D ��\}}|D ]} |d �t| d �� f� qP|D ]} |d �t| d �� f� qa| �|� d S ) Nz%s.addPort('%s', '%s')c � | d � kS �Nr r) �rJ ��protocolr) r* �<lambda>� � z-FirewallDConfigZone.addPort.<locals>.<lambda>r� r �%s:%sc S � g | ]\}}|�qS r) r) �r� �_port� _protocolr) r) r* � <listcomp>� � z/FirewallDConfigZone.addPort.<locals>.<listcomp>�-�r r? r r@ r r rM rZ r^ �filterr r r r� r r� r r� rx � r" r� r� rB r\ �existing_port_ids�port_id� added_ranges�removed_ranges�ranger) r� r* �addPort� �( � ��zFirewallDConfigZone.addPortc �� t |t�}t � t�� t�d| j|� � | j�|� t| �� �}tt � fdd�|d ��}|D ] }t ||d �r9 n q.t t j d|� f ��t|dd� |D ��\}}|D ]} |d �t| d �� f� qR|D ]} |d �t| d �� f� qc| �|� d S ) Nz%s.removePort('%s', '%s')c r� r� r) r� r� r) r* r� � r� z0FirewallDConfigZone.removePort.<locals>.<lambda>r� r r� c S r� r) r) r� r) r) r* r� r� z2FirewallDConfigZone.removePort.<locals>.<listcomp>r� �r r? r r@ r r rM rZ r^ r� r r r r� r r� r r� rx r� r) r� r* � removePort� �& � �z FirewallDConfigZone.removePortc C �X t |t�}t |t�}t�d| j||� | �� d D ]\}}t||�r)||kr) dS qdS )Nz%s.queryPort('%s', '%s')r� TF�r r? r r@ r r^ r �r" r� r� rB r� r� r) r) r* � queryPort � ��z FirewallDConfigZone.queryPortc C r� )Nz%s.getProtocols()� r� r| r) r) r* � getProtocols r� z FirewallDConfigZone.getProtocolsc C r� )Nz%s.setProtocols('[%s]')r� r� r� )r" � protocolsrB r\ r) r) r* � setProtocols! r� z FirewallDConfigZone.setProtocolsc C r� )Nz%s.addProtocol('%s')r� r� �r" r� rB r\ r) r) r* � addProtocol- r� z FirewallDConfigZone.addProtocolc C r� )Nz%s.removeProtocol('%s')r� r� r� r) r) r* �removeProtocol: r� z"FirewallDConfigZone.removeProtocolc C r� )Nz%s.queryProtocol('%s')r� r� )r" r� rB r) r) r* � queryProtocolG r� z!FirewallDConfigZone.queryProtocolc C r� )Nz%s.getSourcePorts()� r� r| r) r) r* �getSourcePortsQ r� z"FirewallDConfigZone.getSourcePortsc C r� )Nz%s.setSourcePorts('[%s]')r� c s r� r� r) r� r) r) r* r� e r� z5FirewallDConfigZone.setSourcePorts.<locals>.<genexpr>r� r� r� r) r) r* �setSourcePortsX r� z"FirewallDConfigZone.setSourcePortsc r� ) Nz %s.addSourcePort('%s', '%s')c r� r� r) r� r� r) r* r� u r� z3FirewallDConfigZone.addSourcePort.<locals>.<lambda>r� r r� c S r� r) r) r� r) r) r* r� z r� z5FirewallDConfigZone.addSourcePort.<locals>.<listcomp>r� r� r� r) r� r* � addSourcePortk r� z!FirewallDConfigZone.addSourcePortc r� ) Nz %s.removeSourcePort('%s', '%s')c r� r� r) r� r� r) r* r� � r� z6FirewallDConfigZone.removeSourcePort.<locals>.<lambda>r� r r� c S r� r) r) r� r) r) r* r� � r� z8FirewallDConfigZone.removeSourcePort.<locals>.<listcomp>r� r� r� r) r� r* �removeSourcePort� r� z$FirewallDConfigZone.removeSourcePortc C r� )Nz %s.querySourcePort('%s', '%s')r� TFr� r� r) r) r* �querySourcePort� r� z#FirewallDConfigZone.querySourcePortc C r� )Nz%s.getIcmpBlocks()� r� r| r) r) r* � getIcmpBlocks� r� z!FirewallDConfigZone.getIcmpBlocksc C r� )Nz%s.setIcmpBlocks('[%s]')r� r� r� )r" � icmptypesrB r\ r) r) r* � setIcmpBlocks� r� z!FirewallDConfigZone.setIcmpBlocksc C r� )Nz%s.addIcmpBlock('%s')r� r� �r" �icmptyperB r\ r) r) r* � addIcmpBlock� r� z FirewallDConfigZone.addIcmpBlockc C r� )Nz%s.removeIcmpBlock('%s')r� r� r� r) r) r* �removeIcmpBlock� r� z#FirewallDConfigZone.removeIcmpBlockc C r� )Nz%s.queryIcmpBlock('%s')r� r� )r" r� rB r) r) r* �queryIcmpBlock� r� z"FirewallDConfigZone.queryIcmpBlockc C r� )Nz%s.getIcmpBlockInversion()� r� r| r) r) r* �getIcmpBlockInversion� r� z)FirewallDConfigZone.getIcmpBlockInversionc C r� )Nz %s.setIcmpBlockInversion('%s')r � r �boolr r@ r r rM rZ r^ rx )r" �flagrB r\ r) r) r* �setIcmpBlockInversion� r� z)FirewallDConfigZone.setIcmpBlockInversionc C �P t �d| j� | j�|� t| �� �}|d r ttj d��d|d< | � |� d S )Nz%s.addIcmpBlockInversion()r �icmp-block-inversionT� r r@ r r rM rZ r^ r r r� rx ra r) r) r* �addIcmpBlockInversion� � z)FirewallDConfigZone.addIcmpBlockInversionc C �P t �d| j� | j�|� t| �� �}|d s ttj d��d|d< | � |� d S )Nz %s.removeIcmpBlockInversion()r r F� r r@ r r rM rZ r^ r r r� rx ra r) r) r* �removeIcmpBlockInversion� r z,FirewallDConfigZone.removeIcmpBlockInversionc C r� )Nz %s.queryIcmpBlockInversion()r r� r| r) r) r* �queryIcmpBlockInversion r� z+FirewallDConfigZone.queryIcmpBlockInversionc C r� )Nz%s.getMasquerade()� r� r| r) r) r* � getMasquerade r� z!FirewallDConfigZone.getMasqueradec C r� )Nz%s.setMasquerade('%s')r r )r" � masqueraderB r\ r) r) r* � setMasquerade r� z!FirewallDConfigZone.setMasqueradec C r )Nz%s.addMasquerade()r r Tr ra r) r) r* � addMasquerade" r z!FirewallDConfigZone.addMasqueradec C r )Nz%s.removeMasquerade()r r Fr ra r) r) r* �removeMasquerade- r z$FirewallDConfigZone.removeMasqueradec C r� )Nz%s.queryMasquerade()r r� r| r) r) r* �queryMasquerade8 r� z#FirewallDConfigZone.queryMasqueradeza(ssss)c C r� )Nz%s.getForwardPorts()� r� r| r) r) r* �getForwardPortsA r� z#FirewallDConfigZone.getForwardPortsc C r� )Nz%s.setForwardPorts('[%s]')r� c s s0 � | ]}d |d |d |d |d f V qdS )z('%s, '%s', '%s', '%s')r r r� � Nr) r� r) r) r* r� U s � � �z6FirewallDConfigZone.setForwardPorts.<locals>.<genexpr>r r� r� r) r) r* �setForwardPortsH s �� z#FirewallDConfigZone.setForwardPorts�ssssc C s� t |t�}t |t�}t |t�}t |t�}t�d| j||||� | j�|� ||t|�t|�f}t| �� �}||d v rGt t j d||||f ��|d � |� | � |� d S )Nz)%s.addForwardPort('%s', '%s', '%s', '%s')r � %s:%s:%s:%sr� �r" r� r� �toport�toaddrrB �fwp_idr\ r) r) r* �addForwardPort\ �$ � ��z"FirewallDConfigZone.addForwardPortc C s� t |t�}t |t�}t |t�}t |t�}t�d| j||||� | j�|� ||t|�t|�f}t| �� �}||d vrGt t j d||||f ��|d � |� | � |� d S )Nz,%s.removeForwardPort('%s', '%s', '%s', '%s')r r r� r r) r) r* �removeForwardPortp r! z%FirewallDConfigZone.removeForwardPortc C sb t |t�}t |t�}t |t�}t |t�}t�d| j||||� ||t|�t|�f}|| �� d v S )Nz+%s.queryForwardPort('%s', '%s', '%s', '%s')r r� )r" r� r� r r rB r r) r) r* �queryForwardPort� s �z$FirewallDConfigZone.queryForwardPortc C r� )Nz%s.getInterfaces()� r� r| r) r) r* � getInterfaces� r� z!FirewallDConfigZone.getInterfacesc C r� )Nz%s.setInterfaces('[%s]')r� r$ r� )r" rc rB r\ r) r) r* � setInterfaces� r� z!FirewallDConfigZone.setInterfacesc C st t |t�}t�d| j|� | j�|� t| �� �}||d v r%t t j |��|d � |� | � |� t| jj|� d S )Nz%s.addInterface('%s')r$ )r r? r r@ r r rM rZ r^ r r r� r� rx r r r0 �r" � interfacerB r\ r) r) r* � addInterface� s z FirewallDConfigZone.addInterfacec C sp t |t�}t�d| j|� | j�|� t| �� �}||d vr%t t j |��|d � |� | � |� td|� d S )Nz%s.removeInterface('%s')r$ � )r r? r r@ r r rM rZ r^ r r r� r� rx r r' r) r) r* �removeInterface� s z#FirewallDConfigZone.removeInterfacec C r� )Nz%s.queryInterface('%s')r$ r� )r" r( rB r) r) r* �queryInterface� s z"FirewallDConfigZone.queryInterfacec C r� )Nz%s.getSources()� r� r| r) r) r* � getSources� r� z FirewallDConfigZone.getSourcesc C r� )Nz%s.setSources('[%s]')r� r- r� )r" rd rB r\ r) r) r* � setSources� r� z FirewallDConfigZone.setSourcesc C r� )Nz%s.addSource('%s')r- r� �r" rs rB r\ r) r) r* � addSource� r� z FirewallDConfigZone.addSourcec C r� )Nz%s.removeSource('%s')r- r� r0 r) r) r* � removeSource� r� z FirewallDConfigZone.removeSourcec C r� )Nz%s.querySource('%s')r- r� )r" rs rB r) r) r* � querySource� r� z FirewallDConfigZone.querySourcec C r� )Nz%s.getRichRules()� r� r| r) r) r* � getRichRules r� z FirewallDConfigZone.getRichRulesc C s\ t |t�}t�d| jd�|�� | j�|� t| �� �}dd� |D �}||d< | � |� d S )Nz%s.setRichRules('[%s]')r� c S s g | ] }t t|d ���qS )��rule_str)r? r )r� �rr) r) r* r� s z4FirewallDConfigZone.setRichRules.<locals>.<listcomp>r4 r� )r" �rulesrB r\ r) r) r* � setRichRules s � z FirewallDConfigZone.setRichRulesc C st t |t�}t�d| j|� | j�|� t| �� �}tt |d��}||d v r,t t j |��|d � |� | �|� d S )Nz%s.addRichRule('%s')r6 r4 )r r? r r@ r r rM rZ r^ r r r r� r� rx �r" �rulerB r\ r7 r) r) r* � addRichRule � z FirewallDConfigZone.addRichRulec C st t |t�}t�d| j|� | j�|� t| �� �}tt |d��}||d vr,t t j |��|d � |� | �|� d S )Nz%s.removeRichRule('%s')r6 r4 )r r? r r@ r r rM rZ r^ r r r r� r� rx r; r) r) r* �removeRichRule) r> z"FirewallDConfigZone.removeRichRulec C s8 t |t�}t�d| j|� tt|d��}|| �� d v S )Nz%s.queryRichRule('%s')r6 r4 )r r? r r@ r r r^ )r" r< rB r7 r) r) r* � queryRichRule7 s z!FirewallDConfigZone.queryRichRuler+ )g�__name__� __module__� __qualname__�__doc__� persistentr r �PK_ACTION_CONFIG� default_polkit_auth_requiredr r r r- r/ r9 r �PROPERTIES_IFACErC rK r rO r� �signalrR �PK_ACTION_INFO�INTROSPECTABLE_IFACErT r! r^ rb rt rx rz r} rw r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r r r r r r r r r r r r r r" r# r% r& r) r+ r, r. r/ r1 r2 r3 r5 r: r= r? r@ � __classcell__r) r) r' r* r 0 s �� � � �� � �� �� �� �� �� � � ������ �� � � ������ �� � � ��� ��� ������ �� � � ��� � � ��� � � �r )"r � dbus.service�firewallr �firewall.dbus_utilsr r r �firewall.core.io.zoner �firewall.core.fw_ifcfgr �firewall.core.baser �firewall.core.richr �firewall.core.loggerr �firewall.server.dbusr �firewall.server.decoratorsr r r r r �firewall.errorsr �firewall.functionsr r r r r r) r) r) r* �<module> s PK ���Z�� u ' server/__pycache__/dbus.cpython-310.pycnu �[��� o bhAb� � @ sP d dl Z d dlmZ G dd� de j�ZG dd� de j�ZG dd� de jj�ZdS ) � N)�configc @ s e Zd Zd Zdejj ZdS )�FirewallDBusExceptionz %s.ExceptionN)�__name__� __module__� __qualname__�__doc__r �dbus�DBUS_INTERFACE�_dbus_error_name� r r �6/usr/lib/python3/dist-packages/firewall/server/dbus.pyr s r c � e Zd Z� fdd�Z� ZS )�NotAuthorizedExceptionc s& t jjd | _t� �d�||�� d S )Nz.NotAuthorizedExceptionzNot Authorized({}): {})r r r r �super�__init__�format)�self� action_id�method�args�kwargs�� __class__r r r s z NotAuthorizedException.__init__)r r r r � __classcell__r r r r r � r c r )�DbusServiceObjectc s^ ddl m} t| �D ] }t| |�}t|d�r(t|d�s(|| j�}t| |||�� q t� �| �S )Nr )�dbus_polkit_require_auth�_dbus_is_method�_polkit_auth_required) �firewall.server.decoratorsr �dir�getattr�hasattr� default_polkit_auth_required�setattrr �__new__)�clsr r r � attr_namer � _decoratorr r r r% s � � zDbusServiceObject.__new__)r r r r% r r r r r r r r ) r �firewallr � DBusExceptionr r �service�Objectr r r r r �<module> s PK ���Zpq)��� �� ) server/__pycache__/config.cpython-310.pycnu �[��� o bhAb" � @ sL d dl Z d dlZd dlZd dlmZ d dlmZ d dlmZ d dl m Z d dl m Z d dl mZmZmZmZmZmZ d dlmZ d d lmZ d d lmZ d d lmZ d d l m Z d d l m Z d dl m!Z! d dl"m#Z# d dl$m%Z% d dl&m'Z' d dl(m)Z) d dl*m+Z+m,Z,m-Z-m.Z.m/Z/m0Z0m1Z1m2Z2 d dlm3Z3 d dl4m5Z5 G dd� de �Z6dS )� N)�config)�DEFAULT_ZONE_TARGET)�Watcher)�log)�DbusServiceObject)�handle_exceptions�dbus_handle_exceptions�dbus_service_method� dbus_service_method_deprecated� dbus_service_signal_deprecated�dbus_polkit_require_auth)�FirewallDConfigIcmpType)�FirewallDConfigService)�FirewallDConfigZone)�FirewallDConfigPolicy)�FirewallDConfigIPSet)�FirewallDConfigHelper)�IcmpType)�IPSet)�Helper)�LockdownWhitelist)�Direct)�dbus_to_python�command_of_sender�context_of_sender� uid_of_sender� user_of_uid�%dbus_introspection_prepare_properties�!dbus_introspection_add_properties�!dbus_introspection_add_deprecated)�errors)� FirewallErrorc s� e Zd ZdZdZ ejjZ e � fdd��Z e dd� �Z e dd� �Z e d d � �Z e d d � �Ze d d� �Ze dd� �Ze dd� �Ze dd� �Ze dd� �Ze dd� �Ze dd� �Ze dd � �Ze d d � �Ze d d � �Ze d!d"� �Ze d#d$� �Ze d%d&� �Ze d'd(� �Z e d)d*� �Z e d+d,� �Z e d-d.� �Z e d/d0� �Z e!d1d2� �Z"e!d3d4� �Z#e!d5d6� �Z$e%ej&d7d8d9�e!d�d;d<���Z'e%ej&d=d>d9�e!d�d?d@���Z(e)ejj�e%ej&dAdB�e!d�dCdD����Z*ej+j,ej&dEdF�dGdH� �Z-e)ejj.�e%ej/d=dI�e!d� fdJdK� ���Z0e%ejj1e2j3dI�e!d�dLdM���Z4e%ejj1e2j3dB�e!d�dNdO���Z5ej+�,ejj1�e!dPdQ� ��Z6e%ejj1d=dB�e!d�dRdS���Z7e%ejj1d=dB�e!d�dTdU���Z8e%ejj1d=dVd9�e!d�dWdX���Z9e%ejj1dYdI�e!d�dZd[���Z:e%ejj1d=dB�e!d�d\d]���Z;e%ejj1d=dB�e!d�d^d_���Z<e%ejj1d=dVd9�e!d�d`da���Z=e%ejj1dYdI�e!d�dbdc���Z>e%ejj1d=dB�e!d�ddde���Z?e%ejj1d=dB�e!d�dfdg���Z@e%ejj1d=dVd9�e!d�dhdi���ZAe%ejj1dYdI�e!d�djdk���ZBe%ejj1dldB�e!d�dmdn���ZCe%ejj1dldB�e!d�dodp���ZDe%ejj1dldVd9�e!d�dqdr���ZEe%ejj1dsdI�e!d�dtdu���ZFe%ejjGdvdI�e!d�dwdx���ZHe%ejjGdYdI�e!d�dydz���ZIe%ejjGd=d{d9�e!d�d|d}���ZJe%ejjGd=eKj3 d{d9�e!d�d~d���ZLej+j,ejjGd=dF�e!d�d�� ��ZMe%ejjGdvdI�e!d�d�d����ZNe%ejjGdYdI�e!d�d�d����ZOe%ejjGd=d{d9�e!d�d�d����ZPe%ejjGd=eQj3 d{d9�e!d�d�d����ZRej+j,ejjGd=dF�e!d�d�� ��ZSe%ejjGdvdI�e!d�d�d����ZTe%ejjGdYdI�e!d�d�d����ZUe%ejjGd=d{d9�e!d�d�d����ZVe%ejjGd�d{d9�e!d�d�d����ZWe%ejjGd�d{d9�e!d�d�d����ZXej+j,ejjGd=dF�e!d�d�� ��ZYe%ejjGdvdI�e!d�d�d����ZZe%ejjGdYdI�e!d�d�d����Z[e%ejjGd=d{d9�e!d�d�d����Z\e%ejjGd=d=d9�e!d�d�d����Z]e%ejjGd=d=d9�e!d�d�d����Z^e%ejjGd�d{d9�e!d�d�d����Z_e%ejjGd�d{d9�e!d�d�d����Z`ej+j,ejjGd=dF�e!d�d�� ��Zae%ejjGdvdI�e!d�d�d����Zbe%ejjGdYdI�e!d�d�d����Zce%ejjGd=d{d9�e!d�d�d����Zde%ejjGd�d{d9�e!d�d�d����Zeej+j,ejjGd=dF�e!d�d�� ��Zfe%ejjGdvdI�e!d�d�d����Zge%ejjGdYdI�e!d�d�d����Zhe%ejjGd=d{d9�e!d�d�d����Zie%ejjGd=ejj3 d{d9�e!d�d�d����Zkej+j,ejjGd=dF�e!d�d�� ��Zlemejjn�e%ejjneoj3dI�e!d�d�d�����Zpemejjn�e%ejjneoj3dB�e!d�d�d���Zqerejjn�ej+�,ejjn�e!d�dĄ ���Zsemejjn�e%ejjnd�dB�e!d�d�dDŽ���Ztemejjn�e%ejjnd�dB�e!d�d�dɄ���Zuemejjn�e%ejjnd�dVd9�e!d�d�d˄���Zvemejjn�e%ejjnd7dYd9�e!d�d�d̈́���Zwemejjn�e%ejjnd�d�d9�e!d�d�dф���Zxemejjn�e%ejjnd�dB�e!d�d�dԄ���Zyemejjn�e%ejjnd�dB�e!d�d�dք���Zzemejjn�e%ejjnd�dVd9�e!d�d�d���Z{emejjn�e%ejjnd�dB�e!d�d�dڄ���Z|emejjn�e%ejjnd�d�d9�e!d�d�d݄���Z}emejjn�e%ejjnd�d�d9�e!d�d�d����Z~emejjn�e%ejjnd�dB�e!d�d�d����Zemejjn�e%ejjnd�dB�e!d�d�d����Z�emejjn�e%ejjnd�dVd9�e!d�d�d����Z�emejjn�e%ejjnd=d�d9�e!d�d�d����Z�emejjn�e%ejjnd�dI�e!d�d�d����Z�� Z�S )��FirewallDConfigzFirewallD main classTc s� t t| �j|i |�� || _|d | _|d | _| �� t| jd�| _ | j � tj � | j � tj � | j � tj � | j � tj� | j � tj� | j � tj� | j � tj� | j � tj� | j � tj� | j � tj� | j � tj� | j � tj� tj�tj�r�tt�tj��D ]}dtj|f }tj�|�r�| j � |� q�| j � tj � | j � tj � | j � tj � t | tj!j"ddddddddddddd� � d S )Nr � � z%s/%s� readwrite) � CleanupOnExit�CleanupModulesOnExit� IPv6_rpfilter�Lockdown� MinimalMark�IndividualCalls� LogDenied�AutomaticHelpers�FirewallBackend�FlushAllOnReload� RFC3964_IPv4�AllowZoneDrifting)#�superr" �__init__r �busname�path� _init_varsr � watch_updater�watcher� add_watch_dir�FIREWALLD_IPSETS�ETC_FIREWALLD_IPSETS�FIREWALLD_ICMPTYPES�ETC_FIREWALLD_ICMPTYPES�FIREWALLD_HELPERS�ETC_FIREWALLD_HELPERS�FIREWALLD_SERVICES�ETC_FIREWALLD_SERVICES�FIREWALLD_ZONES�ETC_FIREWALLD_ZONES�FIREWALLD_POLICIES�ETC_FIREWALLD_POLICIES�os�exists�sorted�listdir�isdir�add_watch_file�LOCKDOWN_WHITELIST�FIREWALLD_DIRECT�FIREWALLD_CONFr �dbus�DBUS_INTERFACE_CONFIG)�self�conf�args�kwargs�filenamer5 �� __class__� �8/usr/lib/python3/dist-packages/firewall/server/config.pyr3 D sV ���zFirewallDConfig.__init__c C s g | _ d| _g | _d| _g | _d| _g | _d| _g | _d| _ g | _ d| _ | j � � D ] }| �| j �|�� q)| j �� D ] }| �| j �|�� q:| j �� D ] }| �| j �|�� qK| j �� D ] }| �| j �|�� q\| j �� D ] }| �| j �|�� qm| j � � D ] }| � | j � |�� q~d S �Nr ) �ipsets� ipset_idx� icmptypes� icmptype_idx�services� service_idx�zones�zone_idx�helpers� helper_idx�policy_objects�policy_object_idxr � get_ipsets� _addIPSet� get_ipset� get_icmptypes� _addIcmpType� get_icmptype� get_services� _addService� get_service� get_zones�_addZone�get_zone� get_helpers� _addHelper� get_helper�get_policy_objects� _addPolicy�get_policy_object)rQ �ipset�icmptype�service�zone�helper�policyrX rX rY r6 r s2 �zFirewallDConfig._init_varsc C s d S �NrX �rQ rX rX rY �__del__� s zFirewallDConfig.__del__c C s, t | j�dkr| j�� }|�� ~t | j�dkst | j�dkr0| j�� }|�� ~t | j�dks t | j�dkrH| j�� }|�� ~t | j�dks7t | j�dkr`| j�� }|�� ~t | j�dksOt | j�dkrx| j�� }|�� ~t | j�dksgt | j�dkr�| j�� }|�� ~t | j�dks| � � d S rZ ) �lenr[ �pop� unregisterr] r_ ra rc re r6 )rQ �itemrX rX rY �reload� s> � � � � � � zFirewallDConfig.reloadc C s� |t jkri| �t jj�}t�dt j� z| j �� W n ty6 } zt� d||f � W Y d }~d S d }~ww | �t jj�� � }t |� � �D ]}||v rW|| || krW||= qFt |�dkrg| �t jj|g � d S |�t j�su|�t j�r�|�d�r�z | j �|�\}}W n ty� } zt� d||f � W Y d }~d S d }~ww |dkr�| �|� d S |dkr�| �|� d S |dkr�| �|� d S d S |�t j�s�|�t j��r$|�d��r$z | j �|�\}}W n ty� } zt� d ||f � W Y d }~d S d }~ww |dk�r | �|� d S |dk�r| �|� d S |dk�r"| � |� d S d S |�t j ��s2|�t j ��r�|�d��r�z | j � |�\}}W n t�y_ } zt� d ||f � W Y d }~d S d }~ww |dk�rl| � |� d S |dk�rx| �!|� d S |dk�r�| �"|� d S d S |�t j ��r�|�#t j d ��$d �}t |�d k �s�d |v �r�d S t%j&�'|��r�| j(�)|��s�| j(�*|� d S d S | j(�)|��r�| j(�+|� d S d S d S |�t j,��s�|�t j-��r2|�d��r2z | j �.|�\}}W n t�y } zt� d||f � W Y d }~d S d }~ww |dk�r| �/|� d S |dk�r$| �0|� d S |dk�r0| �1|� d S d S |�t j2��s@|�t j3��r�|�d��r�z | j �4|�\}}W n t�ym } zt� d||f � W Y d }~d S d }~ww |dk�rz| �5|� d S |dk�r�| �6|� d S |dk�r�| �7|� d S d S |t j8k�r�z| j �9� W n t�y� } zt� d||f � W Y d }~d S d }~ww | �:� d S |t j;k�r�z| j �<� W n t�y� } zt� d||f � W Y d }~d S d }~ww | �=� d S |�t j>��s|�t j?��rX|�d��rVz | j �@|�\}}W n t�y1 } zt� d||f � W Y d }~d S d }~ww |dk�r>| �A|� d S |dk�rJ| �B|� d S |dk�rZ| �C|� d S d S d S d S )Nz,config: Reloading firewalld config file '%s'z+Failed to load firewalld.conf file '%s': %sr z.xmlz%Failed to load icmptype file '%s': %s�new�remove�updatez$Failed to load service file '%s': %sz!Failed to load zone file '%s': %s� �/r# z"Failed to load ipset file '%s': %sz#Failed to load helper file '%s': %sz/Failed to load lockdown whitelist file '%s': %sz)Failed to load direct rules file '%s': %sz#Failed to load policy file '%s': %s)Dr rN �GetAllrO rP r �debug1�update_firewalld_conf� Exception�error�copy�list�keysr� �PropertiesChanged� startswithr< r= �endswith�update_icmptype_from_pathrk �removeIcmpType�_updateIcmpTyper@ rA �update_service_from_pathrn � removeService�_updateServicerB rC �update_zone_from_pathrq � removeZone� _updateZone�replace�striprF r5 rJ r8 � has_watchr9 � remove_watchr: r; �update_ipset_from_pathrh � removeIPSet� _updateIPSetr> r? �update_helper_from_pathrt � removeHelper� _updateHelperrL �update_lockdown_whitelist�LockdownWhitelistUpdatedrM � update_direct�UpdatedrD rE � update_policy_object_from_pathrw � removePolicy� _updatePolicy) rQ �name� old_props�msg�props�key�what�obj�_namerX rX rY r7 � s` ����� � ����� ���� � � �� ��� ����� � ����� � ��� ��� ���� � z FirewallDConfig.watch_updaterc C �P t | | j|| j| jdtjj| jf �}| j�|� | jd7 _| �|j � |S �Nz%s/%dr# ) r r r^ r4 rO �DBUS_PATH_CONFIG_ICMPTYPEr] �append� IcmpTypeAddedr� )rQ r� �config_icmptyperX rX rY rk ? s �� z FirewallDConfig._addIcmpTypec C �L | j D ] }|jj|jkr#|jj|jkr#|jj|jkr#||_|�|j� qd S r )r] r� r� r5 rU r� )rQ r� rz rX rX rY r� K � ��z FirewallDConfig._updateIcmpTypec C �� d}| j D ]%}|�� }|j|| v r*|| �|j� | j�|j|�|_|�|jj� q| jD ])}|�� }d|v rW|j|d v rW|d �|j� | j� |j|�|_|�|jj� q.| j D ]}|j|krs|� |j� |� � | j �|� ~q[d S )N� � icmp_blocks) ra � getSettingsr� r� r �set_zone_configr� r� re � set_policy_object_config_dictr] �Removedr� )rQ r� �indexr| �settingsr~ rz rX rX rY r� T �. � � ��z FirewallDConfig.removeIcmpTypec C r� r� ) r r r` r4 rO �DBUS_PATH_CONFIG_SERVICEr_ r� � ServiceAddedr� )rQ r� �config_servicerX rX rY rn n � � zFirewallDConfig._addServicec C r� r )r_ r� r� r5 rU r� )rQ r� r{ rX rX rY r� y r� z FirewallDConfig._updateServicec C r� )Nr$ r_ ) ra r� r� r� r r� r� r� re r� r_ r� r� )rQ r� r� r| r� r~ r{ rX rX rY r� � r� z FirewallDConfig.removeServicec C r� r� ) r r rb r4 rO �DBUS_PATH_CONFIG_ZONEra r� � ZoneAddedr� )rQ r� � config_zonerX rX rY rq � r� zFirewallDConfig._addZonec C r� r )ra r� r� r5 rU r� �rQ r� r| rX rX rY r� � � ��zFirewallDConfig._updateZonec C �< | j D ]}|j|kr|�|j� |�� | j �|� ~qd S r )ra r� r� r� r� r� r� rX rX rY r� � � ��zFirewallDConfig.removeZonec C r� r� ) r r rf r4 rO �DBUS_PATH_CONFIG_POLICYre r� � PolicyAddedr� )rQ r� � config_policyrX rX rY rw � r� zFirewallDConfig._addPolicyc C r� r )re r� r� r5 rU r� �rQ r� r~ rX rX rY r� � r� z FirewallDConfig._updatePolicyc C r� r )re r� r� r� r� r� r� rX rX rY r� � r� z FirewallDConfig.removePolicyc C r� r� ) r r r\ r4 rO �DBUS_PATH_CONFIG_IPSETr[ r� � IPSetAddedr� )rQ r� � config_ipsetrX rX rY rh � r� zFirewallDConfig._addIPSetc C r� r )r[ r� r� r5 rU r� �rQ r� ry rX rX rY r� � r� z FirewallDConfig._updateIPSetc C r� r )r[ r� r� r� r� r� r� rX rX rY r� � r� zFirewallDConfig.removeIPSetc C r� r� ) r r rd r4 rO �DBUS_PATH_CONFIG_HELPERrc r� � HelperAddedr� )rQ r� � config_helperrX rX rY rt � r� zFirewallDConfig._addHelperc C r� r )rc r� r� r5 rU r� �rQ r� r} rX rX rY r� � r� z FirewallDConfig._updateHelperc C r� r )rc r� r� r� r� r� r� rX rX rY r� r� z FirewallDConfig.removeHelperc C s� | j �� rQ|d u rt�d� d S t�� }t||�}| j �d|�r"d S t||�}| j �d|�r0d S t |�}| j �d|�r=d S t ||�}| j �d|�rKd S t t j d��d S )Nz&Lockdown not possible, sender not set.�context�uid�user�commandzlockdown is enabled)r �lockdown_enabledr r� rO � SystemBusr � access_checkr r r r! r � ACCESS_DENIED)rQ �sender�busr� r� r� r� rX rX rY � accessCheck s& �zFirewallDConfig.accessCheckc C s |dvr t j�d| ��| j�� �|�}|dkr$|d u r tj}t �|�S |dkr9|d u r0tj}nt |�}t � |�S |dkrM|d u rHtj rFdnd}t �|�S |dkra|d u r\tj rZdnd}t �|�S |d kru|d u rptj rndnd}t �|�S |d kr�|d u r�tjr�dnd}t �|�S |d kr�|d u r�tjr�dnd}t �|�S |d kr�|d u r�tj}t �|�S |d kr�|d u r�tj}t �|�S |dkr�|d u r�tj}t �|�S |dkr�|d u r�tjr�dnd}t �|�S |dkr�|d u r�tjr�dnd}t �|�S |dk�r |d u �rtj�rdnd}t �|�S d S )N� � DefaultZoner* r& r' r) r( r+ r, r- r. r/ r0 r1 �Dorg.freedesktop.DBus.Error.InvalidArgs: Property '%s' does not existr� r* r& �yes�nor' r) r( r+ r, r- r. r/ r0 r1 )rO � exceptions� DBusExceptionr �get_firewalld_conf�get� FALLBACK_ZONE�String�FALLBACK_MINIMAL_MARK�int�Int32�FALLBACK_CLEANUP_ON_EXIT� FALLBACK_CLEANUP_MODULES_ON_EXIT�FALLBACK_LOCKDOWN�FALLBACK_IPV6_RPFILTER�FALLBACK_INDIVIDUAL_CALLS�FALLBACK_LOG_DENIED�FALLBACK_AUTOMATIC_HELPERS�FALLBACK_FIREWALL_BACKEND� FALLBACK_FLUSH_ALL_ON_RELOAD�FALLBACK_RFC3964_IPV4� FALLBACK_ALLOW_ZONE_DRIFTING)rQ �prop�valuerX rX rY � _get_property) sz �� �z FirewallDConfig._get_propertyc C sH |dkr t �| �|��S |dkrt �| �|��S |dkr$t �| �|��S |dkr0t �| �|��S |dkr<t �| �|��S |dkrHt �| �|��S |dkrTt �| �|��S |dkr`t �| �|��S |d krlt �| �|��S |d krxt �| �|��S |d kr�t �| �|��S |d kr�t �| �|��S |d kr�t �| �|��S t j�d| ��)Nr� r* r& r' r) r( r+ r, r- r. r/ r0 r1 r� )rO r� r r� r� r� )rQ r rX rX rY �_get_dbus_propertym s> ��z"FirewallDConfig._get_dbus_property�ss�v)� in_signature� out_signatureNc C sl t |t�}t |t�}t�d||� |tjjkr | �|�S |tjjtjj fv r.tj � d| ��tj � d| ��)Nzconfig.Get('%s', '%s')r� �Jorg.freedesktop.DBus.Error.UnknownInterface: Interface '%s' does not exist) r �strr r� r rO rP r � DBUS_INTERFACE_CONFIG_DIRECT� DBUS_INTERFACE_CONFIG_POLICIESr� r� )rQ �interface_name� property_namer� rX rX rY �Get� s$ �����zFirewallDConfig.Get�sza{sv}c C st t |t�}t�d|� i }|tjjkr dD ] }| �|�||< qn|tjjtjj fv r+ntj � d| ��tj |dd�S )Nzconfig.GetAll('%s')r� r �sv�� signature) r r r r� r rO rP r r r r� r� � Dictionary)rQ r r� �ret�xrX rX rY r� � s" ����zFirewallDConfig.GetAll�ssv)r c C sZ t |t�}t |t�}t |�}t�d|||� | �|� |tjjkr�|dv r�|dv r:|�� dvr9t t j d||f ��n0|dkrN|tj vrMt t j d||f ��n |dkrb|tj vrat t j d||f ��ntj�d| ��| j�� �||� | j�� �� | �|||ig � d S |d v r�d S tj�d| ��|tjjtjjfv r�tj�d| ��tj�d | ��) Nz config.Set('%s', '%s', '%s')) r& r' r) r( r+ r, r. r/ r0 )r& r' r) r( r+ r/ r0 )r� r� �true�falsez '%s' for %sr, r. r� )r* r- r1 r )r r r r� r� r rO rP �lowerr! r � INVALID_VALUE�LOG_DENIED_VALUES�FIREWALL_BACKEND_VALUESr� r� r� �set�writer� r r )rQ r r � new_valuer� rX rX rY �Set� s~ � ��� ��� �������������zFirewallDConfig.Setzsa{sv}asr c C s. t |t�}t |�}t |�}t�d|||� d S )Nz*config.PropertiesChanged('%s', '%s', '%s')�r r r r� )rQ r �changed_properties�invalidated_propertiesrX rX rY r� � s �z!FirewallDConfig.PropertiesChanged)r c s` t �d� tt| ��| j| j�� �}t| |t j j �}t j j fD ]}t | ||t� jt� j�}q |S )Nzconfig.Introspect())r �debug2r2 r" � Introspectr5 r4 �get_busr r rO rP r r r � deprecatedr )rQ r� �data� interfacerV rX rY r+ s � ��zFirewallDConfig.Introspectc C s t �d� | j�� j�� S )Nz&config.policies.getLockdownWhitelist())r r� r � get_policies�lockdown_whitelist� export_config�rQ r� rX rX rY �getLockdownWhitelist s z$FirewallDConfig.getLockdownWhitelistc C sB t �d� t|�}| j�� j�|i � | j�� j�� | �� d S )Nz)config.policies.setLockdownWhitelist(...)) r r� r r r0 r1 � import_configr$ r� �rQ r� r� rX rX rY �setLockdownWhitelist" s z$FirewallDConfig.setLockdownWhitelistc C � t �d� d S )Nz*config.policies.LockdownWhitelistUpdated()�r r� r� rX rX rY r� , s z(FirewallDConfig.LockdownWhitelistUpdatedc C �^ t |�}t�d|� | �|� t| �� �}||d v r!ttj|��|d � |� | � |� d S )Nz1config.policies.addLockdownWhitelistCommand('%s')r � r r r� r� r� r4 r! r �ALREADY_ENABLEDr� r7 �rQ r� r� r� rX rX rY �addLockdownWhitelistCommand3 � z+FirewallDConfig.addLockdownWhitelistCommandc C �^ t |�}t�d|� | �|� t| �� �}||d vr!ttj|��|d � |� | � |� d S )Nz4config.policies.removeLockdownWhitelistCommand('%s')r � r r r� r� r� r4 r! r � NOT_ENABLEDr� r7 r= rX rX rY � removeLockdownWhitelistCommand@ � � z.FirewallDConfig.removeLockdownWhitelistCommand�bc C �$ t |�}t�d|� || �� d v S )Nz3config.policies.queryLockdownWhitelistCommand('%s')r �r r r� r4 )rQ r� r� rX rX rY � queryLockdownWhitelistCommandN � �z-FirewallDConfig.queryLockdownWhitelistCommand�asc C � t �d� | �� d S )Nz.config.policies.getLockdownWhitelistCommands()r �r r� r4 r3 rX rX rY � getLockdownWhitelistCommandsW � z,FirewallDConfig.getLockdownWhitelistCommandsc C r: )Nz1config.policies.addLockdownWhitelistContext('%s')r# r; �rQ r� r� r� rX rX rY �addLockdownWhitelistContext` r? z+FirewallDConfig.addLockdownWhitelistContextc C r@ )Nz4config.policies.removeLockdownWhitelistContext('%s')r# rA rO rX rX rY � removeLockdownWhitelistContextm rD z.FirewallDConfig.removeLockdownWhitelistContextc C rF )Nz3config.policies.queryLockdownWhitelistContext('%s')r# rG )rQ r� r� rX rX rY � queryLockdownWhitelistContext{ rI z-FirewallDConfig.queryLockdownWhitelistContextc C rK )Nz.config.policies.getLockdownWhitelistContexts()r# rL r3 rX rX rY � getLockdownWhitelistContexts� rN z,FirewallDConfig.getLockdownWhitelistContextsc C r: )Nz.config.policies.addLockdownWhitelistUser('%s')� r; �rQ r� r� r� rX rX rY �addLockdownWhitelistUser� r? z(FirewallDConfig.addLockdownWhitelistUserc C r@ )Nz1config.policies.removeLockdownWhitelistUser('%s')rT rA rU rX rX rY �removeLockdownWhitelistUser� r? z+FirewallDConfig.removeLockdownWhitelistUserc C rF )Nz0config.policies.queryLockdownWhitelistUser('%s')rT rG )rQ r� r� rX rX rY �queryLockdownWhitelistUser� � z*FirewallDConfig.queryLockdownWhitelistUserc C rK )Nz+config.policies.getLockdownWhitelistUsers()rT rL r3 rX rX rY �getLockdownWhitelistUsers� rN z)FirewallDConfig.getLockdownWhitelistUsers�ic C r: )Nz+config.policies.addLockdownWhitelistUid(%d)� r; �rQ r� r� r� rX rX rY �addLockdownWhitelistUid� r? z'FirewallDConfig.addLockdownWhitelistUidc C r@ )Nz.config.policies.removeLockdownWhitelistUid(%d)r\ rA r] rX rX rY �removeLockdownWhitelistUid� r? z*FirewallDConfig.removeLockdownWhitelistUidc C rF )Nz-config.policies.queryLockdownWhitelistUid(%d)r\ rG )rQ r� r� rX rX rY �queryLockdownWhitelistUid� rY z)FirewallDConfig.queryLockdownWhitelistUid�aic C rK )Nz*config.policies.getLockdownWhitelistUids()r\ rL r3 rX rX rY �getLockdownWhitelistUids� rN z(FirewallDConfig.getLockdownWhitelistUids�aoc C � t �d� | jS )z"list ipsets objects paths zconfig.listIPSets())r r� r[ r3 rX rX rY � listIPSets� � zFirewallDConfig.listIPSetsc C �0 t �d� g }| jD ] }|�|jj� q t|�S )zget ipset names zconfig.getIPSetNames())r r� r[ r� r� r� rH )rQ r� r[ r� rX rX rY � getIPSetNames� � z FirewallDConfig.getIPSetNames�oc C �B t |t�}t�d|� | jD ] }|jj|kr| S qttj |��)z-object path of ipset with given name zconfig.getIPSetByName('%s')) r r r r� r[ r� r� r! r � INVALID_IPSET)rQ ry r� r� rX rX rY �getIPSetByName� � � z FirewallDConfig.getIPSetByNamec C �D t |t�}t |�}t�d|� | �|� | j�||�}| �|�}|S )z/add ipset with given name and settings zconfig.addIPSet('%s'))r r r r� r� r � new_ipsetrh )rQ ry r� r� r� r� rX rX rY �addIPSet � zFirewallDConfig.addIPSetc C � t |t�}t�d| � d S )Nzconfig.IPSetAdded('%s')r' )rQ ry rX rX rY r� � zFirewallDConfig.IPSetAddedc C rd )z%list icmptypes objects paths zconfig.listIcmpTypes())r r� r] r3 rX rX rY � listIcmpTypes rf z FirewallDConfig.listIcmpTypesc C rg )zget icmptype names zconfig.getIcmpTypeNames())r r� r] r� r� r� rH )rQ r� r] r� rX rX rY �getIcmpTypeNames$ ri z FirewallDConfig.getIcmpTypeNamesc C rk )z0object path of icmptype with given name z config.getIcmpTypeByName('%s')) r r r r� r] r� r� r! r �INVALID_ICMPTYPE)rQ rz r� r� rX rX rY �getIcmpTypeByName/ rn z!FirewallDConfig.getIcmpTypeByNamec C ro )z2add icmptype with given name and settings zconfig.addIcmpType('%s'))r r r r� r� r � new_icmptyperk )rQ rz r� r� r� r� rX rX rY � addIcmpType< rr zFirewallDConfig.addIcmpTypec C � t �d| � d S )Nzconfig.IcmpTypeAdded('%s')r9 )rQ rz rX rX rY r� K � z FirewallDConfig.IcmpTypeAddedc C rd )z$list services objects paths zconfig.listServices())r r� r_ r3 rX rX rY � listServicesR rf z FirewallDConfig.listServicesc C rg )zget service names zconfig.getServiceNames())r r� r_ r� r� r� rH )rQ r� r_ r� rX rX rY �getServiceNamesZ ri z FirewallDConfig.getServiceNamesc C rk )z/object path of service with given name z config.getServiceByName('%s')) r r r r� r_ r� r� r! r �INVALID_SERVICE)rQ r{ r� r� rX rX rY �getServiceByNamee rn z FirewallDConfig.getServiceByNamezs(sssa(ss)asa{ss}asa(ss))c C ro )�1add service with given name and settings zconfig.addService('%s'))r r r r� r� r � new_servicern �rQ r{ r� r� r� r� rX rX rY � addServicer rr zFirewallDConfig.addServicezsa{sv}c C ro )r� zconfig.addService2('%s'))r r r r� r� r �new_service_dictrn r� rX rX rY � addService2� rr zFirewallDConfig.addService2c C r{ )Nzconfig.ServiceAdded('%s')r9 )rQ r{ rX rX rY r� � r| z FirewallDConfig.ServiceAddedc C rd )z!list zones objects paths zconfig.listZones())r r� ra r3 rX rX rY � listZones� rf zFirewallDConfig.listZonesc C rg )zget zone names zconfig.getZoneNames())r r� ra r� r� r� rH )rQ r� ra r� rX rX rY � getZoneNames� ri z FirewallDConfig.getZoneNamesc C rk )z,object path of zone with given name zconfig.getZoneByName('%s')) r r r r� ra r� r� r! r � INVALID_ZONE)rQ r| r� r� rX rX rY � getZoneByName� rn z FirewallDConfig.getZoneByNamec C �v t |t�}t�d|� g }| jD ]}||jjv r |�|jj� qt |�dkr3d� |�d|t |�f S |r9|d S dS )z4name of zone the given interface belongs to z config.getZoneOfInterface('%s')r# � zE (ERROR: interface '%s' is in %s zone XML files, can be only in one)r r� ) r r r r� ra r� � interfacesr� r� r� �join)rQ �ifacer� r r� rX rX rY �getZoneOfInterface� � � ��z"FirewallDConfig.getZoneOfInterfacec C r� )z1name of zone the given source belongs to z config.getZoneOfSource('%s')r# r� zB (ERROR: source '%s' is in %s zone XML files, can be only in one)r r� ) r r r r� ra r� �sourcesr� r� r� r� )rQ �sourcer� r r� rX rX rY �getZoneOfSource� r� z FirewallDConfig.getZoneOfSourcez's(sssbsasa(ss)asba(ssss)asasasasa(ss)b)c C sh t |t�}t |�}t�d|� | �|� |d dkr&t|�}t|d< t|�}| j� ||�}| � |�}|S )�.add zone with given name and settings �config.addZone('%s')� �default) r r r r� r� r� r �tupler �new_zonerq )rQ r| r� r� � _settingsr� r� rX rX rY �addZone� s zFirewallDConfig.addZonec C s` t |t�}t |�}t�d|� | �|� d|v r"|d dkr"t|d< | j�||�}| �|�}|S )r� r� �targetr� ) r r r r� r� r r � new_zone_dictrq )rQ r| r� r� r� r� rX rX rY �addZone2� s zFirewallDConfig.addZone2c C r{ )Nzconfig.ZoneAdded('%s')r9 )rQ r| rX rX rY r� r| zFirewallDConfig.ZoneAddedc C rd )z$list policies objects paths zconfig.listPolicies())r r� re r3 rX rX rY � listPolicies rf z FirewallDConfig.listPoliciesc C rg )zget policy names zconfig.getPolicyNames())r r� re r� r� r� rH )rQ r� �policiesr� rX rX rY �getPolicyNames ri z FirewallDConfig.getPolicyNamesc C rk )z.object path of policy with given name z config.getPolicyByName('%s')) r r r r� re r� r� r! r �INVALID_POLICY)rQ r~ r� r� rX rX rY �getPolicyByName rn z FirewallDConfig.getPolicyByNamec C ro )z0add policy with given name and settings zconfig.addPolicy('%s'))r r r r� r� r �new_policy_object_dictrw )rQ r~ r� r� r� r� rX rX rY � addPolicy+ rr zFirewallDConfig.addPolicyc C r{ )Nzconfig.PolicyAdded('%s')r9 )rQ r~ rX rX rY r� : r| zFirewallDConfig.PolicyAddedc C rd )z#list helpers objects paths zconfig.listHelpers())r r� rc r3 rX rX rY � listHelpersC rf zFirewallDConfig.listHelpersc C rg )zget helper names zconfig.getHelperNames())r r� rc r� r� r� rH )rQ r� rc r� rX rX rY �getHelperNamesK ri z FirewallDConfig.getHelperNamesc C rk )z.object path of helper with given name z config.getHelperByName('%s')) r r r r� rc r� r� r! r �INVALID_HELPER)rQ r} r� r� rX rX rY �getHelperByNameV rn z FirewallDConfig.getHelperByNamec C ro )z0add helper with given name and settings zconfig.addHelper('%s'))r r r r� r� r � new_helperrt )rQ r} r� r� r� r� rX rX rY � addHelperc rr zFirewallDConfig.addHelperc C rs )Nzconfig.HelperAdded('%s')r' )rQ r} rX rX rY r� r rt zFirewallDConfig.HelperAddedc C s t �d� | j�� �� S )Nzconfig.direct.getSettings())r r� r � get_directr2 r3 rX rX rY r� { s zFirewallDConfig.getSettingsc C s> t �d� t|�}| j�� �|i � | j�� �� | �� d S )Nzconfig.direct.update())r r� r r r� r5 r$ r� r6 rX rX rY r� � s zFirewallDConfig.updatec C r8 )Nzconfig.direct.Updated()r9 r� rX rX rY r� � s zFirewallDConfig.Updated�sssc C s� t |�}t |�}t |�}t�d|||f � | �|� t|||f�}t| �� �}||d v r9ttj d|||f ��|d � |� | � |� d S )Nz(config.direct.addChain('%s', '%s', '%s')r z chain '%s' already is in '%s:%s') r r r� r� r� r� r� r! r r< r� r� �rQ �ipv�table�chainr� �idxr� rX rX rY �addChain� s" � ��zFirewallDConfig.addChainc C s� t |�}t |�}t |�}t�d|||f � | �|� t|||f�}t| �� �}||d vr9ttj d|||f ��|d � |� | � |� d S )Nz+config.direct.removeChain('%s', '%s', '%s')r z chain '%s' is not in '%s:%s') r r r� r� r� r� r� r! r rB r� r� r� rX rX rY � removeChain� s" � ��zFirewallDConfig.removeChainc C sJ t |�}t |�}t |�}t�d|||f � t|||f�}|| �� d v S )Nz*config.direct.queryChain('%s', '%s', '%s')r )r r r� r� r� )rQ r� r� r� r� r� rX rX rY � queryChain� s �zFirewallDConfig.queryChainc C sb t |�}t |�}t�d||f � g }| �� d D ]}|d |kr.|d |kr.|�|d � q|S )Nz#config.direct.getChains('%s', '%s')r r# rT �r r r� r� r� )rQ r� r� r� r r� rX rX rY � getChains� s �zFirewallDConfig.getChainsr� za(sss)c C rK )Nz config.direct.getAllChains()r �r r� r� r3 rX rX rY � getAllChains� � z FirewallDConfig.getAllChains�sssiasc C s� t |�}t |�}t |�}t |�}t |�}t�d||||d�|�f � | �|� |||||f}t| �� �}||d v rGttj d||||f ��|d � |� | � t |�� d S )Nz1config.direct.addRule('%s', '%s', '%s', %d, '%s')�','r# z"rule '%s' already is in '%s:%s:%s') r r r� r� r� r� r� r! r r< r� r� r� � rQ r� r� r� �priorityrS r� r� r� rX rX rY �addRule� �& � ��zFirewallDConfig.addRulec C s� t |�}t |�}t |�}t |�}t |�}t�d||||d�|�f � | �|� |||||f}t| �� �}||d vrGttj d||||f ��|d � |� | � t |�� d S )Nz4config.direct.removeRule('%s', '%s', '%s', %d, '%s')r� r# z rule '%s' is not in '%s:%s:%s') r r r� r� r� r� r� r! r rB r� r� r� r� rX rX rY � removeRule� r� zFirewallDConfig.removeRulec C sd t |�}t |�}t |�}t |�}t |�}t�d||||d�|�f � |||||f}|| �� d v S )Nz3config.direct.queryRule('%s', '%s', '%s', %d, '%s')r� r# �r r r� r� r� )rQ r� r� r� r� rS r� r� rX rX rY � queryRule s �zFirewallDConfig.queryRulec C s� t |�}t |�}t |�}t�d|||f � | �|� t| �� �}|d d d � D ]}|||f|d |d |d fkrB|d �|� q)| �t|�� d S )Nz+config.direct.removeRules('%s', '%s', '%s')r# r rT ) r r r� r� r� r� r� r� r� )rQ r� r� r� r� r� �rulerX rX rY � removeRules s � �zFirewallDConfig.removeRulesza(ias)c C s� t |�}t |�}t |�}t�d|||f � g }| �� d D ] }|d |kr=|d |kr=|d |kr=|�|d |d f� q |S )Nz(config.direct.getRules('%s', '%s', '%s')r# r rT r\ r� r� )rQ r� r� r� r� r r� rX rX rY �getRules1 s �$�zFirewallDConfig.getRulesz a(sssias)c C rK )Nzconfig.direct.getAllRules()r# r� r3 rX rX rY � getAllRulesA r� zFirewallDConfig.getAllRules�sasc C s� t |�}t |�}t�d|d�|�f � | �|� ||f}t| �� �}||d v r3ttj d||f ��|d � |� | � |� d S )Nz(config.direct.addPassthrough('%s', '%s')r� rT �passthrough '%s', '%s') r r r� r� r� r� r� r! r r< r� r� �rQ r� rS r� r� r� rX rX rY �addPassthroughK � � �z FirewallDConfig.addPassthroughc C s� t |�}t |�}t�d|d�|�f � | �|� ||f}t| �� �}||d vr3ttj d||f ��|d � |� | � |� d S )Nz+config.direct.removePassthrough('%s', '%s')r� rT r� ) r r r� r� r� r� r� r! r rB r� r� r� rX rX rY �removePassthrough^ r� z!FirewallDConfig.removePassthroughc C s@ t |�}t |�}t�d|d�|�f � ||f}|| �� d v S )Nz*config.direct.queryPassthrough('%s', '%s')r� rT r� )rQ r� rS r� r� rX rX rY �queryPassthroughp s �z FirewallDConfig.queryPassthrough�aasc C sJ t |�}t�d| � g }| �� d D ]}|d |kr"|�|d � q|S )Nz#config.direct.getPassthroughs('%s')rT r r# r� )rQ r� r� r r� rX rX rY �getPassthroughs| s �z FirewallDConfig.getPassthroughsza(sas)c C rK )Nz"config.direct.getAllPassthroughs()rT r� r3 rX rX rY �getAllPassthroughs� r� z"FirewallDConfig.getAllPassthroughsr )��__name__� __module__� __qualname__�__doc__� persistentr rO �PK_ACTION_CONFIG� default_polkit_auth_requiredr r3 r6 r� r� r7 rk r� r� rn r� r� rq r� r� rw r� r� rh r� r� rt r� r� r r� r r r �PROPERTIES_IFACEr r� r r& r{ �signalr� �PK_ACTION_INFO�INTROSPECTABLE_IFACEr+ r r �DBUS_SIGNATUREr4 r7 r� r> rC rH rM rP rQ rR rS rV rW rX rZ r^ r_ r` rb rP re rh rm r rq r� ru rv rx r rz r� r} r~ r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r r� r� r r r r� r� r r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� � __classcell__rX rX rV rY r" < sT - C �� < �� � � ��� � ��� � ��� � �� � � � � � � � � � ��� � � � � � � � � � � � � � � � � � � � � � �r" )7rF rO � dbus.service�firewallr �firewall.core.baser �firewall.core.watcherr �firewall.core.loggerr �firewall.server.dbusr �firewall.server.decoratorsr r r r r r � firewall.server.config_icmptyper � firewall.server.config_servicer �firewall.server.config_zoner � firewall.server.config_policyr � firewall.server.config_ipsetr � firewall.server.config_helperr �firewall.core.io.icmptyper �firewall.core.io.ipsetr �firewall.core.io.helperr �#firewall.core.io.lockdown_whitelistr �firewall.core.io.directr �firewall.dbus_utilsr r r r r r r r r �firewall.errorsr! r" rX rX rX rY �<module> s0 ( PK ���Zq��0 �0 / server/__pycache__/config_ipset.cpython-310.pycnu �[��� o bhAbI � @ s� d dl Z d dlZ d dlmZ d dlmZmZmZ d dlm Z d dl m Z m Z m Z mZ d dlmZ d dlmZ d dlmZmZmZmZ d d lmZ d d lmZ G d d � d e�ZdS ) � N)�config)�dbus_to_python�%dbus_introspection_prepare_properties�!dbus_introspection_add_properties)�IPSet)� IPSET_TYPES�normalize_ipset_entry� check_entry_overlaps_existing� check_for_overlapping_entries)�log)�DbusServiceObject)�handle_exceptions�dbus_handle_exceptions�dbus_service_method�dbus_polkit_require_auth)�errors)� FirewallErrorc s e Zd ZdZdZ ejjZ e � fdd��Z e dd� �Z e dd� �Z e d d � �Zeejd d d �e dWdd���Zeejddd �e dWdd���Zeejj�eejdd�e dWdd����Zejjejdd�dd � �Zeejj�eejdd �e dW� fd d � ���Zeejje j d �e dWd d!���Z eejje j d�e dWd"d#���Z eejj�e dWd$d%���Z ejjejjdd�e d&d'� ��Z!eejj�e dWd(d)���Z"ejjejjdd�e d*d+� ��Z#eejjdd�e dWd,d-���Z$ejjejjdd�e d.d/� ��Z%eejjdd �e dWd0d1���Z&eejjdd�e dWd2d3���Z'eejjdd �e dWd4d5���Z(eejjdd�e dWd6d7���Z)eejjdd �e dWd8d9���Z*eejjdd�e dWd:d;���Z+eejjdd �e dWd<d=���Z,eejjdd�e dWd>d?���Z-eejjd@d �e dWdAdB���Z.eejjd@d�e dWdCdD���Z/eejjd d�e dWdEdF���Z0eejjdd�e dWdGdH���Z1eejjd dId �e dWdJdK���Z2eejjdLd �e dWdMdN���Z3eejjdLd�e dWdOdP���Z4eejjdd�e dWdQdR���Z5eejjdd�e dWdSdT���Z6eejjddId �e dWdUdV���Z7� Z8S )X�FirewallDConfigIPSetzFirewallD main classTc s` t t| �j|i |�� || _|| _|| _|| _|d | _|d | _d| j | _ t | tj j � d S )Nr � zconfig.ipset.%d) �superr �__init__�parentr �obj�item_id�busname�path� _log_prefixr �dbus�DBUS_INTERFACE_CONFIG_IPSET)�selfr �conf�ipsetr �args�kwargs�� __class__� �>/usr/lib/python3/dist-packages/firewall/server/config_ipset.pyr 6 s �z FirewallDConfigIPSet.__init__c C s d S �Nr& �r r& r& r' �__del__C s z FirewallDConfigIPSet.__del__c C s | � � d S r( )�remove_from_connectionr) r& r& r' � unregisterG s z FirewallDConfigIPSet.unregisterc C s~ |dkr t �| jj�S |dkrt �| jj�S |dkr!t �| jj�S |dkr,t �| jj�S |dkr7t �| jj�S t j � d| ��)N�name�filenamer �default�builtinzDorg.freedesktop.DBus.Error.InvalidArgs: Property '%s' does not exist) r �Stringr r- r. r �Booleanr/ r0 � exceptions� DBusException)r � property_namer& r& r' � _get_propertyO s ��z"FirewallDConfigIPSet._get_property�ss�v)� in_signature� out_signatureNc C sL t |t�}t |t�}t�d| j||� |tjjkr!tj� d| ��| � |�S )Nz%s.Get('%s', '%s')�Jorg.freedesktop.DBus.Error.UnknownInterface: Interface '%s' does not exist) r �strr �debug1r r r r r3 r4 r6 )r �interface_namer5 �senderr& r& r' �Get` s � �� zFirewallDConfigIPSet.Get�sza{sv}c C s` t |t�}t�d| j|� |tjjkrtj� d| ��i }dD ] }| � |�||< q tj |dd�S )Nz%s.GetAll('%s')r; )r- r. r r/ r0 �sv�� signature) r r< r r= r r r r r3 r4 r6 � Dictionary)r r> r? �ret�xr& r& r' �GetAllq s ��zFirewallDConfigIPSet.GetAll�ssv)r9 c C sh t |t�}t |t�}t |�}t�d| j|||� | j�|� |tjj kr,tj � d| ��tj � d| ��)Nz%s.Set('%s', '%s', '%s')r; zGorg.freedesktop.DBus.Error.PropertyReadOnly: Property '%s' is read-only) r r< r r= r r � accessCheckr r r r3 r4 )r r> r5 � new_valuer? r& r& r' �Set� s$ � ����zFirewallDConfigIPSet.Setzsa{sv}asrC c C s2 t |t�}t |�}t |�}t�d| j|||� d S )Nz&%s.PropertiesChanged('%s', '%s', '%s'))r r< r r= r )r r> �changed_properties�invalidated_propertiesr& r& r' �PropertiesChanged� s �z&FirewallDConfigIPSet.PropertiesChanged)r: c s8 t �d| j� tt| ��| j| j�� �}t | |t j j �S )Nz%s.Introspect()) r �debug2r r r � Introspectr r �get_busr r r r )r r? �datar$ r& r' rQ � s � �z FirewallDConfigIPSet.Introspectc C s t �d| j� | j�| j�S )z get settings for ipset z%s.getSettings())r r= r r �get_ipset_configr �r r? r& r& r' � getSettings� s z FirewallDConfigIPSet.getSettingsc C sF t |�}t�d| j� | j�|� | j�| j|�| _| � | jj � dS )z"update settings for ipset z%s.update('...')N) r r r= r r rJ r �set_ipset_configr �Updatedr- )r �settingsr? r& r& r' �update� s zFirewallDConfigIPSet.updatec C s< t �d| j� | j�|� | j�| j�| _| �| jj � dS )z0load default settings for builtin ipset z%s.loadDefaults()N) r r= r r rJ r �load_ipset_defaultsr rX r- rU r& r& r' � loadDefaults� s z!FirewallDConfigIPSet.loadDefaultsc C � t �d| j|f � d S )Nz%s.Updated('%s')�r r= r �r r- r& r& r' rX � � z FirewallDConfigIPSet.Updatedc C s: t �d| j� | j�|� | j�| j� | j�| j� dS )zremove ipset z %s.remove()N) r r= r r rJ r � remove_ipsetr � removeIPSetrU r& r& r' �remove� s zFirewallDConfigIPSet.removec C r] )Nz%s.Removed('%s')r^ r_ r& r& r' �Removed� r` z FirewallDConfigIPSet.Removedc C sF t |t�}t�d| j|� | j�|� | j�| j |�| _ | � |� dS )zrename ipset z%s.rename('%s')N) r r< r r= r r rJ r � rename_ipsetr �Renamed)r r- r? r& r& r' �rename� s zFirewallDConfigIPSet.renamec C r] )Nz%s.Renamed('%s')r^ r_ r& r& r' rf � r` z FirewallDConfigIPSet.Renamedc C � t �d| j� | �� d S )Nz%s.getVersion()r �r r= r rV rU r& r& r' � getVersion� � z FirewallDConfigIPSet.getVersionc C �H t |t�}t�d| j|� | j�|� t| �� �}||d< | � |� d S )Nz%s.setVersion('%s')r � r r< r r= r r rJ �listrV rZ )r �versionr? rY r& r& r' � setVersion � z FirewallDConfigIPSet.setVersionc C rh )Nz %s.getShort()r ri rU r& r& r' �getShort rk z FirewallDConfigIPSet.getShortc C rl )Nz%s.setShort('%s')r rm )r �shortr? rY r& r& r' �setShort rq z FirewallDConfigIPSet.setShortc C rh )Nz%s.getDescription()� ri rU r& r& r' �getDescription# rk z#FirewallDConfigIPSet.getDescriptionc C rl )Nz%s.setDescription('%s')ru rm )r � descriptionr? rY r& r& r' �setDescription* s � z#FirewallDConfigIPSet.setDescriptionc C rh )Nz %s.getType()� ri rU r& r& r' �getType8 rk z FirewallDConfigIPSet.getTypec C s\ t |t�}t�d| j|� | j�|� |tvr tt j |��t | � � �}||d< | � |� d S )Nz%s.setType('%s')ry )r r< r r= r r rJ r r r � INVALID_TYPErn rV rZ )r � ipset_typer? rY r& r& r' �setType? s z FirewallDConfigIPSet.setTypeza{ss}c C rh )Nz%s.getOptions()� ri rU r& r& r' � getOptionsN rk z FirewallDConfigIPSet.getOptionsc C sL t |t�}t�d| jt|�� | j�|� t| � � �}||d< | � |� d S )Nz%s.setOptions('[%s]')r~ ) r �dictr r= r �reprr rJ rn rV rZ )r �optionsr? rY r& r& r' � setOptionsU s � z FirewallDConfigIPSet.setOptionsc C s� t |t�}t |t�}t�d| j||� | j�|� t| �� �}||d v r7|d | |kr7t t j d||f ��||d |< | � |� d S )Nz%s.addOption('%s', '%s')r~ z '%s': '%s') r r< r r= r r rJ rn rV r r �ALREADY_ENABLEDrZ �r �key�valuer? rY r& r& r' � addOptiona s � z FirewallDConfigIPSet.addOptionc C sb t |t�}t�d| j|� | j�|� t| �� �}||d vr%t t j |��|d |= | � |� d S )Nz%s.removeOption('%s')r~ ) r r< r r= r r rJ rn rV r r � NOT_ENABLEDrZ )r r� r? rY r& r& r' � removeOptionp s z!FirewallDConfigIPSet.removeOption�bc C sN t |t�}t |t�}t�d| j||� t| �� �}||d v o&|d | |kS )Nz%s.queryOption('%s', '%s')r~ )r r< r r= r rn rV r� r& r& r' � queryOption} s � z FirewallDConfigIPSet.queryOption�asc C rh )Nz%s.getEntries()� ri rU r& r& r' � getEntries� rk z FirewallDConfigIPSet.getEntriesc C s| t |t�}t|� t�d| jd�|�� | j�|� t| � � �}d|d v r3|d d dkr3t t j ��||d< | � |� d S )Nz%s.setEntries('[%s]')�,�timeoutr~ �0r� )r rn r r r= r �joinr rJ rV r r �IPSET_WITH_TIMEOUTrZ )r �entriesr? rY r& r& r' � setEntries� s � z FirewallDConfigIPSet.setEntriesc C s� t |t�}t|�}t�d| j|� | j�|� t| � � �}d|d v r0|d d dkr0t t j ��||d v r<t t j |��t||d � |d �|� | �|� d S )Nz%s.addEntry('%s')r� r~ r� r� )r r< r r r= r r rJ rn rV r r r� r� r �appendrZ �r �entryr? rY r& r& r' �addEntry� s z FirewallDConfigIPSet.addEntryc C s� t |t�}t|�}t�d| j|� | j�|� t| � � �}d|d v r0|d d dkr0t t j ��||d vr<t t j |��|d �|� | �|� d S )Nz%s.removeEntry('%s')r� r~ r� r� )r r< r r r= r r rJ rn rV r r r� r� rc rZ r� r& r& r' � removeEntry� s z FirewallDConfigIPSet.removeEntryc C s` t |t�}t|�}t�d| j|� t| �� �}d|d v r*|d d dkr*tt j ��||d v S )Nz%s.queryEntry('%s')r� r~ r� r� ) r r< r r r= r rn rV r r r� r� r& r& r' � queryEntry� s z FirewallDConfigIPSet.queryEntryr( )9�__name__� __module__� __qualname__�__doc__� persistentr r �PK_ACTION_CONFIG� default_polkit_auth_requiredr r r r* r, r6 r �PROPERTIES_IFACEr@ rH r rL �service�signalrO �PK_ACTION_INFO�INTROSPECTABLE_IFACErQ r r �DBUS_SIGNATURErV rZ r\ rX rc rd rg rf rj rp rr rt rv rx rz r} r r� r� r� r� r� r� r� r� r� � __classcell__r& r& r$ r' r . s6 �� �� � �� �� �� �� �� � � � �� �� �r ) r � dbus.service�firewallr �firewall.dbus_utilsr r r �firewall.core.io.ipsetr �firewall.core.ipsetr r r r �firewall.core.loggerr �firewall.server.dbusr �firewall.server.decoratorsr r r r r �firewall.errorsr r r& r& r& r' �<module> s PK ���Z4�7}�9 �9 server/config_icmptype.pynu �[��� # -*- coding: utf-8 -*- # # Copyright (C) 2010-2016 Red Hat, Inc. # # Authors: # Thomas Woerner <twoerner@redhat.com> # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see <http://www.gnu.org/licenses/>. import dbus import dbus.service from firewall import config from firewall.dbus_utils import dbus_to_python, \ dbus_introspection_prepare_properties, \ dbus_introspection_add_properties from firewall.core.io.icmptype import IcmpType from firewall.core.logger import log from firewall.server.dbus import DbusServiceObject from firewall.server.decorators import handle_exceptions, \ dbus_handle_exceptions, dbus_service_method, \ dbus_polkit_require_auth from firewall import errors from firewall.errors import FirewallError ############################################################################ # # class FirewallDConfigIcmpType # ############################################################################ class FirewallDConfigIcmpType(DbusServiceObject): """FirewallD main class""" persistent = True """ Make FirewallD persistent. """ default_polkit_auth_required = config.dbus.PK_ACTION_CONFIG """ Use PK_ACTION_INFO as a default """ @handle_exceptions def __init__(self, parent, conf, icmptype, item_id, *args, **kwargs): super(FirewallDConfigIcmpType, self).__init__(*args, **kwargs) self.parent = parent self.config = conf self.obj = icmptype self.item_id = item_id self.busname = args[0] self.path = args[1] self._log_prefix = "config.icmptype.%d" % self.item_id dbus_introspection_prepare_properties( self, config.dbus.DBUS_INTERFACE_CONFIG_ICMPTYPE) @dbus_handle_exceptions def __del__(self): pass @dbus_handle_exceptions def unregister(self): self.remove_from_connection() # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # P R O P E R T I E S @dbus_handle_exceptions def _get_property(self, property_name): if property_name == "name": return dbus.String(self.obj.name) elif property_name == "filename": return dbus.String(self.obj.filename) elif property_name == "path": return dbus.String(self.obj.path) elif property_name == "default": return dbus.Boolean(self.obj.default) elif property_name == "builtin": return dbus.Boolean(self.obj.builtin) else: raise dbus.exceptions.DBusException( "org.freedesktop.DBus.Error.InvalidArgs: " "Property '%s' does not exist" % property_name) @dbus_service_method(dbus.PROPERTIES_IFACE, in_signature='ss', out_signature='v') @dbus_handle_exceptions def Get(self, interface_name, property_name, sender=None): # pylint: disable=W0613 # get a property interface_name = dbus_to_python(interface_name, str) property_name = dbus_to_python(property_name, str) log.debug1("%s.Get('%s', '%s')", self._log_prefix, interface_name, property_name) if interface_name != config.dbus.DBUS_INTERFACE_CONFIG_ICMPTYPE: raise dbus.exceptions.DBusException( "org.freedesktop.DBus.Error.UnknownInterface: " "Interface '%s' does not exist" % interface_name) return self._get_property(property_name) @dbus_service_method(dbus.PROPERTIES_IFACE, in_signature='s', out_signature='a{sv}') @dbus_handle_exceptions def GetAll(self, interface_name, sender=None): # pylint: disable=W0613 interface_name = dbus_to_python(interface_name, str) log.debug1("%s.GetAll('%s')", self._log_prefix, interface_name) if interface_name != config.dbus.DBUS_INTERFACE_CONFIG_ICMPTYPE: raise dbus.exceptions.DBusException( "org.freedesktop.DBus.Error.UnknownInterface: " "Interface '%s' does not exist" % interface_name) ret = { } for x in [ "name", "filename", "path", "default", "builtin" ]: ret[x] = self._get_property(x) return dbus.Dictionary(ret, signature="sv") @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG) @dbus_service_method(dbus.PROPERTIES_IFACE, in_signature='ssv') @dbus_handle_exceptions def Set(self, interface_name, property_name, new_value, sender=None): interface_name = dbus_to_python(interface_name, str) property_name = dbus_to_python(property_name, str) new_value = dbus_to_python(new_value) log.debug1("%s.Set('%s', '%s', '%s')", self._log_prefix, interface_name, property_name, new_value) self.parent.accessCheck(sender) if interface_name != config.dbus.DBUS_INTERFACE_CONFIG_ICMPTYPE: raise dbus.exceptions.DBusException( "org.freedesktop.DBus.Error.UnknownInterface: " "Interface '%s' does not exist" % interface_name) raise dbus.exceptions.DBusException( "org.freedesktop.DBus.Error.PropertyReadOnly: " "Property '%s' is read-only" % property_name) @dbus.service.signal(dbus.PROPERTIES_IFACE, signature='sa{sv}as') def PropertiesChanged(self, interface_name, changed_properties, invalidated_properties): interface_name = dbus_to_python(interface_name, str) changed_properties = dbus_to_python(changed_properties) invalidated_properties = dbus_to_python(invalidated_properties) log.debug1("%s.PropertiesChanged('%s', '%s', '%s')", self._log_prefix, interface_name, changed_properties, invalidated_properties) @dbus_polkit_require_auth(config.dbus.PK_ACTION_INFO) @dbus_service_method(dbus.INTROSPECTABLE_IFACE, out_signature='s') @dbus_handle_exceptions def Introspect(self, sender=None): # pylint: disable=W0613 log.debug2("%s.Introspect()", self._log_prefix) data = super(FirewallDConfigIcmpType, self).Introspect( self.path, self.busname.get_bus()) return dbus_introspection_add_properties( self, data, config.dbus.DBUS_INTERFACE_CONFIG_ICMPTYPE) # S E T T I N G S @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ICMPTYPE, out_signature=IcmpType.DBUS_SIGNATURE) @dbus_handle_exceptions def getSettings(self, sender=None): # pylint: disable=W0613 """get settings for icmptype """ log.debug1("%s.getSettings()", self._log_prefix) return self.config.get_icmptype_config(self.obj) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ICMPTYPE, in_signature=IcmpType.DBUS_SIGNATURE) @dbus_handle_exceptions def update(self, settings, sender=None): """update settings for icmptype """ settings = dbus_to_python(settings) log.debug1("%s.update('...')", self._log_prefix) self.parent.accessCheck(sender) self.obj = self.config.set_icmptype_config(self.obj, settings) self.Updated(self.obj.name) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ICMPTYPE) @dbus_handle_exceptions def loadDefaults(self, sender=None): """load default settings for builtin icmptype """ log.debug1("%s.loadDefaults()", self._log_prefix) self.parent.accessCheck(sender) self.obj = self.config.load_icmptype_defaults(self.obj) self.Updated(self.obj.name) @dbus.service.signal(config.dbus.DBUS_INTERFACE_CONFIG_ICMPTYPE, signature='s') @dbus_handle_exceptions def Updated(self, name): log.debug1("%s.Updated('%s')" % (self._log_prefix, name)) # R E M O V E @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ICMPTYPE) @dbus_handle_exceptions def remove(self, sender=None): """remove icmptype """ log.debug1("%s.removeIcmpType()", self._log_prefix) self.parent.accessCheck(sender) self.config.remove_icmptype(self.obj) self.parent.removeIcmpType(self.obj) @dbus.service.signal(config.dbus.DBUS_INTERFACE_CONFIG_ICMPTYPE, signature='s') @dbus_handle_exceptions def Removed(self, name): log.debug1("%s.Removed('%s')" % (self._log_prefix, name)) # R E N A M E @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ICMPTYPE, in_signature='s') @dbus_handle_exceptions def rename(self, name, sender=None): """rename icmptype """ name = dbus_to_python(name, str) log.debug1("%s.rename('%s')", self._log_prefix, name) self.parent.accessCheck(sender) self.obj = self.config.rename_icmptype(self.obj, name) self.Renamed(name) @dbus.service.signal(config.dbus.DBUS_INTERFACE_CONFIG_ICMPTYPE, signature='s') @dbus_handle_exceptions def Renamed(self, name): log.debug1("%s.Renamed('%s')" % (self._log_prefix, name)) # version @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ICMPTYPE, out_signature='s') @dbus_handle_exceptions def getVersion(self, sender=None): # pylint: disable=W0613 log.debug1("%s.getVersion()", self._log_prefix) return self.getSettings()[0] @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ICMPTYPE, in_signature='s') @dbus_handle_exceptions def setVersion(self, version, sender=None): version = dbus_to_python(version, str) log.debug1("%s.setVersion('%s')", self._log_prefix, version) self.parent.accessCheck(sender) settings = list(self.getSettings()) settings[0] = version self.update(settings) # short @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ICMPTYPE, out_signature='s') @dbus_handle_exceptions def getShort(self, sender=None): # pylint: disable=W0613 log.debug1("%s.getShort()", self._log_prefix) return self.getSettings()[1] @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ICMPTYPE, in_signature='s') @dbus_handle_exceptions def setShort(self, short, sender=None): short = dbus_to_python(short, str) log.debug1("%s.setShort('%s')", self._log_prefix, short) self.parent.accessCheck(sender) settings = list(self.getSettings()) settings[1] = short self.update(settings) # description @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ICMPTYPE, out_signature='s') @dbus_handle_exceptions def getDescription(self, sender=None): # pylint: disable=W0613 log.debug1("%s.getDescription()", self._log_prefix) return self.getSettings()[2] @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ICMPTYPE, in_signature='s') @dbus_handle_exceptions def setDescription(self, description, sender=None): description = dbus_to_python(description, str) log.debug1("%s.setDescription('%s')", self._log_prefix, description) self.parent.accessCheck(sender) settings = list(self.getSettings()) settings[2] = description self.update(settings) # destination @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ICMPTYPE, out_signature='as') @dbus_handle_exceptions def getDestinations(self, sender=None): # pylint: disable=W0613 log.debug1("%s.getDestinations()", self._log_prefix) return sorted(self.getSettings()[3]) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ICMPTYPE, in_signature='as') @dbus_handle_exceptions def setDestinations(self, destinations, sender=None): destinations = dbus_to_python(destinations, list) log.debug1("%s.setDestinations('[%s]')", self._log_prefix, ",".join(destinations)) self.parent.accessCheck(sender) settings = list(self.getSettings()) settings[3] = destinations self.update(settings) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ICMPTYPE, in_signature='s') @dbus_handle_exceptions def addDestination(self, destination, sender=None): destination = dbus_to_python(destination, str) log.debug1("%s.addDestination('%s')", self._log_prefix, destination) self.parent.accessCheck(sender) settings = list(self.getSettings()) if destination in settings[3]: raise FirewallError(errors.ALREADY_ENABLED, destination) settings[3].append(destination) self.update(settings) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ICMPTYPE, in_signature='s') @dbus_handle_exceptions def removeDestination(self, destination, sender=None): destination = dbus_to_python(destination, str) log.debug1("%s.removeDestination('%s')", self._log_prefix, destination) self.parent.accessCheck(sender) settings = list(self.getSettings()) if settings[3]: if destination not in settings[3]: raise FirewallError(errors.NOT_ENABLED, destination) else: settings[3].remove(destination) else: # empty means all settings[3] = list(set(['ipv4', 'ipv6']) - set([destination])) self.update(settings) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ICMPTYPE, in_signature='s', out_signature='b') @dbus_handle_exceptions def queryDestination(self, destination, sender=None): # pylint: disable=W0613 destination = dbus_to_python(destination, str) log.debug1("%s.queryDestination('%s')", self._log_prefix, destination) settings = self.getSettings() # empty means all return (not settings[3] or destination in settings[3]) PK ���ZLO _u _u server/config_service.pynu �[��� # -*- coding: utf-8 -*- # # Copyright (C) 2010-2016 Red Hat, Inc. # # Authors: # Thomas Woerner <twoerner@redhat.com> # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see <http://www.gnu.org/licenses/>. import dbus import dbus.service from firewall import config from firewall.dbus_utils import dbus_to_python, \ dbus_introspection_prepare_properties, \ dbus_introspection_add_properties from firewall.core.logger import log from firewall.server.dbus import DbusServiceObject from firewall.server.decorators import handle_exceptions, \ dbus_handle_exceptions, dbus_service_method, \ dbus_polkit_require_auth from firewall import errors from firewall.errors import FirewallError ############################################################################ # # class FirewallDConfig # ############################################################################ class FirewallDConfigService(DbusServiceObject): """FirewallD main class""" persistent = True """ Make FirewallD persistent. """ default_polkit_auth_required = config.dbus.PK_ACTION_CONFIG """ Use PK_ACTION_INFO as a default """ @handle_exceptions def __init__(self, parent, conf, service, item_id, *args, **kwargs): super(FirewallDConfigService, self).__init__(*args, **kwargs) self.parent = parent self.config = conf self.obj = service self.item_id = item_id self.busname = args[0] self.path = args[1] self._log_prefix = "config.service.%d" % self.item_id dbus_introspection_prepare_properties( self, config.dbus.DBUS_INTERFACE_CONFIG_SERVICE) @dbus_handle_exceptions def __del__(self): pass @dbus_handle_exceptions def unregister(self): self.remove_from_connection() # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # P R O P E R T I E S @dbus_handle_exceptions def _get_property(self, property_name): if property_name == "name": return dbus.String(self.obj.name) elif property_name == "filename": return dbus.String(self.obj.filename) elif property_name == "path": return dbus.String(self.obj.path) elif property_name == "default": return dbus.Boolean(self.obj.default) elif property_name == "builtin": return dbus.Boolean(self.obj.builtin) else: raise dbus.exceptions.DBusException( "org.freedesktop.DBus.Error.InvalidArgs: " "Property '%s' does not exist" % property_name) @dbus_service_method(dbus.PROPERTIES_IFACE, in_signature='ss', out_signature='v') @dbus_handle_exceptions def Get(self, interface_name, property_name, sender=None): # pylint: disable=W0613 # get a property interface_name = dbus_to_python(interface_name, str) property_name = dbus_to_python(property_name, str) log.debug1("%s.Get('%s', '%s')", self._log_prefix, interface_name, property_name) if interface_name != config.dbus.DBUS_INTERFACE_CONFIG_SERVICE: raise dbus.exceptions.DBusException( "org.freedesktop.DBus.Error.UnknownInterface: " "Interface '%s' does not exist" % interface_name) return self._get_property(property_name) @dbus_service_method(dbus.PROPERTIES_IFACE, in_signature='s', out_signature='a{sv}') @dbus_handle_exceptions def GetAll(self, interface_name, sender=None): # pylint: disable=W0613 interface_name = dbus_to_python(interface_name, str) log.debug1("%s.GetAll('%s')", self._log_prefix, interface_name) if interface_name != config.dbus.DBUS_INTERFACE_CONFIG_SERVICE: raise dbus.exceptions.DBusException( "org.freedesktop.DBus.Error.UnknownInterface: " "Interface '%s' does not exist" % interface_name) ret = { } for x in [ "name", "filename", "path", "default", "builtin" ]: ret[x] = self._get_property(x) return dbus.Dictionary(ret, signature="sv") @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG) @dbus_service_method(dbus.PROPERTIES_IFACE, in_signature='ssv') @dbus_handle_exceptions def Set(self, interface_name, property_name, new_value, sender=None): interface_name = dbus_to_python(interface_name, str) property_name = dbus_to_python(property_name, str) new_value = dbus_to_python(new_value) log.debug1("%s.Set('%s', '%s', '%s')", self._log_prefix, interface_name, property_name, new_value) self.parent.accessCheck(sender) if interface_name != config.dbus.DBUS_INTERFACE_CONFIG_SERVICE: raise dbus.exceptions.DBusException( "org.freedesktop.DBus.Error.UnknownInterface: " "Interface '%s' does not exist" % interface_name) raise dbus.exceptions.DBusException( "org.freedesktop.DBus.Error.PropertyReadOnly: " "Property '%s' is read-only" % property_name) @dbus.service.signal(dbus.PROPERTIES_IFACE, signature='sa{sv}as') def PropertiesChanged(self, interface_name, changed_properties, invalidated_properties): interface_name = dbus_to_python(interface_name, str) changed_properties = dbus_to_python(changed_properties) invalidated_properties = dbus_to_python(invalidated_properties) log.debug1("%s.PropertiesChanged('%s', '%s', '%s')", self._log_prefix, interface_name, changed_properties, invalidated_properties) @dbus_polkit_require_auth(config.dbus.PK_ACTION_INFO) @dbus_service_method(dbus.INTROSPECTABLE_IFACE, out_signature='s') @dbus_handle_exceptions def Introspect(self, sender=None): # pylint: disable=W0613 log.debug2("%s.Introspect()", self._log_prefix) data = super(FirewallDConfigService, self).Introspect( self.path, self.busname.get_bus()) return dbus_introspection_add_properties( self, data, config.dbus.DBUS_INTERFACE_CONFIG_SERVICE) # S E T T I N G S @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE, out_signature='(sssa(ss)asa{ss}asa(ss))') @dbus_handle_exceptions def getSettings(self, sender=None): # pylint: disable=W0613 """get settings for service """ log.debug1("%s.getSettings()", self._log_prefix) return self.config.get_service_config(self.obj) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE, out_signature='a{sv}') @dbus_handle_exceptions def getSettings2(self, sender=None): """get settings for service """ log.debug1("%s.getSettings2()", self._log_prefix) return self.config.get_service_config_dict(self.obj) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE, in_signature='(sssa(ss)asa{ss}asa(ss))') @dbus_handle_exceptions def update(self, settings, sender=None): """update settings for service """ settings = dbus_to_python(settings) log.debug1("%s.update('...')", self._log_prefix) self.parent.accessCheck(sender) self.obj = self.config.set_service_config(self.obj, settings) self.Updated(self.obj.name) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE, in_signature='a{sv}') @dbus_handle_exceptions def update2(self, settings, sender=None): settings = dbus_to_python(settings) log.debug1("%s.update2('...')", self._log_prefix) self.parent.accessCheck(sender) self.obj = self.config.set_service_config_dict(self.obj, settings) self.Updated(self.obj.name) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE) @dbus_handle_exceptions def loadDefaults(self, sender=None): """load default settings for builtin service """ log.debug1("%s.loadDefaults()", self._log_prefix) self.parent.accessCheck(sender) self.obj = self.config.load_service_defaults(self.obj) self.Updated(self.obj.name) @dbus.service.signal(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE, signature='s') @dbus_handle_exceptions def Updated(self, name): log.debug1("%s.Updated('%s')" % (self._log_prefix, name)) # R E M O V E @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE) @dbus_handle_exceptions def remove(self, sender=None): """remove service """ log.debug1("%s.removeService()", self._log_prefix) self.parent.accessCheck(sender) self.config.remove_service(self.obj) self.parent.removeService(self.obj) @dbus.service.signal(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE, signature='s') @dbus_handle_exceptions def Removed(self, name): log.debug1("%s.Removed('%s')" % (self._log_prefix, name)) # R E N A M E @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE, in_signature='s') @dbus_handle_exceptions def rename(self, name, sender=None): """rename service """ name = dbus_to_python(name, str) log.debug1("%s.rename('%s')", self._log_prefix, name) self.parent.accessCheck(sender) self.obj = self.config.rename_service(self.obj, name) self.Renamed(name) @dbus.service.signal(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE, signature='s') @dbus_handle_exceptions def Renamed(self, name): log.debug1("%s.Renamed('%s')" % (self._log_prefix, name)) # version @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE, out_signature='s') @dbus_handle_exceptions def getVersion(self, sender=None): # pylint: disable=W0613 log.debug1("%s.getVersion()", self._log_prefix) return self.getSettings()[0] @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE, in_signature='s') @dbus_handle_exceptions def setVersion(self, version, sender=None): version = dbus_to_python(version, str) log.debug1("%s.setVersion('%s')", self._log_prefix, version) self.parent.accessCheck(sender) settings = list(self.getSettings()) settings[0] = version self.update(settings) # short @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE, out_signature='s') @dbus_handle_exceptions def getShort(self, sender=None): # pylint: disable=W0613 log.debug1("%s.getShort()", self._log_prefix) return self.getSettings()[1] @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE, in_signature='s') @dbus_handle_exceptions def setShort(self, short, sender=None): short = dbus_to_python(short, str) log.debug1("%s.setShort('%s')", self._log_prefix, short) self.parent.accessCheck(sender) settings = list(self.getSettings()) settings[1] = short self.update(settings) # description @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE, out_signature='s') @dbus_handle_exceptions def getDescription(self, sender=None): # pylint: disable=W0613 log.debug1("%s.getDescription()", self._log_prefix) return self.getSettings()[2] @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE, in_signature='s') @dbus_handle_exceptions def setDescription(self, description, sender=None): description = dbus_to_python(description, str) log.debug1("%s.setDescription('%s')", self._log_prefix, description) self.parent.accessCheck(sender) settings = list(self.getSettings()) settings[2] = description self.update(settings) # port @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE, out_signature='a(ss)') @dbus_handle_exceptions def getPorts(self, sender=None): # pylint: disable=W0613 log.debug1("%s.getPorts()", self._log_prefix) return self.getSettings()[3] @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE, in_signature='a(ss)') @dbus_handle_exceptions def setPorts(self, ports, sender=None): _ports = [ ] # convert embedded lists to tuples for port in dbus_to_python(ports, list): if isinstance(port, list): _ports.append(tuple(port)) else: _ports.append(port) ports = _ports log.debug1("%s.setPorts('[%s]')", self._log_prefix, ",".join("('%s, '%s')" % (port[0], port[1]) for port in ports)) self.parent.accessCheck(sender) settings = list(self.getSettings()) settings[3] = ports self.update(settings) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE, in_signature='ss') @dbus_handle_exceptions def addPort(self, port, protocol, sender=None): port = dbus_to_python(port, str) protocol = dbus_to_python(protocol, str) log.debug1("%s.addPort('%s', '%s')", self._log_prefix, port, protocol) self.parent.accessCheck(sender) settings = list(self.getSettings()) if (port,protocol) in settings[3]: raise FirewallError(errors.ALREADY_ENABLED, "%s:%s" % (port, protocol)) settings[3].append((port,protocol)) self.update(settings) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE, in_signature='ss') @dbus_handle_exceptions def removePort(self, port, protocol, sender=None): port = dbus_to_python(port, str) protocol = dbus_to_python(protocol, str) log.debug1("%s.removePort('%s', '%s')", self._log_prefix, port, protocol) self.parent.accessCheck(sender) settings = list(self.getSettings()) if (port,protocol) not in settings[3]: raise FirewallError(errors.NOT_ENABLED, "%s:%s" % (port, protocol)) settings[3].remove((port,protocol)) self.update(settings) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE, in_signature='ss', out_signature='b') @dbus_handle_exceptions def queryPort(self, port, protocol, sender=None): # pylint: disable=W0613 port = dbus_to_python(port, str) protocol = dbus_to_python(protocol, str) log.debug1("%s.queryPort('%s', '%s')", self._log_prefix, port, protocol) return (port,protocol) in self.getSettings()[3] # protocol @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE, out_signature='as') @dbus_handle_exceptions def getProtocols(self, sender=None): # pylint: disable=W0613 log.debug1("%s.getProtocols()", self._log_prefix) return self.getSettings()[6] @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE, in_signature='as') @dbus_handle_exceptions def setProtocols(self, protocols, sender=None): protocols = dbus_to_python(protocols, list) log.debug1("%s.setProtocols('[%s]')", self._log_prefix, ",".join(protocols)) self.parent.accessCheck(sender) settings = list(self.getSettings()) settings[6] = protocols self.update(settings) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE, in_signature='s') @dbus_handle_exceptions def addProtocol(self, protocol, sender=None): protocol = dbus_to_python(protocol, str) log.debug1("%s.addProtocol('%s')", self._log_prefix, protocol) self.parent.accessCheck(sender) settings = list(self.getSettings()) if protocol in settings[6]: raise FirewallError(errors.ALREADY_ENABLED, protocol) settings[6].append(protocol) self.update(settings) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE, in_signature='s') @dbus_handle_exceptions def removeProtocol(self, protocol, sender=None): protocol = dbus_to_python(protocol, str) log.debug1("%s.removeProtocol('%s')", self._log_prefix, protocol) self.parent.accessCheck(sender) settings = list(self.getSettings()) if protocol not in settings[6]: raise FirewallError(errors.NOT_ENABLED, protocol) settings[6].remove(protocol) self.update(settings) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE, in_signature='s', out_signature='b') @dbus_handle_exceptions def queryProtocol(self, protocol, sender=None): # pylint: disable=W0613 protocol = dbus_to_python(protocol, str) log.debug1("%s.queryProtocol(%s')", self._log_prefix, protocol) return protocol in self.getSettings()[6] # source port @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE, out_signature='a(ss)') @dbus_handle_exceptions def getSourcePorts(self, sender=None): # pylint: disable=W0613 log.debug1("%s.getSourcePorts()", self._log_prefix) return self.getSettings()[7] @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE, in_signature='a(ss)') @dbus_handle_exceptions def setSourcePorts(self, ports, sender=None): _ports = [ ] # convert embedded lists to tuples for port in dbus_to_python(ports, list): if isinstance(port, list): _ports.append(tuple(port)) else: _ports.append(port) ports = _ports log.debug1("%s.setSourcePorts('[%s]')", self._log_prefix, ",".join("('%s, '%s')" % (port[0], port[1]) for port in ports)) self.parent.accessCheck(sender) settings = list(self.getSettings()) settings[7] = ports self.update(settings) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE, in_signature='ss') @dbus_handle_exceptions def addSourcePort(self, port, protocol, sender=None): port = dbus_to_python(port, str) protocol = dbus_to_python(protocol, str) log.debug1("%s.addSourcePort('%s', '%s')", self._log_prefix, port, protocol) self.parent.accessCheck(sender) settings = list(self.getSettings()) if (port,protocol) in settings[7]: raise FirewallError(errors.ALREADY_ENABLED, "%s:%s" % (port, protocol)) settings[7].append((port,protocol)) self.update(settings) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE, in_signature='ss') @dbus_handle_exceptions def removeSourcePort(self, port, protocol, sender=None): port = dbus_to_python(port, str) protocol = dbus_to_python(protocol, str) log.debug1("%s.removeSourcePort('%s', '%s')", self._log_prefix, port, protocol) self.parent.accessCheck(sender) settings = list(self.getSettings()) if (port,protocol) not in settings[7]: raise FirewallError(errors.NOT_ENABLED, "%s:%s" % (port, protocol)) settings[7].remove((port,protocol)) self.update(settings) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE, in_signature='ss', out_signature='b') @dbus_handle_exceptions def querySourcePort(self, port, protocol, sender=None): # pylint: disable=W0613 port = dbus_to_python(port, str) protocol = dbus_to_python(protocol, str) log.debug1("%s.querySourcePort('%s', '%s')", self._log_prefix, port, protocol) return (port,protocol) in self.getSettings()[7] # module @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE, out_signature='as') @dbus_handle_exceptions def getModules(self, sender=None): # pylint: disable=W0613 log.debug1("%s.getModules()", self._log_prefix) return self.getSettings()[4] @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE, in_signature='as') @dbus_handle_exceptions def setModules(self, modules, sender=None): modules = dbus_to_python(modules, list) _modules = [ ] for module in modules: if module.startswith("nf_conntrack_"): module = module.replace("nf_conntrack_", "") if "_" in module: module = module.replace("_", "-") _modules.append(module) modules = _modules log.debug1("%s.setModules('[%s]')", self._log_prefix, ",".join(modules)) self.parent.accessCheck(sender) settings = list(self.getSettings()) settings[4] = modules self.update(settings) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE, in_signature='s') @dbus_handle_exceptions def addModule(self, module, sender=None): module = dbus_to_python(module, str) if module.startswith("nf_conntrack_"): module = module.replace("nf_conntrack_", "") if "_" in module: module = module.replace("_", "-") log.debug1("%s.addModule('%s')", self._log_prefix, module) self.parent.accessCheck(sender) settings = list(self.getSettings()) if module in settings[4]: raise FirewallError(errors.ALREADY_ENABLED, module) settings[4].append(module) self.update(settings) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE, in_signature='s') @dbus_handle_exceptions def removeModule(self, module, sender=None): module = dbus_to_python(module, str) if module.startswith("nf_conntrack_"): module = module.replace("nf_conntrack_", "") if "_" in module: module = module.replace("_", "-") log.debug1("%s.removeModule('%s')", self._log_prefix, module) self.parent.accessCheck(sender) settings = list(self.getSettings()) if module not in settings[4]: raise FirewallError(errors.NOT_ENABLED, module) settings[4].remove(module) self.update(settings) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE, in_signature='s', out_signature='b') @dbus_handle_exceptions def queryModule(self, module, sender=None): # pylint: disable=W0613 module = dbus_to_python(module, str) if module.startswith("nf_conntrack_"): module = module.replace("nf_conntrack_", "") if "_" in module: module = module.replace("_", "-") log.debug1("%s.queryModule('%s')", self._log_prefix, module) return module in self.getSettings()[4] # destination @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE, out_signature='a{ss}') @dbus_handle_exceptions def getDestinations(self, sender=None): # pylint: disable=W0613 log.debug1("%s.getDestinations()", self._log_prefix) return self.getSettings()[5] @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE, in_signature='a{ss}') @dbus_handle_exceptions def setDestinations(self, destinations, sender=None): destinations = dbus_to_python(destinations, dict) log.debug1("%s.setDestinations({ipv4:'%s', ipv6:'%s'})", self._log_prefix, destinations.get('ipv4'), destinations.get('ipv6')) self.parent.accessCheck(sender) settings = list(self.getSettings()) settings[5] = destinations self.update(settings) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE, in_signature='s', out_signature='s') @dbus_handle_exceptions def getDestination(self, family, sender=None): family = dbus_to_python(family, str) log.debug1("%s.getDestination('%s')", self._log_prefix, family) self.parent.accessCheck(sender) settings = list(self.getSettings()) if family not in settings[5]: raise FirewallError(errors.NOT_ENABLED, family) return settings[5][family] @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE, in_signature='ss') @dbus_handle_exceptions def setDestination(self, family, address, sender=None): family = dbus_to_python(family, str) address = dbus_to_python(address, str) log.debug1("%s.setDestination('%s', '%s')", self._log_prefix, family, address) self.parent.accessCheck(sender) settings = list(self.getSettings()) if family in settings[5] and settings[5][family] == address: raise FirewallError(errors.ALREADY_ENABLED, "'%s': '%s'" % (family, address)) settings[5][family] = address self.update(settings) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE, in_signature='s') @dbus_handle_exceptions def removeDestination(self, family, sender=None): family = dbus_to_python(family, str) log.debug1("%s.removeDestination('%s')", self._log_prefix, family) self.parent.accessCheck(sender) settings = list(self.getSettings()) if family not in settings[5]: raise FirewallError(errors.NOT_ENABLED, family) del settings[5][family] self.update(settings) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE, in_signature='ss', out_signature='b') @dbus_handle_exceptions def queryDestination(self, family, address, sender=None): # pylint: disable=W0613 family = dbus_to_python(family, str) address = dbus_to_python(address, str) log.debug1("%s.queryDestination('%s', '%s')", self._log_prefix, family, address) settings = self.getSettings() return (family in settings[5] and address == settings[5][family]) # includes @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE, out_signature='as') @dbus_handle_exceptions def getIncludes(self, sender=None): log.debug1("%s.getIncludes()", self._log_prefix) self.parent.accessCheck(sender) settings = self.config.get_service_config_dict(self.obj) return settings["includes"] if "includes" in settings else [] @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE, in_signature='as') @dbus_handle_exceptions def setIncludes(self, includes, sender=None): includes = dbus_to_python(includes, list) log.debug1("%s.setIncludes('%s')", self._log_prefix, includes) self.parent.accessCheck(sender) settings = {"includes": includes[:]} self.obj = self.config.set_service_config_dict(self.obj, settings) self.Updated(self.obj.name) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE, in_signature='s') @dbus_handle_exceptions def addInclude(self, include, sender=None): include = dbus_to_python(include, str) log.debug1("%s.addInclude('%s')", self._log_prefix, include) self.parent.accessCheck(sender) settings = self.config.get_service_config_dict(self.obj) settings.setdefault("includes", []).append(include) self.obj = self.config.set_service_config_dict(self.obj, settings) self.Updated(self.obj.name) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE, in_signature='s') @dbus_handle_exceptions def removeInclude(self, include, sender=None): include = dbus_to_python(include, str) log.debug1("%s.removeInclude('%s')", self._log_prefix, include) self.parent.accessCheck(sender) settings = self.config.get_service_config_dict(self.obj) settings["includes"].remove(include) self.obj = self.config.set_service_config_dict(self.obj, settings) self.Updated(self.obj.name) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE, in_signature='s', out_signature='b') @dbus_handle_exceptions def queryInclude(self, include, sender=None): include = dbus_to_python(include, str) log.debug1("%s.queryInclude('%s')", self._log_prefix, include) settings = self.config.get_service_config_dict(self.obj) return include in settings["includes"] if "includes" in settings else False PK ���Z��I�� � server/dbus.pynu �[��� # -*- coding: utf-8 -*- # # SPDX-License-Identifier: GPL-2.0-or-later import dbus from firewall import config class FirewallDBusException(dbus.DBusException): """FirewallDBusException""" _dbus_error_name = "%s.Exception" % config.dbus.DBUS_INTERFACE class NotAuthorizedException(dbus.DBusException): def __init__(self, action_id, method, *args, **kwargs): self._dbus_error_name = config.dbus.DBUS_INTERFACE + ".NotAuthorizedException" super().__init__("Not Authorized({}): {}".format(method, action_id)) class DbusServiceObject(dbus.service.Object): def __new__(cls, *args, **kwargs): # Check each dbus method. If it does not have an explicit polkit auth # then implicitly wrap it with the default from firewall.server.decorators import dbus_polkit_require_auth for attr_name in dir(cls): method = getattr(cls, attr_name) if hasattr(method, "_dbus_is_method") and \ not hasattr(method, "_polkit_auth_required"): _decorator = dbus_polkit_require_auth(cls.default_polkit_auth_required) setattr(cls, attr_name, _decorator(method)) return super().__new__(cls) PK ���Zxki�� �� server/config_zone.pynu �[��� # -*- coding: utf-8 -*- # # Copyright (C) 2010-2016 Red Hat, Inc. # # Authors: # Thomas Woerner <twoerner@redhat.com> # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see <http://www.gnu.org/licenses/>. import dbus import dbus.service from firewall import config from firewall.dbus_utils import dbus_to_python, \ dbus_introspection_prepare_properties, \ dbus_introspection_add_properties from firewall.core.io.zone import Zone from firewall.core.fw_ifcfg import ifcfg_set_zone_of_interface from firewall.core.base import DEFAULT_ZONE_TARGET from firewall.core.rich import Rich_Rule from firewall.core.logger import log from firewall.server.dbus import DbusServiceObject from firewall.server.decorators import handle_exceptions, \ dbus_handle_exceptions, dbus_service_method, \ dbus_polkit_require_auth from firewall import errors from firewall.errors import FirewallError from firewall.functions import portStr, portInPortRange, coalescePortRange, \ breakPortRange ############################################################################ # # class FirewallDConfig # ############################################################################ class FirewallDConfigZone(DbusServiceObject): """FirewallD main class""" persistent = True """ Make FirewallD persistent. """ default_polkit_auth_required = config.dbus.PK_ACTION_CONFIG """ Use PK_ACTION_INFO as a default """ @handle_exceptions def __init__(self, parent, conf, zone, item_id, *args, **kwargs): super(FirewallDConfigZone, self).__init__(*args, **kwargs) self.parent = parent self.config = conf self.obj = zone self.item_id = item_id self.busname = args[0] self.path = args[1] self._log_prefix = "config.zone.%d" % self.item_id dbus_introspection_prepare_properties( self, config.dbus.DBUS_INTERFACE_CONFIG_ZONE) @dbus_handle_exceptions def __del__(self): pass @dbus_handle_exceptions def unregister(self): self.remove_from_connection() # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # P R O P E R T I E S @dbus_handle_exceptions def _get_property(self, property_name): if property_name == "name": return dbus.String(self.obj.name) elif property_name == "filename": return dbus.String(self.obj.filename) elif property_name == "path": return dbus.String(self.obj.path) elif property_name == "default": return dbus.Boolean(self.obj.default) elif property_name == "builtin": return dbus.Boolean(self.obj.builtin) else: raise dbus.exceptions.DBusException( "org.freedesktop.DBus.Error.InvalidArgs: " "Property '%s' does not exist" % property_name) @dbus_service_method(dbus.PROPERTIES_IFACE, in_signature='ss', out_signature='v') @dbus_handle_exceptions def Get(self, interface_name, property_name, sender=None): # pylint: disable=W0613 # get a property interface_name = dbus_to_python(interface_name, str) property_name = dbus_to_python(property_name, str) log.debug1("%s.Get('%s', '%s')", self._log_prefix, interface_name, property_name) if interface_name != config.dbus.DBUS_INTERFACE_CONFIG_ZONE: raise dbus.exceptions.DBusException( "org.freedesktop.DBus.Error.UnknownInterface: " "Interface '%s' does not exist" % interface_name) return self._get_property(property_name) @dbus_service_method(dbus.PROPERTIES_IFACE, in_signature='s', out_signature='a{sv}') @dbus_handle_exceptions def GetAll(self, interface_name, sender=None): # pylint: disable=W0613 interface_name = dbus_to_python(interface_name, str) log.debug1("%s.GetAll('%s')", self._log_prefix, interface_name) if interface_name != config.dbus.DBUS_INTERFACE_CONFIG_ZONE: raise dbus.exceptions.DBusException( "org.freedesktop.DBus.Error.UnknownInterface: " "Interface '%s' does not exist" % interface_name) ret = { } for x in [ "name", "filename", "path", "default", "builtin" ]: ret[x] = self._get_property(x) return dbus.Dictionary(ret, signature="sv") @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG) @dbus_service_method(dbus.PROPERTIES_IFACE, in_signature='ssv') @dbus_handle_exceptions def Set(self, interface_name, property_name, new_value, sender=None): interface_name = dbus_to_python(interface_name, str) property_name = dbus_to_python(property_name, str) new_value = dbus_to_python(new_value) log.debug1("%s.Set('%s', '%s', '%s')", self._log_prefix, interface_name, property_name, new_value) self.parent.accessCheck(sender) if interface_name != config.dbus.DBUS_INTERFACE_CONFIG_ZONE: raise dbus.exceptions.DBusException( "org.freedesktop.DBus.Error.UnknownInterface: " "Interface '%s' does not exist" % interface_name) raise dbus.exceptions.DBusException( "org.freedesktop.DBus.Error.PropertyReadOnly: " "Property '%s' is read-only" % property_name) @dbus.service.signal(dbus.PROPERTIES_IFACE, signature='sa{sv}as') def PropertiesChanged(self, interface_name, changed_properties, invalidated_properties): interface_name = dbus_to_python(interface_name, str) changed_properties = dbus_to_python(changed_properties) invalidated_properties = dbus_to_python(invalidated_properties) log.debug1("%s.PropertiesChanged('%s', '%s', '%s')", self._log_prefix, interface_name, changed_properties, invalidated_properties) @dbus_polkit_require_auth(config.dbus.PK_ACTION_INFO) @dbus_service_method(dbus.INTROSPECTABLE_IFACE, out_signature='s') @dbus_handle_exceptions def Introspect(self, sender=None): # pylint: disable=W0613 log.debug2("%s.Introspect()", self._log_prefix) data = super(FirewallDConfigZone, self).Introspect( self.path, self.busname.get_bus()) return dbus_introspection_add_properties( self, data, config.dbus.DBUS_INTERFACE_CONFIG_ZONE) # S E T T I N G S @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE, out_signature="(sssbsasa(ss)asba(ssss)asasasasa(ss)b)") @dbus_handle_exceptions def getSettings(self, sender=None): # pylint: disable=W0613 """get settings for zone """ log.debug1("%s.getSettings()", self._log_prefix) settings = self.config.get_zone_config(self.obj) if settings[4] == DEFAULT_ZONE_TARGET: # convert to list, fix target, convert back to tuple _settings = list(settings) _settings[4] = "default" settings = tuple(_settings) return settings @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE, out_signature="a{sv}") @dbus_handle_exceptions def getSettings2(self, sender=None): """get settings for zone """ log.debug1("%s.getSettings2()", self._log_prefix) settings = self.config.get_zone_config_dict(self.obj) if settings["target"] == DEFAULT_ZONE_TARGET: settings["target"] = "default" return settings def _checkDuplicateInterfacesSources(self, settings): """Assignment of interfaces/sources to zones is different from other zone settings in the sense that particular interface/zone can be part of only one zone. So make sure added interfaces/sources have not already been bound to another zone.""" old_settings = self.config.get_zone_config_dict(self.obj) old_ifaces = set(old_settings["interfaces"]) if "interfaces" in old_settings else set() old_sources = set(old_settings["sources"]) if "sources" in old_settings else set() if isinstance(settings, tuple): added_ifaces = set(settings[Zone.index_of("interfaces")]) - old_ifaces added_sources = set(settings[Zone.index_of("sources")]) - old_sources else: # dict new_ifaces = set(settings["interfaces"]) if "interfaces" in settings else set() new_sources = set(settings["sources"]) if "sources" in settings else set() added_ifaces = new_ifaces - old_ifaces added_sources = new_sources - old_sources for iface in added_ifaces: if self.parent.getZoneOfInterface(iface): raise FirewallError(errors.ZONE_CONFLICT, iface) # or move to new zone ? for source in added_sources: if self.parent.getZoneOfSource(source): raise FirewallError(errors.ZONE_CONFLICT, source) # or move to new zone ? @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE, in_signature="(sssbsasa(ss)asba(ssss)asasasasa(ss)b)") @dbus_handle_exceptions def update(self, settings, sender=None): """update settings for zone """ settings = dbus_to_python(settings) log.debug1("%s.update('...')", self._log_prefix) self.parent.accessCheck(sender) if settings[4] == "default": # convert to list, fix target, convert back to tuple _settings = list(settings) _settings[4] = DEFAULT_ZONE_TARGET settings = tuple(_settings) self._checkDuplicateInterfacesSources(settings) self.obj = self.config.set_zone_config(self.obj, settings) self.Updated(self.obj.name) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE, in_signature="a{sv}") @dbus_handle_exceptions def update2(self, settings, sender=None): """update settings for zone """ settings = dbus_to_python(settings) log.debug1("%s.update2('...')", self._log_prefix) self.parent.accessCheck(sender) if "target" in settings and settings["target"] == "default": settings["target"] = DEFAULT_ZONE_TARGET self._checkDuplicateInterfacesSources(settings) self.obj = self.config.set_zone_config_dict(self.obj, settings) self.Updated(self.obj.name) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE) @dbus_handle_exceptions def loadDefaults(self, sender=None): """load default settings for builtin zone """ log.debug1("%s.loadDefaults()", self._log_prefix) self.parent.accessCheck(sender) self.obj = self.config.load_zone_defaults(self.obj) self.Updated(self.obj.name) @dbus.service.signal(config.dbus.DBUS_INTERFACE_CONFIG_ZONE, signature='s') @dbus_handle_exceptions def Updated(self, name): log.debug1("%s.Updated('%s')" % (self._log_prefix, name)) # R E M O V E @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE) @dbus_handle_exceptions def remove(self, sender=None): """remove zone """ log.debug1("%s.removeZone()", self._log_prefix) self.parent.accessCheck(sender) self.config.remove_zone(self.obj) self.parent.removeZone(self.obj) @dbus.service.signal(config.dbus.DBUS_INTERFACE_CONFIG_ZONE, signature='s') @dbus_handle_exceptions def Removed(self, name): log.debug1("%s.Removed('%s')" % (self._log_prefix, name)) # R E N A M E @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE, in_signature='s') @dbus_handle_exceptions def rename(self, name, sender=None): """rename zone """ name = dbus_to_python(name, str) log.debug1("%s.rename('%s')", self._log_prefix, name) self.parent.accessCheck(sender) self.obj = self.config.rename_zone(self.obj, name) self.Renamed(name) @dbus.service.signal(config.dbus.DBUS_INTERFACE_CONFIG_ZONE, signature='s') @dbus_handle_exceptions def Renamed(self, name): log.debug1("%s.Renamed('%s')" % (self._log_prefix, name)) # version @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE, out_signature='s') @dbus_handle_exceptions def getVersion(self, sender=None): # pylint: disable=W0613 log.debug1("%s.getVersion()", self._log_prefix) return self.getSettings()[0] @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE, in_signature='s') @dbus_handle_exceptions def setVersion(self, version, sender=None): version = dbus_to_python(version, str) log.debug1("%s.setVersion('%s')", self._log_prefix, version) self.parent.accessCheck(sender) settings = list(self.getSettings()) settings[0] = version self.update(settings) # short @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE, out_signature='s') @dbus_handle_exceptions def getShort(self, sender=None): # pylint: disable=W0613 log.debug1("%s.getShort()", self._log_prefix) return self.getSettings()[1] @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE, in_signature='s') @dbus_handle_exceptions def setShort(self, short, sender=None): short = dbus_to_python(short, str) log.debug1("%s.setShort('%s')", self._log_prefix, short) self.parent.accessCheck(sender) settings = list(self.getSettings()) settings[1] = short self.update(settings) # description @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE, out_signature='s') @dbus_handle_exceptions def getDescription(self, sender=None): # pylint: disable=W0613 log.debug1("%s.getDescription()", self._log_prefix) return self.getSettings()[2] @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE, in_signature='s') @dbus_handle_exceptions def setDescription(self, description, sender=None): description = dbus_to_python(description, str) log.debug1("%s.setDescription('%s')", self._log_prefix, description) self.parent.accessCheck(sender) settings = list(self.getSettings()) settings[2] = description self.update(settings) # immutable (deprecated) # settings[3] was used for 'immutable' # target @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE, out_signature='s') @dbus_handle_exceptions def getTarget(self, sender=None): # pylint: disable=W0613 log.debug1("%s.getTarget()", self._log_prefix) settings = self.getSettings() return settings[4] if settings[4] != DEFAULT_ZONE_TARGET else "default" @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE, in_signature='s') @dbus_handle_exceptions def setTarget(self, target, sender=None): target = dbus_to_python(target, str) log.debug1("%s.setTarget('%s')", self._log_prefix, target) self.parent.accessCheck(sender) settings = list(self.getSettings()) settings[4] = target if target != "default" else DEFAULT_ZONE_TARGET self.update(settings) # service @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE, out_signature='as') @dbus_handle_exceptions def getServices(self, sender=None): # pylint: disable=W0613 log.debug1("%s.getServices()", self._log_prefix) return self.getSettings()[5] @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE, in_signature='as') @dbus_handle_exceptions def setServices(self, services, sender=None): services = dbus_to_python(services, list) log.debug1("%s.setServices('[%s]')", self._log_prefix, ",".join(services)) self.parent.accessCheck(sender) settings = list(self.getSettings()) settings[5] = services self.update(settings) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE, in_signature='s') @dbus_handle_exceptions def addService(self, service, sender=None): service = dbus_to_python(service, str) log.debug1("%s.addService('%s')", self._log_prefix, service) self.parent.accessCheck(sender) settings = list(self.getSettings()) if service in settings[5]: raise FirewallError(errors.ALREADY_ENABLED, service) settings[5].append(service) self.update(settings) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE, in_signature='s') @dbus_handle_exceptions def removeService(self, service, sender=None): service = dbus_to_python(service, str) log.debug1("%s.removeService('%s')", self._log_prefix, service) self.parent.accessCheck(sender) settings = list(self.getSettings()) if service not in settings[5]: raise FirewallError(errors.NOT_ENABLED, service) settings[5].remove(service) self.update(settings) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE, in_signature='s', out_signature='b') @dbus_handle_exceptions def queryService(self, service, sender=None): # pylint: disable=W0613 service = dbus_to_python(service, str) log.debug1("%s.queryService('%s')", self._log_prefix, service) return service in self.getSettings()[5] # port @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE, out_signature='a(ss)') @dbus_handle_exceptions def getPorts(self, sender=None): # pylint: disable=W0613 log.debug1("%s.getPorts()", self._log_prefix) return self.getSettings()[6] @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE, in_signature='a(ss)') @dbus_handle_exceptions def setPorts(self, ports, sender=None): _ports = [ ] # convert embedded lists to tuples for port in dbus_to_python(ports, list): if isinstance(port, list): _ports.append(tuple(port)) else: _ports.append(port) ports = _ports log.debug1("%s.setPorts('[%s]')", self._log_prefix, ",".join("('%s, '%s')" % (port[0], port[1]) for port in ports)) self.parent.accessCheck(sender) settings = list(self.getSettings()) settings[6] = ports self.update(settings) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE, in_signature='ss') @dbus_handle_exceptions def addPort(self, port, protocol, sender=None): port = dbus_to_python(port, str) protocol = dbus_to_python(protocol, str) log.debug1("%s.addPort('%s', '%s')", self._log_prefix, port, protocol) self.parent.accessCheck(sender) settings = list(self.getSettings()) existing_port_ids = list(filter(lambda x: x[1] == protocol, settings[6])) for port_id in existing_port_ids: if portInPortRange(port, port_id[0]): raise FirewallError(errors.ALREADY_ENABLED, "%s:%s" % (port, protocol)) added_ranges, removed_ranges = coalescePortRange(port, [_port for (_port, _protocol) in existing_port_ids]) for range in removed_ranges: settings[6].remove((portStr(range, "-"), protocol)) for range in added_ranges: settings[6].append((portStr(range, "-"), protocol)) self.update(settings) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE, in_signature='ss') @dbus_handle_exceptions def removePort(self, port, protocol, sender=None): port = dbus_to_python(port, str) protocol = dbus_to_python(protocol, str) log.debug1("%s.removePort('%s', '%s')", self._log_prefix, port, protocol) self.parent.accessCheck(sender) settings = list(self.getSettings()) existing_port_ids = list(filter(lambda x: x[1] == protocol, settings[6])) for port_id in existing_port_ids: if portInPortRange(port, port_id[0]): break else: raise FirewallError(errors.NOT_ENABLED, "%s:%s" % (port, protocol)) added_ranges, removed_ranges = breakPortRange(port, [_port for (_port, _protocol) in existing_port_ids]) for range in removed_ranges: settings[6].remove((portStr(range, "-"), protocol)) for range in added_ranges: settings[6].append((portStr(range, "-"), protocol)) self.update(settings) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE, in_signature='ss', out_signature='b') @dbus_handle_exceptions def queryPort(self, port, protocol, sender=None): # pylint: disable=W0613 port = dbus_to_python(port, str) protocol = dbus_to_python(protocol, str) log.debug1("%s.queryPort('%s', '%s')", self._log_prefix, port, protocol) for (_port, _protocol) in self.getSettings()[6]: if portInPortRange(port, _port) and protocol == _protocol: return True return False # protocol @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE, out_signature='as') @dbus_handle_exceptions def getProtocols(self, sender=None): # pylint: disable=W0613 log.debug1("%s.getProtocols()", self._log_prefix) return self.getSettings()[13] @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE, in_signature='as') @dbus_handle_exceptions def setProtocols(self, protocols, sender=None): protocols = dbus_to_python(protocols, list) log.debug1("%s.setProtocols('[%s]')", self._log_prefix, ",".join(protocols)) self.parent.accessCheck(sender) settings = list(self.getSettings()) settings[13] = protocols self.update(settings) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE, in_signature='s') @dbus_handle_exceptions def addProtocol(self, protocol, sender=None): protocol = dbus_to_python(protocol, str) log.debug1("%s.addProtocol('%s')", self._log_prefix, protocol) self.parent.accessCheck(sender) settings = list(self.getSettings()) if protocol in settings[13]: raise FirewallError(errors.ALREADY_ENABLED, protocol) settings[13].append(protocol) self.update(settings) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE, in_signature='s') @dbus_handle_exceptions def removeProtocol(self, protocol, sender=None): protocol = dbus_to_python(protocol, str) log.debug1("%s.removeProtocol('%s')", self._log_prefix, protocol) self.parent.accessCheck(sender) settings = list(self.getSettings()) if protocol not in settings[13]: raise FirewallError(errors.NOT_ENABLED, protocol) settings[13].remove(protocol) self.update(settings) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE, in_signature='s', out_signature='b') @dbus_handle_exceptions def queryProtocol(self, protocol, sender=None): # pylint: disable=W0613 protocol = dbus_to_python(protocol, str) log.debug1("%s.queryProtocol('%s')", self._log_prefix, protocol) return protocol in self.getSettings()[13] # source port @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE, out_signature='a(ss)') @dbus_handle_exceptions def getSourcePorts(self, sender=None): # pylint: disable=W0613 log.debug1("%s.getSourcePorts()", self._log_prefix) return self.getSettings()[14] @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE, in_signature='a(ss)') @dbus_handle_exceptions def setSourcePorts(self, ports, sender=None): _ports = [ ] # convert embedded lists to tuples for port in dbus_to_python(ports, list): if isinstance(port, list): _ports.append(tuple(port)) else: _ports.append(port) ports = _ports log.debug1("%s.setSourcePorts('[%s]')", self._log_prefix, ",".join("('%s, '%s')" % (port[0], port[1]) for port in ports)) self.parent.accessCheck(sender) settings = list(self.getSettings()) settings[14] = ports self.update(settings) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE, in_signature='ss') @dbus_handle_exceptions def addSourcePort(self, port, protocol, sender=None): port = dbus_to_python(port, str) protocol = dbus_to_python(protocol, str) log.debug1("%s.addSourcePort('%s', '%s')", self._log_prefix, port, protocol) self.parent.accessCheck(sender) settings = list(self.getSettings()) existing_port_ids = list(filter(lambda x: x[1] == protocol, settings[14])) for port_id in existing_port_ids: if portInPortRange(port, port_id[0]): raise FirewallError(errors.ALREADY_ENABLED, "%s:%s" % (port, protocol)) added_ranges, removed_ranges = coalescePortRange(port, [_port for (_port, _protocol) in existing_port_ids]) for range in removed_ranges: settings[14].remove((portStr(range, "-"), protocol)) for range in added_ranges: settings[14].append((portStr(range, "-"), protocol)) self.update(settings) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE, in_signature='ss') @dbus_handle_exceptions def removeSourcePort(self, port, protocol, sender=None): port = dbus_to_python(port, str) protocol = dbus_to_python(protocol, str) log.debug1("%s.removeSourcePort('%s', '%s')", self._log_prefix, port, protocol) self.parent.accessCheck(sender) settings = list(self.getSettings()) existing_port_ids = list(filter(lambda x: x[1] == protocol, settings[14])) for port_id in existing_port_ids: if portInPortRange(port, port_id[0]): break else: raise FirewallError(errors.NOT_ENABLED, "%s:%s" % (port, protocol)) added_ranges, removed_ranges = breakPortRange(port, [_port for (_port, _protocol) in existing_port_ids]) for range in removed_ranges: settings[14].remove((portStr(range, "-"), protocol)) for range in added_ranges: settings[14].append((portStr(range, "-"), protocol)) self.update(settings) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE, in_signature='ss', out_signature='b') @dbus_handle_exceptions def querySourcePort(self, port, protocol, sender=None): # pylint: disable=W0613 port = dbus_to_python(port, str) protocol = dbus_to_python(protocol, str) log.debug1("%s.querySourcePort('%s', '%s')", self._log_prefix, port, protocol) for (_port, _protocol) in self.getSettings()[14]: if portInPortRange(port, _port) and protocol == _protocol: return True return False # icmp block @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE, out_signature='as') @dbus_handle_exceptions def getIcmpBlocks(self, sender=None): # pylint: disable=W0613 log.debug1("%s.getIcmpBlocks()", self._log_prefix) return self.getSettings()[7] @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE, in_signature='as') @dbus_handle_exceptions def setIcmpBlocks(self, icmptypes, sender=None): icmptypes = dbus_to_python(icmptypes, list) log.debug1("%s.setIcmpBlocks('[%s]')", self._log_prefix, ",".join(icmptypes)) self.parent.accessCheck(sender) settings = list(self.getSettings()) settings[7] = icmptypes self.update(settings) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE, in_signature='s') @dbus_handle_exceptions def addIcmpBlock(self, icmptype, sender=None): icmptype = dbus_to_python(icmptype, str) log.debug1("%s.addIcmpBlock('%s')", self._log_prefix, icmptype) self.parent.accessCheck(sender) settings = list(self.getSettings()) if icmptype in settings[7]: raise FirewallError(errors.ALREADY_ENABLED, icmptype) settings[7].append(icmptype) self.update(settings) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE, in_signature='s') @dbus_handle_exceptions def removeIcmpBlock(self, icmptype, sender=None): icmptype = dbus_to_python(icmptype, str) log.debug1("%s.removeIcmpBlock('%s')", self._log_prefix, icmptype) self.parent.accessCheck(sender) settings = list(self.getSettings()) if icmptype not in settings[7]: raise FirewallError(errors.NOT_ENABLED, icmptype) settings[7].remove(icmptype) self.update(settings) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE, in_signature='s', out_signature='b') @dbus_handle_exceptions def queryIcmpBlock(self, icmptype, sender=None): # pylint: disable=W0613 icmptype = dbus_to_python(icmptype, str) log.debug1("%s.queryIcmpBlock('%s')", self._log_prefix, icmptype) return icmptype in self.getSettings()[7] # icmp block inversion @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE, out_signature='b') @dbus_handle_exceptions def getIcmpBlockInversion(self, sender=None): # pylint: disable=W0613 log.debug1("%s.getIcmpBlockInversion()", self._log_prefix) return self.getSettings()[15] @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE, in_signature='b') @dbus_handle_exceptions def setIcmpBlockInversion(self, flag, sender=None): flag = dbus_to_python(flag, bool) log.debug1("%s.setIcmpBlockInversion('%s')", self._log_prefix, flag) self.parent.accessCheck(sender) settings = list(self.getSettings()) settings[15] = flag self.update(settings) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE) @dbus_handle_exceptions def addIcmpBlockInversion(self, sender=None): log.debug1("%s.addIcmpBlockInversion()", self._log_prefix) self.parent.accessCheck(sender) settings = list(self.getSettings()) if settings[15]: raise FirewallError(errors.ALREADY_ENABLED, "icmp-block-inversion") settings[15] = True self.update(settings) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE) @dbus_handle_exceptions def removeIcmpBlockInversion(self, sender=None): log.debug1("%s.removeIcmpBlockInversion()", self._log_prefix) self.parent.accessCheck(sender) settings = list(self.getSettings()) if not settings[15]: raise FirewallError(errors.NOT_ENABLED, "icmp-block-inversion") settings[15] = False self.update(settings) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE, out_signature='b') @dbus_handle_exceptions def queryIcmpBlockInversion(self, sender=None): # pylint: disable=W0613 log.debug1("%s.queryIcmpBlockInversion()", self._log_prefix) return self.getSettings()[15] # masquerade @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE, out_signature='b') @dbus_handle_exceptions def getMasquerade(self, sender=None): # pylint: disable=W0613 log.debug1("%s.getMasquerade()", self._log_prefix) return self.getSettings()[8] @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE, in_signature='b') @dbus_handle_exceptions def setMasquerade(self, masquerade, sender=None): masquerade = dbus_to_python(masquerade, bool) log.debug1("%s.setMasquerade('%s')", self._log_prefix, masquerade) self.parent.accessCheck(sender) settings = list(self.getSettings()) settings[8] = masquerade self.update(settings) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE) @dbus_handle_exceptions def addMasquerade(self, sender=None): log.debug1("%s.addMasquerade()", self._log_prefix) self.parent.accessCheck(sender) settings = list(self.getSettings()) if settings[8]: raise FirewallError(errors.ALREADY_ENABLED, "masquerade") settings[8] = True self.update(settings) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE) @dbus_handle_exceptions def removeMasquerade(self, sender=None): log.debug1("%s.removeMasquerade()", self._log_prefix) self.parent.accessCheck(sender) settings = list(self.getSettings()) if not settings[8]: raise FirewallError(errors.NOT_ENABLED, "masquerade") settings[8] = False self.update(settings) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE, out_signature='b') @dbus_handle_exceptions def queryMasquerade(self, sender=None): # pylint: disable=W0613 log.debug1("%s.queryMasquerade()", self._log_prefix) return self.getSettings()[8] # forward port @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE, out_signature='a(ssss)') @dbus_handle_exceptions def getForwardPorts(self, sender=None): # pylint: disable=W0613 log.debug1("%s.getForwardPorts()", self._log_prefix) return self.getSettings()[9] @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE, in_signature='a(ssss)') @dbus_handle_exceptions def setForwardPorts(self, ports, sender=None): _ports = [ ] # convert embedded lists to tuples for port in dbus_to_python(ports, list): if isinstance(port, list): _ports.append(tuple(port)) else: _ports.append(port) ports = _ports log.debug1("%s.setForwardPorts('[%s]')", self._log_prefix, ",".join("('%s, '%s', '%s', '%s')" % (port[0], port[1], \ port[2], port[3]) for port in ports)) self.parent.accessCheck(sender) settings = list(self.getSettings()) settings[9] = ports self.update(settings) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE, in_signature='ssss') @dbus_handle_exceptions def addForwardPort(self, port, protocol, toport, toaddr, sender=None): # pylint: disable=R0913 port = dbus_to_python(port, str) protocol = dbus_to_python(protocol, str) toport = dbus_to_python(toport, str) toaddr = dbus_to_python(toaddr, str) log.debug1("%s.addForwardPort('%s', '%s', '%s', '%s')", self._log_prefix, port, protocol, toport, toaddr) self.parent.accessCheck(sender) fwp_id = (port, protocol, str(toport), str(toaddr)) settings = list(self.getSettings()) if fwp_id in settings[9]: raise FirewallError(errors.ALREADY_ENABLED, "%s:%s:%s:%s" % (port, protocol, toport, toaddr)) settings[9].append(fwp_id) self.update(settings) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE, in_signature='ssss') @dbus_handle_exceptions def removeForwardPort(self, port, protocol, toport, toaddr, sender=None): # pylint: disable=R0913 port = dbus_to_python(port, str) protocol = dbus_to_python(protocol, str) toport = dbus_to_python(toport, str) toaddr = dbus_to_python(toaddr, str) log.debug1("%s.removeForwardPort('%s', '%s', '%s', '%s')", self._log_prefix, port, protocol, toport, toaddr) self.parent.accessCheck(sender) fwp_id = (port, protocol, str(toport), str(toaddr)) settings = list(self.getSettings()) if fwp_id not in settings[9]: raise FirewallError(errors.NOT_ENABLED, "%s:%s:%s:%s" % (port, protocol, toport, toaddr)) settings[9].remove(fwp_id) self.update(settings) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE, in_signature='ssss', out_signature='b') @dbus_handle_exceptions def queryForwardPort(self, port, protocol, toport, toaddr, sender=None): # pylint: disable=W0613, R0913 port = dbus_to_python(port, str) protocol = dbus_to_python(protocol, str) toport = dbus_to_python(toport, str) toaddr = dbus_to_python(toaddr, str) log.debug1("%s.queryForwardPort('%s', '%s', '%s', '%s')", self._log_prefix, port, protocol, toport, toaddr) fwp_id = (port, protocol, str(toport), str(toaddr)) return fwp_id in self.getSettings()[9] # interface @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE, out_signature='as') @dbus_handle_exceptions def getInterfaces(self, sender=None): # pylint: disable=W0613 log.debug1("%s.getInterfaces()", self._log_prefix) return self.getSettings()[10] @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE, in_signature='as') @dbus_handle_exceptions def setInterfaces(self, interfaces, sender=None): interfaces = dbus_to_python(interfaces, list) log.debug1("%s.setInterfaces('[%s]')", self._log_prefix, ",".join(interfaces)) self.parent.accessCheck(sender) settings = list(self.getSettings()) settings[10] = interfaces self.update(settings) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE, in_signature='s') @dbus_handle_exceptions def addInterface(self, interface, sender=None): interface = dbus_to_python(interface, str) log.debug1("%s.addInterface('%s')", self._log_prefix, interface) self.parent.accessCheck(sender) settings = list(self.getSettings()) if interface in settings[10]: raise FirewallError(errors.ALREADY_ENABLED, interface) settings[10].append(interface) self.update(settings) ifcfg_set_zone_of_interface(self.obj.name, interface) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE, in_signature='s') @dbus_handle_exceptions def removeInterface(self, interface, sender=None): interface = dbus_to_python(interface, str) log.debug1("%s.removeInterface('%s')", self._log_prefix, interface) self.parent.accessCheck(sender) settings = list(self.getSettings()) if interface not in settings[10]: raise FirewallError(errors.NOT_ENABLED, interface) settings[10].remove(interface) self.update(settings) ifcfg_set_zone_of_interface("", interface) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE, in_signature='s', out_signature='b') @dbus_handle_exceptions def queryInterface(self, interface, sender=None): # pylint: disable=W0613 interface = dbus_to_python(interface, str) log.debug1("%s.queryInterface('%s')", self._log_prefix, interface) return interface in self.getSettings()[10] # source @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE, out_signature='as') @dbus_handle_exceptions def getSources(self, sender=None): # pylint: disable=W0613 log.debug1("%s.getSources()", self._log_prefix) return self.getSettings()[11] @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE, in_signature='as') @dbus_handle_exceptions def setSources(self, sources, sender=None): sources = dbus_to_python(sources, list) log.debug1("%s.setSources('[%s]')", self._log_prefix, ",".join(sources)) self.parent.accessCheck(sender) settings = list(self.getSettings()) settings[11] = sources self.update(settings) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE, in_signature='s') @dbus_handle_exceptions def addSource(self, source, sender=None): source = dbus_to_python(source, str) log.debug1("%s.addSource('%s')", self._log_prefix, source) self.parent.accessCheck(sender) settings = list(self.getSettings()) if source in settings[11]: raise FirewallError(errors.ALREADY_ENABLED, source) settings[11].append(source) self.update(settings) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE, in_signature='s') @dbus_handle_exceptions def removeSource(self, source, sender=None): source = dbus_to_python(source, str) log.debug1("%s.removeSource('%s')", self._log_prefix, source) self.parent.accessCheck(sender) settings = list(self.getSettings()) if source not in settings[11]: raise FirewallError(errors.NOT_ENABLED, source) settings[11].remove(source) self.update(settings) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE, in_signature='s', out_signature='b') @dbus_handle_exceptions def querySource(self, source, sender=None): # pylint: disable=W0613 source = dbus_to_python(source, str) log.debug1("%s.querySource('%s')", self._log_prefix, source) return source in self.getSettings()[11] # rich rule @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE, out_signature='as') @dbus_handle_exceptions def getRichRules(self, sender=None): # pylint: disable=W0613 log.debug1("%s.getRichRules()", self._log_prefix) return self.getSettings()[12] @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE, in_signature='as') @dbus_handle_exceptions def setRichRules(self, rules, sender=None): rules = dbus_to_python(rules, list) log.debug1("%s.setRichRules('[%s]')", self._log_prefix, ",".join(rules)) self.parent.accessCheck(sender) settings = list(self.getSettings()) rules = [ str(Rich_Rule(rule_str=r)) for r in rules ] settings[12] = rules self.update(settings) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE, in_signature='s') @dbus_handle_exceptions def addRichRule(self, rule, sender=None): rule = dbus_to_python(rule, str) log.debug1("%s.addRichRule('%s')", self._log_prefix, rule) self.parent.accessCheck(sender) settings = list(self.getSettings()) rule_str = str(Rich_Rule(rule_str=rule)) if rule_str in settings[12]: raise FirewallError(errors.ALREADY_ENABLED, rule) settings[12].append(rule_str) self.update(settings) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE, in_signature='s') @dbus_handle_exceptions def removeRichRule(self, rule, sender=None): rule = dbus_to_python(rule, str) log.debug1("%s.removeRichRule('%s')", self._log_prefix, rule) self.parent.accessCheck(sender) settings = list(self.getSettings()) rule_str = str(Rich_Rule(rule_str=rule)) if rule_str not in settings[12]: raise FirewallError(errors.NOT_ENABLED, rule) settings[12].remove(rule_str) self.update(settings) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_ZONE, in_signature='s', out_signature='b') @dbus_handle_exceptions def queryRichRule(self, rule, sender=None): # pylint: disable=W0613 rule = dbus_to_python(rule, str) log.debug1("%s.queryRichRule('%s')", self._log_prefix, rule) rule_str = str(Rich_Rule(rule_str=rule)) return rule_str in self.getSettings()[12] PK ���ZO0�" " server/config.pynu �[��� # -*- coding: utf-8 -*- # # Copyright (C) 2010-2016 Red Hat, Inc. # # Authors: # Thomas Woerner <twoerner@redhat.com> # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see <http://www.gnu.org/licenses/>. import os import dbus import dbus.service from firewall import config from firewall.core.base import DEFAULT_ZONE_TARGET from firewall.core.watcher import Watcher from firewall.core.logger import log from firewall.server.dbus import DbusServiceObject from firewall.server.decorators import handle_exceptions, \ dbus_handle_exceptions, dbus_service_method, \ dbus_service_method_deprecated, dbus_service_signal_deprecated, \ dbus_polkit_require_auth from firewall.server.config_icmptype import FirewallDConfigIcmpType from firewall.server.config_service import FirewallDConfigService from firewall.server.config_zone import FirewallDConfigZone from firewall.server.config_policy import FirewallDConfigPolicy from firewall.server.config_ipset import FirewallDConfigIPSet from firewall.server.config_helper import FirewallDConfigHelper from firewall.core.io.icmptype import IcmpType from firewall.core.io.ipset import IPSet from firewall.core.io.helper import Helper from firewall.core.io.lockdown_whitelist import LockdownWhitelist from firewall.core.io.direct import Direct from firewall.dbus_utils import dbus_to_python, \ command_of_sender, context_of_sender, uid_of_sender, user_of_uid, \ dbus_introspection_prepare_properties, \ dbus_introspection_add_properties, \ dbus_introspection_add_deprecated from firewall import errors from firewall.errors import FirewallError ############################################################################ # # class FirewallDConfig # ############################################################################ class FirewallDConfig(DbusServiceObject): """FirewallD main class""" persistent = True """ Make FirewallD persistent. """ default_polkit_auth_required = config.dbus.PK_ACTION_CONFIG """ Use config.dbus.PK_ACTION_INFO as a default """ @handle_exceptions def __init__(self, conf, *args, **kwargs): super(FirewallDConfig, self).__init__(*args, **kwargs) self.config = conf self.busname = args[0] self.path = args[1] self._init_vars() self.watcher = Watcher(self.watch_updater, 5) self.watcher.add_watch_dir(config.FIREWALLD_IPSETS) self.watcher.add_watch_dir(config.ETC_FIREWALLD_IPSETS) self.watcher.add_watch_dir(config.FIREWALLD_ICMPTYPES) self.watcher.add_watch_dir(config.ETC_FIREWALLD_ICMPTYPES) self.watcher.add_watch_dir(config.FIREWALLD_HELPERS) self.watcher.add_watch_dir(config.ETC_FIREWALLD_HELPERS) self.watcher.add_watch_dir(config.FIREWALLD_SERVICES) self.watcher.add_watch_dir(config.ETC_FIREWALLD_SERVICES) self.watcher.add_watch_dir(config.FIREWALLD_ZONES) self.watcher.add_watch_dir(config.ETC_FIREWALLD_ZONES) self.watcher.add_watch_dir(config.FIREWALLD_POLICIES) self.watcher.add_watch_dir(config.ETC_FIREWALLD_POLICIES) # Add watches for combined zone directories if os.path.exists(config.ETC_FIREWALLD_ZONES): for filename in sorted(os.listdir(config.ETC_FIREWALLD_ZONES)): path = "%s/%s" % (config.ETC_FIREWALLD_ZONES, filename) if os.path.isdir(path): self.watcher.add_watch_dir(path) self.watcher.add_watch_file(config.LOCKDOWN_WHITELIST) self.watcher.add_watch_file(config.FIREWALLD_DIRECT) self.watcher.add_watch_file(config.FIREWALLD_CONF) dbus_introspection_prepare_properties(self, config.dbus.DBUS_INTERFACE_CONFIG, { "CleanupOnExit": "readwrite", "CleanupModulesOnExit": "readwrite", "IPv6_rpfilter": "readwrite", "Lockdown": "readwrite", "MinimalMark": "readwrite", "IndividualCalls": "readwrite", "LogDenied": "readwrite", "AutomaticHelpers": "readwrite", "FirewallBackend": "readwrite", "FlushAllOnReload": "readwrite", "RFC3964_IPv4": "readwrite", "AllowZoneDrifting": "readwrite", }) @handle_exceptions def _init_vars(self): self.ipsets = [ ] self.ipset_idx = 0 self.icmptypes = [ ] self.icmptype_idx = 0 self.services = [ ] self.service_idx = 0 self.zones = [ ] self.zone_idx = 0 self.helpers = [ ] self.helper_idx = 0 self.policy_objects = [ ] self.policy_object_idx = 0 for ipset in self.config.get_ipsets(): self._addIPSet(self.config.get_ipset(ipset)) for icmptype in self.config.get_icmptypes(): self._addIcmpType(self.config.get_icmptype(icmptype)) for service in self.config.get_services(): self._addService(self.config.get_service(service)) for zone in self.config.get_zones(): self._addZone(self.config.get_zone(zone)) for helper in self.config.get_helpers(): self._addHelper(self.config.get_helper(helper)) for policy in self.config.get_policy_objects(): self._addPolicy(self.config.get_policy_object(policy)) @handle_exceptions def __del__(self): pass @handle_exceptions def reload(self): while len(self.ipsets) > 0: item = self.ipsets.pop() item.unregister() del item while len(self.icmptypes) > 0: item = self.icmptypes.pop() item.unregister() del item while len(self.services) > 0: item = self.services.pop() item.unregister() del item while len(self.zones) > 0: item = self.zones.pop() item.unregister() del item while len(self.helpers) > 0: item = self.helpers.pop() item.unregister() del item while len(self.policy_objects) > 0: item = self.policy_objects.pop() item.unregister() del item self._init_vars() @handle_exceptions def watch_updater(self, name): if name == config.FIREWALLD_CONF: old_props = self.GetAll(config.dbus.DBUS_INTERFACE_CONFIG) log.debug1("config: Reloading firewalld config file '%s'", config.FIREWALLD_CONF) try: self.config.update_firewalld_conf() except Exception as msg: log.error("Failed to load firewalld.conf file '%s': %s" % \ (name, msg)) return props = self.GetAll(config.dbus.DBUS_INTERFACE_CONFIG).copy() for key in list(props.keys()): if key in old_props and old_props[key] == props[key]: del props[key] if len(props) > 0: self.PropertiesChanged(config.dbus.DBUS_INTERFACE_CONFIG, props, []) return if (name.startswith(config.FIREWALLD_ICMPTYPES) or \ name.startswith(config.ETC_FIREWALLD_ICMPTYPES)) and \ name.endswith(".xml"): try: (what, obj) = self.config.update_icmptype_from_path(name) except Exception as msg: log.error("Failed to load icmptype file '%s': %s" % (name, msg)) return if what == "new": self._addIcmpType(obj) elif what == "remove": self.removeIcmpType(obj) elif what == "update": self._updateIcmpType(obj) elif (name.startswith(config.FIREWALLD_SERVICES) or \ name.startswith(config.ETC_FIREWALLD_SERVICES)) and \ name.endswith(".xml"): try: (what, obj) = self.config.update_service_from_path(name) except Exception as msg: log.error("Failed to load service file '%s': %s" % (name, msg)) return if what == "new": self._addService(obj) elif what == "remove": self.removeService(obj) elif what == "update": self._updateService(obj) elif name.startswith(config.FIREWALLD_ZONES) or \ name.startswith(config.ETC_FIREWALLD_ZONES): if name.endswith(".xml"): try: (what, obj) = self.config.update_zone_from_path(name) except Exception as msg: log.error("Failed to load zone file '%s': %s" % (name, msg)) return if what == "new": self._addZone(obj) elif what == "remove": self.removeZone(obj) elif what == "update": self._updateZone(obj) elif name.startswith(config.ETC_FIREWALLD_ZONES): # possible combined zone base directory _name = name.replace(config.ETC_FIREWALLD_ZONES, "").strip("/") if len(_name) < 1 or "/" in _name: # if there is a / in x, then it is a sub sub directory # ignore it return if os.path.isdir(name): if not self.watcher.has_watch(name): self.watcher.add_watch_dir(name) elif self.watcher.has_watch(name): self.watcher.remove_watch(name) elif (name.startswith(config.FIREWALLD_IPSETS) or \ name.startswith(config.ETC_FIREWALLD_IPSETS)) and \ name.endswith(".xml"): try: (what, obj) = self.config.update_ipset_from_path(name) except Exception as msg: log.error("Failed to load ipset file '%s': %s" % (name, msg)) return if what == "new": self._addIPSet(obj) elif what == "remove": self.removeIPSet(obj) elif what == "update": self._updateIPSet(obj) elif (name.startswith(config.FIREWALLD_HELPERS) or \ name.startswith(config.ETC_FIREWALLD_HELPERS)) and \ name.endswith(".xml"): try: (what, obj) = self.config.update_helper_from_path(name) except Exception as msg: log.error("Failed to load helper file '%s': %s" % (name, msg)) return if what == "new": self._addHelper(obj) elif what == "remove": self.removeHelper(obj) elif what == "update": self._updateHelper(obj) elif name == config.LOCKDOWN_WHITELIST: try: self.config.update_lockdown_whitelist() except Exception as msg: log.error("Failed to load lockdown whitelist file '%s': %s" % \ (name, msg)) return self.LockdownWhitelistUpdated() elif name == config.FIREWALLD_DIRECT: try: self.config.update_direct() except Exception as msg: log.error("Failed to load direct rules file '%s': %s" % (name, msg)) return self.Updated() elif (name.startswith(config.FIREWALLD_POLICIES) or \ name.startswith(config.ETC_FIREWALLD_POLICIES)) and \ name.endswith(".xml"): try: (what, obj) = self.config.update_policy_object_from_path(name) except Exception as msg: log.error("Failed to load policy file '%s': %s" % (name, msg)) return if what == "new": self._addPolicy(obj) elif what == "remove": self.removePolicy(obj) elif what == "update": self._updatePolicy(obj) @handle_exceptions def _addIcmpType(self, obj): # TODO: check for idx overflow config_icmptype = FirewallDConfigIcmpType( self, self.config, obj, self.icmptype_idx, self.busname, "%s/%d" % (config.dbus.DBUS_PATH_CONFIG_ICMPTYPE, self.icmptype_idx)) self.icmptypes.append(config_icmptype) self.icmptype_idx += 1 self.IcmpTypeAdded(obj.name) return config_icmptype @handle_exceptions def _updateIcmpType(self, obj): for icmptype in self.icmptypes: if icmptype.obj.name == obj.name and \ icmptype.obj.path == obj.path and \ icmptype.obj.filename == obj.filename: icmptype.obj = obj icmptype.Updated(obj.name) @handle_exceptions def removeIcmpType(self, obj): index = 7 # see IMPORT_EXPORT_STRUCTURE in class Zone(IO_Object) for zone in self.zones: settings = zone.getSettings() # if this IcmpType is used in a zone remove it from that zone first if obj.name in settings[index]: settings[index].remove(obj.name) zone.obj = self.config.set_zone_config(zone.obj, settings) zone.Updated(zone.obj.name) for policy in self.policy_objects: settings = policy.getSettings() # if this IcmpType is used in a policy remove it from that policy first if "icmp_blocks" in settings and obj.name in settings["icmp_blocks"]: settings["icmp_blocks"].remove(obj.name) policy.obj = self.config.set_policy_object_config_dict(policy.obj, settings) policy.Updated(policy.obj.name) for icmptype in self.icmptypes: if icmptype.obj == obj: icmptype.Removed(obj.name) icmptype.unregister() self.icmptypes.remove(icmptype) del icmptype @handle_exceptions def _addService(self, obj): # TODO: check for idx overflow config_service = FirewallDConfigService( self, self.config, obj, self.service_idx, self.busname, "%s/%d" % (config.dbus.DBUS_PATH_CONFIG_SERVICE, self.service_idx)) self.services.append(config_service) self.service_idx += 1 self.ServiceAdded(obj.name) return config_service @handle_exceptions def _updateService(self, obj): for service in self.services: if service.obj.name == obj.name and \ service.obj.path == obj.path and \ service.obj.filename == obj.filename: service.obj = obj service.Updated(obj.name) @handle_exceptions def removeService(self, obj): index = 5 # see IMPORT_EXPORT_STRUCTURE in class Zone(IO_Object) for zone in self.zones: settings = zone.getSettings() # if this Service is used in a zone remove it from that zone first if obj.name in settings[index]: settings[index].remove(obj.name) zone.obj = self.config.set_zone_config(zone.obj, settings) zone.Updated(zone.obj.name) for policy in self.policy_objects: settings = policy.getSettings() # if this Service is used in a policy remove it from that policy first if "services" in settings and obj.name in settings["services"]: settings["services"].remove(obj.name) policy.obj = self.config.set_policy_object_config_dict(policy.obj, settings) policy.Updated(policy.obj.name) for service in self.services: if service.obj == obj: service.Removed(obj.name) service.unregister() self.services.remove(service) del service @handle_exceptions def _addZone(self, obj): # TODO: check for idx overflow config_zone = FirewallDConfigZone( self, self.config, obj, self.zone_idx, self.busname, "%s/%d" % (config.dbus.DBUS_PATH_CONFIG_ZONE, self.zone_idx)) self.zones.append(config_zone) self.zone_idx += 1 self.ZoneAdded(obj.name) return config_zone @handle_exceptions def _updateZone(self, obj): for zone in self.zones: if zone.obj.name == obj.name and zone.obj.path == obj.path and \ zone.obj.filename == obj.filename: zone.obj = obj zone.Updated(obj.name) @handle_exceptions def removeZone(self, obj): for zone in self.zones: if zone.obj == obj: zone.Removed(obj.name) zone.unregister() self.zones.remove(zone) del zone @handle_exceptions def _addPolicy(self, obj): # TODO: check for idx overflow config_policy = FirewallDConfigPolicy( self, self.config, obj, self.policy_object_idx, self.busname, "%s/%d" % (config.dbus.DBUS_PATH_CONFIG_POLICY, self.policy_object_idx)) self.policy_objects.append(config_policy) self.policy_object_idx += 1 self.PolicyAdded(obj.name) return config_policy @handle_exceptions def _updatePolicy(self, obj): for policy in self.policy_objects: if policy.obj.name == obj.name and policy.obj.path == obj.path and \ policy.obj.filename == obj.filename: policy.obj = obj policy.Updated(obj.name) @handle_exceptions def removePolicy(self, obj): for policy in self.policy_objects: if policy.obj == obj: policy.Removed(obj.name) policy.unregister() self.policy_objects.remove(policy) del policy @handle_exceptions def _addIPSet(self, obj): # TODO: check for idx overflow config_ipset = FirewallDConfigIPSet( self, self.config, obj, self.ipset_idx, self.busname, "%s/%d" % (config.dbus.DBUS_PATH_CONFIG_IPSET, self.ipset_idx)) self.ipsets.append(config_ipset) self.ipset_idx += 1 self.IPSetAdded(obj.name) return config_ipset @handle_exceptions def _updateIPSet(self, obj): for ipset in self.ipsets: if ipset.obj.name == obj.name and ipset.obj.path == obj.path and \ ipset.obj.filename == obj.filename: ipset.obj = obj ipset.Updated(obj.name) @handle_exceptions def removeIPSet(self, obj): for ipset in self.ipsets: if ipset.obj == obj: ipset.Removed(obj.name) ipset.unregister() self.ipsets.remove(ipset) del ipset # access check @handle_exceptions def _addHelper(self, obj): # TODO: check for idx overflow config_helper = FirewallDConfigHelper( self, self.config, obj, self.helper_idx, self.busname, "%s/%d" % (config.dbus.DBUS_PATH_CONFIG_HELPER, self.helper_idx)) self.helpers.append(config_helper) self.helper_idx += 1 self.HelperAdded(obj.name) return config_helper @handle_exceptions def _updateHelper(self, obj): for helper in self.helpers: if helper.obj.name == obj.name and helper.obj.path == obj.path and \ helper.obj.filename == obj.filename: helper.obj = obj helper.Updated(obj.name) @handle_exceptions def removeHelper(self, obj): for helper in self.helpers: if helper.obj == obj: helper.Removed(obj.name) helper.unregister() self.helpers.remove(helper) del helper # access check @dbus_handle_exceptions def accessCheck(self, sender): if self.config.lockdown_enabled(): if sender is None: log.error("Lockdown not possible, sender not set.") return bus = dbus.SystemBus() context = context_of_sender(bus, sender) if self.config.access_check("context", context): return uid = uid_of_sender(bus, sender) if self.config.access_check("uid", uid): return user = user_of_uid(uid) if self.config.access_check("user", user): return command = command_of_sender(bus, sender) if self.config.access_check("command", command): return raise FirewallError(errors.ACCESS_DENIED, "lockdown is enabled") # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # P R O P E R T I E S @dbus_handle_exceptions def _get_property(self, prop): if prop not in [ "DefaultZone", "MinimalMark", "CleanupOnExit", "CleanupModulesOnExit", "Lockdown", "IPv6_rpfilter", "IndividualCalls", "LogDenied", "AutomaticHelpers", "FirewallBackend", "FlushAllOnReload", "RFC3964_IPv4", "AllowZoneDrifting" ]: raise dbus.exceptions.DBusException( "org.freedesktop.DBus.Error.InvalidArgs: " "Property '%s' does not exist" % prop) value = self.config.get_firewalld_conf().get(prop) if prop == "DefaultZone": if value is None: value = config.FALLBACK_ZONE return dbus.String(value) elif prop == "MinimalMark": if value is None: value = config.FALLBACK_MINIMAL_MARK else: value = int(value) return dbus.Int32(value) elif prop == "CleanupOnExit": if value is None: value = "yes" if config.FALLBACK_CLEANUP_ON_EXIT else "no" return dbus.String(value) elif prop == "CleanupModulesOnExit": if value is None: value = "yes" if config.FALLBACK_CLEANUP_MODULES_ON_EXIT else "no" return dbus.String(value) elif prop == "Lockdown": if value is None: value = "yes" if config.FALLBACK_LOCKDOWN else "no" return dbus.String(value) elif prop == "IPv6_rpfilter": if value is None: value = "yes" if config.FALLBACK_IPV6_RPFILTER else "no" return dbus.String(value) elif prop == "IndividualCalls": if value is None: value = "yes" if config.FALLBACK_INDIVIDUAL_CALLS else "no" return dbus.String(value) elif prop == "LogDenied": if value is None: value = config.FALLBACK_LOG_DENIED return dbus.String(value) elif prop == "AutomaticHelpers": if value is None: value = config.FALLBACK_AUTOMATIC_HELPERS return dbus.String(value) elif prop == "FirewallBackend": if value is None: value = config.FALLBACK_FIREWALL_BACKEND return dbus.String(value) elif prop == "FlushAllOnReload": if value is None: value = "yes" if config.FALLBACK_FLUSH_ALL_ON_RELOAD else "no" return dbus.String(value) elif prop == "RFC3964_IPv4": if value is None: value = "yes" if config.FALLBACK_RFC3964_IPV4 else "no" return dbus.String(value) elif prop == "AllowZoneDrifting": if value is None: value = "yes" if config.FALLBACK_ALLOW_ZONE_DRIFTING else "no" return dbus.String(value) @dbus_handle_exceptions def _get_dbus_property(self, prop): if prop == "DefaultZone": return dbus.String(self._get_property(prop)) elif prop == "MinimalMark": return dbus.Int32(self._get_property(prop)) elif prop == "CleanupOnExit": return dbus.String(self._get_property(prop)) elif prop == "CleanupModulesOnExit": return dbus.String(self._get_property(prop)) elif prop == "Lockdown": return dbus.String(self._get_property(prop)) elif prop == "IPv6_rpfilter": return dbus.String(self._get_property(prop)) elif prop == "IndividualCalls": return dbus.String(self._get_property(prop)) elif prop == "LogDenied": return dbus.String(self._get_property(prop)) elif prop == "AutomaticHelpers": return dbus.String(self._get_property(prop)) elif prop == "FirewallBackend": return dbus.String(self._get_property(prop)) elif prop == "FlushAllOnReload": return dbus.String(self._get_property(prop)) elif prop == "RFC3964_IPv4": return dbus.String(self._get_property(prop)) elif prop == "AllowZoneDrifting": return dbus.String(self._get_property(prop)) else: raise dbus.exceptions.DBusException( "org.freedesktop.DBus.Error.InvalidArgs: " "Property '%s' does not exist" % prop) @dbus_service_method(dbus.PROPERTIES_IFACE, in_signature='ss', out_signature='v') @dbus_handle_exceptions def Get(self, interface_name, property_name, sender=None): # pylint: disable=W0613 # get a property interface_name = dbus_to_python(interface_name, str) property_name = dbus_to_python(property_name, str) log.debug1("config.Get('%s', '%s')", interface_name, property_name) if interface_name == config.dbus.DBUS_INTERFACE_CONFIG: return self._get_dbus_property(property_name) elif interface_name in [ config.dbus.DBUS_INTERFACE_CONFIG_DIRECT, config.dbus.DBUS_INTERFACE_CONFIG_POLICIES ]: raise dbus.exceptions.DBusException( "org.freedesktop.DBus.Error.InvalidArgs: " "Property '%s' does not exist" % property_name) else: raise dbus.exceptions.DBusException( "org.freedesktop.DBus.Error.UnknownInterface: " "Interface '%s' does not exist" % interface_name) @dbus_service_method(dbus.PROPERTIES_IFACE, in_signature='s', out_signature='a{sv}') @dbus_handle_exceptions def GetAll(self, interface_name, sender=None): # pylint: disable=W0613 interface_name = dbus_to_python(interface_name, str) log.debug1("config.GetAll('%s')", interface_name) ret = { } if interface_name == config.dbus.DBUS_INTERFACE_CONFIG: for x in [ "DefaultZone", "MinimalMark", "CleanupOnExit", "CleanupModulesOnExit", "Lockdown", "IPv6_rpfilter", "IndividualCalls", "LogDenied", "AutomaticHelpers", "FirewallBackend", "FlushAllOnReload", "RFC3964_IPv4", "AllowZoneDrifting" ]: ret[x] = self._get_property(x) elif interface_name in [ config.dbus.DBUS_INTERFACE_CONFIG_DIRECT, config.dbus.DBUS_INTERFACE_CONFIG_POLICIES ]: pass else: raise dbus.exceptions.DBusException( "org.freedesktop.DBus.Error.UnknownInterface: " "Interface '%s' does not exist" % interface_name) return dbus.Dictionary(ret, signature="sv") @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG) @dbus_service_method(dbus.PROPERTIES_IFACE, in_signature='ssv') @dbus_handle_exceptions def Set(self, interface_name, property_name, new_value, sender=None): interface_name = dbus_to_python(interface_name, str) property_name = dbus_to_python(property_name, str) new_value = dbus_to_python(new_value) log.debug1("config.Set('%s', '%s', '%s')", interface_name, property_name, new_value) self.accessCheck(sender) if interface_name == config.dbus.DBUS_INTERFACE_CONFIG: if property_name in [ "CleanupOnExit", "CleanupModulesOnExit", "Lockdown", "IPv6_rpfilter", "IndividualCalls", "LogDenied", "FirewallBackend", "FlushAllOnReload", "RFC3964_IPv4"]: if property_name in [ "CleanupOnExit", "CleanupModulesOnExit", "Lockdown", "IPv6_rpfilter", "IndividualCalls", "FlushAllOnReload", "RFC3964_IPv4"]: if new_value.lower() not in [ "yes", "no", "true", "false" ]: raise FirewallError(errors.INVALID_VALUE, "'%s' for %s" % \ (new_value, property_name)) elif property_name == "LogDenied": if new_value not in config.LOG_DENIED_VALUES: raise FirewallError(errors.INVALID_VALUE, "'%s' for %s" % \ (new_value, property_name)) elif property_name == "FirewallBackend": if new_value not in config.FIREWALL_BACKEND_VALUES: raise FirewallError(errors.INVALID_VALUE, "'%s' for %s" % \ (new_value, property_name)) else: raise dbus.exceptions.DBusException( "org.freedesktop.DBus.Error.InvalidArgs: " "Property '%s' does not exist" % property_name) self.config.get_firewalld_conf().set(property_name, new_value) self.config.get_firewalld_conf().write() self.PropertiesChanged(interface_name, { property_name: new_value }, [ ]) elif property_name in ["MinimalMark", "AutomaticHelpers", "AllowZoneDrifting"]: # deprecated fields. Ignore setting them. pass else: raise dbus.exceptions.DBusException( "org.freedesktop.DBus.Error.InvalidArgs: " "Property '%s' does not exist" % property_name) elif interface_name in [ config.dbus.DBUS_INTERFACE_CONFIG_DIRECT, config.dbus.DBUS_INTERFACE_CONFIG_POLICIES ]: raise dbus.exceptions.DBusException( "org.freedesktop.DBus.Error.InvalidArgs: " "Property '%s' does not exist" % property_name) else: raise dbus.exceptions.DBusException( "org.freedesktop.DBus.Error.UnknownInterface: " "Interface '%s' does not exist" % interface_name) @dbus.service.signal(dbus.PROPERTIES_IFACE, signature='sa{sv}as') def PropertiesChanged(self, interface_name, changed_properties, invalidated_properties): interface_name = dbus_to_python(interface_name, str) changed_properties = dbus_to_python(changed_properties) invalidated_properties = dbus_to_python(invalidated_properties) log.debug1("config.PropertiesChanged('%s', '%s', '%s')", interface_name, changed_properties, invalidated_properties) @dbus_polkit_require_auth(config.dbus.PK_ACTION_INFO) @dbus_service_method(dbus.INTROSPECTABLE_IFACE, out_signature='s') @dbus_handle_exceptions def Introspect(self, sender=None): # pylint: disable=W0613 log.debug2("config.Introspect()") data = super(FirewallDConfig, self).Introspect(self.path, self.busname.get_bus()) data = dbus_introspection_add_properties( self, data, config.dbus.DBUS_INTERFACE_CONFIG) for interface in [config.dbus.DBUS_INTERFACE_CONFIG_DIRECT]: data = dbus_introspection_add_deprecated( self, data, interface, dbus_service_method_deprecated().deprecated, dbus_service_signal_deprecated().deprecated) return data # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # policies @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_POLICIES, out_signature=LockdownWhitelist.DBUS_SIGNATURE) @dbus_handle_exceptions def getLockdownWhitelist(self, sender=None): # pylint: disable=W0613 log.debug1("config.policies.getLockdownWhitelist()") return self.config.get_policies().lockdown_whitelist.export_config() @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_POLICIES, in_signature=LockdownWhitelist.DBUS_SIGNATURE) @dbus_handle_exceptions def setLockdownWhitelist(self, settings, sender=None): # pylint: disable=W0613 log.debug1("config.policies.setLockdownWhitelist(...)") settings = dbus_to_python(settings) self.config.get_policies().lockdown_whitelist.import_config(settings, {}) self.config.get_policies().lockdown_whitelist.write() self.LockdownWhitelistUpdated() @dbus.service.signal(config.dbus.DBUS_INTERFACE_CONFIG_POLICIES) @dbus_handle_exceptions def LockdownWhitelistUpdated(self): log.debug1("config.policies.LockdownWhitelistUpdated()") # command @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_POLICIES, in_signature='s') @dbus_handle_exceptions def addLockdownWhitelistCommand(self, command, sender=None): command = dbus_to_python(command) log.debug1("config.policies.addLockdownWhitelistCommand('%s')", command) self.accessCheck(sender) settings = list(self.getLockdownWhitelist()) if command in settings[0]: raise FirewallError(errors.ALREADY_ENABLED, command) settings[0].append(command) self.setLockdownWhitelist(settings) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_POLICIES, in_signature='s') @dbus_handle_exceptions def removeLockdownWhitelistCommand(self, command, sender=None): command = dbus_to_python(command) log.debug1("config.policies.removeLockdownWhitelistCommand('%s')", command) self.accessCheck(sender) settings = list(self.getLockdownWhitelist()) if command not in settings[0]: raise FirewallError(errors.NOT_ENABLED, command) settings[0].remove(command) self.setLockdownWhitelist(settings) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_POLICIES, in_signature='s', out_signature='b') @dbus_handle_exceptions def queryLockdownWhitelistCommand(self, command, sender=None): # pylint: disable=W0613 command = dbus_to_python(command) log.debug1("config.policies.queryLockdownWhitelistCommand('%s')", command) return command in self.getLockdownWhitelist()[0] @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_POLICIES, out_signature='as') @dbus_handle_exceptions def getLockdownWhitelistCommands(self, sender=None): # pylint: disable=W0613 log.debug1("config.policies.getLockdownWhitelistCommands()") return self.getLockdownWhitelist()[0] # context @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_POLICIES, in_signature='s') @dbus_handle_exceptions def addLockdownWhitelistContext(self, context, sender=None): context = dbus_to_python(context) log.debug1("config.policies.addLockdownWhitelistContext('%s')", context) self.accessCheck(sender) settings = list(self.getLockdownWhitelist()) if context in settings[1]: raise FirewallError(errors.ALREADY_ENABLED, context) settings[1].append(context) self.setLockdownWhitelist(settings) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_POLICIES, in_signature='s') @dbus_handle_exceptions def removeLockdownWhitelistContext(self, context, sender=None): context = dbus_to_python(context) log.debug1("config.policies.removeLockdownWhitelistContext('%s')", context) self.accessCheck(sender) settings = list(self.getLockdownWhitelist()) if context not in settings[1]: raise FirewallError(errors.NOT_ENABLED, context) settings[1].remove(context) self.setLockdownWhitelist(settings) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_POLICIES, in_signature='s', out_signature='b') @dbus_handle_exceptions def queryLockdownWhitelistContext(self, context, sender=None): # pylint: disable=W0613 context = dbus_to_python(context) log.debug1("config.policies.queryLockdownWhitelistContext('%s')", context) return context in self.getLockdownWhitelist()[1] @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_POLICIES, out_signature='as') @dbus_handle_exceptions def getLockdownWhitelistContexts(self, sender=None): # pylint: disable=W0613 log.debug1("config.policies.getLockdownWhitelistContexts()") return self.getLockdownWhitelist()[1] # user @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_POLICIES, in_signature='s') @dbus_handle_exceptions def addLockdownWhitelistUser(self, user, sender=None): user = dbus_to_python(user) log.debug1("config.policies.addLockdownWhitelistUser('%s')", user) self.accessCheck(sender) settings = list(self.getLockdownWhitelist()) if user in settings[2]: raise FirewallError(errors.ALREADY_ENABLED, user) settings[2].append(user) self.setLockdownWhitelist(settings) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_POLICIES, in_signature='s') @dbus_handle_exceptions def removeLockdownWhitelistUser(self, user, sender=None): user = dbus_to_python(user) log.debug1("config.policies.removeLockdownWhitelistUser('%s')", user) self.accessCheck(sender) settings = list(self.getLockdownWhitelist()) if user not in settings[2]: raise FirewallError(errors.NOT_ENABLED, user) settings[2].remove(user) self.setLockdownWhitelist(settings) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_POLICIES, in_signature='s', out_signature='b') @dbus_handle_exceptions def queryLockdownWhitelistUser(self, user, sender=None): # pylint: disable=W0613 user = dbus_to_python(user) log.debug1("config.policies.queryLockdownWhitelistUser('%s')", user) return user in self.getLockdownWhitelist()[2] @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_POLICIES, out_signature='as') @dbus_handle_exceptions def getLockdownWhitelistUsers(self, sender=None): # pylint: disable=W0613 log.debug1("config.policies.getLockdownWhitelistUsers()") return self.getLockdownWhitelist()[2] # uid @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_POLICIES, in_signature='i') @dbus_handle_exceptions def addLockdownWhitelistUid(self, uid, sender=None): uid = dbus_to_python(uid) log.debug1("config.policies.addLockdownWhitelistUid(%d)", uid) self.accessCheck(sender) settings = list(self.getLockdownWhitelist()) if uid in settings[3]: raise FirewallError(errors.ALREADY_ENABLED, uid) settings[3].append(uid) self.setLockdownWhitelist(settings) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_POLICIES, in_signature='i') @dbus_handle_exceptions def removeLockdownWhitelistUid(self, uid, sender=None): uid = dbus_to_python(uid) log.debug1("config.policies.removeLockdownWhitelistUid(%d)", uid) self.accessCheck(sender) settings = list(self.getLockdownWhitelist()) if uid not in settings[3]: raise FirewallError(errors.NOT_ENABLED, uid) settings[3].remove(uid) self.setLockdownWhitelist(settings) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_POLICIES, in_signature='i', out_signature='b') @dbus_handle_exceptions def queryLockdownWhitelistUid(self, uid, sender=None): # pylint: disable=W0613 uid = dbus_to_python(uid) log.debug1("config.policies.queryLockdownWhitelistUid(%d)", uid) return uid in self.getLockdownWhitelist()[3] @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_POLICIES, out_signature='ai') @dbus_handle_exceptions def getLockdownWhitelistUids(self, sender=None): # pylint: disable=W0613 log.debug1("config.policies.getLockdownWhitelistUids()") return self.getLockdownWhitelist()[3] # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # I P S E T S @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG, out_signature='ao') @dbus_handle_exceptions def listIPSets(self, sender=None): # pylint: disable=W0613 """list ipsets objects paths """ log.debug1("config.listIPSets()") return self.ipsets @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG, out_signature='as') @dbus_handle_exceptions def getIPSetNames(self, sender=None): # pylint: disable=W0613 """get ipset names """ log.debug1("config.getIPSetNames()") ipsets = [ ] for obj in self.ipsets: ipsets.append(obj.obj.name) return sorted(ipsets) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG, in_signature='s', out_signature='o') @dbus_handle_exceptions def getIPSetByName(self, ipset, sender=None): # pylint: disable=W0613 """object path of ipset with given name """ ipset = dbus_to_python(ipset, str) log.debug1("config.getIPSetByName('%s')", ipset) for obj in self.ipsets: if obj.obj.name == ipset: return obj raise FirewallError(errors.INVALID_IPSET, ipset) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG, in_signature='s'+IPSet.DBUS_SIGNATURE, out_signature='o') @dbus_handle_exceptions def addIPSet(self, ipset, settings, sender=None): """add ipset with given name and settings """ ipset = dbus_to_python(ipset, str) settings = dbus_to_python(settings) log.debug1("config.addIPSet('%s')", ipset) self.accessCheck(sender) obj = self.config.new_ipset(ipset, settings) config_ipset = self._addIPSet(obj) return config_ipset @dbus.service.signal(config.dbus.DBUS_INTERFACE_CONFIG, signature='s') @dbus_handle_exceptions def IPSetAdded(self, ipset): ipset = dbus_to_python(ipset, str) log.debug1("config.IPSetAdded('%s')" % (ipset)) # I C M P T Y P E S @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG, out_signature='ao') @dbus_handle_exceptions def listIcmpTypes(self, sender=None): # pylint: disable=W0613 """list icmptypes objects paths """ log.debug1("config.listIcmpTypes()") return self.icmptypes @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG, out_signature='as') @dbus_handle_exceptions def getIcmpTypeNames(self, sender=None): # pylint: disable=W0613 """get icmptype names """ log.debug1("config.getIcmpTypeNames()") icmptypes = [ ] for obj in self.icmptypes: icmptypes.append(obj.obj.name) return sorted(icmptypes) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG, in_signature='s', out_signature='o') @dbus_handle_exceptions def getIcmpTypeByName(self, icmptype, sender=None): # pylint: disable=W0613 """object path of icmptype with given name """ icmptype = dbus_to_python(icmptype, str) log.debug1("config.getIcmpTypeByName('%s')", icmptype) for obj in self.icmptypes: if obj.obj.name == icmptype: return obj raise FirewallError(errors.INVALID_ICMPTYPE, icmptype) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG, in_signature='s'+IcmpType.DBUS_SIGNATURE, out_signature='o') @dbus_handle_exceptions def addIcmpType(self, icmptype, settings, sender=None): """add icmptype with given name and settings """ icmptype = dbus_to_python(icmptype, str) settings = dbus_to_python(settings) log.debug1("config.addIcmpType('%s')", icmptype) self.accessCheck(sender) obj = self.config.new_icmptype(icmptype, settings) config_icmptype = self._addIcmpType(obj) return config_icmptype @dbus.service.signal(config.dbus.DBUS_INTERFACE_CONFIG, signature='s') @dbus_handle_exceptions def IcmpTypeAdded(self, icmptype): log.debug1("config.IcmpTypeAdded('%s')" % (icmptype)) # S E R V I C E S @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG, out_signature='ao') @dbus_handle_exceptions def listServices(self, sender=None): # pylint: disable=W0613 """list services objects paths """ log.debug1("config.listServices()") return self.services @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG, out_signature='as') @dbus_handle_exceptions def getServiceNames(self, sender=None): # pylint: disable=W0613 """get service names """ log.debug1("config.getServiceNames()") services = [ ] for obj in self.services: services.append(obj.obj.name) return sorted(services) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG, in_signature='s', out_signature='o') @dbus_handle_exceptions def getServiceByName(self, service, sender=None): # pylint: disable=W0613 """object path of service with given name """ service = dbus_to_python(service, str) log.debug1("config.getServiceByName('%s')", service) for obj in self.services: if obj.obj.name == service: return obj raise FirewallError(errors.INVALID_SERVICE, service) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG, in_signature='s(sssa(ss)asa{ss}asa(ss))', out_signature='o') @dbus_handle_exceptions def addService(self, service, settings, sender=None): """add service with given name and settings """ service = dbus_to_python(service, str) settings = dbus_to_python(settings) log.debug1("config.addService('%s')", service) self.accessCheck(sender) obj = self.config.new_service(service, settings) config_service = self._addService(obj) return config_service @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG, in_signature='sa{sv}', out_signature='o') @dbus_handle_exceptions def addService2(self, service, settings, sender=None): """add service with given name and settings """ service = dbus_to_python(service, str) settings = dbus_to_python(settings) log.debug1("config.addService2('%s')", service) self.accessCheck(sender) obj = self.config.new_service_dict(service, settings) config_service = self._addService(obj) return config_service @dbus.service.signal(config.dbus.DBUS_INTERFACE_CONFIG, signature='s') @dbus_handle_exceptions def ServiceAdded(self, service): log.debug1("config.ServiceAdded('%s')" % (service)) # Z O N E S @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG, out_signature='ao') @dbus_handle_exceptions def listZones(self, sender=None): # pylint: disable=W0613 """list zones objects paths """ log.debug1("config.listZones()") return self.zones @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG, out_signature='as') @dbus_handle_exceptions def getZoneNames(self, sender=None): # pylint: disable=W0613 """get zone names """ log.debug1("config.getZoneNames()") zones = [ ] for obj in self.zones: zones.append(obj.obj.name) return sorted(zones) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG, in_signature='s', out_signature='o') @dbus_handle_exceptions def getZoneByName(self, zone, sender=None): # pylint: disable=W0613 """object path of zone with given name """ zone = dbus_to_python(zone, str) log.debug1("config.getZoneByName('%s')", zone) for obj in self.zones: if obj.obj.name == zone: return obj raise FirewallError(errors.INVALID_ZONE, zone) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG, in_signature='s', out_signature='s') @dbus_handle_exceptions def getZoneOfInterface(self, iface, sender=None): # pylint: disable=W0613 """name of zone the given interface belongs to """ iface = dbus_to_python(iface, str) log.debug1("config.getZoneOfInterface('%s')", iface) ret = [] for obj in self.zones: if iface in obj.obj.interfaces: ret.append(obj.obj.name) if len(ret) > 1: # Even it shouldn't happen, it's actually possible that # the same interface is in several zone XML files return " ".join(ret) + \ " (ERROR: interface '%s' is in %s zone XML files, can be only in one)" % \ (iface, len(ret)) return ret[0] if ret else "" @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG, in_signature='s', out_signature='s') @dbus_handle_exceptions def getZoneOfSource(self, source, sender=None): # pylint: disable=W0613 """name of zone the given source belongs to """ source = dbus_to_python(source, str) log.debug1("config.getZoneOfSource('%s')", source) ret = [] for obj in self.zones: if source in obj.obj.sources: ret.append(obj.obj.name) if len(ret) > 1: # Even it shouldn't happen, it's actually possible that # the same source is in several zone XML files return " ".join(ret) + \ " (ERROR: source '%s' is in %s zone XML files, can be only in one)" % \ (source, len(ret)) return ret[0] if ret else "" @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG, in_signature="s(sssbsasa(ss)asba(ssss)asasasasa(ss)b)", out_signature='o') @dbus_handle_exceptions def addZone(self, zone, settings, sender=None): """add zone with given name and settings """ zone = dbus_to_python(zone, str) settings = dbus_to_python(settings) log.debug1("config.addZone('%s')", zone) self.accessCheck(sender) if settings[4] == "default": # convert to list, fix target, convert back to tuple _settings = list(settings) _settings[4] = DEFAULT_ZONE_TARGET settings = tuple(_settings) obj = self.config.new_zone(zone, settings) config_zone = self._addZone(obj) return config_zone @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG, in_signature="sa{sv}", out_signature='o') @dbus_handle_exceptions def addZone2(self, zone, settings, sender=None): """add zone with given name and settings """ zone = dbus_to_python(zone, str) settings = dbus_to_python(settings) log.debug1("config.addZone('%s')", zone) self.accessCheck(sender) if "target" in settings and settings["target"] == "default": settings["target"] = DEFAULT_ZONE_TARGET obj = self.config.new_zone_dict(zone, settings) config_zone = self._addZone(obj) return config_zone @dbus.service.signal(config.dbus.DBUS_INTERFACE_CONFIG, signature='s') @dbus_handle_exceptions def ZoneAdded(self, zone): log.debug1("config.ZoneAdded('%s')" % (zone)) # policies @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG, out_signature='ao') @dbus_handle_exceptions def listPolicies(self, sender=None): """list policies objects paths """ log.debug1("config.listPolicies()") return self.policy_objects @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG, out_signature='as') @dbus_handle_exceptions def getPolicyNames(self, sender=None): """get policy names """ log.debug1("config.getPolicyNames()") policies = [ ] for obj in self.policy_objects: policies.append(obj.obj.name) return sorted(policies) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG, in_signature='s', out_signature='o') @dbus_handle_exceptions def getPolicyByName(self, policy, sender=None): """object path of policy with given name """ policy = dbus_to_python(policy, str) log.debug1("config.getPolicyByName('%s')", policy) for obj in self.policy_objects: if obj.obj.name == policy: return obj raise FirewallError(errors.INVALID_POLICY, policy) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG, in_signature="sa{sv}", out_signature='o') @dbus_handle_exceptions def addPolicy(self, policy, settings, sender=None): """add policy with given name and settings """ policy = dbus_to_python(policy, str) settings = dbus_to_python(settings) log.debug1("config.addPolicy('%s')", policy) self.accessCheck(sender) obj = self.config.new_policy_object_dict(policy, settings) config_policy = self._addPolicy(obj) return config_policy @dbus.service.signal(config.dbus.DBUS_INTERFACE_CONFIG, signature='s') @dbus_handle_exceptions def PolicyAdded(self, policy): log.debug1("config.PolicyAdded('%s')" % (policy)) # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # H E L P E R S @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG, out_signature='ao') @dbus_handle_exceptions def listHelpers(self, sender=None): # pylint: disable=W0613 """list helpers objects paths """ log.debug1("config.listHelpers()") return self.helpers @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG, out_signature='as') @dbus_handle_exceptions def getHelperNames(self, sender=None): # pylint: disable=W0613 """get helper names """ log.debug1("config.getHelperNames()") helpers = [ ] for obj in self.helpers: helpers.append(obj.obj.name) return sorted(helpers) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG, in_signature='s', out_signature='o') @dbus_handle_exceptions def getHelperByName(self, helper, sender=None): # pylint: disable=W0613 """object path of helper with given name """ helper = dbus_to_python(helper, str) log.debug1("config.getHelperByName('%s')", helper) for obj in self.helpers: if obj.obj.name == helper: return obj raise FirewallError(errors.INVALID_HELPER, helper) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG, in_signature='s'+Helper.DBUS_SIGNATURE, out_signature='o') @dbus_handle_exceptions def addHelper(self, helper, settings, sender=None): """add helper with given name and settings """ helper = dbus_to_python(helper, str) settings = dbus_to_python(settings) log.debug1("config.addHelper('%s')", helper) self.accessCheck(sender) obj = self.config.new_helper(helper, settings) config_helper = self._addHelper(obj) return config_helper @dbus.service.signal(config.dbus.DBUS_INTERFACE_CONFIG, signature='s') @dbus_handle_exceptions def HelperAdded(self, helper): helper = dbus_to_python(helper, str) log.debug1("config.HelperAdded('%s')" % (helper)) # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # DIRECT @dbus_service_method_deprecated(config.dbus.DBUS_INTERFACE_CONFIG_DIRECT) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_DIRECT, out_signature=Direct.DBUS_SIGNATURE) @dbus_handle_exceptions def getSettings(self, sender=None): # pylint: disable=W0613 # returns list ipv, table, list of chains log.debug1("config.direct.getSettings()") return self.config.get_direct().export_config() @dbus_service_method_deprecated(config.dbus.DBUS_INTERFACE_CONFIG_DIRECT) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_DIRECT, in_signature=Direct.DBUS_SIGNATURE) @dbus_handle_exceptions def update(self, settings, sender=None): # pylint: disable=W0613 # returns list ipv, table, list of chains log.debug1("config.direct.update()") settings = dbus_to_python(settings) self.config.get_direct().import_config(settings, {}) self.config.get_direct().write() self.Updated() @dbus_service_signal_deprecated(config.dbus.DBUS_INTERFACE_CONFIG_DIRECT) @dbus.service.signal(config.dbus.DBUS_INTERFACE_CONFIG_DIRECT) @dbus_handle_exceptions def Updated(self): log.debug1("config.direct.Updated()") # chain @dbus_service_method_deprecated(config.dbus.DBUS_INTERFACE_CONFIG_DIRECT) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_DIRECT, in_signature='sss') @dbus_handle_exceptions def addChain(self, ipv, table, chain, sender=None): ipv = dbus_to_python(ipv) table = dbus_to_python(table) chain = dbus_to_python(chain) log.debug1("config.direct.addChain('%s', '%s', '%s')" % \ (ipv, table, chain)) self.accessCheck(sender) idx = tuple((ipv, table, chain)) settings = list(self.getSettings()) if idx in settings[0]: raise FirewallError(errors.ALREADY_ENABLED, "chain '%s' already is in '%s:%s'" % \ (chain, ipv, table)) settings[0].append(idx) self.update(settings) @dbus_service_method_deprecated(config.dbus.DBUS_INTERFACE_CONFIG_DIRECT) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_DIRECT, in_signature='sss') @dbus_handle_exceptions def removeChain(self, ipv, table, chain, sender=None): ipv = dbus_to_python(ipv) table = dbus_to_python(table) chain = dbus_to_python(chain) log.debug1("config.direct.removeChain('%s', '%s', '%s')" % \ (ipv, table, chain)) self.accessCheck(sender) idx = tuple((ipv, table, chain)) settings = list(self.getSettings()) if idx not in settings[0]: raise FirewallError(errors.NOT_ENABLED, "chain '%s' is not in '%s:%s'" % (chain, ipv, table)) settings[0].remove(idx) self.update(settings) @dbus_service_method_deprecated(config.dbus.DBUS_INTERFACE_CONFIG_DIRECT) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_DIRECT, in_signature='sss', out_signature='b') @dbus_handle_exceptions def queryChain(self, ipv, table, chain, sender=None): # pylint: disable=W0613 ipv = dbus_to_python(ipv) table = dbus_to_python(table) chain = dbus_to_python(chain) log.debug1("config.direct.queryChain('%s', '%s', '%s')" % \ (ipv, table, chain)) idx = tuple((ipv, table, chain)) return idx in self.getSettings()[0] @dbus_service_method_deprecated(config.dbus.DBUS_INTERFACE_CONFIG_DIRECT) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_DIRECT, in_signature='ss', out_signature='as') @dbus_handle_exceptions def getChains(self, ipv, table, sender=None): # pylint: disable=W0613 ipv = dbus_to_python(ipv) table = dbus_to_python(table) log.debug1("config.direct.getChains('%s', '%s')" % (ipv, table)) ret = [ ] for idx in self.getSettings()[0]: if idx[0] == ipv and idx[1] == table: ret.append(idx[2]) return ret @dbus_service_method_deprecated(config.dbus.DBUS_INTERFACE_CONFIG_DIRECT) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_DIRECT, in_signature='', out_signature='a(sss)') @dbus_handle_exceptions def getAllChains(self, sender=None): # pylint: disable=W0613 log.debug1("config.direct.getAllChains()") return self.getSettings()[0] # rule @dbus_service_method_deprecated(config.dbus.DBUS_INTERFACE_CONFIG_DIRECT) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_DIRECT, in_signature='sssias') @dbus_handle_exceptions def addRule(self, ipv, table, chain, priority, args, sender=None): # pylint: disable=R0913 ipv = dbus_to_python(ipv) table = dbus_to_python(table) chain = dbus_to_python(chain) priority = dbus_to_python(priority) args = dbus_to_python(args) log.debug1("config.direct.addRule('%s', '%s', '%s', %d, '%s')" % \ (ipv, table, chain, priority, "','".join(args))) self.accessCheck(sender) idx = (ipv, table, chain, priority, args) settings = list(self.getSettings()) if idx in settings[1]: raise FirewallError(errors.ALREADY_ENABLED, "rule '%s' already is in '%s:%s:%s'" % \ (args, ipv, table, chain)) settings[1].append(idx) self.update(tuple(settings)) @dbus_service_method_deprecated(config.dbus.DBUS_INTERFACE_CONFIG_DIRECT) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_DIRECT, in_signature='sssias') @dbus_handle_exceptions def removeRule(self, ipv, table, chain, priority, args, sender=None): # pylint: disable=R0913 ipv = dbus_to_python(ipv) table = dbus_to_python(table) chain = dbus_to_python(chain) priority = dbus_to_python(priority) args = dbus_to_python(args) log.debug1("config.direct.removeRule('%s', '%s', '%s', %d, '%s')" % \ (ipv, table, chain, priority, "','".join(args))) self.accessCheck(sender) idx = (ipv, table, chain, priority, args) settings = list(self.getSettings()) if idx not in settings[1]: raise FirewallError(errors.NOT_ENABLED, "rule '%s' is not in '%s:%s:%s'" % \ (args, ipv, table, chain)) settings[1].remove(idx) self.update(tuple(settings)) @dbus_service_method_deprecated(config.dbus.DBUS_INTERFACE_CONFIG_DIRECT) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_DIRECT, in_signature='sssias', out_signature='b') @dbus_handle_exceptions def queryRule(self, ipv, table, chain, priority, args, sender=None): # pylint: disable=W0613,R0913 ipv = dbus_to_python(ipv) table = dbus_to_python(table) chain = dbus_to_python(chain) priority = dbus_to_python(priority) args = dbus_to_python(args) log.debug1("config.direct.queryRule('%s', '%s', '%s', %d, '%s')" % \ (ipv, table, chain, priority, "','".join(args))) idx = (ipv, table, chain, priority, args) return idx in self.getSettings()[1] @dbus_service_method_deprecated(config.dbus.DBUS_INTERFACE_CONFIG_DIRECT) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_DIRECT, in_signature='sss') @dbus_handle_exceptions def removeRules(self, ipv, table, chain, sender=None): ipv = dbus_to_python(ipv) table = dbus_to_python(table) chain = dbus_to_python(chain) log.debug1("config.direct.removeRules('%s', '%s', '%s')" % \ (ipv, table, chain, )) self.accessCheck(sender) settings = list(self.getSettings()) for rule in settings[1][:]: if (ipv, table, chain) == (rule[0], rule[1], rule[2]): settings[1].remove(rule) self.update(tuple(settings)) @dbus_service_method_deprecated(config.dbus.DBUS_INTERFACE_CONFIG_DIRECT) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_DIRECT, in_signature='sss', out_signature='a(ias)') @dbus_handle_exceptions def getRules(self, ipv, table, chain, sender=None): # pylint: disable=W0613 ipv = dbus_to_python(ipv) table = dbus_to_python(table) chain = dbus_to_python(chain) log.debug1("config.direct.getRules('%s', '%s', '%s')" % \ (ipv, table, chain)) ret = [ ] for idx in self.getSettings()[1]: if idx[0] == ipv and idx[1] == table and idx[2] == chain: ret.append((idx[3], idx[4])) return ret @dbus_service_method_deprecated(config.dbus.DBUS_INTERFACE_CONFIG_DIRECT) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_DIRECT, in_signature='', out_signature='a(sssias)') @dbus_handle_exceptions def getAllRules(self, sender=None): # pylint: disable=W0613 log.debug1("config.direct.getAllRules()") return self.getSettings()[1] # passthrough @dbus_service_method_deprecated(config.dbus.DBUS_INTERFACE_CONFIG_DIRECT) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_DIRECT, in_signature='sas') @dbus_handle_exceptions def addPassthrough(self, ipv, args, sender=None): ipv = dbus_to_python(ipv) args = dbus_to_python(args) log.debug1("config.direct.addPassthrough('%s', '%s')" % \ (ipv, "','".join(args))) self.accessCheck(sender) idx = (ipv, args) settings = list(self.getSettings()) if idx in settings[2]: raise FirewallError(errors.ALREADY_ENABLED, "passthrough '%s', '%s'" % (ipv, args)) settings[2].append(idx) self.update(settings) @dbus_service_method_deprecated(config.dbus.DBUS_INTERFACE_CONFIG_DIRECT) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_DIRECT, in_signature='sas') @dbus_handle_exceptions def removePassthrough(self, ipv, args, sender=None): ipv = dbus_to_python(ipv) args = dbus_to_python(args) log.debug1("config.direct.removePassthrough('%s', '%s')" % \ (ipv, "','".join(args))) self.accessCheck(sender) idx = (ipv, args) settings = list(self.getSettings()) if idx not in settings[2]: raise FirewallError(errors.NOT_ENABLED, "passthrough '%s', '%s'" % (ipv, args)) settings[2].remove(idx) self.update(settings) @dbus_service_method_deprecated(config.dbus.DBUS_INTERFACE_CONFIG_DIRECT) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_DIRECT, in_signature='sas', out_signature='b') @dbus_handle_exceptions def queryPassthrough(self, ipv, args, sender=None): # pylint: disable=W0613 ipv = dbus_to_python(ipv) args = dbus_to_python(args) log.debug1("config.direct.queryPassthrough('%s', '%s')" % \ (ipv, "','".join(args))) idx = (ipv, args) return idx in self.getSettings()[2] @dbus_service_method_deprecated(config.dbus.DBUS_INTERFACE_CONFIG_DIRECT) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_DIRECT, in_signature='s', out_signature='aas') @dbus_handle_exceptions def getPassthroughs(self, ipv, sender=None): # pylint: disable=W0613 ipv = dbus_to_python(ipv) log.debug1("config.direct.getPassthroughs('%s')" % (ipv)) ret = [ ] for idx in self.getSettings()[2]: if idx[0] == ipv: ret.append(idx[1]) return ret @dbus_service_method_deprecated(config.dbus.DBUS_INTERFACE_CONFIG_DIRECT) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_DIRECT, out_signature='a(sas)') @dbus_handle_exceptions def getAllPassthroughs(self, sender=None): # pylint: disable=W0613 log.debug1("config.direct.getAllPassthroughs()") return self.getSettings()[2] PK ���Z��ϬI I server/config_ipset.pynu �[��� # -*- coding: utf-8 -*- # # Copyright (C) 2015-2016 Red Hat, Inc. # # Authors: # Thomas Woerner <twoerner@redhat.com> # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see <http://www.gnu.org/licenses/>. import dbus import dbus.service from firewall import config from firewall.dbus_utils import dbus_to_python, \ dbus_introspection_prepare_properties, \ dbus_introspection_add_properties from firewall.core.io.ipset import IPSet from firewall.core.ipset import IPSET_TYPES, normalize_ipset_entry, \ check_entry_overlaps_existing, \ check_for_overlapping_entries from firewall.core.logger import log from firewall.server.dbus import DbusServiceObject from firewall.server.decorators import handle_exceptions, \ dbus_handle_exceptions, dbus_service_method, \ dbus_polkit_require_auth from firewall import errors from firewall.errors import FirewallError ############################################################################ # # class FirewallDConfigIPSet # ############################################################################ class FirewallDConfigIPSet(DbusServiceObject): """FirewallD main class""" persistent = True """ Make FirewallD persistent. """ default_polkit_auth_required = config.dbus.PK_ACTION_CONFIG """ Use PK_ACTION_INFO as a default """ @handle_exceptions def __init__(self, parent, conf, ipset, item_id, *args, **kwargs): super(FirewallDConfigIPSet, self).__init__(*args, **kwargs) self.parent = parent self.config = conf self.obj = ipset self.item_id = item_id self.busname = args[0] self.path = args[1] self._log_prefix = "config.ipset.%d" % self.item_id dbus_introspection_prepare_properties( self, config.dbus.DBUS_INTERFACE_CONFIG_IPSET) @dbus_handle_exceptions def __del__(self): pass @dbus_handle_exceptions def unregister(self): self.remove_from_connection() # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # P R O P E R T I E S @dbus_handle_exceptions def _get_property(self, property_name): if property_name == "name": return dbus.String(self.obj.name) elif property_name == "filename": return dbus.String(self.obj.filename) elif property_name == "path": return dbus.String(self.obj.path) elif property_name == "default": return dbus.Boolean(self.obj.default) elif property_name == "builtin": return dbus.Boolean(self.obj.builtin) else: raise dbus.exceptions.DBusException( "org.freedesktop.DBus.Error.InvalidArgs: " "Property '%s' does not exist" % property_name) @dbus_service_method(dbus.PROPERTIES_IFACE, in_signature='ss', out_signature='v') @dbus_handle_exceptions def Get(self, interface_name, property_name, sender=None): # pylint: disable=W0613 # get a property interface_name = dbus_to_python(interface_name, str) property_name = dbus_to_python(property_name, str) log.debug1("%s.Get('%s', '%s')", self._log_prefix, interface_name, property_name) if interface_name != config.dbus.DBUS_INTERFACE_CONFIG_IPSET: raise dbus.exceptions.DBusException( "org.freedesktop.DBus.Error.UnknownInterface: " "Interface '%s' does not exist" % interface_name) return self._get_property(property_name) @dbus_service_method(dbus.PROPERTIES_IFACE, in_signature='s', out_signature='a{sv}') @dbus_handle_exceptions def GetAll(self, interface_name, sender=None): # pylint: disable=W0613 interface_name = dbus_to_python(interface_name, str) log.debug1("%s.GetAll('%s')", self._log_prefix, interface_name) if interface_name != config.dbus.DBUS_INTERFACE_CONFIG_IPSET: raise dbus.exceptions.DBusException( "org.freedesktop.DBus.Error.UnknownInterface: " "Interface '%s' does not exist" % interface_name) ret = { } for x in [ "name", "filename", "path", "default", "builtin" ]: ret[x] = self._get_property(x) return dbus.Dictionary(ret, signature="sv") @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG) @dbus_service_method(dbus.PROPERTIES_IFACE, in_signature='ssv') @dbus_handle_exceptions def Set(self, interface_name, property_name, new_value, sender=None): interface_name = dbus_to_python(interface_name, str) property_name = dbus_to_python(property_name, str) new_value = dbus_to_python(new_value) log.debug1("%s.Set('%s', '%s', '%s')", self._log_prefix, interface_name, property_name, new_value) self.parent.accessCheck(sender) if interface_name != config.dbus.DBUS_INTERFACE_CONFIG_IPSET: raise dbus.exceptions.DBusException( "org.freedesktop.DBus.Error.UnknownInterface: " "Interface '%s' does not exist" % interface_name) raise dbus.exceptions.DBusException( "org.freedesktop.DBus.Error.PropertyReadOnly: " "Property '%s' is read-only" % property_name) @dbus.service.signal(dbus.PROPERTIES_IFACE, signature='sa{sv}as') def PropertiesChanged(self, interface_name, changed_properties, invalidated_properties): interface_name = dbus_to_python(interface_name, str) changed_properties = dbus_to_python(changed_properties) invalidated_properties = dbus_to_python(invalidated_properties) log.debug1("%s.PropertiesChanged('%s', '%s', '%s')", self._log_prefix, interface_name, changed_properties, invalidated_properties) @dbus_polkit_require_auth(config.dbus.PK_ACTION_INFO) @dbus_service_method(dbus.INTROSPECTABLE_IFACE, out_signature='s') @dbus_handle_exceptions def Introspect(self, sender=None): # pylint: disable=W0613 log.debug2("%s.Introspect()", self._log_prefix) data = super(FirewallDConfigIPSet, self).Introspect( self.path, self.busname.get_bus()) return dbus_introspection_add_properties( self, data, config.dbus.DBUS_INTERFACE_CONFIG_IPSET) # S E T T I N G S @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_IPSET, out_signature=IPSet.DBUS_SIGNATURE) @dbus_handle_exceptions def getSettings(self, sender=None): # pylint: disable=W0613 """get settings for ipset """ log.debug1("%s.getSettings()", self._log_prefix) return self.config.get_ipset_config(self.obj) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_IPSET, in_signature=IPSet.DBUS_SIGNATURE) @dbus_handle_exceptions def update(self, settings, sender=None): """update settings for ipset """ settings = dbus_to_python(settings) log.debug1("%s.update('...')", self._log_prefix) self.parent.accessCheck(sender) self.obj = self.config.set_ipset_config(self.obj, settings) self.Updated(self.obj.name) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_IPSET) @dbus_handle_exceptions def loadDefaults(self, sender=None): """load default settings for builtin ipset """ log.debug1("%s.loadDefaults()", self._log_prefix) self.parent.accessCheck(sender) self.obj = self.config.load_ipset_defaults(self.obj) self.Updated(self.obj.name) #self.PropertiesChanged(config.dbus.DBUS_INTERFACE_CONFIG_IPSET, # { "default": True }, [ ]) @dbus.service.signal(config.dbus.DBUS_INTERFACE_CONFIG_IPSET, signature='s') @dbus_handle_exceptions def Updated(self, name): log.debug1("%s.Updated('%s')" % (self._log_prefix, name)) # R E M O V E @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_IPSET) @dbus_handle_exceptions def remove(self, sender=None): """remove ipset """ log.debug1("%s.remove()", self._log_prefix) self.parent.accessCheck(sender) self.config.remove_ipset(self.obj) self.parent.removeIPSet(self.obj) @dbus.service.signal(config.dbus.DBUS_INTERFACE_CONFIG_IPSET, signature='s') @dbus_handle_exceptions def Removed(self, name): log.debug1("%s.Removed('%s')" % (self._log_prefix, name)) # R E N A M E @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_IPSET, in_signature='s') @dbus_handle_exceptions def rename(self, name, sender=None): """rename ipset """ name = dbus_to_python(name, str) log.debug1("%s.rename('%s')", self._log_prefix, name) self.parent.accessCheck(sender) self.obj = self.config.rename_ipset(self.obj, name) self.Renamed(name) #self.PropertiesChanged(config.dbus.DBUS_INTERFACE_CONFIG_IPSET, # { "name": name }, [ ]) @dbus.service.signal(config.dbus.DBUS_INTERFACE_CONFIG_IPSET, signature='s') @dbus_handle_exceptions def Renamed(self, name): log.debug1("%s.Renamed('%s')" % (self._log_prefix, name)) # version @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_IPSET, out_signature='s') @dbus_handle_exceptions def getVersion(self, sender=None): # pylint: disable=W0613 log.debug1("%s.getVersion()", self._log_prefix) return self.getSettings()[0] @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_IPSET, in_signature='s') @dbus_handle_exceptions def setVersion(self, version, sender=None): version = dbus_to_python(version, str) log.debug1("%s.setVersion('%s')", self._log_prefix, version) self.parent.accessCheck(sender) settings = list(self.getSettings()) settings[0] = version self.update(settings) # short @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_IPSET, out_signature='s') @dbus_handle_exceptions def getShort(self, sender=None): # pylint: disable=W0613 log.debug1("%s.getShort()", self._log_prefix) return self.getSettings()[1] @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_IPSET, in_signature='s') @dbus_handle_exceptions def setShort(self, short, sender=None): short = dbus_to_python(short, str) log.debug1("%s.setShort('%s')", self._log_prefix, short) self.parent.accessCheck(sender) settings = list(self.getSettings()) settings[1] = short self.update(settings) # description @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_IPSET, out_signature='s') @dbus_handle_exceptions def getDescription(self, sender=None): # pylint: disable=W0613 log.debug1("%s.getDescription()", self._log_prefix) return self.getSettings()[2] @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_IPSET, in_signature='s') @dbus_handle_exceptions def setDescription(self, description, sender=None): description = dbus_to_python(description, str) log.debug1("%s.setDescription('%s')", self._log_prefix, description) self.parent.accessCheck(sender) settings = list(self.getSettings()) settings[2] = description self.update(settings) # type @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_IPSET, out_signature='s') @dbus_handle_exceptions def getType(self, sender=None): # pylint: disable=W0613 log.debug1("%s.getType()", self._log_prefix) return self.getSettings()[3] @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_IPSET, in_signature='s') @dbus_handle_exceptions def setType(self, ipset_type, sender=None): ipset_type = dbus_to_python(ipset_type, str) log.debug1("%s.setType('%s')", self._log_prefix, ipset_type) self.parent.accessCheck(sender) if ipset_type not in IPSET_TYPES: raise FirewallError(errors.INVALID_TYPE, ipset_type) settings = list(self.getSettings()) settings[3] = ipset_type self.update(settings) # options @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_IPSET, out_signature='a{ss}') @dbus_handle_exceptions def getOptions(self, sender=None): # pylint: disable=W0613 log.debug1("%s.getOptions()", self._log_prefix) return self.getSettings()[4] @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_IPSET, in_signature='a{ss}') @dbus_handle_exceptions def setOptions(self, options, sender=None): options = dbus_to_python(options, dict) log.debug1("%s.setOptions('[%s]')", self._log_prefix, repr(options)) self.parent.accessCheck(sender) settings = list(self.getSettings()) settings[4] = options self.update(settings) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_IPSET, in_signature='ss') @dbus_handle_exceptions def addOption(self, key, value, sender=None): key = dbus_to_python(key, str) value = dbus_to_python(value, str) log.debug1("%s.addOption('%s', '%s')", self._log_prefix, key, value) self.parent.accessCheck(sender) settings = list(self.getSettings()) if key in settings[4] and settings[4][key] == value: raise FirewallError(errors.ALREADY_ENABLED, "'%s': '%s'" % (key, value)) settings[4][key] = value self.update(settings) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_IPSET, in_signature='s') @dbus_handle_exceptions def removeOption(self, key, sender=None): key = dbus_to_python(key, str) log.debug1("%s.removeOption('%s')", self._log_prefix, key) self.parent.accessCheck(sender) settings = list(self.getSettings()) if key not in settings[4]: raise FirewallError(errors.NOT_ENABLED, key) del settings[4][key] self.update(settings) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_IPSET, in_signature='ss', out_signature='b') @dbus_handle_exceptions def queryOption(self, key, value, sender=None): # pylint: disable=W0613 key = dbus_to_python(key, str) value = dbus_to_python(value, str) log.debug1("%s.queryOption('%s', '%s')", self._log_prefix, key, value) settings = list(self.getSettings()) return (key in settings[4] and settings[4][key] == value) # entries @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_IPSET, out_signature='as') @dbus_handle_exceptions def getEntries(self, sender=None): # pylint: disable=W0613 log.debug1("%s.getEntries()", self._log_prefix) return self.getSettings()[5] @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_IPSET, in_signature='as') @dbus_handle_exceptions def setEntries(self, entries, sender=None): entries = dbus_to_python(entries, list) check_for_overlapping_entries(entries) log.debug1("%s.setEntries('[%s]')", self._log_prefix, ",".join(entries)) self.parent.accessCheck(sender) settings = list(self.getSettings()) if "timeout" in settings[4] and settings[4]["timeout"] != "0": raise FirewallError(errors.IPSET_WITH_TIMEOUT) settings[5] = entries self.update(settings) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_IPSET, in_signature='s') @dbus_handle_exceptions def addEntry(self, entry, sender=None): entry = dbus_to_python(entry, str) entry = normalize_ipset_entry(entry) log.debug1("%s.addEntry('%s')", self._log_prefix, entry) self.parent.accessCheck(sender) settings = list(self.getSettings()) if "timeout" in settings[4] and settings[4]["timeout"] != "0": raise FirewallError(errors.IPSET_WITH_TIMEOUT) if entry in settings[5]: raise FirewallError(errors.ALREADY_ENABLED, entry) check_entry_overlaps_existing(entry, settings[5]) settings[5].append(entry) self.update(settings) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_IPSET, in_signature='s') @dbus_handle_exceptions def removeEntry(self, entry, sender=None): entry = dbus_to_python(entry, str) entry = normalize_ipset_entry(entry) log.debug1("%s.removeEntry('%s')", self._log_prefix, entry) self.parent.accessCheck(sender) settings = list(self.getSettings()) if "timeout" in settings[4] and settings[4]["timeout"] != "0": raise FirewallError(errors.IPSET_WITH_TIMEOUT) if entry not in settings[5]: raise FirewallError(errors.NOT_ENABLED, entry) settings[5].remove(entry) self.update(settings) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_IPSET, in_signature='s', out_signature='b') @dbus_handle_exceptions def queryEntry(self, entry, sender=None): # pylint: disable=W0613 entry = dbus_to_python(entry, str) entry = normalize_ipset_entry(entry) log.debug1("%s.queryEntry('%s')", self._log_prefix, entry) settings = list(self.getSettings()) if "timeout" in settings[4] and settings[4]["timeout"] != "0": raise FirewallError(errors.IPSET_WITH_TIMEOUT) return entry in settings[5] PK ���Z��{��� �� server/firewalld.pynu �[��� # -*- coding: utf-8 -*- # # Copyright (C) 2010-2016 Red Hat, Inc. # # Authors: # Thomas Woerner <twoerner@redhat.com> # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see <http://www.gnu.org/licenses/>. __all__ = [ "FirewallD" ] from gi.repository import GLib import copy import dbus import dbus.service from firewall import config from firewall.core.fw import Firewall from firewall.core.rich import Rich_Rule from firewall.core.logger import log from firewall.client import FirewallClientZoneSettings from firewall.server.dbus import FirewallDBusException, DbusServiceObject from firewall.server.decorators import dbus_handle_exceptions, \ dbus_service_method, \ handle_exceptions, \ dbus_service_method_deprecated, \ dbus_service_signal_deprecated, \ dbus_polkit_require_auth from firewall.server.config import FirewallDConfig from firewall.dbus_utils import dbus_to_python, \ command_of_sender, context_of_sender, uid_of_sender, user_of_uid, \ dbus_introspection_prepare_properties, \ dbus_introspection_add_properties, \ dbus_introspection_add_deprecated from firewall.core.io.functions import check_on_disk_config from firewall.core.io.ipset import IPSet from firewall.core.io.icmptype import IcmpType from firewall.core.io.helper import Helper from firewall.core.fw_nm import nm_get_connection_of_interface, \ nm_set_zone_of_connection from firewall.core.fw_ifcfg import ifcfg_set_zone_of_interface from firewall import errors from firewall.errors import FirewallError ############################################################################ # # class FirewallD # ############################################################################ class FirewallD(DbusServiceObject): """FirewallD main class""" persistent = True """ Make FirewallD persistent. """ default_polkit_auth_required = config.dbus.PK_ACTION_CONFIG """ Use config.dbus.PK_ACTION_CONFIG as a default """ @handle_exceptions def __init__(self, *args, **kwargs): super(FirewallD, self).__init__(*args, **kwargs) self.fw = Firewall() self.busname = args[0] self.path = args[1] self.start() dbus_introspection_prepare_properties(self, config.dbus.DBUS_INTERFACE) self.config = FirewallDConfig(self.fw.config, self.busname, config.dbus.DBUS_PATH_CONFIG) def __del__(self): self.stop() @handle_exceptions def start(self): # tests if iptables and ip6tables are usable using test functions # loads default firewall rules for iptables and ip6tables log.debug1("start()") self._timeouts = { } return self.fw.start() @handle_exceptions def stop(self): # stops firewall: unloads firewall modules, flushes chains and tables, # resets policies log.debug1("stop()") return self.fw.stop() # lockdown functions @dbus_handle_exceptions def accessCheck(self, sender): if self.fw.policies.query_lockdown(): if sender is None: log.error("Lockdown not possible, sender not set.") return bus = dbus.SystemBus() context = context_of_sender(bus, sender) if self.fw.policies.access_check("context", context): return uid = uid_of_sender(bus, sender) if self.fw.policies.access_check("uid", uid): return user = user_of_uid(uid) if self.fw.policies.access_check("user", user): return command = command_of_sender(bus, sender) if self.fw.policies.access_check("command", command): return raise FirewallError(errors.ACCESS_DENIED, "lockdown is enabled") # timeout functions @dbus_handle_exceptions def addTimeout(self, zone, x, tag): if zone not in self._timeouts: self._timeouts[zone] = { } self._timeouts[zone][x] = tag @dbus_handle_exceptions def removeTimeout(self, zone, x): if zone in self._timeouts and x in self._timeouts[zone]: GLib.source_remove(self._timeouts[zone][x]) del self._timeouts[zone][x] @dbus_handle_exceptions def cleanup_timeouts(self): # cleanup timeouts for zone in self._timeouts: for x in self._timeouts[zone]: GLib.source_remove(self._timeouts[zone][x]) self._timeouts[zone].clear() self._timeouts.clear() # property handling @dbus_handle_exceptions def _get_property(self, prop): if prop == "version": return dbus.String(config.VERSION) elif prop == "interface_version": return dbus.String("%d.%d" % (config.dbus.DBUS_INTERFACE_VERSION, config.dbus.DBUS_INTERFACE_REVISION)) elif prop == "state": return dbus.String(self.fw.get_state()) elif prop == "IPv4": return dbus.Boolean(self.fw.is_ipv_enabled("ipv4")) elif prop == "IPv4ICMPTypes": return dbus.Array(self.fw.ipv4_supported_icmp_types, "s") elif prop == "IPv6": return dbus.Boolean(self.fw.is_ipv_enabled("ipv6")) elif prop == "IPv6_rpfilter": return dbus.Boolean(self.fw.ipv6_rpfilter_enabled) elif prop == "IPv6ICMPTypes": return dbus.Array(self.fw.ipv6_supported_icmp_types, "s") elif prop == "BRIDGE": return dbus.Boolean(self.fw.ebtables_enabled) elif prop == "IPSet": return dbus.Boolean(self.fw.ipset_enabled) elif prop == "IPSetTypes": return dbus.Array(self.fw.ipset_supported_types, "s") elif prop == "nf_conntrack_helper_setting": return dbus.Boolean(False) elif prop == "nf_conntrack_helpers": return dbus.Dictionary({}, "sas") elif prop == "nf_nat_helpers": return dbus.Dictionary({}, "sas") else: raise dbus.exceptions.DBusException( "org.freedesktop.DBus.Error.InvalidArgs: " "Property '%s' does not exist" % prop) @dbus_service_method(dbus.PROPERTIES_IFACE, in_signature='ss', out_signature='v') @dbus_handle_exceptions def Get(self, interface_name, property_name, sender=None): # pylint: disable=W0613 # get a property interface_name = dbus_to_python(interface_name, str) property_name = dbus_to_python(property_name, str) log.debug1("Get('%s', '%s')", interface_name, property_name) if interface_name == config.dbus.DBUS_INTERFACE: return self._get_property(property_name) elif interface_name in [ config.dbus.DBUS_INTERFACE_ZONE, config.dbus.DBUS_INTERFACE_DIRECT, config.dbus.DBUS_INTERFACE_POLICIES, config.dbus.DBUS_INTERFACE_IPSET ]: raise dbus.exceptions.DBusException( "org.freedesktop.DBus.Error.InvalidArgs: " "Property '%s' does not exist" % property_name) else: raise dbus.exceptions.DBusException( "org.freedesktop.DBus.Error.UnknownInterface: " "Interface '%s' does not exist" % interface_name) @dbus_service_method(dbus.PROPERTIES_IFACE, in_signature='s', out_signature='a{sv}') @dbus_handle_exceptions def GetAll(self, interface_name, sender=None): # pylint: disable=W0613 interface_name = dbus_to_python(interface_name, str) log.debug1("GetAll('%s')", interface_name) ret = { } if interface_name == config.dbus.DBUS_INTERFACE: for x in [ "version", "interface_version", "state", "IPv4", "IPv6", "IPv6_rpfilter", "BRIDGE", "IPSet", "IPSetTypes", "nf_conntrack_helper_setting", "nf_conntrack_helpers", "nf_nat_helpers", "IPv4ICMPTypes", "IPv6ICMPTypes" ]: ret[x] = self._get_property(x) elif interface_name in [ config.dbus.DBUS_INTERFACE_ZONE, config.dbus.DBUS_INTERFACE_DIRECT, config.dbus.DBUS_INTERFACE_POLICIES, config.dbus.DBUS_INTERFACE_IPSET ]: pass else: raise dbus.exceptions.DBusException( "org.freedesktop.DBus.Error.UnknownInterface: " "Interface '%s' does not exist" % interface_name) return dbus.Dictionary(ret, signature="sv") @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG) @dbus_service_method(dbus.PROPERTIES_IFACE, in_signature='ssv') @dbus_handle_exceptions def Set(self, interface_name, property_name, new_value, sender=None): interface_name = dbus_to_python(interface_name, str) property_name = dbus_to_python(property_name, str) new_value = dbus_to_python(new_value) log.debug1("Set('%s', '%s', '%s')", interface_name, property_name, new_value) self.accessCheck(sender) if interface_name == config.dbus.DBUS_INTERFACE: if property_name in [ "version", "interface_version", "state", "IPv4", "IPv6", "IPv6_rpfilter", "BRIDGE", "IPSet", "IPSetTypes", "nf_conntrack_helper_setting", "nf_conntrack_helpers", "nf_nat_helpers", "IPv4ICMPTypes", "IPv6ICMPTypes" ]: raise dbus.exceptions.DBusException( "org.freedesktop.DBus.Error.PropertyReadOnly: " "Property '%s' is read-only" % property_name) else: raise dbus.exceptions.DBusException( "org.freedesktop.DBus.Error.InvalidArgs: " "Property '%s' does not exist" % property_name) elif interface_name in [ config.dbus.DBUS_INTERFACE_ZONE, config.dbus.DBUS_INTERFACE_DIRECT, config.dbus.DBUS_INTERFACE_POLICIES, config.dbus.DBUS_INTERFACE_IPSET ]: raise dbus.exceptions.DBusException( "org.freedesktop.DBus.Error.InvalidArgs: " "Property '%s' does not exist" % property_name) else: raise dbus.exceptions.DBusException( "org.freedesktop.DBus.Error.UnknownInterface: " "Interface '%s' does not exist" % interface_name) @dbus.service.signal(dbus.PROPERTIES_IFACE, signature='sa{sv}as') def PropertiesChanged(self, interface_name, changed_properties, invalidated_properties): interface_name = dbus_to_python(interface_name, str) changed_properties = dbus_to_python(changed_properties) invalidated_properties = dbus_to_python(invalidated_properties) log.debug1("PropertiesChanged('%s', '%s', '%s')", interface_name, changed_properties, invalidated_properties) @dbus_polkit_require_auth(config.dbus.PK_ACTION_INFO) @dbus_service_method(dbus.INTROSPECTABLE_IFACE, out_signature='s') @dbus_handle_exceptions def Introspect(self, sender=None): # pylint: disable=W0613 log.debug2("Introspect()") data = super(FirewallD, self).Introspect(self.path, self.busname.get_bus()) data = dbus_introspection_add_properties(self, data, config.dbus.DBUS_INTERFACE) for interface in [config.dbus.DBUS_INTERFACE_DIRECT]: data = dbus_introspection_add_deprecated(self, data, interface, dbus_service_method_deprecated().deprecated, dbus_service_signal_deprecated().deprecated) return data # reload @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG) @dbus_service_method(config.dbus.DBUS_INTERFACE, in_signature='', out_signature='') @dbus_handle_exceptions def reload(self, sender=None): # pylint: disable=W0613 """Reload the firewall rules. """ log.debug1("reload()") self.fw.reload() self.config.reload() self.Reloaded() # complete_reload @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG) @dbus_service_method(config.dbus.DBUS_INTERFACE, in_signature='', out_signature='') @dbus_handle_exceptions def completeReload(self, sender=None): # pylint: disable=W0613 """Completely reload the firewall. Completely reload the firewall: Stops firewall, unloads modules and starts the firewall again. """ log.debug1("completeReload()") self.fw.reload(True) self.config.reload() self.Reloaded() @dbus.service.signal(config.dbus.DBUS_INTERFACE) @dbus_handle_exceptions def Reloaded(self): log.debug1("Reloaded()") @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG) @dbus_service_method(config.dbus.DBUS_INTERFACE, in_signature='', out_signature='') @dbus_handle_exceptions def checkPermanentConfig(self, sender=None): # pylint: disable=W0613 """Check permanent configuration """ log.debug1("checkPermanentConfig()") check_on_disk_config(self.fw) # runtime to permanent @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG) @dbus_service_method(config.dbus.DBUS_INTERFACE, in_signature='', out_signature='') @dbus_handle_exceptions def runtimeToPermanent(self, sender=None): # pylint: disable=W0613 """Make runtime configuration permanent """ log.debug1("copyRuntimeToPermanent()") error = False # Services or icmptypes can not be modified in runtime, but they can # be removed or modified in permanent environment. Therefore copying # of services and icmptypes to permanent is also needed. # services config_names = self.config.getServiceNames() for name in self.fw.service.get_services(): conf = self.getServiceSettings(name) try: if name in config_names: conf_obj = self.config.getServiceByName(name) if conf_obj.getSettings() != conf: log.debug1("Copying service '%s' settings" % name) conf_obj.update(conf) else: log.debug1("Service '%s' is identical, ignoring." % name) else: log.debug1("Creating service '%s'" % name) self.config.addService(name, conf) except Exception as e: log.warning( "Runtime To Permanent failed on service '%s': %s" % \ (name, e)) error = True # icmptypes config_names = self.config.getIcmpTypeNames() for name in self.fw.icmptype.get_icmptypes(): conf = self.getIcmpTypeSettings(name) try: if name in config_names: conf_obj = self.config.getIcmpTypeByName(name) if conf_obj.getSettings() != conf: log.debug1("Copying icmptype '%s' settings" % name) conf_obj.update(conf) else: log.debug1("IcmpType '%s' is identical, ignoring." % name) else: log.debug1("Creating icmptype '%s'" % name) self.config.addIcmpType(name, conf) except Exception as e: log.warning( "Runtime To Permanent failed on icmptype '%s': %s" % \ (name, e)) error = True # ipsets config_names = self.config.getIPSetNames() for name in self.fw.ipset.get_ipsets(): try: conf = self.getIPSetSettings(name) if name in config_names: conf_obj = self.config.getIPSetByName(name) if conf_obj.getSettings() != conf: log.debug1("Copying ipset '%s' settings" % name) conf_obj.update(conf) else: log.debug1("IPSet '%s' is identical, ignoring." % name) else: log.debug1("Creating ipset '%s'" % name) self.config.addIPSet(name, conf) except Exception as e: log.warning( "Runtime To Permanent failed on ipset '%s': %s" % \ (name, e)) error = True # zones config_names = self.config.getZoneNames() for name in self.fw.zone.get_zones(): conf = self.getZoneSettings2(name) settings = FirewallClientZoneSettings(conf) changed = False for interface in self.fw._nm_assigned_interfaces: log.debug1("Zone '%s': interface binding for '%s' has been added by NM, ignoring." % (name, interface)) settings.removeInterface(interface) changed = True # For the remaining interfaces, attempt to let NM manage them for interface in settings.getInterfaces(): try: connection = nm_get_connection_of_interface(interface) if connection and nm_set_zone_of_connection(name, connection): settings.removeInterface(interface) changed = True except Exception: pass if changed: conf = settings.getSettingsDict() # For the remaining try to update the ifcfg files for interface in settings.getInterfaces(): ifcfg_set_zone_of_interface(name, interface) try: if name in config_names: conf_obj = self.config.getZoneByName(name) log.debug1("Copying zone '%s' settings" % name) conf_obj.update2(conf) else: log.debug1("Creating zone '%s'" % name) self.config.addZone2(name, conf) except Exception as e: log.warning( "Runtime To Permanent failed on zone '%s': %s" % \ (name, e)) error = True # policies config_names = self.config.getPolicyNames() for name in self.fw.policy.get_policies_not_derived_from_zone(): conf = self.getPolicySettings(name) try: if name in config_names: conf_obj = self.config.getPolicyByName(name) conf_obj.update(conf) else: log.debug1("Creating policy '%s'" % name) self.config.addPolicy(name, conf) except Exception as e: log.warning( "Runtime To Permanent failed on policy '%s': %s" % \ (name, e)) error = True # helpers config_names = self.config.getHelperNames() for name in self.fw.helper.get_helpers(): conf = self.getHelperSettings(name) try: if name in config_names: conf_obj = self.config.getHelperByName(name) if conf_obj.getSettings() != conf: log.debug1("Copying helper '%s' settings" % name) conf_obj.update(conf) else: log.debug1("Helper '%s' is identical, ignoring." % name) else: log.debug1("Creating helper '%s'" % name) self.config.addHelper(name, conf) except Exception as e: log.warning( "Runtime To Permanent failed on helper '%s': %s" % \ (name, e)) error = True # direct # rt_config = self.fw.direct.get_config() conf = ( self.fw.direct.get_all_chains(), self.fw.direct.get_all_rules(), self.fw.direct.get_all_passthroughs() ) try: if self.config.getSettings() != conf: log.debug1("Copying direct configuration") self.config.update(conf) else: log.debug1("Direct configuration is identical, ignoring.") except Exception as e: log.warning( "Runtime To Permanent failed on direct configuration: %s" % e) error = True # policies conf = self.fw.policies.lockdown_whitelist.export_config() try: if self.config.getSettings() != conf: log.debug1("Copying policies configuration") self.config.setLockdownWhitelist(conf) else: log.debug1("Policies configuration is identical, ignoring.") except Exception as e: log.warning( "Runtime To Permanent failed on policies configuration: %s" % \ e) error = True if error: raise FirewallError(errors.RT_TO_PERM_FAILED) # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # POLICIES # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # lockdown @dbus_polkit_require_auth(config.dbus.PK_ACTION_POLICIES) @dbus_service_method(config.dbus.DBUS_INTERFACE_POLICIES, in_signature='', out_signature='') @dbus_handle_exceptions def enableLockdown(self, sender=None): """Enable lockdown policies """ log.debug1("policies.enableLockdown()") self.accessCheck(sender) self.fw.policies.enable_lockdown() self.LockdownEnabled() @dbus_polkit_require_auth(config.dbus.PK_ACTION_POLICIES) @dbus_service_method(config.dbus.DBUS_INTERFACE_POLICIES, in_signature='', out_signature='') @dbus_handle_exceptions def disableLockdown(self, sender=None): """Disable lockdown policies """ log.debug1("policies.disableLockdown()") self.accessCheck(sender) self.fw.policies.disable_lockdown() self.LockdownDisabled() @dbus_polkit_require_auth(config.dbus.PK_ACTION_POLICIES_INFO) @dbus_service_method(config.dbus.DBUS_INTERFACE_POLICIES, in_signature='', out_signature='b') @dbus_handle_exceptions def queryLockdown(self, sender=None): # pylint: disable=W0613 """Retuns True if lockdown is enabled """ log.debug1("policies.queryLockdown()") # no access check here return self.fw.policies.query_lockdown() @dbus.service.signal(config.dbus.DBUS_INTERFACE_POLICIES, signature='') @dbus_handle_exceptions def LockdownEnabled(self): log.debug1("LockdownEnabled()") @dbus.service.signal(config.dbus.DBUS_INTERFACE_POLICIES, signature='') @dbus_handle_exceptions def LockdownDisabled(self): log.debug1("LockdownDisabled()") # lockdown whitelist # command @dbus_polkit_require_auth(config.dbus.PK_ACTION_POLICIES) @dbus_service_method(config.dbus.DBUS_INTERFACE_POLICIES, in_signature='s', out_signature='') @dbus_handle_exceptions def addLockdownWhitelistCommand(self, command, sender=None): """Add lockdown command """ command = dbus_to_python(command, str) log.debug1("policies.addLockdownWhitelistCommand('%s')" % command) self.accessCheck(sender) self.fw.policies.lockdown_whitelist.add_command(command) self.LockdownWhitelistCommandAdded(command) @dbus_polkit_require_auth(config.dbus.PK_ACTION_POLICIES) @dbus_service_method(config.dbus.DBUS_INTERFACE_POLICIES, in_signature='s', out_signature='') @dbus_handle_exceptions def removeLockdownWhitelistCommand(self, command, sender=None): """Remove lockdown command """ command = dbus_to_python(command, str) log.debug1("policies.removeLockdownWhitelistCommand('%s')" % command) self.accessCheck(sender) self.fw.policies.lockdown_whitelist.remove_command(command) self.LockdownWhitelistCommandRemoved(command) @dbus_polkit_require_auth(config.dbus.PK_ACTION_POLICIES_INFO) @dbus_service_method(config.dbus.DBUS_INTERFACE_POLICIES, in_signature='s', out_signature='b') @dbus_handle_exceptions def queryLockdownWhitelistCommand(self, command, sender=None): # pylint: disable=W0613 """Query lockdown command """ command = dbus_to_python(command, str) log.debug1("policies.queryLockdownWhitelistCommand('%s')" % command) # no access check here return self.fw.policies.lockdown_whitelist.has_command(command) @dbus_polkit_require_auth(config.dbus.PK_ACTION_POLICIES_INFO) @dbus_service_method(config.dbus.DBUS_INTERFACE_POLICIES, in_signature='', out_signature='as') @dbus_handle_exceptions def getLockdownWhitelistCommands(self, sender=None): # pylint: disable=W0613 """Add lockdown command """ log.debug1("policies.getLockdownWhitelistCommands()") # no access check here return self.fw.policies.lockdown_whitelist.get_commands() @dbus.service.signal(config.dbus.DBUS_INTERFACE_POLICIES, signature='s') @dbus_handle_exceptions def LockdownWhitelistCommandAdded(self, command): log.debug1("LockdownWhitelistCommandAdded('%s')" % command) @dbus.service.signal(config.dbus.DBUS_INTERFACE_POLICIES, signature='s') @dbus_handle_exceptions def LockdownWhitelistCommandRemoved(self, command): log.debug1("LockdownWhitelistCommandRemoved('%s')" % command) # uid @dbus_polkit_require_auth(config.dbus.PK_ACTION_POLICIES) @dbus_service_method(config.dbus.DBUS_INTERFACE_POLICIES, in_signature='i', out_signature='') @dbus_handle_exceptions def addLockdownWhitelistUid(self, uid, sender=None): """Add lockdown uid """ uid = dbus_to_python(uid, int) log.debug1("policies.addLockdownWhitelistUid('%s')" % uid) self.accessCheck(sender) self.fw.policies.lockdown_whitelist.add_uid(uid) self.LockdownWhitelistUidAdded(uid) @dbus_polkit_require_auth(config.dbus.PK_ACTION_POLICIES) @dbus_service_method(config.dbus.DBUS_INTERFACE_POLICIES, in_signature='i', out_signature='') @dbus_handle_exceptions def removeLockdownWhitelistUid(self, uid, sender=None): """Remove lockdown uid """ uid = dbus_to_python(uid, int) log.debug1("policies.removeLockdownWhitelistUid('%s')" % uid) self.accessCheck(sender) self.fw.policies.lockdown_whitelist.remove_uid(uid) self.LockdownWhitelistUidRemoved(uid) @dbus_polkit_require_auth(config.dbus.PK_ACTION_POLICIES_INFO) @dbus_service_method(config.dbus.DBUS_INTERFACE_POLICIES, in_signature='i', out_signature='b') @dbus_handle_exceptions def queryLockdownWhitelistUid(self, uid, sender=None): # pylint: disable=W0613 """Query lockdown uid """ uid = dbus_to_python(uid, int) log.debug1("policies.queryLockdownWhitelistUid('%s')" % uid) # no access check here return self.fw.policies.lockdown_whitelist.has_uid(uid) @dbus_polkit_require_auth(config.dbus.PK_ACTION_POLICIES_INFO) @dbus_service_method(config.dbus.DBUS_INTERFACE_POLICIES, in_signature='', out_signature='ai') @dbus_handle_exceptions def getLockdownWhitelistUids(self, sender=None): # pylint: disable=W0613 """Add lockdown uid """ log.debug1("policies.getLockdownWhitelistUids()") # no access check here return self.fw.policies.lockdown_whitelist.get_uids() @dbus.service.signal(config.dbus.DBUS_INTERFACE_POLICIES, signature='i') @dbus_handle_exceptions def LockdownWhitelistUidAdded(self, uid): log.debug1("LockdownWhitelistUidAdded(%d)" % uid) @dbus.service.signal(config.dbus.DBUS_INTERFACE_POLICIES, signature='i') @dbus_handle_exceptions def LockdownWhitelistUidRemoved(self, uid): log.debug1("LockdownWhitelistUidRemoved(%d)" % uid) # user @dbus_polkit_require_auth(config.dbus.PK_ACTION_POLICIES) @dbus_service_method(config.dbus.DBUS_INTERFACE_POLICIES, in_signature='s', out_signature='') @dbus_handle_exceptions def addLockdownWhitelistUser(self, user, sender=None): """Add lockdown user """ user = dbus_to_python(user, str) log.debug1("policies.addLockdownWhitelistUser('%s')" % user) self.accessCheck(sender) self.fw.policies.lockdown_whitelist.add_user(user) self.LockdownWhitelistUserAdded(user) @dbus_polkit_require_auth(config.dbus.PK_ACTION_POLICIES) @dbus_service_method(config.dbus.DBUS_INTERFACE_POLICIES, in_signature='s', out_signature='') @dbus_handle_exceptions def removeLockdownWhitelistUser(self, user, sender=None): """Remove lockdown user """ user = dbus_to_python(user, str) log.debug1("policies.removeLockdownWhitelistUser('%s')" % user) self.accessCheck(sender) self.fw.policies.lockdown_whitelist.remove_user(user) self.LockdownWhitelistUserRemoved(user) @dbus_polkit_require_auth(config.dbus.PK_ACTION_POLICIES_INFO) @dbus_service_method(config.dbus.DBUS_INTERFACE_POLICIES, in_signature='s', out_signature='b') @dbus_handle_exceptions def queryLockdownWhitelistUser(self, user, sender=None): # pylint: disable=W0613 """Query lockdown user """ user = dbus_to_python(user, str) log.debug1("policies.queryLockdownWhitelistUser('%s')" % user) # no access check here return self.fw.policies.lockdown_whitelist.has_user(user) @dbus_polkit_require_auth(config.dbus.PK_ACTION_POLICIES_INFO) @dbus_service_method(config.dbus.DBUS_INTERFACE_POLICIES, in_signature='', out_signature='as') @dbus_handle_exceptions def getLockdownWhitelistUsers(self, sender=None): # pylint: disable=W0613 """Add lockdown user """ log.debug1("policies.getLockdownWhitelistUsers()") # no access check here return self.fw.policies.lockdown_whitelist.get_users() @dbus.service.signal(config.dbus.DBUS_INTERFACE_POLICIES, signature='s') @dbus_handle_exceptions def LockdownWhitelistUserAdded(self, user): log.debug1("LockdownWhitelistUserAdded('%s')" % user) @dbus.service.signal(config.dbus.DBUS_INTERFACE_POLICIES, signature='s') @dbus_handle_exceptions def LockdownWhitelistUserRemoved(self, user): log.debug1("LockdownWhitelistUserRemoved('%s')" % user) # context @dbus_polkit_require_auth(config.dbus.PK_ACTION_POLICIES) @dbus_service_method(config.dbus.DBUS_INTERFACE_POLICIES, in_signature='s', out_signature='') @dbus_handle_exceptions def addLockdownWhitelistContext(self, context, sender=None): """Add lockdown context """ context = dbus_to_python(context, str) log.debug1("policies.addLockdownWhitelistContext('%s')" % context) self.accessCheck(sender) self.fw.policies.lockdown_whitelist.add_context(context) self.LockdownWhitelistContextAdded(context) @dbus_polkit_require_auth(config.dbus.PK_ACTION_POLICIES) @dbus_service_method(config.dbus.DBUS_INTERFACE_POLICIES, in_signature='s', out_signature='') @dbus_handle_exceptions def removeLockdownWhitelistContext(self, context, sender=None): """Remove lockdown context """ context = dbus_to_python(context, str) log.debug1("policies.removeLockdownWhitelistContext('%s')" % context) self.accessCheck(sender) self.fw.policies.lockdown_whitelist.remove_context(context) self.LockdownWhitelistContextRemoved(context) @dbus_polkit_require_auth(config.dbus.PK_ACTION_POLICIES_INFO) @dbus_service_method(config.dbus.DBUS_INTERFACE_POLICIES, in_signature='s', out_signature='b') @dbus_handle_exceptions def queryLockdownWhitelistContext(self, context, sender=None): # pylint: disable=W0613 """Query lockdown context """ context = dbus_to_python(context, str) log.debug1("policies.queryLockdownWhitelistContext('%s')" % context) # no access check here return self.fw.policies.lockdown_whitelist.has_context(context) @dbus_polkit_require_auth(config.dbus.PK_ACTION_POLICIES_INFO) @dbus_service_method(config.dbus.DBUS_INTERFACE_POLICIES, in_signature='', out_signature='as') @dbus_handle_exceptions def getLockdownWhitelistContexts(self, sender=None): # pylint: disable=W0613 """Add lockdown context """ log.debug1("policies.getLockdownWhitelistContexts()") # no access check here return self.fw.policies.lockdown_whitelist.get_contexts() @dbus.service.signal(config.dbus.DBUS_INTERFACE_POLICIES, signature='s') @dbus_handle_exceptions def LockdownWhitelistContextAdded(self, context): log.debug1("LockdownWhitelistContextAdded('%s')" % context) @dbus.service.signal(config.dbus.DBUS_INTERFACE_POLICIES, signature='s') @dbus_handle_exceptions def LockdownWhitelistContextRemoved(self, context): log.debug1("LockdownWhitelistContextRemoved('%s')" % context) # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # PANIC @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG) @dbus_service_method(config.dbus.DBUS_INTERFACE, in_signature='', out_signature='') @dbus_handle_exceptions def enablePanicMode(self, sender=None): """Enable panic mode. All ingoing and outgoing connections and packets will be blocked. """ log.debug1("enablePanicMode()") self.accessCheck(sender) self.fw.enable_panic_mode() self.PanicModeEnabled() @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG) @dbus_service_method(config.dbus.DBUS_INTERFACE, in_signature='', out_signature='') @dbus_handle_exceptions def disablePanicMode(self, sender=None): """Disable panic mode. Enables normal mode: Allowed ingoing and outgoing connections will not be blocked anymore """ log.debug1("disablePanicMode()") self.accessCheck(sender) self.fw.disable_panic_mode() self.PanicModeDisabled() @dbus_polkit_require_auth(config.dbus.PK_ACTION_INFO) @dbus_service_method(config.dbus.DBUS_INTERFACE, in_signature='', out_signature='b') @dbus_handle_exceptions def queryPanicMode(self, sender=None): # pylint: disable=W0613 # returns True if in panic mode log.debug1("queryPanicMode()") return self.fw.query_panic_mode() @dbus.service.signal(config.dbus.DBUS_INTERFACE, signature='') @dbus_handle_exceptions def PanicModeEnabled(self): log.debug1("PanicModeEnabled()") @dbus.service.signal(config.dbus.DBUS_INTERFACE, signature='') @dbus_handle_exceptions def PanicModeDisabled(self): log.debug1("PanicModeDisabled()") # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # list functions @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG_INFO) @dbus_service_method(config.dbus.DBUS_INTERFACE, in_signature='s', out_signature="(sssbsasa(ss)asba(ssss)asasasasa(ss)b)") @dbus_handle_exceptions def getZoneSettings(self, zone, sender=None): # pylint: disable=W0613 # returns zone settings for zone zone = dbus_to_python(zone, str) log.debug1("getZoneSettings(%s)", zone) return self.fw.zone.get_config_with_settings(zone) @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG_INFO) @dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='s', out_signature="a{sv}") @dbus_handle_exceptions def getZoneSettings2(self, zone, sender=None): zone = dbus_to_python(zone, str) log.debug1("getZoneSettings2(%s)", zone) return self.fw.zone.get_config_with_settings_dict(zone) @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG_INFO) @dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='sa{sv}') @dbus_handle_exceptions def setZoneSettings2(self, zone, settings, sender=None): zone = dbus_to_python(zone, str) log.debug1("setZoneSettings2(%s)", zone) self.accessCheck(sender) self.fw.zone.set_config_with_settings_dict(zone, dbus_to_python(settings), sender) self.ZoneUpdated(zone, settings) @dbus.service.signal(config.dbus.DBUS_INTERFACE_ZONE, signature='sa{sv}') @dbus_handle_exceptions def ZoneUpdated(self, zone, settings): log.debug1("zone.ZoneUpdated('%s', '%s')" % (zone, settings)) @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG_INFO) @dbus_service_method(config.dbus.DBUS_INTERFACE_POLICY, in_signature='s', out_signature="a{sv}") @dbus_handle_exceptions def getPolicySettings(self, policy, sender=None): policy = dbus_to_python(policy, str) log.debug1("policy.getPolicySettings(%s)", policy) return self.fw.policy.get_config_with_settings_dict(policy) @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG_INFO) @dbus_service_method(config.dbus.DBUS_INTERFACE_POLICY, in_signature='sa{sv}') @dbus_handle_exceptions def setPolicySettings(self, policy, settings, sender=None): policy = dbus_to_python(policy, str) log.debug1("policy.setPolicySettings(%s)", policy) self.accessCheck(sender) self.fw.policy.set_config_with_settings_dict(policy, dbus_to_python(settings), sender) self.PolicyUpdated(policy, settings) @dbus.service.signal(config.dbus.DBUS_INTERFACE_POLICY, signature='sa{sv}') @dbus_handle_exceptions def PolicyUpdated(self, policy, settings): log.debug1("policy.PolicyUpdated('%s', '%s')" % (policy, settings)) @dbus_polkit_require_auth(config.dbus.PK_ACTION_INFO) @dbus_service_method(config.dbus.DBUS_INTERFACE, in_signature='', out_signature='as') @dbus_handle_exceptions def listServices(self, sender=None): # pylint: disable=W0613 # returns the list of services # TODO: should be renamed to getServices() # because is called by firewall-cmd --get-services log.debug1("listServices()") return self.fw.service.get_services() @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG_INFO) @dbus_service_method(config.dbus.DBUS_INTERFACE, in_signature='s', out_signature='(sssa(ss)asa{ss}asa(ss))') @dbus_handle_exceptions def getServiceSettings(self, service, sender=None): # pylint: disable=W0613 # returns service settings for service service = dbus_to_python(service, str) log.debug1("getServiceSettings(%s)", service) obj = self.fw.service.get_service(service) conf_dict = obj.export_config_dict() conf_list = [] for i in range(8): # tuple based dbus API has 8 elements if obj.IMPORT_EXPORT_STRUCTURE[i][0] not in conf_dict: # old API needs the empty elements as well. Grab it from the # object otherwise we don't know the type. conf_list.append(copy.deepcopy(getattr(obj, obj.IMPORT_EXPORT_STRUCTURE[i][0]))) else: conf_list.append(conf_dict[obj.IMPORT_EXPORT_STRUCTURE[i][0]]) return tuple(conf_list) @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG_INFO) @dbus_service_method(config.dbus.DBUS_INTERFACE, in_signature='s', out_signature='a{sv}') @dbus_handle_exceptions def getServiceSettings2(self, service, sender=None): # pylint: disable=W0613 service = dbus_to_python(service, str) log.debug1("getServiceSettings2(%s)", service) obj = self.fw.service.get_service(service) return obj.export_config_dict() @dbus_polkit_require_auth(config.dbus.PK_ACTION_INFO) @dbus_service_method(config.dbus.DBUS_INTERFACE, in_signature='', out_signature='as') @dbus_handle_exceptions def listIcmpTypes(self, sender=None): # pylint: disable=W0613 # returns the list of services # TODO: should be renamed to getIcmptypes() # because is called by firewall-cmd --get-icmptypes log.debug1("listIcmpTypes()") return self.fw.icmptype.get_icmptypes() @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG_INFO) @dbus_service_method(config.dbus.DBUS_INTERFACE, in_signature='s', out_signature=IcmpType.DBUS_SIGNATURE) @dbus_handle_exceptions def getIcmpTypeSettings(self, icmptype, sender=None): # pylint: disable=W0613 # returns icmptype settings for icmptype icmptype = dbus_to_python(icmptype, str) log.debug1("getIcmpTypeSettings(%s)", icmptype) return self.fw.icmptype.get_icmptype(icmptype).export_config() # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # LOG DENIED @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG_INFO) @dbus_service_method(config.dbus.DBUS_INTERFACE, in_signature='', out_signature='s') @dbus_handle_exceptions def getLogDenied(self, sender=None): # pylint: disable=W0613 # returns the log denied value log.debug1("getLogDenied()") return self.fw.get_log_denied() @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG) @dbus_service_method(config.dbus.DBUS_INTERFACE, in_signature='s', out_signature='') @dbus_handle_exceptions def setLogDenied(self, value, sender=None): # set the log denied value value = dbus_to_python(value, str) log.debug1("setLogDenied('%s')" % value) self.accessCheck(sender) self.fw.set_log_denied(value) self.LogDeniedChanged(value) # must reload the firewall as well self.fw.reload() self.config.reload() self.Reloaded() @dbus.service.signal(config.dbus.DBUS_INTERFACE, signature='s') @dbus_handle_exceptions def LogDeniedChanged(self, value): log.debug1("LogDeniedChanged('%s')" % (value)) # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # AUTOMATIC HELPER ASSIGNMENT @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG_INFO) @dbus_service_method(config.dbus.DBUS_INTERFACE, in_signature='', out_signature='s') @dbus_handle_exceptions def getAutomaticHelpers(self, sender=None): # pylint: disable=W0613 # returns the automatic helpers value log.debug1("getAutomaticHelpers()") # NOTE: This feature was removed and is now a noop. We retain the dbus # call to keep API. return "no" @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG) @dbus_service_method(config.dbus.DBUS_INTERFACE, in_signature='s', out_signature='') @dbus_handle_exceptions def setAutomaticHelpers(self, value, sender=None): # set the automatic helpers value value = dbus_to_python(value, str) log.debug1("setAutomaticHelpers('%s')" % value) self.accessCheck(sender) # NOTE: This feature was removed and is now a noop. We retain the dbus # call to keep API. @dbus.service.signal(config.dbus.DBUS_INTERFACE, signature='s') @dbus_handle_exceptions def AutomaticHelpersChanged(self, value): log.debug1("AutomaticHelpersChanged('%s')" % (value)) # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # DEFAULT ZONE @dbus_polkit_require_auth(config.dbus.PK_ACTION_INFO) @dbus_service_method(config.dbus.DBUS_INTERFACE, in_signature='', out_signature='s') @dbus_handle_exceptions def getDefaultZone(self, sender=None): # pylint: disable=W0613 # returns the system default zone log.debug1("getDefaultZone()") return self.fw.get_default_zone() @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG) @dbus_service_method(config.dbus.DBUS_INTERFACE, in_signature='s', out_signature='') @dbus_handle_exceptions def setDefaultZone(self, zone, sender=None): # set the system default zone zone = dbus_to_python(zone, str) log.debug1("setDefaultZone('%s')" % zone) self.accessCheck(sender) self.fw.set_default_zone(zone) self.DefaultZoneChanged(zone) @dbus.service.signal(config.dbus.DBUS_INTERFACE, signature='s') @dbus_handle_exceptions def DefaultZoneChanged(self, zone): log.debug1("DefaultZoneChanged('%s')" % (zone)) # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # POLICY INTERFACE # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # POLICIES @dbus_polkit_require_auth(config.dbus.PK_ACTION_INFO) @dbus_service_method(config.dbus.DBUS_INTERFACE_POLICY, in_signature='', out_signature='as') @dbus_handle_exceptions def getPolicies(self, sender=None): log.debug1("policy.getPolicies()") return self.fw.policy.get_policies_not_derived_from_zone() @dbus_polkit_require_auth(config.dbus.PK_ACTION_INFO) @dbus_service_method(config.dbus.DBUS_INTERFACE_POLICY, in_signature='', out_signature='a{sa{sas}}') @dbus_handle_exceptions def getActivePolicies(self, sender=None): log.debug1("policy.getActivePolicies()") policies = { } for policy in self.fw.policy.get_active_policies_not_derived_from_zone(): policies[policy] = { } policies[policy]["ingress_zones"] = self.fw.policy.list_ingress_zones(policy) policies[policy]["egress_zones"] = self.fw.policy.list_egress_zones(policy) return policies # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # ZONE INTERFACE # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # ZONES @dbus_polkit_require_auth(config.dbus.PK_ACTION_INFO) # TODO: shouldn't this be in DBUS_INTERFACE instead of DBUS_INTERFACE_ZONE ? @dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='', out_signature='as') @dbus_handle_exceptions def getZones(self, sender=None): # pylint: disable=W0613 # returns the list of zones log.debug1("zone.getZones()") return self.fw.zone.get_zones() @dbus_polkit_require_auth(config.dbus.PK_ACTION_INFO) @dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='', out_signature='a{sa{sas}}') @dbus_handle_exceptions def getActiveZones(self, sender=None): # pylint: disable=W0613 # returns the list of active zones log.debug1("zone.getActiveZones()") zones = { } for zone in self.fw.zone.get_zones(): interfaces = self.fw.zone.list_interfaces(zone) sources = self.fw.zone.list_sources(zone) if len(interfaces) + len(sources) > 0: zones[zone] = { } if len(interfaces) > 0: zones[zone]["interfaces"] = interfaces if len(sources) > 0: zones[zone]["sources"] = sources return zones @dbus_polkit_require_auth(config.dbus.PK_ACTION_INFO) @dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='s', out_signature='s') @dbus_handle_exceptions def getZoneOfInterface(self, interface, sender=None): # pylint: disable=W0613 """Return the zone an interface belongs to. :Parameters: `interface` : str Name of the interface :Returns: str. The name of the zone. """ interface = dbus_to_python(interface, str) log.debug1("zone.getZoneOfInterface('%s')" % interface) zone = self.fw.zone.get_zone_of_interface(interface) if zone: return zone return "" @dbus_polkit_require_auth(config.dbus.PK_ACTION_INFO) @dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='s', out_signature='s') @dbus_handle_exceptions def getZoneOfSource(self, source, sender=None): # pylint: disable=W0613 #Return the zone an source belongs to. source = dbus_to_python(source, str) log.debug1("zone.getZoneOfSource('%s')" % source) zone = self.fw.zone.get_zone_of_source(source) if zone: return zone return "" @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG_INFO) @dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='s', out_signature='b') @dbus_handle_exceptions def isImmutable(self, zone, sender=None): # pylint: disable=W0613 # no immutable zones anymore return False # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # INTERFACES @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG) @dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='ss', out_signature='s') @dbus_handle_exceptions def addInterface(self, zone, interface, sender=None): """Add an interface to a zone. If zone is empty, use default zone. """ zone = dbus_to_python(zone, str) interface = dbus_to_python(interface, str) log.debug1("zone.addInterface('%s', '%s')" % (zone, interface)) self.accessCheck(sender) _zone = self.fw.zone.add_interface(zone, interface, sender) self.InterfaceAdded(_zone, interface) return _zone @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG) @dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='ss', out_signature='s') @dbus_handle_exceptions def changeZone(self, zone, interface, sender=None): """Change a zone an interface is part of. If zone is empty, use default zone. This function is deprecated, use changeZoneOfInterface instead """ zone = dbus_to_python(zone, str) interface = dbus_to_python(interface, str) return self.changeZoneOfInterface(zone, interface, sender) @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG) @dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='ss', out_signature='s') @dbus_handle_exceptions def changeZoneOfInterface(self, zone, interface, sender=None): """Change a zone an interface is part of. If zone is empty, use default zone. """ zone = dbus_to_python(zone, str) interface = dbus_to_python(interface, str) log.debug1("zone.changeZoneOfInterface('%s', '%s')" % (zone, interface)) self.accessCheck(sender) _zone = self.fw.zone.change_zone_of_interface(zone, interface, sender) self.ZoneOfInterfaceChanged(_zone, interface) return _zone @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG) @dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='ss', out_signature='s') @dbus_handle_exceptions def removeInterface(self, zone, interface, sender=None): """Remove interface from a zone. If zone is empty, remove from zone the interface belongs to. """ zone = dbus_to_python(zone, str) interface = dbus_to_python(interface, str) log.debug1("zone.removeInterface('%s', '%s')" % (zone, interface)) self.accessCheck(sender) _zone = self.fw.zone.remove_interface(zone, interface) self.InterfaceRemoved(_zone, interface) return _zone @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG_INFO) @dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='ss', out_signature='b') @dbus_handle_exceptions def queryInterface(self, zone, interface, sender=None): # pylint: disable=W0613 """Return true if an interface is in a zone. If zone is empty, use default zone. """ zone = dbus_to_python(zone, str) interface = dbus_to_python(interface, str) log.debug1("zone.queryInterface('%s', '%s')" % (zone, interface)) return self.fw.zone.query_interface(zone, interface) @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG_INFO) @dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='s', out_signature='as') @dbus_handle_exceptions def getInterfaces(self, zone, sender=None): # pylint: disable=W0613 """Return the list of interfaces of a zone. If zone is empty, use default zone. """ # TODO: should be renamed to listInterfaces() # because is called by firewall-cmd --zone --list-interfaces zone = dbus_to_python(zone, str) log.debug1("zone.getInterfaces('%s')" % (zone)) return self.fw.zone.list_interfaces(zone) @dbus.service.signal(config.dbus.DBUS_INTERFACE_ZONE, signature='ss') @dbus_handle_exceptions def InterfaceAdded(self, zone, interface): log.debug1("zone.InterfaceAdded('%s', '%s')" % (zone, interface)) @dbus.service.signal(config.dbus.DBUS_INTERFACE_ZONE, signature='ss') @dbus_handle_exceptions def ZoneChanged(self, zone, interface): """ This signal is deprecated. """ log.debug1("zone.ZoneChanged('%s', '%s')" % (zone, interface)) @dbus.service.signal(config.dbus.DBUS_INTERFACE_ZONE, signature='ss') @dbus_handle_exceptions def ZoneOfInterfaceChanged(self, zone, interface): log.debug1("zone.ZoneOfInterfaceChanged('%s', '%s')" % (zone, interface)) self.ZoneChanged(zone, interface) @dbus.service.signal(config.dbus.DBUS_INTERFACE_ZONE, signature='ss') @dbus_handle_exceptions def InterfaceRemoved(self, zone, interface): log.debug1("zone.InterfaceRemoved('%s', '%s')" % (zone, interface)) # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # SOURCES @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG) @dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='ss', out_signature='s') @dbus_handle_exceptions def addSource(self, zone, source, sender=None): """Add a source to a zone. If zone is empty, use default zone. """ zone = dbus_to_python(zone, str) source = dbus_to_python(source, str) log.debug1("zone.addSource('%s', '%s')" % (zone, source)) self.accessCheck(sender) _zone = self.fw.zone.add_source(zone, source, sender) self.SourceAdded(_zone, source) return _zone @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG) @dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='ss', out_signature='s') @dbus_handle_exceptions def changeZoneOfSource(self, zone, source, sender=None): """Change a zone an source is part of. If zone is empty, use default zone. """ zone = dbus_to_python(zone, str) source = dbus_to_python(source, str) log.debug1("zone.changeZoneOfSource('%s', '%s')" % (zone, source)) self.accessCheck(sender) _zone = self.fw.zone.change_zone_of_source(zone, source, sender) self.ZoneOfSourceChanged(_zone, source) return _zone @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG) @dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='ss', out_signature='s') @dbus_handle_exceptions def removeSource(self, zone, source, sender=None): """Remove source from a zone. If zone is empty, remove from zone the source belongs to. """ zone = dbus_to_python(zone, str) source = dbus_to_python(source, str) log.debug1("zone.removeSource('%s', '%s')" % (zone, source)) self.accessCheck(sender) _zone = self.fw.zone.remove_source(zone, source) self.SourceRemoved(_zone, source) return _zone @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG_INFO) @dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='ss', out_signature='b') @dbus_handle_exceptions def querySource(self, zone, source, sender=None): # pylint: disable=W0613 """Return true if an source is in a zone. If zone is empty, use default zone. """ zone = dbus_to_python(zone, str) source = dbus_to_python(source, str) log.debug1("zone.querySource('%s', '%s')" % (zone, source)) return self.fw.zone.query_source(zone, source) @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG_INFO) @dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='s', out_signature='as') @dbus_handle_exceptions def getSources(self, zone, sender=None): # pylint: disable=W0613 """Return the list of sources of a zone. If zone is empty, use default zone. """ # TODO: should be renamed to listSources() # because is called by firewall-cmd --zone --list-sources zone = dbus_to_python(zone, str) log.debug1("zone.getSources('%s')" % (zone)) return self.fw.zone.list_sources(zone) @dbus.service.signal(config.dbus.DBUS_INTERFACE_ZONE, signature='ss') @dbus_handle_exceptions def SourceAdded(self, zone, source): log.debug1("zone.SourceAdded('%s', '%s')" % (zone, source)) @dbus.service.signal(config.dbus.DBUS_INTERFACE_ZONE, signature='ss') @dbus_handle_exceptions def ZoneOfSourceChanged(self, zone, source): log.debug1("zone.ZoneOfSourceChanged('%s', '%s')" % (zone, source)) @dbus.service.signal(config.dbus.DBUS_INTERFACE_ZONE, signature='ss') @dbus_handle_exceptions def SourceRemoved(self, zone, source): log.debug1("zone.SourceRemoved('%s', '%s')" % (zone, source)) # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # RICH RULES @dbus_handle_exceptions def disableTimedRichRule(self, zone, rule): log.debug1("zone.disableTimedRichRule('%s', '%s')" % (zone, rule)) del self._timeouts[zone][rule] obj = Rich_Rule(rule_str=rule) self.fw.zone.remove_rule(zone, obj) self.RichRuleRemoved(zone, rule) @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG) @dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='ssi', out_signature='s') @dbus_handle_exceptions def addRichRule(self, zone, rule, timeout, sender=None): # pylint: disable=W0613 zone = dbus_to_python(zone, str) rule = dbus_to_python(rule, str) timeout = dbus_to_python(timeout, int) log.debug1("zone.addRichRule('%s', '%s')" % (zone, rule)) obj = Rich_Rule(rule_str=rule) _zone = self.fw.zone.add_rule(zone, obj, timeout) if timeout > 0: tag = GLib.timeout_add_seconds(timeout, self.disableTimedRichRule, _zone, rule) self.addTimeout(_zone, rule, tag) self.RichRuleAdded(_zone, rule, timeout) return _zone @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG) @dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='ss', out_signature='s') @dbus_handle_exceptions def removeRichRule(self, zone, rule, sender=None): # pylint: disable=W0613 zone = dbus_to_python(zone, str) rule = dbus_to_python(rule, str) log.debug1("zone.removeRichRule('%s', '%s')" % (zone, rule)) obj = Rich_Rule(rule_str=rule) _zone = self.fw.zone.remove_rule(zone, obj) self.removeTimeout(_zone, rule) self.RichRuleRemoved(_zone, rule) return _zone @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG_INFO) @dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='ss', out_signature='b') @dbus_handle_exceptions def queryRichRule(self, zone, rule, sender=None): # pylint: disable=W0613 zone = dbus_to_python(zone, str) rule = dbus_to_python(rule, str) log.debug1("zone.queryRichRule('%s', '%s')" % (zone, rule)) obj = Rich_Rule(rule_str=rule) return self.fw.zone.query_rule(zone, obj) @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG_INFO) @dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='s', out_signature='as') @dbus_handle_exceptions def getRichRules(self, zone, sender=None): # pylint: disable=W0613 # returns the list of enabled rich rules for zone # TODO: should be renamed to listRichRules() # because is called by firewall-cmd --zone --list-rich-rules zone = dbus_to_python(zone, str) log.debug1("zone.getRichRules('%s')" % (zone)) return self.fw.zone.list_rules(zone) @dbus.service.signal(config.dbus.DBUS_INTERFACE_ZONE, signature='ssi') @dbus_handle_exceptions def RichRuleAdded(self, zone, rule, timeout): log.debug1("zone.RichRuleAdded('%s', '%s', %d)" % (zone, rule, timeout)) @dbus.service.signal(config.dbus.DBUS_INTERFACE_ZONE, signature='ss') @dbus_handle_exceptions def RichRuleRemoved(self, zone, rule): log.debug1("zone.RichRuleRemoved('%s', '%s')" % (zone, rule)) # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # SERVICES @dbus_handle_exceptions def disableTimedService(self, zone, service): log.debug1("zone.disableTimedService('%s', '%s')" % (zone, service)) del self._timeouts[zone][service] self.fw.zone.remove_service(zone, service) self.ServiceRemoved(zone, service) @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG) @dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='ssi', out_signature='s') @dbus_handle_exceptions def addService(self, zone, service, timeout, sender=None): # enables service <service> if not enabled already for zone zone = dbus_to_python(zone, str) service = dbus_to_python(service, str) timeout = dbus_to_python(timeout, int) log.debug1("zone.addService('%s', '%s', %d)" % (zone, service, timeout)) self.accessCheck(sender) _zone = self.fw.zone.add_service(zone, service, timeout, sender) if timeout > 0: tag = GLib.timeout_add_seconds(timeout, self.disableTimedService, _zone, service) self.addTimeout(_zone, service, tag) self.ServiceAdded(_zone, service, timeout) return _zone @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG) @dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='ss', out_signature='s') @dbus_handle_exceptions def removeService(self, zone, service, sender=None): # disables service for zone zone = dbus_to_python(zone, str) service = dbus_to_python(service, str) log.debug1("zone.removeService('%s', '%s')" % (zone, service)) self.accessCheck(sender) _zone = self.fw.zone.remove_service(zone, service) self.removeTimeout(_zone, service) self.ServiceRemoved(_zone, service) return _zone @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG_INFO) @dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='ss', out_signature='b') @dbus_handle_exceptions def queryService(self, zone, service, sender=None): # pylint: disable=W0613 # returns true if a service is enabled for zone zone = dbus_to_python(zone, str) service = dbus_to_python(service, str) log.debug1("zone.queryService('%s', '%s')" % (zone, service)) return self.fw.zone.query_service(zone, service) @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG_INFO) @dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='s', out_signature='as') @dbus_handle_exceptions def getServices(self, zone, sender=None): # pylint: disable=W0613 # returns the list of enabled services for zone # TODO: should be renamed to listServices() # because is called by firewall-cmd --zone --list-services zone = dbus_to_python(zone, str) log.debug1("zone.getServices('%s')" % (zone)) return self.fw.zone.list_services(zone) @dbus.service.signal(config.dbus.DBUS_INTERFACE_ZONE, signature='ssi') @dbus_handle_exceptions def ServiceAdded(self, zone, service, timeout): log.debug1("zone.ServiceAdded('%s', '%s', %d)" % \ (zone, service, timeout)) @dbus.service.signal(config.dbus.DBUS_INTERFACE_ZONE, signature='ss') @dbus_handle_exceptions def ServiceRemoved(self, zone, service): log.debug1("zone.ServiceRemoved('%s', '%s')" % (zone, service)) # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # PORTS @dbus_handle_exceptions def disableTimedPort(self, zone, port, protocol): log.debug1("zone.disableTimedPort('%s', '%s', '%s')" % \ (zone, port, protocol)) del self._timeouts[zone][(port, protocol)] self.fw.zone.remove_port(zone, port, protocol) self.PortRemoved(zone, port, protocol) @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG) @dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='sssi', out_signature='s') @dbus_handle_exceptions def addPort(self, zone, port, protocol, timeout, sender=None): # pylint: disable=R0913 # adds port <port> <protocol> if not enabled already to zone zone = dbus_to_python(zone, str) port = dbus_to_python(port, str) protocol = dbus_to_python(protocol, str) timeout = dbus_to_python(timeout, int) log.debug1("zone.addPort('%s', '%s', '%s')" % \ (zone, port, protocol)) self.accessCheck(sender) _zone = self.fw.zone.add_port(zone, port, protocol, timeout, sender) if timeout > 0: tag = GLib.timeout_add_seconds(timeout, self.disableTimedPort, _zone, port, protocol) self.addTimeout(_zone, (port, protocol), tag) self.PortAdded(_zone, port, protocol, timeout) return _zone @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG) @dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='sss', out_signature='s') @dbus_handle_exceptions def removePort(self, zone, port, protocol, sender=None): # pylint: disable=R0913 # removes port<port> <protocol> if enabled from zone zone = dbus_to_python(zone, str) port = dbus_to_python(port, str) protocol = dbus_to_python(protocol, str) log.debug1("zone.removePort('%s', '%s', '%s')" % \ (zone, port, protocol)) self.accessCheck(sender) _zone= self.fw.zone.remove_port(zone, port, protocol) self.removeTimeout(_zone, (port, protocol)) self.PortRemoved(_zone, port, protocol) return _zone @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG_INFO) @dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='sss', out_signature='b') @dbus_handle_exceptions def queryPort(self, zone, port, protocol, sender=None): # pylint: disable=W0613, R0913 # returns true if a port is enabled for zone zone = dbus_to_python(zone, str) port = dbus_to_python(port, str) protocol = dbus_to_python(protocol, str) log.debug1("zone.queryPort('%s', '%s', '%s')" % (zone, port, protocol)) return self.fw.zone.query_port(zone, port, protocol) @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG_INFO) @dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='s', out_signature='aas') @dbus_handle_exceptions def getPorts(self, zone, sender=None): # pylint: disable=W0613 # returns the list of enabled ports # TODO: should be renamed to listPorts() # because is called by firewall-cmd --zone --list-ports zone = dbus_to_python(zone, str) log.debug1("zone.getPorts('%s')" % (zone)) return self.fw.zone.list_ports(zone) @dbus.service.signal(config.dbus.DBUS_INTERFACE_ZONE, signature='sssi') @dbus_handle_exceptions def PortAdded(self, zone, port, protocol, timeout=0): log.debug1("zone.PortAdded('%s', '%s', '%s', %d)" % \ (zone, port, protocol, timeout)) @dbus.service.signal(config.dbus.DBUS_INTERFACE_ZONE, signature='sss') @dbus_handle_exceptions def PortRemoved(self, zone, port, protocol): log.debug1("zone.PortRemoved('%s', '%s', '%s')" % \ (zone, port, protocol)) # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # PROTOCOLS @dbus_handle_exceptions def disableTimedProtocol(self, zone, protocol): log.debug1("zone.disableTimedProtocol('%s', '%s')" % (zone, protocol)) del self._timeouts[zone][(protocol)] self.fw.zone.remove_protocol(zone, protocol) self.ProtocolRemoved(zone, protocol) @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG) @dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='ssi', out_signature='s') @dbus_handle_exceptions def addProtocol(self, zone, protocol, timeout, sender=None): # adds protocol <protocol> if not enabled already to zone zone = dbus_to_python(zone, str) protocol = dbus_to_python(protocol, str) timeout = dbus_to_python(timeout, int) log.debug1("zone.enableProtocol('%s', '%s')" % (zone, protocol)) self.accessCheck(sender) _zone = self.fw.zone.add_protocol(zone, protocol, timeout, sender) if timeout > 0: tag = GLib.timeout_add_seconds(timeout, self.disableTimedProtocol, _zone, protocol) self.addTimeout(_zone, protocol, tag) self.ProtocolAdded(_zone, protocol, timeout) return _zone @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG) @dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='ss', out_signature='s') @dbus_handle_exceptions def removeProtocol(self, zone, protocol, sender=None): # removes protocol<protocol> if enabled from zone zone = dbus_to_python(zone, str) protocol = dbus_to_python(protocol, str) log.debug1("zone.removeProtocol('%s', '%s')" % (zone, protocol)) self.accessCheck(sender) _zone= self.fw.zone.remove_protocol(zone, protocol) self.removeTimeout(_zone, protocol) self.ProtocolRemoved(_zone, protocol) return _zone @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG_INFO) @dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='ss', out_signature='b') @dbus_handle_exceptions def queryProtocol(self, zone, protocol, sender=None): # pylint: disable=W0613 # returns true if a protocol is enabled for zone zone = dbus_to_python(zone, str) protocol = dbus_to_python(protocol, str) log.debug1("zone.queryProtocol('%s', '%s')" % (zone, protocol)) return self.fw.zone.query_protocol(zone, protocol) @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG_INFO) @dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='s', out_signature='as') @dbus_handle_exceptions def getProtocols(self, zone, sender=None): # pylint: disable=W0613 # returns the list of enabled protocols # TODO: should be renamed to listProtocols() # because is called by firewall-cmd --zone --list-protocols zone = dbus_to_python(zone, str) log.debug1("zone.getProtocols('%s')" % (zone)) return self.fw.zone.list_protocols(zone) @dbus.service.signal(config.dbus.DBUS_INTERFACE_ZONE, signature='ssi') @dbus_handle_exceptions def ProtocolAdded(self, zone, protocol, timeout=0): log.debug1("zone.ProtocolAdded('%s', '%s', %d)" % \ (zone, protocol, timeout)) @dbus.service.signal(config.dbus.DBUS_INTERFACE_ZONE, signature='ss') @dbus_handle_exceptions def ProtocolRemoved(self, zone, protocol): log.debug1("zone.ProtocolRemoved('%s', '%s')" % (zone, protocol)) # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # SOURCE PORTS @dbus_handle_exceptions def disableTimedSourcePort(self, zone, port, protocol): log.debug1("zone.disableTimedSourcePort('%s', '%s', '%s')" % \ (zone, port, protocol)) del self._timeouts[zone][("sport", port, protocol)] self.fw.zone.remove_source_port(zone, port, protocol) self.SourcePortRemoved(zone, port, protocol) @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG) @dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='sssi', out_signature='s') @dbus_handle_exceptions def addSourcePort(self, zone, port, protocol, timeout, sender=None): # pylint: disable=R0913 # adds source port <port> <protocol> if not enabled already to zone zone = dbus_to_python(zone, str) port = dbus_to_python(port, str) protocol = dbus_to_python(protocol, str) timeout = dbus_to_python(timeout, int) log.debug1("zone.addSourcePort('%s', '%s', '%s')" % (zone, port, protocol)) self.accessCheck(sender) _zone = self.fw.zone.add_source_port(zone, port, protocol, timeout, sender) if timeout > 0: tag = GLib.timeout_add_seconds(timeout, self.disableTimedSourcePort, _zone, port, protocol) self.addTimeout(_zone, ("sport", port, protocol), tag) self.SourcePortAdded(_zone, port, protocol, timeout) return _zone @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG) @dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='sss', out_signature='s') @dbus_handle_exceptions def removeSourcePort(self, zone, port, protocol, sender=None): # pylint: disable=R0913 # removes source port<port> <protocol> if enabled from zone zone = dbus_to_python(zone, str) port = dbus_to_python(port, str) protocol = dbus_to_python(protocol, str) log.debug1("zone.removeSourcePort('%s', '%s', '%s')" % (zone, port, protocol)) self.accessCheck(sender) _zone= self.fw.zone.remove_source_port(zone, port, protocol) self.removeTimeout(_zone, ("sport", port, protocol)) self.SourcePortRemoved(_zone, port, protocol) return _zone @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG_INFO) @dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='sss', out_signature='b') @dbus_handle_exceptions def querySourcePort(self, zone, port, protocol, sender=None): # pylint: disable=W0613, R0913 # returns true if a source port is enabled for zone zone = dbus_to_python(zone, str) port = dbus_to_python(port, str) protocol = dbus_to_python(protocol, str) log.debug1("zone.querySourcePort('%s', '%s', '%s')" % (zone, port, protocol)) return self.fw.zone.query_source_port(zone, port, protocol) @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG_INFO) @dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='s', out_signature='aas') @dbus_handle_exceptions def getSourcePorts(self, zone, sender=None): # pylint: disable=W0613 # returns the list of enabled source ports # TODO: should be renamed to listSourcePorts() # because is called by firewall-cmd --zone --list-source-ports zone = dbus_to_python(zone, str) log.debug1("zone.getSourcePorts('%s')" % (zone)) return self.fw.zone.list_source_ports(zone) @dbus.service.signal(config.dbus.DBUS_INTERFACE_ZONE, signature='sssi') @dbus_handle_exceptions def SourcePortAdded(self, zone, port, protocol, timeout=0): log.debug1("zone.SourcePortAdded('%s', '%s', '%s', %d)" % \ (zone, port, protocol, timeout)) @dbus.service.signal(config.dbus.DBUS_INTERFACE_ZONE, signature='sss') @dbus_handle_exceptions def SourcePortRemoved(self, zone, port, protocol): log.debug1("zone.SourcePortRemoved('%s', '%s', '%s')" % (zone, port, protocol)) # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # MASQUERADE @dbus_handle_exceptions def disableTimedMasquerade(self, zone): del self._timeouts[zone]["masquerade"] self.fw.zone.remove_masquerade(zone) self.MasqueradeRemoved(zone) @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG) @dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='si', out_signature='s') @dbus_handle_exceptions def addMasquerade(self, zone, timeout, sender=None): # adds masquerade if not added already zone = dbus_to_python(zone, str) timeout = dbus_to_python(timeout, int) log.debug1("zone.addMasquerade('%s')" % (zone)) self.accessCheck(sender) _zone = self.fw.zone.add_masquerade(zone, timeout, sender) if timeout > 0: tag = GLib.timeout_add_seconds(timeout, self.disableTimedMasquerade, _zone) self.addTimeout(_zone, "masquerade", tag) self.MasqueradeAdded(_zone, timeout) return _zone @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG) @dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='s', out_signature='s') @dbus_handle_exceptions def removeMasquerade(self, zone, sender=None): # removes masquerade zone = dbus_to_python(zone, str) log.debug1("zone.removeMasquerade('%s')" % (zone)) self.accessCheck(sender) _zone = self.fw.zone.remove_masquerade(zone) self.removeTimeout(_zone, "masquerade") self.MasqueradeRemoved(_zone) return _zone @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG_INFO) @dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='s', out_signature='b') @dbus_handle_exceptions def queryMasquerade(self, zone, sender=None): # pylint: disable=W0613 # returns true if a masquerade is added zone = dbus_to_python(zone, str) log.debug1("zone.queryMasquerade('%s')" % (zone)) return self.fw.zone.query_masquerade(zone) @dbus.service.signal(config.dbus.DBUS_INTERFACE_ZONE, signature='si') @dbus_handle_exceptions def MasqueradeAdded(self, zone, timeout=0): log.debug1("zone.MasqueradeAdded('%s', %d)" % (zone, timeout)) @dbus.service.signal(config.dbus.DBUS_INTERFACE_ZONE, signature='s') @dbus_handle_exceptions def MasqueradeRemoved(self, zone): log.debug1("zone.MasqueradeRemoved('%s')" % (zone)) # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # FORWARD PORT @dbus_handle_exceptions def disable_forward_port(self, zone, port, protocol, toport, toaddr): # pylint: disable=R0913 del self._timeouts[zone][(port, protocol, toport, toaddr)] self.fw.zone.remove_forward_port(zone, port, protocol, toport, toaddr) self.ForwardPortRemoved(zone, port, protocol, toport, toaddr) @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG) @dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='sssssi', out_signature='s') @dbus_handle_exceptions def addForwardPort(self, zone, port, protocol, toport, toaddr, timeout, sender=None): # pylint: disable=R0913 # add forward port if not enabled already for zone zone = dbus_to_python(zone, str) port = dbus_to_python(port, str) protocol = dbus_to_python(protocol, str) toport = dbus_to_python(toport, str) toaddr = dbus_to_python(toaddr, str) timeout = dbus_to_python(timeout, int) log.debug1("zone.addForwardPort('%s', '%s', '%s', '%s', '%s')" % \ (zone, port, protocol, toport, toaddr)) self.accessCheck(sender) _zone = self.fw.zone.add_forward_port(zone, port, protocol, toport, toaddr, timeout, sender) if timeout > 0: tag = GLib.timeout_add_seconds(timeout, self.disable_forward_port, _zone, port, protocol, toport, toaddr) self.addTimeout(_zone, (port, protocol, toport, toaddr), tag) self.ForwardPortAdded(_zone, port, protocol, toport, toaddr, timeout) return _zone @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG) @dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='sssss', out_signature='s') @dbus_handle_exceptions def removeForwardPort(self, zone, port, protocol, toport, toaddr, sender=None): # pylint: disable=R0913 # remove forward port from zone zone = dbus_to_python(zone, str) port = dbus_to_python(port, str) protocol = dbus_to_python(protocol, str) toport = dbus_to_python(toport, str) toaddr = dbus_to_python(toaddr, str) log.debug1("zone.removeForwardPort('%s', '%s', '%s', '%s', '%s')" % \ (zone, port, protocol, toport, toaddr)) self.accessCheck(sender) _zone = self.fw.zone.remove_forward_port(zone, port, protocol, toport, toaddr) self.removeTimeout(_zone, (port, protocol, toport, toaddr)) self.ForwardPortRemoved(_zone, port, protocol, toport, toaddr) return _zone @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG_INFO) @dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='sssss', out_signature='b') @dbus_handle_exceptions def queryForwardPort(self, zone, port, protocol, toport, toaddr, sender=None): # pylint: disable=W0613, R0913 # returns true if a forward port is enabled for zone zone = dbus_to_python(zone, str) port = dbus_to_python(port, str) protocol = dbus_to_python(protocol, str) toport = dbus_to_python(toport, str) toaddr = dbus_to_python(toaddr, str) log.debug1("zone.queryForwardPort('%s', '%s', '%s', '%s', '%s')" % \ (zone, port, protocol, toport, toaddr)) return self.fw.zone.query_forward_port(zone, port, protocol, toport, toaddr) @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG_INFO) @dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='s', out_signature='aas') @dbus_handle_exceptions def getForwardPorts(self, zone, sender=None): # pylint: disable=W0613 # returns the list of enabled ports for zone # TODO: should be renamed to listForwardPorts() # because is called by firewall-cmd --zone --list-forward-ports zone = dbus_to_python(zone, str) log.debug1("zone.getForwardPorts('%s')" % (zone)) return self.fw.zone.list_forward_ports(zone) @dbus.service.signal(config.dbus.DBUS_INTERFACE_ZONE, signature='sssssi') @dbus_handle_exceptions def ForwardPortAdded(self, zone, port, protocol, toport, toaddr, timeout=0): # pylint: disable=R0913 log.debug1("zone.ForwardPortAdded('%s', '%s', '%s', '%s', '%s', %d)" % \ (zone, port, protocol, toport, toaddr, timeout)) @dbus.service.signal(config.dbus.DBUS_INTERFACE_ZONE, signature='sssss') @dbus_handle_exceptions def ForwardPortRemoved(self, zone, port, protocol, toport, toaddr): # pylint: disable=R0913 log.debug1("zone.ForwardPortRemoved('%s', '%s', '%s', '%s', '%s')" % \ (zone, port, protocol, toport, toaddr)) # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # ICMP BLOCK @dbus_handle_exceptions def disableTimedIcmpBlock(self, zone, icmp, sender): # pylint: disable=W0613 log.debug1("zone.disableTimedIcmpBlock('%s', '%s')" % (zone, icmp)) del self._timeouts[zone][icmp] self.fw.zone.remove_icmp_block(zone, icmp) self.IcmpBlockRemoved(zone, icmp) @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG) @dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='ssi', out_signature='s') @dbus_handle_exceptions def addIcmpBlock(self, zone, icmp, timeout, sender=None): # add icmpblock <icmp> if not enabled already for zone zone = dbus_to_python(zone, str) icmp = dbus_to_python(icmp, str) timeout = dbus_to_python(timeout, int) log.debug1("zone.enableIcmpBlock('%s', '%s')" % (zone, icmp)) self.accessCheck(sender) _zone = self.fw.zone.add_icmp_block(zone, icmp, timeout, sender) if timeout > 0: tag = GLib.timeout_add_seconds(timeout, self.disableTimedIcmpBlock, _zone, icmp, sender) self.addTimeout(_zone, icmp, tag) self.IcmpBlockAdded(_zone, icmp, timeout) return _zone @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG) @dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='ss', out_signature='s') @dbus_handle_exceptions def removeIcmpBlock(self, zone, icmp, sender=None): # removes icmpBlock from zone zone = dbus_to_python(zone, str) icmp = dbus_to_python(icmp, str) log.debug1("zone.removeIcmpBlock('%s', '%s')" % (zone, icmp)) self.accessCheck(sender) _zone = self.fw.zone.remove_icmp_block(zone, icmp) self.removeTimeout(_zone, icmp) self.IcmpBlockRemoved(_zone, icmp) return _zone @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG_INFO) @dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='ss', out_signature='b') @dbus_handle_exceptions def queryIcmpBlock(self, zone, icmp, sender=None): # pylint: disable=W0613 # returns true if a icmp is enabled for zone zone = dbus_to_python(zone, str) icmp = dbus_to_python(icmp, str) log.debug1("zone.queryIcmpBlock('%s', '%s')" % (zone, icmp)) return self.fw.zone.query_icmp_block(zone, icmp) @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG_INFO) @dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='s', out_signature='as') @dbus_handle_exceptions def getIcmpBlocks(self, zone, sender=None): # pylint: disable=W0613 # returns the list of enabled icmpblocks # TODO: should be renamed to listIcmpBlocks() # because is called by firewall-cmd --zone --list-icmp-blocks zone = dbus_to_python(zone, str) log.debug1("zone.getIcmpBlocks('%s')" % (zone)) return self.fw.zone.list_icmp_blocks(zone) @dbus.service.signal(config.dbus.DBUS_INTERFACE_ZONE, signature='ssi') @dbus_handle_exceptions def IcmpBlockAdded(self, zone, icmp, timeout=0): log.debug1("zone.IcmpBlockAdded('%s', '%s', %d)" % \ (zone, icmp, timeout)) @dbus.service.signal(config.dbus.DBUS_INTERFACE_ZONE, signature='ss') @dbus_handle_exceptions def IcmpBlockRemoved(self, zone, icmp): log.debug1("zone.IcmpBlockRemoved('%s', '%s')" % (zone, icmp)) # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # ICMP BLOCK INVERSION @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG) @dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='s', out_signature='s') @dbus_handle_exceptions def addIcmpBlockInversion(self, zone, sender=None): # adds icmpBlockInversion if not added already zone = dbus_to_python(zone, str) log.debug1("zone.addIcmpBlockInversion('%s')" % (zone)) self.accessCheck(sender) _zone = self.fw.zone.add_icmp_block_inversion(zone, sender) self.IcmpBlockInversionAdded(_zone) return _zone @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG) @dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='s', out_signature='s') @dbus_handle_exceptions def removeIcmpBlockInversion(self, zone, sender=None): # removes icmpBlockInversion zone = dbus_to_python(zone, str) log.debug1("zone.removeIcmpBlockInversion('%s')" % (zone)) self.accessCheck(sender) _zone = self.fw.zone.remove_icmp_block_inversion(zone) self.IcmpBlockInversionRemoved(_zone) return _zone @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG_INFO) @dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='s', out_signature='b') @dbus_handle_exceptions def queryIcmpBlockInversion(self, zone, sender=None): # pylint: disable=W0613 # returns true if a icmpBlockInversion is added zone = dbus_to_python(zone, str) log.debug1("zone.queryIcmpBlockInversion('%s')" % (zone)) return self.fw.zone.query_icmp_block_inversion(zone) @dbus.service.signal(config.dbus.DBUS_INTERFACE_ZONE, signature='s') @dbus_handle_exceptions def IcmpBlockInversionAdded(self, zone): log.debug1("zone.IcmpBlockInversionAdded('%s')" % (zone)) @dbus.service.signal(config.dbus.DBUS_INTERFACE_ZONE, signature='s') @dbus_handle_exceptions def IcmpBlockInversionRemoved(self, zone): log.debug1("zone.IcmpBlockInversionRemoved('%s')" % (zone)) # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # DIRECT INTERFACE # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # DIRECT CHAIN @dbus_polkit_require_auth(config.dbus.PK_ACTION_DIRECT) @dbus_service_method_deprecated(config.dbus.DBUS_INTERFACE_DIRECT) @dbus_service_method(config.dbus.DBUS_INTERFACE_DIRECT, in_signature='sss', out_signature='') @dbus_handle_exceptions def addChain(self, ipv, table, chain, sender=None): # inserts direct chain ipv = dbus_to_python(ipv, str) table = dbus_to_python(table, str) chain = dbus_to_python(chain, str) log.debug1("direct.addChain('%s', '%s', '%s')" % (ipv, table, chain)) self.accessCheck(sender) self.fw.direct.add_chain(ipv, table, chain) self.ChainAdded(ipv, table, chain) @dbus_polkit_require_auth(config.dbus.PK_ACTION_DIRECT) @dbus_service_method_deprecated(config.dbus.DBUS_INTERFACE_DIRECT) @dbus_service_method(config.dbus.DBUS_INTERFACE_DIRECT, in_signature='sss', out_signature='') @dbus_handle_exceptions def removeChain(self, ipv, table, chain, sender=None): # removes direct chain ipv = dbus_to_python(ipv, str) table = dbus_to_python(table, str) chain = dbus_to_python(chain, str) log.debug1("direct.removeChain('%s', '%s', '%s')" % (ipv, table, chain)) self.accessCheck(sender) self.fw.direct.remove_chain(ipv, table, chain) self.ChainRemoved(ipv, table, chain) @dbus_polkit_require_auth(config.dbus.PK_ACTION_DIRECT_INFO) @dbus_service_method_deprecated(config.dbus.DBUS_INTERFACE_DIRECT) @dbus_service_method(config.dbus.DBUS_INTERFACE_DIRECT, in_signature='sss', out_signature='b') @dbus_handle_exceptions def queryChain(self, ipv, table, chain, sender=None): # pylint: disable=W0613 # returns true if a chain is enabled ipv = dbus_to_python(ipv, str) table = dbus_to_python(table, str) chain = dbus_to_python(chain, str) log.debug1("direct.queryChain('%s', '%s', '%s')" % (ipv, table, chain)) return self.fw.direct.query_chain(ipv, table, chain) @dbus_polkit_require_auth(config.dbus.PK_ACTION_DIRECT_INFO) @dbus_service_method_deprecated(config.dbus.DBUS_INTERFACE_DIRECT) @dbus_service_method(config.dbus.DBUS_INTERFACE_DIRECT, in_signature='ss', out_signature='as') @dbus_handle_exceptions def getChains(self, ipv, table, sender=None): # pylint: disable=W0613 # returns list of added chains ipv = dbus_to_python(ipv, str) table = dbus_to_python(table, str) log.debug1("direct.getChains('%s', '%s')" % (ipv, table)) return self.fw.direct.get_chains(ipv, table) @dbus_polkit_require_auth(config.dbus.PK_ACTION_DIRECT_INFO) @dbus_service_method_deprecated(config.dbus.DBUS_INTERFACE_DIRECT) @dbus_service_method(config.dbus.DBUS_INTERFACE_DIRECT, in_signature='', out_signature='a(sss)') @dbus_handle_exceptions def getAllChains(self, sender=None): # pylint: disable=W0613 # returns list of added chains log.debug1("direct.getAllChains()") return self.fw.direct.get_all_chains() @dbus_service_signal_deprecated(config.dbus.DBUS_INTERFACE_DIRECT) @dbus.service.signal(config.dbus.DBUS_INTERFACE_DIRECT, signature='sss') @dbus_handle_exceptions def ChainAdded(self, ipv, table, chain): log.debug1("direct.ChainAdded('%s', '%s', '%s')" % (ipv, table, chain)) @dbus_service_signal_deprecated(config.dbus.DBUS_INTERFACE_DIRECT) @dbus.service.signal(config.dbus.DBUS_INTERFACE_DIRECT, signature='sss') @dbus_handle_exceptions def ChainRemoved(self, ipv, table, chain): log.debug1("direct.ChainRemoved('%s', '%s', '%s')" % (ipv, table, chain)) # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # DIRECT RULE @dbus_polkit_require_auth(config.dbus.PK_ACTION_DIRECT) @dbus_service_method_deprecated(config.dbus.DBUS_INTERFACE_DIRECT) @dbus_service_method(config.dbus.DBUS_INTERFACE_DIRECT, in_signature='sssias', out_signature='') @dbus_handle_exceptions def addRule(self, ipv, table, chain, priority, args, sender=None): # pylint: disable=R0913 # inserts direct rule ipv = dbus_to_python(ipv, str) table = dbus_to_python(table, str) chain = dbus_to_python(chain, str) priority = dbus_to_python(priority, int) args = tuple( dbus_to_python(i, str) for i in args ) log.debug1("direct.addRule('%s', '%s', '%s', %d, '%s')" % \ (ipv, table, chain, priority, "','".join(args))) self.accessCheck(sender) self.fw.direct.add_rule(ipv, table, chain, priority, args) self.RuleAdded(ipv, table, chain, priority, args) @dbus_polkit_require_auth(config.dbus.PK_ACTION_DIRECT) @dbus_service_method_deprecated(config.dbus.DBUS_INTERFACE_DIRECT) @dbus_service_method(config.dbus.DBUS_INTERFACE_DIRECT, in_signature='sssias', out_signature='') @dbus_handle_exceptions def removeRule(self, ipv, table, chain, priority, args, sender=None): # pylint: disable=R0913 # removes direct rule ipv = dbus_to_python(ipv, str) table = dbus_to_python(table, str) chain = dbus_to_python(chain, str) priority = dbus_to_python(priority, int) args = tuple( dbus_to_python(i, str) for i in args ) log.debug1("direct.removeRule('%s', '%s', '%s', %d, '%s')" % \ (ipv, table, chain, priority, "','".join(args))) self.accessCheck(sender) self.fw.direct.remove_rule(ipv, table, chain, priority, args) self.RuleRemoved(ipv, table, chain, priority, args) @dbus_polkit_require_auth(config.dbus.PK_ACTION_DIRECT) @dbus_service_method_deprecated(config.dbus.DBUS_INTERFACE_DIRECT) @dbus_service_method(config.dbus.DBUS_INTERFACE_DIRECT, in_signature='sss', out_signature='') @dbus_handle_exceptions def removeRules(self, ipv, table, chain, sender=None): # removes direct rule ipv = dbus_to_python(ipv, str) table = dbus_to_python(table, str) chain = dbus_to_python(chain, str) log.debug1("direct.removeRules('%s', '%s', '%s')" % (ipv, table, chain)) self.accessCheck(sender) for (priority, args) in self.fw.direct.get_rules(ipv, table, chain): self.fw.direct.remove_rule(ipv, table, chain, priority, args) self.RuleRemoved(ipv, table, chain, priority, args) @dbus_polkit_require_auth(config.dbus.PK_ACTION_DIRECT_INFO) @dbus_service_method_deprecated(config.dbus.DBUS_INTERFACE_DIRECT) @dbus_service_method(config.dbus.DBUS_INTERFACE_DIRECT, in_signature='sssias', out_signature='b') @dbus_handle_exceptions def queryRule(self, ipv, table, chain, priority, args, sender=None): # pylint: disable=W0613, R0913 # returns true if a rule is enabled ipv = dbus_to_python(ipv, str) table = dbus_to_python(table, str) chain = dbus_to_python(chain, str) priority = dbus_to_python(priority, int) args = tuple( dbus_to_python(i, str) for i in args ) log.debug1("direct.queryRule('%s', '%s', '%s', %d, '%s')" % \ (ipv, table, chain, priority, "','".join(args))) return self.fw.direct.query_rule(ipv, table, chain, priority, args) @dbus_polkit_require_auth(config.dbus.PK_ACTION_DIRECT_INFO) @dbus_service_method_deprecated(config.dbus.DBUS_INTERFACE_DIRECT) @dbus_service_method(config.dbus.DBUS_INTERFACE_DIRECT, in_signature='sss', out_signature='a(ias)') @dbus_handle_exceptions def getRules(self, ipv, table, chain, sender=None): # pylint: disable=W0613 # returns list of added rules ipv = dbus_to_python(ipv, str) table = dbus_to_python(table, str) chain = dbus_to_python(chain, str) log.debug1("direct.getRules('%s', '%s', '%s')" % (ipv, table, chain)) return self.fw.direct.get_rules(ipv, table, chain) @dbus_polkit_require_auth(config.dbus.PK_ACTION_DIRECT_INFO) @dbus_service_method_deprecated(config.dbus.DBUS_INTERFACE_DIRECT) @dbus_service_method(config.dbus.DBUS_INTERFACE_DIRECT, in_signature='', out_signature='a(sssias)') @dbus_handle_exceptions def getAllRules(self, sender=None): # pylint: disable=W0613 # returns list of added rules log.debug1("direct.getAllRules()") return self.fw.direct.get_all_rules() @dbus_service_signal_deprecated(config.dbus.DBUS_INTERFACE_DIRECT) @dbus.service.signal(config.dbus.DBUS_INTERFACE_DIRECT, signature='sssias') @dbus_handle_exceptions def RuleAdded(self, ipv, table, chain, priority, args): # pylint: disable=R0913 log.debug1("direct.RuleAdded('%s', '%s', '%s', %d, '%s')" % \ (ipv, table, chain, priority, "','".join(args))) @dbus_service_signal_deprecated(config.dbus.DBUS_INTERFACE_DIRECT) @dbus.service.signal(config.dbus.DBUS_INTERFACE_DIRECT, signature='sssias') @dbus_handle_exceptions def RuleRemoved(self, ipv, table, chain, priority, args): # pylint: disable=R0913 log.debug1("direct.RuleRemoved('%s', '%s', '%s', %d, '%s')" % \ (ipv, table, chain, priority, "','".join(args))) # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # DIRECT PASSTHROUGH (untracked) @dbus_polkit_require_auth(config.dbus.PK_ACTION_DIRECT) @dbus_service_method_deprecated(config.dbus.DBUS_INTERFACE_DIRECT) @dbus_service_method(config.dbus.DBUS_INTERFACE_DIRECT, in_signature='sas', out_signature='s') @dbus_handle_exceptions def passthrough(self, ipv, args, sender=None): # inserts direct rule ipv = dbus_to_python(ipv, str) args = tuple( dbus_to_python(i, str) for i in args ) log.debug1("direct.passthrough('%s', '%s')" % (ipv, "','".join(args))) self.accessCheck(sender) try: return self.fw.direct.passthrough(ipv, args) except FirewallError as error: if ipv in ["ipv4", "ipv6"]: query_args = set(["-C", "--check", "-L", "--list"]) else: query_args = set(["-L", "--list"]) msg = str(error) if error.code == errors.COMMAND_FAILED: if len(set(args) & query_args) <= 0: log.warning(msg) raise FirewallDBusException(msg) raise # DIRECT PASSTHROUGH (tracked) @dbus_polkit_require_auth(config.dbus.PK_ACTION_DIRECT) @dbus_service_method_deprecated(config.dbus.DBUS_INTERFACE_DIRECT) @dbus_service_method(config.dbus.DBUS_INTERFACE_DIRECT, in_signature='sas', out_signature='') @dbus_handle_exceptions def addPassthrough(self, ipv, args, sender=None): # inserts direct passthrough ipv = dbus_to_python(ipv) args = tuple( dbus_to_python(i) for i in args ) log.debug1("direct.addPassthrough('%s', '%s')" % \ (ipv, "','".join(args))) self.accessCheck(sender) self.fw.direct.add_passthrough(ipv, args) self.PassthroughAdded(ipv, args) @dbus_polkit_require_auth(config.dbus.PK_ACTION_DIRECT) @dbus_service_method_deprecated(config.dbus.DBUS_INTERFACE_DIRECT) @dbus_service_method(config.dbus.DBUS_INTERFACE_DIRECT, in_signature='sas', out_signature='') @dbus_handle_exceptions def removePassthrough(self, ipv, args, sender=None): # removes direct passthrough ipv = dbus_to_python(ipv) args = tuple( dbus_to_python(i) for i in args ) log.debug1("direct.removePassthrough('%s', '%s')" % \ (ipv, "','".join(args))) self.accessCheck(sender) self.fw.direct.remove_passthrough(ipv, args) self.PassthroughRemoved(ipv, args) @dbus_polkit_require_auth(config.dbus.PK_ACTION_DIRECT_INFO) @dbus_service_method_deprecated(config.dbus.DBUS_INTERFACE_DIRECT) @dbus_service_method(config.dbus.DBUS_INTERFACE_DIRECT, in_signature='sas', out_signature='b') @dbus_handle_exceptions def queryPassthrough(self, ipv, args, sender=None): # pylint: disable=W0613 # returns true if a passthrough is enabled ipv = dbus_to_python(ipv) args = tuple( dbus_to_python(i) for i in args ) log.debug1("direct.queryPassthrough('%s', '%s')" % \ (ipv, "','".join(args))) return self.fw.direct.query_passthrough(ipv, args) @dbus_polkit_require_auth(config.dbus.PK_ACTION_DIRECT_INFO) @dbus_service_method_deprecated(config.dbus.DBUS_INTERFACE_DIRECT) @dbus_service_method(config.dbus.DBUS_INTERFACE_DIRECT, in_signature='', out_signature='a(sas)') @dbus_handle_exceptions def getAllPassthroughs(self, sender=None): # pylint: disable=W0613 # returns list of all added passthroughs log.debug1("direct.getAllPassthroughs()") return self.fw.direct.get_all_passthroughs() @dbus_polkit_require_auth(config.dbus.PK_ACTION_DIRECT) @dbus_service_method_deprecated(config.dbus.DBUS_INTERFACE_DIRECT) @dbus_service_method(config.dbus.DBUS_INTERFACE_DIRECT, in_signature='', out_signature='') @dbus_handle_exceptions def removeAllPassthroughs(self, sender=None): # pylint: disable=W0613 # remove all passhroughs log.debug1("direct.removeAllPassthroughs()") # remove in reverse order to avoid removing non-empty chains for passthrough in reversed(self.getAllPassthroughs()): self.removePassthrough(*passthrough) @dbus_polkit_require_auth(config.dbus.PK_ACTION_DIRECT_INFO) @dbus_service_method_deprecated(config.dbus.DBUS_INTERFACE_DIRECT) @dbus_service_method(config.dbus.DBUS_INTERFACE_DIRECT, in_signature='s', out_signature='aas') @dbus_handle_exceptions def getPassthroughs(self, ipv, sender=None): # pylint: disable=W0613 # returns list of all added passthroughs with ipv ipv = dbus_to_python(ipv) log.debug1("direct.getPassthroughs('%s')", ipv) return self.fw.direct.get_passthroughs(ipv) @dbus_service_signal_deprecated(config.dbus.DBUS_INTERFACE_DIRECT) @dbus.service.signal(config.dbus.DBUS_INTERFACE_DIRECT, signature='sas') @dbus_handle_exceptions def PassthroughAdded(self, ipv, args): log.debug1("direct.PassthroughAdded('%s', '%s')" % \ (ipv, "','".join(args))) @dbus_service_signal_deprecated(config.dbus.DBUS_INTERFACE_DIRECT) @dbus.service.signal(config.dbus.DBUS_INTERFACE_DIRECT, signature='sas') @dbus_handle_exceptions def PassthroughRemoved(self, ipv, args): log.debug1("direct.PassthroughRemoved('%s', '%s')" % \ (ipv, "','".join(args))) # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # @dbus_polkit_require_auth(config.dbus.PK_ACTION_ALL) @dbus_service_method(config.dbus.DBUS_INTERFACE, in_signature='', out_signature='') @dbus_handle_exceptions def authorizeAll(self, sender=None): # pylint: disable=W0613 """ PK_ACTION_ALL implies all other actions, i.e. once a subject is authorized for PK_ACTION_ALL it's also authorized for any other action. Use-case is GUI (RHBZ#994729). """ pass # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # IPSETS # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # @dbus_polkit_require_auth(config.dbus.PK_ACTION_INFO) @dbus_service_method(config.dbus.DBUS_INTERFACE_IPSET, in_signature='s', out_signature='b') @dbus_handle_exceptions def queryIPSet(self, ipset, sender=None): # pylint: disable=W0613 # returns true if a set with the name exists ipset = dbus_to_python(ipset) log.debug1("ipset.queryIPSet('%s')" % (ipset)) return self.fw.ipset.query_ipset(ipset) @dbus_polkit_require_auth(config.dbus.PK_ACTION_INFO) @dbus_service_method(config.dbus.DBUS_INTERFACE_IPSET, in_signature='', out_signature='as') @dbus_handle_exceptions def getIPSets(self, sender=None): # pylint: disable=W0613 # returns list of added sets log.debug1("ipsets.getIPSets()") return self.fw.ipset.get_ipsets() @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG_INFO) @dbus_service_method(config.dbus.DBUS_INTERFACE_IPSET, in_signature='s', out_signature=IPSet.DBUS_SIGNATURE) @dbus_handle_exceptions def getIPSetSettings(self, ipset, sender=None): # pylint: disable=W0613 # returns ipset settings for ipset ipset = dbus_to_python(ipset, str) log.debug1("getIPSetSettings(%s)", ipset) return self.fw.ipset.get_ipset(ipset).export_config() # set entries # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG) @dbus_service_method(config.dbus.DBUS_INTERFACE_IPSET, in_signature='ss', out_signature='') @dbus_handle_exceptions def addEntry(self, ipset, entry, sender=None): # adds ipset entry ipset = dbus_to_python(ipset) entry = dbus_to_python(entry) log.debug1("ipset.addEntry('%s', '%s')" % (ipset, entry)) self.accessCheck(sender) self.fw.ipset.add_entry(ipset, entry) self.EntryAdded(ipset, entry) @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG) @dbus_service_method(config.dbus.DBUS_INTERFACE_IPSET, in_signature='ss', out_signature='') @dbus_handle_exceptions def removeEntry(self, ipset, entry, sender=None): # removes ipset entry ipset = dbus_to_python(ipset) entry = dbus_to_python(entry) log.debug1("ipset.removeEntry('%s', '%s')" % (ipset, entry)) self.accessCheck(sender) self.fw.ipset.remove_entry(ipset, entry) self.EntryRemoved(ipset, entry) @dbus_polkit_require_auth(config.dbus.PK_ACTION_INFO) @dbus_service_method(config.dbus.DBUS_INTERFACE_IPSET, in_signature='ss', out_signature='b') @dbus_handle_exceptions def queryEntry(self, ipset, entry, sender=None): # pylint: disable=W0613 # returns true if the entry exists in the ipset ipset = dbus_to_python(ipset) entry = dbus_to_python(entry) log.debug1("ipset.queryEntry('%s', '%s')" % (ipset, entry)) return self.fw.ipset.query_entry(ipset, entry) @dbus_polkit_require_auth(config.dbus.PK_ACTION_INFO) @dbus_service_method(config.dbus.DBUS_INTERFACE_IPSET, in_signature='s', out_signature='as') @dbus_handle_exceptions def getEntries(self, ipset, sender=None): # pylint: disable=W0613 # returns list of added entries for the ipset ipset = dbus_to_python(ipset) log.debug1("ipset.getEntries('%s')" % ipset) return self.fw.ipset.get_entries(ipset) @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG) @dbus_service_method(config.dbus.DBUS_INTERFACE_IPSET, in_signature='sas') @dbus_handle_exceptions def setEntries(self, ipset, entries, sender=None): # pylint: disable=W0613 # returns list of added entries for the ipset ipset = dbus_to_python(ipset) entries = dbus_to_python(entries, list) log.debug1("ipset.setEntries('%s', '[%s]')", ipset, ",".join(entries)) old_entries = self.fw.ipset.get_entries(ipset) self.fw.ipset.set_entries(ipset, entries) old_entries_set = set(old_entries) entries_set = set(entries) for entry in entries_set - old_entries_set: self.EntryAdded(ipset, entry) for entry in old_entries_set - entries_set: self.EntryRemoved(ipset, entry) @dbus.service.signal(config.dbus.DBUS_INTERFACE_IPSET, signature='ss') @dbus_handle_exceptions def EntryAdded(self, ipset, entry): ipset = dbus_to_python(ipset) entry = dbus_to_python(entry) log.debug1("ipset.EntryAdded('%s', '%s')" % (ipset, entry)) @dbus.service.signal(config.dbus.DBUS_INTERFACE_IPSET, signature='ss') @dbus_handle_exceptions def EntryRemoved(self, ipset, entry): ipset = dbus_to_python(ipset) entry = dbus_to_python(entry) log.debug1("ipset.EntryRemoved('%s', '%s')" % (ipset, entry)) # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # HELPERS # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # @dbus_polkit_require_auth(config.dbus.PK_ACTION_INFO) @dbus_service_method(config.dbus.DBUS_INTERFACE, in_signature='', out_signature='as') @dbus_handle_exceptions def getHelpers(self, sender=None): # pylint: disable=W0613 # returns list of added sets log.debug1("helpers.getHelpers()") return self.fw.helper.get_helpers() @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG_INFO) @dbus_service_method(config.dbus.DBUS_INTERFACE, in_signature='s', out_signature=Helper.DBUS_SIGNATURE) @dbus_handle_exceptions def getHelperSettings(self, helper, sender=None): # pylint: disable=W0613 # returns helper settings for helper helper = dbus_to_python(helper, str) log.debug1("getHelperSettings(%s)", helper) return self.fw.helper.get_helper(helper).export_config() PK ���ZqiVY Y server/server.pynu �[��� # -*- coding: utf-8 -*- # # Copyright (C) 2010-2016 Red Hat, Inc. # # Authors: # Thomas Woerner <twoerner@redhat.com> # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see <http://www.gnu.org/licenses/>. # # signal handling and run_server derived from setroubleshoot # Copyright (C) 2006,2007,2008,2009 Red Hat, Inc. # Authors: # John Dennis <jdennis@redhat.com> # Thomas Liu <tliu@redhat.com> # Dan Walsh <dwalsh@redhat.com> __all__ = [ "run_server" ] import signal from gi.repository import GLib import dbus import dbus.service import dbus.mainloop.glib from firewall import config from firewall.core.logger import log from firewall.server.firewalld import FirewallD ############################################################################ # # signal handlers # ############################################################################ def sighup(service): service.reload() return True def sigterm(mainloop): mainloop.quit() ############################################################################ # # run_server function # ############################################################################ def run_server(debug_gc=False): """ Main function for firewall server. Handles D-Bus and GLib mainloop. """ service = None if debug_gc: from pprint import pformat import gc gc.enable() gc.set_debug(gc.DEBUG_LEAK) gc_timeout = 10 def gc_collect(): gc.collect() if len(gc.garbage) > 0: print("\n>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>" ">>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>\n") print("GARBAGE OBJECTS (%d):\n" % len(gc.garbage)) for x in gc.garbage: print(type(x), "\n ",) print(pformat(x)) print("\n<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<" "<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<\n") GLib.timeout_add_seconds(gc_timeout, gc_collect) try: dbus.mainloop.glib.DBusGMainLoop(set_as_default=True) bus = dbus.SystemBus() name = dbus.service.BusName(config.dbus.DBUS_INTERFACE, bus=bus) service = FirewallD(name, config.dbus.DBUS_PATH) mainloop = GLib.MainLoop() if debug_gc: GLib.timeout_add_seconds(gc_timeout, gc_collect) # use unix_signal_add if available, else unix_signal_add_full if hasattr(GLib, 'unix_signal_add'): unix_signal_add = GLib.unix_signal_add else: unix_signal_add = GLib.unix_signal_add_full unix_signal_add(GLib.PRIORITY_HIGH, signal.SIGHUP, sighup, service) unix_signal_add(GLib.PRIORITY_HIGH, signal.SIGTERM, sigterm, mainloop) mainloop.run() except KeyboardInterrupt: log.debug1("Stopping..") except SystemExit: log.error("Raising SystemExit in run_server") except Exception as e: log.error("Exception %s: %s", e.__class__.__name__, str(e)) if service: service.stop() PK ���Zn���� � server/config_policy.pynu �[��� # -*- coding: utf-8 -*- # # SPDX-License-Identifier: GPL-2.0-or-later import dbus import dbus.service from firewall import config from firewall.dbus_utils import dbus_to_python, \ dbus_introspection_prepare_properties, \ dbus_introspection_add_properties from firewall.core.logger import log from firewall.server.dbus import DbusServiceObject from firewall.server.decorators import handle_exceptions, \ dbus_handle_exceptions, dbus_service_method, \ dbus_polkit_require_auth class FirewallDConfigPolicy(DbusServiceObject): persistent = True default_polkit_auth_required = config.dbus.PK_ACTION_CONFIG @handle_exceptions def __init__(self, parent, conf, policy, item_id, *args, **kwargs): super(FirewallDConfigPolicy, self).__init__(*args, **kwargs) self.parent = parent self.config = conf self.obj = policy self.item_id = item_id self.busname = args[0] self.path = args[1] self._log_prefix = "config.policy.%d" % self.item_id dbus_introspection_prepare_properties( self, config.dbus.DBUS_INTERFACE_CONFIG_POLICY) @dbus_handle_exceptions def __del__(self): pass @dbus_handle_exceptions def unregister(self): self.remove_from_connection() # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # P R O P E R T I E S @dbus_handle_exceptions def _get_property(self, property_name): if property_name == "name": return dbus.String(self.obj.name) elif property_name == "filename": return dbus.String(self.obj.filename) elif property_name == "path": return dbus.String(self.obj.path) elif property_name == "default": return dbus.Boolean(self.obj.default) elif property_name == "builtin": return dbus.Boolean(self.obj.builtin) else: raise dbus.exceptions.DBusException( "org.freedesktop.DBus.Error.InvalidArgs: " "Property '%s' does not exist" % property_name) @dbus_service_method(dbus.PROPERTIES_IFACE, in_signature='ss', out_signature='v') @dbus_handle_exceptions def Get(self, interface_name, property_name, sender=None): # get a property interface_name = dbus_to_python(interface_name, str) property_name = dbus_to_python(property_name, str) log.debug1("%s.Get('%s', '%s')", self._log_prefix, interface_name, property_name) if interface_name != config.dbus.DBUS_INTERFACE_CONFIG_POLICY: raise dbus.exceptions.DBusException( "org.freedesktop.DBus.Error.UnknownInterface: " "Interface '%s' does not exist" % interface_name) return self._get_property(property_name) @dbus_service_method(dbus.PROPERTIES_IFACE, in_signature='s', out_signature='a{sv}') @dbus_handle_exceptions def GetAll(self, interface_name, sender=None): interface_name = dbus_to_python(interface_name, str) log.debug1("%s.GetAll('%s')", self._log_prefix, interface_name) if interface_name != config.dbus.DBUS_INTERFACE_CONFIG_POLICY: raise dbus.exceptions.DBusException( "org.freedesktop.DBus.Error.UnknownInterface: " "Interface '%s' does not exist" % interface_name) ret = { } for x in [ "name", "filename", "path", "default", "builtin" ]: ret[x] = self._get_property(x) return dbus.Dictionary(ret, signature="sv") @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG) @dbus_service_method(dbus.PROPERTIES_IFACE, in_signature='ssv') @dbus_handle_exceptions def Set(self, interface_name, property_name, new_value, sender=None): interface_name = dbus_to_python(interface_name, str) property_name = dbus_to_python(property_name, str) new_value = dbus_to_python(new_value) log.debug1("%s.Set('%s', '%s', '%s')", self._log_prefix, interface_name, property_name, new_value) self.parent.accessCheck(sender) if interface_name != config.dbus.DBUS_INTERFACE_CONFIG_POLICY: raise dbus.exceptions.DBusException( "org.freedesktop.DBus.Error.UnknownInterface: " "Interface '%s' does not exist" % interface_name) raise dbus.exceptions.DBusException( "org.freedesktop.DBus.Error.PropertyReadOnly: " "Property '%s' is read-only" % property_name) @dbus.service.signal(dbus.PROPERTIES_IFACE, signature='sa{sv}as') def PropertiesChanged(self, interface_name, changed_properties, invalidated_properties): interface_name = dbus_to_python(interface_name, str) changed_properties = dbus_to_python(changed_properties) invalidated_properties = dbus_to_python(invalidated_properties) log.debug1("%s.PropertiesChanged('%s', '%s', '%s')", self._log_prefix, interface_name, changed_properties, invalidated_properties) @dbus_polkit_require_auth(config.dbus.PK_ACTION_INFO) @dbus_service_method(dbus.INTROSPECTABLE_IFACE, out_signature='s') @dbus_handle_exceptions def Introspect(self, sender=None): log.debug2("%s.Introspect()", self._log_prefix) data = super(FirewallDConfigPolicy, self).Introspect( self.path, self.busname.get_bus()) return dbus_introspection_add_properties( self, data, config.dbus.DBUS_INTERFACE_CONFIG_POLICY) # S E T T I N G S @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_POLICY, out_signature="a{sv}") @dbus_handle_exceptions def getSettings(self, sender=None): """get settings for policy """ log.debug1("%s.getSettings()", self._log_prefix) settings = self.config.get_policy_object_config_dict(self.obj) return settings @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_POLICY, in_signature="a{sv}") @dbus_handle_exceptions def update(self, settings, sender=None): """update settings for policy """ settings = dbus_to_python(settings) log.debug1("%s.update('...')", self._log_prefix) self.parent.accessCheck(sender) self.obj = self.config.set_policy_object_config_dict(self.obj, settings) self.Updated(self.obj.name) @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_POLICY) @dbus_handle_exceptions def loadDefaults(self, sender=None): """load default settings for builtin policy """ log.debug1("%s.loadDefaults()", self._log_prefix) self.parent.accessCheck(sender) self.obj = self.config.load_policy_object_defaults(self.obj) self.Updated(self.obj.name) @dbus.service.signal(config.dbus.DBUS_INTERFACE_CONFIG_POLICY, signature='s') @dbus_handle_exceptions def Updated(self, name): log.debug1("%s.Updated('%s')" % (self._log_prefix, name)) # R E M O V E @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_POLICY) @dbus_handle_exceptions def remove(self, sender=None): """remove policy """ log.debug1("%s.removePolicy()", self._log_prefix) self.parent.accessCheck(sender) self.config.remove_policy_object(self.obj) self.parent.removePolicy(self.obj) @dbus.service.signal(config.dbus.DBUS_INTERFACE_CONFIG_POLICY, signature='s') @dbus_handle_exceptions def Removed(self, name): log.debug1("%s.Removed('%s')" % (self._log_prefix, name)) # R E N A M E @dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG_POLICY, in_signature='s') @dbus_handle_exceptions def rename(self, name, sender=None): """rename policy """ name = dbus_to_python(name, str) log.debug1("%s.rename('%s')", self._log_prefix, name) self.parent.accessCheck(sender) self.obj = self.config.rename_policy_object(self.obj, name) self.Renamed(name) @dbus.service.signal(config.dbus.DBUS_INTERFACE_CONFIG_POLICY, signature='s') @dbus_handle_exceptions def Renamed(self, name): log.debug1("%s.Renamed('%s')" % (self._log_prefix, name)) PK ���Z server/__init__.pynu �[��� PK ���Zc�!��$ �$ dbus_utils.pynu �[��� # -*- coding: utf-8 -*- # # Copyright (C) 2011-2016 Red Hat, Inc. # # Authors: # Thomas Woerner <twoerner@redhat.com> # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see <http://www.gnu.org/licenses/>. # __all__ = [ "command_of_pid", "pid_of_sender", "uid_of_sender", "user_of_uid", "context_of_sender", "command_of_sender", "user_of_sender", "dbus_to_python", "dbus_signature", "dbus_introspection_prepare_properties", "dbus_introspection_add_properties" ] import dbus import pwd from xml.dom import minidom from firewall.core.logger import log def command_of_pid(pid): """ Get command for pid from /proc """ try: with open("/proc/%d/cmdline" % pid, "r") as f: cmd = f.readlines()[0].replace('\0', " ").strip() except Exception: return None return cmd def pid_of_sender(bus, sender): """ Get pid from sender string using org.freedesktop.DBus.GetConnectionUnixProcessID """ dbus_obj = bus.get_object('org.freedesktop.DBus', '/org/freedesktop/DBus') dbus_iface = dbus.Interface(dbus_obj, 'org.freedesktop.DBus') try: pid = int(dbus_iface.GetConnectionUnixProcessID(sender)) except ValueError: return None return pid def uid_of_sender(bus, sender): """ Get user id from sender string using org.freedesktop.DBus.GetConnectionUnixUser """ dbus_obj = bus.get_object('org.freedesktop.DBus', '/org/freedesktop/DBus') dbus_iface = dbus.Interface(dbus_obj, 'org.freedesktop.DBus') try: uid = int(dbus_iface.GetConnectionUnixUser(sender)) except ValueError: return None return uid def user_of_uid(uid): """ Get user for uid from pwd """ try: pws = pwd.getpwuid(uid) except Exception: return None return pws[0] def context_of_sender(bus, sender): """ Get SELinux context from sender string using org.freedesktop.DBus.GetConnectionSELinuxSecurityContext """ dbus_obj = bus.get_object('org.freedesktop.DBus', '/org/freedesktop/DBus') dbus_iface = dbus.Interface(dbus_obj, 'org.freedesktop.DBus') try: context = dbus_iface.GetConnectionSELinuxSecurityContext(sender) except Exception: return None return "".join(map(chr, dbus_to_python(context))) def command_of_sender(bus, sender): """ Return command of D-Bus sender """ return command_of_pid(pid_of_sender(bus, sender)) def user_of_sender(bus, sender): return user_of_uid(uid_of_sender(bus, sender)) def dbus_to_python(obj, expected_type=None): if obj is None: python_obj = obj elif isinstance(obj, dbus.Boolean): python_obj = bool(obj) elif isinstance(obj, dbus.String): python_obj = str(obj) elif isinstance(obj, dbus.ObjectPath): python_obj = str(obj) elif isinstance(obj, dbus.Byte) or \ isinstance(obj, dbus.Int16) or \ isinstance(obj, dbus.Int32) or \ isinstance(obj, dbus.Int64) or \ isinstance(obj, dbus.UInt16) or \ isinstance(obj, dbus.UInt32) or \ isinstance(obj, dbus.UInt64): python_obj = int(obj) elif isinstance(obj, dbus.Double): python_obj = float(obj) elif isinstance(obj, dbus.Array): python_obj = [dbus_to_python(x) for x in obj] elif isinstance(obj, dbus.Struct): python_obj = tuple([dbus_to_python(x) for x in obj]) elif isinstance(obj, dbus.Dictionary): python_obj = {dbus_to_python(k): dbus_to_python(v) for k, v in obj.items()} elif isinstance(obj, bool) or \ isinstance(obj, str) or isinstance(obj, bytes) or \ isinstance(obj, int) or isinstance(obj, float) or \ isinstance(obj, list) or isinstance(obj, tuple) or \ isinstance(obj, dict): python_obj = obj else: raise TypeError("Unhandled %s" % repr(obj)) if expected_type is not None: if (expected_type == bool and not isinstance(python_obj, bool)) or \ (expected_type == str and not isinstance(python_obj, str)) or \ (expected_type == int and not isinstance(python_obj, int)) or \ (expected_type == float and not isinstance(python_obj, float)) or \ (expected_type == list and not isinstance(python_obj, list)) or \ (expected_type == tuple and not isinstance(python_obj, tuple)) or \ (expected_type == dict and not isinstance(python_obj, dict)): raise TypeError("%s is %s, expected %s" % (python_obj, type(python_obj), expected_type)) return python_obj def dbus_signature(obj): if isinstance(obj, dbus.Boolean): return 'b' elif isinstance(obj, dbus.String): return 's' elif isinstance(obj, dbus.ObjectPath): return 'o' elif isinstance(obj, dbus.Byte): return 'y' elif isinstance(obj, dbus.Int16): return 'n' elif isinstance(obj, dbus.Int32): return 'i' elif isinstance(obj, dbus.Int64): return 'x' elif isinstance(obj, dbus.UInt16): return 'q' elif isinstance(obj, dbus.UInt32): return 'u' elif isinstance(obj, dbus.UInt64): return 't' elif isinstance(obj, dbus.Double): return 'd' elif isinstance(obj, dbus.Array): if len(obj.signature) > 1: return 'a(%s)' % obj.signature else: return 'a%s' % obj.signature elif isinstance(obj, dbus.Struct): return '(%s)' % obj.signature elif isinstance(obj, dbus.Dictionary): return 'a{%s}' % obj.signature else: raise TypeError("Unhandled %s" % repr(obj)) def dbus_introspection_prepare_properties(obj, interface, access=None): if access is None: access = { } if not hasattr(obj, "_fw_dbus_properties"): setattr(obj, "_fw_dbus_properties", { }) dip = getattr(obj, "_fw_dbus_properties") dip[interface] = { } try: _dict = obj.GetAll(interface) except Exception: _dict = { } for key,value in _dict.items(): dip[interface][key] = { "type": dbus_signature(value) } if key in access: dip[interface][key]["access"] = access[key] else: dip[interface][key]["access"] = "read" def dbus_introspection_add_properties(obj, data, interface): doc = minidom.parseString(data) if hasattr(obj, "_fw_dbus_properties"): for node in doc.getElementsByTagName("interface"): if node.hasAttribute("name") and \ node.getAttribute("name") == interface: dip = { } if getattr(obj, "_fw_dbus_properties"): dip = getattr(obj, "_fw_dbus_properties") if interface in dip: for key,value in dip[interface].items(): prop = doc.createElement("property") prop.setAttribute("name", key) prop.setAttribute("type", value["type"]) prop.setAttribute("access", value["access"]) node.appendChild(prop) log.debug10(doc.toxml()) new_data = doc.toxml() doc.unlink() return new_data def dbus_introspection_add_deprecated(obj, data, interface, deprecated_methods, deprecated_signals): doc = minidom.parseString(data) if interface in deprecated_methods: for node in doc.getElementsByTagName("interface"): if node.hasAttribute("name") and \ node.getAttribute("name") == interface: for method_node in node.getElementsByTagName("method"): if method_node.hasAttribute("name") and \ method_node.getAttribute("name") in deprecated_methods[interface]: annotation = doc.createElement("annotation") annotation.setAttribute("name", "org.freedesktop.DBus.Deprecated") annotation.setAttribute("value", "true") method_node.appendChild(annotation) if interface in deprecated_signals: for node in doc.getElementsByTagName("interface"): if node.hasAttribute("name") and \ node.getAttribute("name") == interface: for signal_node in node.getElementsByTagName("signal"): if signal_node.hasAttribute("name") and \ signal_node.getAttribute("name") in deprecated_signals[interface]: annotation = doc.createElement("annotation") annotation.setAttribute("name", "org.freedesktop.DBus.Deprecated") annotation.setAttribute("value", "true") signal_node.appendChild(annotation) log.debug10(doc.toxml()) data = doc.toxml() doc.unlink() return data PK ���Z����$ �$ core/ebtables.pynu �[��� # -*- coding: utf-8 -*- # # Copyright (C) 2010-2016 Red Hat, Inc. # # Authors: # Thomas Woerner <twoerner@redhat.com> # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see <http://www.gnu.org/licenses/>. # __all__ = [ "ebtables" ] import os.path from firewall.core.prog import runProg from firewall.core.logger import log from firewall.functions import tempFile, readfile, splitArgs from firewall.config import COMMANDS from firewall.core import ipXtables # some common stuff lives there from firewall.errors import FirewallError, INVALID_IPV import string BUILT_IN_CHAINS = { "broute": [ "BROUTING" ], "nat": [ "PREROUTING", "POSTROUTING", "OUTPUT" ], "filter": [ "INPUT", "OUTPUT", "FORWARD" ], } DEFAULT_RULES = { } LOG_RULES = { } OUR_CHAINS = {} # chains created by firewalld for table in BUILT_IN_CHAINS.keys(): DEFAULT_RULES[table] = [ ] OUR_CHAINS[table] = set() for chain in BUILT_IN_CHAINS[table]: DEFAULT_RULES[table].append("-N %s_direct" % chain) DEFAULT_RULES[table].append("-I %s 1 -j %s_direct" % (chain, chain)) DEFAULT_RULES[table].append("-I %s_direct 1 -j RETURN" % chain) OUR_CHAINS[table].add("%s_direct" % chain) class ebtables(object): ipv = "eb" name = "ebtables" policies_supported = False # ebtables only supported with direct interface def __init__(self): self._command = COMMANDS[self.ipv] self._restore_command = COMMANDS["%s-restore" % self.ipv] self.restore_noflush_option = self._detect_restore_noflush_option() self.concurrent_option = self._detect_concurrent_option() self.fill_exists() self.available_tables = [] def fill_exists(self): self.command_exists = os.path.exists(self._command) self.restore_command_exists = os.path.exists(self._restore_command) def _detect_concurrent_option(self): # Do not change any rules, just try to use the --concurrent option # with -L concurrent_option = "" ret = runProg(self._command, ["--concurrent", "-L"]) if ret[0] == 0: concurrent_option = "--concurrent" # concurrent for ebtables lock return concurrent_option def _detect_restore_noflush_option(self): # Do not change any rules, just try to use the restore command # with --noflush rules = [ ] try: self.set_rules(rules, "off") except ValueError: return False return True def __run(self, args): # convert to string list _args = [ ] if self.concurrent_option and self.concurrent_option not in args: _args.append(self.concurrent_option) _args += ["%s" % item for item in args] log.debug2("%s: %s %s", self.__class__, self._command, " ".join(_args)) (status, ret) = runProg(self._command, _args) if status != 0: raise ValueError("'%s %s' failed: %s" % (self._command, " ".join(args), ret)) return ret def _rule_validate(self, rule): for str in ["%%REJECT%%", "%%ICMP%%", "%%LOGTYPE%%"]: if str in rule: raise FirewallError(INVALID_IPV, "'%s' invalid for ebtables" % str) def is_chain_builtin(self, ipv, table, chain): return table in BUILT_IN_CHAINS and \ chain in BUILT_IN_CHAINS[table] def build_chain_rules(self, add, table, chain): rules = [] if add: rules.append([ "-t", table, "-N", chain ]) rules.append([ "-t", table, "-I", chain, "1", "-j", "RETURN" ]) else: rules.append([ "-t", table, "-X", chain ]) return rules def build_rule(self, add, table, chain, index, args): rule = [ "-t", table ] if add: rule += [ "-I", chain, str(index) ] else: rule += [ "-D", chain ] rule += args return rule def reverse_rule(self, args): return ipXtables.common_reverse_rule(args) def check_passthrough(self, args): ipXtables.common_check_passthrough(args) def reverse_passthrough(self, args): return ipXtables.common_reverse_passthrough(args) def set_rules(self, rules, log_denied): temp_file = tempFile() table = "filter" table_rules = { } for _rule in rules: rule = _rule[:] self._rule_validate(rule) # get table form rule for opt in [ "-t", "--table" ]: try: i = rule.index(opt) except ValueError: pass else: if len(rule) >= i+1: rule.pop(i) table = rule.pop(i) # we can not use joinArgs here, because it would use "'" instead # of '"' for the start and end of the string, this breaks # iptables-restore for i in range(len(rule)): for c in string.whitespace: if c in rule[i] and not (rule[i].startswith('"') and rule[i].endswith('"')): rule[i] = '"%s"' % rule[i] table_rules.setdefault(table, []).append(rule) for table in table_rules: temp_file.write("*%s\n" % table) for rule in table_rules[table]: temp_file.write(" ".join(rule) + "\n") temp_file.close() stat = os.stat(temp_file.name) log.debug2("%s: %s %s", self.__class__, self._restore_command, "%s: %d" % (temp_file.name, stat.st_size)) args = [ ] args.append("--noflush") (status, ret) = runProg(self._restore_command, args, stdin=temp_file.name) if log.getDebugLogLevel() > 2: lines = readfile(temp_file.name) if lines is not None: i = 1 for line in lines: log.debug3("%8d: %s" % (i, line), nofmt=1, nl=0) if not line.endswith("\n"): log.debug3("", nofmt=1) i += 1 os.unlink(temp_file.name) if status != 0: raise ValueError("'%s %s' failed: %s" % (self._restore_command, " ".join(args), ret)) def set_rule(self, rule, log_denied): self._rule_validate(rule) return self.__run(rule) def get_available_tables(self, table=None): ret = [] tables = [ table ] if table else BUILT_IN_CHAINS.keys() for table in tables: if table in self.available_tables: ret.append(table) else: try: self.__run(["-t", table, "-L"]) self.available_tables.append(table) ret.append(table) except ValueError: log.debug1("ebtables table '%s' does not exist." % table) return ret def get_zone_table_chains(self, table): return {} def build_flush_rules(self): rules = [] for table in BUILT_IN_CHAINS.keys(): if table not in self.get_available_tables(): continue # Flush firewall rules: -F # Delete firewall chains: -X # Set counter to zero: -Z for flag in [ "-F", "-X", "-Z" ]: rules.append(["-t", table, flag]) return rules def build_set_policy_rules(self, policy): rules = [] _policy = "DROP" if policy == "PANIC" else policy for table in BUILT_IN_CHAINS.keys(): if table not in self.get_available_tables(): continue for chain in BUILT_IN_CHAINS[table]: rules.append(["-t", table, "-P", chain, _policy]) return rules def build_default_tables(self): # nothing to do, they always exist return [] def build_default_rules(self, log_denied="off"): default_rules = [] for table in DEFAULT_RULES: if table not in self.get_available_tables(): continue _default_rules = DEFAULT_RULES[table][:] if log_denied != "off" and table in LOG_RULES: _default_rules.extend(LOG_RULES[table]) prefix = [ "-t", table ] for rule in _default_rules: if type(rule) == list: default_rules.append(prefix + rule) else: default_rules.append(prefix + splitArgs(rule)) return default_rules def is_ipv_supported(self, ipv): return ipv == self.ipv PK ���Z{��G2 G2 core/ipset.pynu �[��� # -*- coding: utf-8 -*- # # Copyright (C) 2015-2016 Red Hat, Inc. # # Authors: # Thomas Woerner <twoerner@redhat.com> # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see <http://www.gnu.org/licenses/>. # """The ipset command wrapper""" __all__ = [ "ipset", "check_ipset_name", "remove_default_create_options" ] import os.path import ipaddress from firewall import errors from firewall.errors import FirewallError from firewall.core.prog import runProg from firewall.core.logger import log from firewall.functions import tempFile, readfile from firewall.config import COMMANDS IPSET_MAXNAMELEN = 32 IPSET_TYPES = [ # bitmap and set types are currently not supported # "bitmap:ip", # "bitmap:ip,mac", # "bitmap:port", # "list:set", "hash:ip", "hash:ip,port", "hash:ip,port,ip", "hash:ip,port,net", "hash:ip,mark", "hash:net", "hash:net,net", "hash:net,port", "hash:net,port,net", "hash:net,iface", "hash:mac", ] IPSET_CREATE_OPTIONS = { "family": "inet|inet6", "hashsize": "value", "maxelem": "value", "timeout": "value in secs", #"counters": None, #"comment": None, } IPSET_DEFAULT_CREATE_OPTIONS = { "family": "inet", "hashsize": "1024", "maxelem": "65536", } class ipset(object): """ipset command wrapper class""" def __init__(self): self._command = COMMANDS["ipset"] self.name = "ipset" def __run(self, args): """Call ipset with args""" # convert to string list _args = ["%s" % item for item in args] log.debug2("%s: %s %s", self.__class__, self._command, " ".join(_args)) (status, ret) = runProg(self._command, _args) if status != 0: raise ValueError("'%s %s' failed: %s" % (self._command, " ".join(_args), ret)) return ret def check_name(self, name): """Check ipset name""" if len(name) > IPSET_MAXNAMELEN: raise FirewallError(errors.INVALID_NAME, "ipset name '%s' is not valid" % name) def set_supported_types(self): """Return types that are supported by the ipset command and kernel""" ret = [ ] output = "" try: output = self.__run(["--help"]) except ValueError as ex: log.debug1("ipset error: %s" % ex) lines = output.splitlines() in_types = False for line in lines: #print(line) if in_types: splits = line.strip().split(None, 2) if splits[0] not in ret and splits[0] in IPSET_TYPES: ret.append(splits[0]) if line.startswith("Supported set types:"): in_types = True return ret def check_type(self, type_name): """Check ipset type""" if len(type_name) > IPSET_MAXNAMELEN or type_name not in IPSET_TYPES: raise FirewallError(errors.INVALID_TYPE, "ipset type name '%s' is not valid" % type_name) def set_create(self, set_name, type_name, options=None): """Create an ipset with name, type and options""" self.check_name(set_name) self.check_type(type_name) args = [ "create", set_name, type_name ] if isinstance(options, dict): for key, val in options.items(): args.append(key) if val != "": args.append(val) return self.__run(args) def set_destroy(self, set_name): self.check_name(set_name) return self.__run([ "destroy", set_name ]) def set_add(self, set_name, entry): args = [ "add", set_name, entry ] return self.__run(args) def set_delete(self, set_name, entry): args = [ "del", set_name, entry ] return self.__run(args) def test(self, set_name, entry, options=None): args = [ "test", set_name, entry ] if options: args.append("%s" % " ".join(options)) return self.__run(args) def set_list(self, set_name=None, options=None): args = [ "list" ] if set_name: args.append(set_name) if options: args.extend(options) return self.__run(args).split("\n") def set_get_active_terse(self): """ Get active ipsets (only headers) """ lines = self.set_list(options=["-terse"]) ret = { } _name = _type = None _options = { } for line in lines: if len(line) < 1: continue pair = [ x.strip() for x in line.split(":", 1) ] if len(pair) != 2: continue elif pair[0] == "Name": _name = pair[1] elif pair[0] == "Type": _type = pair[1] elif pair[0] == "Header": splits = pair[1].split() i = 0 while i < len(splits): opt = splits[i] if opt in [ "family", "hashsize", "maxelem", "timeout", "netmask" ]: if len(splits) > i: i += 1 _options[opt] = splits[i] else: log.error("Malformed ipset list -terse output: %s", line) return { } i += 1 if _name and _type: ret[_name] = (_type, remove_default_create_options(_options)) _name = _type = None _options.clear() return ret def save(self, set_name=None): args = [ "save" ] if set_name: args.append(set_name) return self.__run(args) def set_restore(self, set_name, type_name, entries, create_options=None, entry_options=None): self.check_name(set_name) self.check_type(type_name) temp_file = tempFile() if ' ' in set_name: set_name = "'%s'" % set_name args = [ "create", set_name, type_name, "-exist" ] if create_options: for key, val in create_options.items(): args.append(key) if val != "": args.append(val) temp_file.write("%s\n" % " ".join(args)) temp_file.write("flush %s\n" % set_name) for entry in entries: if ' ' in entry: entry = "'%s'" % entry if entry_options: temp_file.write("add %s %s %s\n" % \ (set_name, entry, " ".join(entry_options))) else: temp_file.write("add %s %s\n" % (set_name, entry)) temp_file.close() stat = os.stat(temp_file.name) log.debug2("%s: %s restore %s", self.__class__, self._command, "%s: %d" % (temp_file.name, stat.st_size)) args = [ "restore" ] (status, ret) = runProg(self._command, args, stdin=temp_file.name) if log.getDebugLogLevel() > 2: try: readfile(temp_file.name) except Exception: pass else: i = 1 for line in readfile(temp_file.name): log.debug3("%8d: %s" % (i, line), nofmt=1, nl=0) if not line.endswith("\n"): log.debug3("", nofmt=1) i += 1 os.unlink(temp_file.name) if status != 0: raise ValueError("'%s %s' failed: %s" % (self._command, " ".join(args), ret)) return ret def set_flush(self, set_name): args = [ "flush" ] if set_name: args.append(set_name) return self.__run(args) def rename(self, old_set_name, new_set_name): return self.__run([ "rename", old_set_name, new_set_name ]) def swap(self, set_name_1, set_name_2): return self.__run([ "swap", set_name_1, set_name_2 ]) def version(self): return self.__run([ "version" ]) def check_ipset_name(name): """Return true if ipset name is valid""" if len(name) > IPSET_MAXNAMELEN: return False return True def remove_default_create_options(options): """ Return only non default create options """ _options = options.copy() for opt in IPSET_DEFAULT_CREATE_OPTIONS: if opt in _options and \ IPSET_DEFAULT_CREATE_OPTIONS[opt] == _options[opt]: del _options[opt] return _options def normalize_ipset_entry(entry): """ Normalize IP addresses in entry """ _entry = [] for _part in entry.split(","): try: _part.index("/") _entry.append(str(ipaddress.ip_network(_part, strict=False))) except ValueError: _entry.append(_part) return ",".join(_entry) def check_entry_overlaps_existing(entry, entries): """ Check if entry overlaps any entry in the list of entries """ # Only check simple types if len(entry.split(",")) > 1: return try: entry_network = ipaddress.ip_network(entry, strict=False) except ValueError: # could not parse the new IP address, maybe a MAC return for itr in entries: if entry_network.overlaps(ipaddress.ip_network(itr, strict=False)): raise FirewallError(errors.INVALID_ENTRY, "Entry '{}' overlaps with existing entry '{}'".format(entry, itr)) def check_for_overlapping_entries(entries): """ Check if any entry overlaps any entry in the list of entries """ try: entries = [ipaddress.ip_network(x, strict=False) for x in entries] except ValueError: # at least one entry can not be parsed return # We can take advantage of some facts of IPv4Network/IPv6Network and # how Python sorts the networks to quickly detect overlaps. # # Facts: # # 1. IPv{4,6}Network are normalized to remove host bits, e.g. # 10.1.1.0/16 will become 10.1.0.0/16. # # 2. IPv{4,6}Network objects are sorted by: # a. IP address (network bits) # then # b. netmask (significant bits count) # # Because of the above we have these properties: # # 1. big networks (netA) are sorted before smaller networks (netB) # that overlap the big network (netA) # - e.g. 10.1.128.0/17 (netA) sorts before 10.1.129.0/24 (netB) # 2. same value addresses (network bits) are grouped together even # if the number of network bits vary. e.g. /16 vs /24 # - recall that address are normalized to remove host bits # - e.g. 10.1.128.0/17 (netA) sorts before 10.1.128.0/24 (netC) # 3. non-overlapping networks (netD, netE) are always sorted before or # after networks that overlap (netB, netC) the current one (netA) # - e.g. 10.1.128.0/17 (netA) sorts before 10.2.128.0/16 (netD) # - e.g. 10.1.128.0/17 (netA) sorts after 9.1.128.0/17 (netE) # - e.g. 9.1.128.0/17 (netE) sorts before 10.1.129.0/24 (netB) # # With this we know the sorted list looks like: # # list: [ netE, netA, netB, netC, netD ] # # netE = non-overlapping network # netA = big network # netB = smaller network that overlaps netA (subnet) # netC = smaller network that overlaps netA (subnet) # netD = non-overlapping network # # If networks netB and netC exist in the list, they overlap and are # adjacent to netA. # # Checking for overlaps on a sorted list is thus: # # 1. compare adjacent elements in the list for overlaps # # Recall that we only need to detect a single overlap. We do not need to # detect them all. # entries.sort() prev_network = entries.pop(0) for current_network in entries: if prev_network.overlaps(current_network): raise FirewallError(errors.INVALID_ENTRY, "Entry '{}' overlaps entry '{}'".format(prev_network, current_network)) prev_network = current_network PK ���Z��d core/base.pynu �[��� # -*- coding: utf-8 -*- # # Copyright (C) 2011-2016 Red Hat, Inc. # # Authors: # Thomas Woerner <twoerner@redhat.com> # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see <http://www.gnu.org/licenses/>. # """Base firewall settings""" DEFAULT_ZONE_TARGET = "{chain}_{zone}" DEFAULT_POLICY_TARGET = "CONTINUE" DEFAULT_POLICY_PRIORITY = -1 ZONE_TARGETS = [ "ACCEPT", "%%REJECT%%", "DROP", DEFAULT_ZONE_TARGET, "default" ] POLICY_TARGETS = [ "ACCEPT", "REJECT", "DROP", "CONTINUE" ] SHORTCUTS = { "PREROUTING": "PRE", "POSTROUTING": "POST", "INPUT": "IN", "FORWARD": "FWD", "OUTPUT": "OUT", } REJECT_TYPES = { "ipv4": [ "icmp-host-prohibited", "host-prohib", "icmp-net-unreachable", "net-unreach", "icmp-host-unreachable", "host-unreach", "icmp-port-unreachable", "port-unreach", "icmp-proto-unreachable", "proto-unreach", "icmp-net-prohibited", "net-prohib", "tcp-reset", "tcp-rst", "icmp-admin-prohibited", "admin-prohib" ], "ipv6": [ "icmp6-adm-prohibited", "adm-prohibited", "icmp6-no-route", "no-route", "icmp6-addr-unreachable", "addr-unreach", "icmp6-port-unreachable", "port-unreach", "tcp-reset" ] } # ipset types that can be used as a source in zones # The match-set option will be src or src,src according to the # dimension of the ipset. SOURCE_IPSET_TYPES = [ "hash:ip", "hash:ip,port", "hash:ip,mark", "hash:net", "hash:net,port", "hash:net,iface", "hash:mac" ] PK ���ZD��� � core/prog.pynu �[��� # -*- coding: utf-8 -*- # # Copyright (C) 2010-2016 Red Hat, Inc. # # Authors: # Thomas Woerner <twoerner@redhat.com> # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see <http://www.gnu.org/licenses/>. # import subprocess __all__ = ["runProg"] def runProg(prog, argv=None, stdin=None): if argv is None: argv = [] args = [prog] + argv input_string = None if stdin: with open(stdin, 'r') as handle: input_string = handle.read().encode() env = {'LANG': 'C'} try: process = subprocess.Popen(args, stdin=subprocess.PIPE, stderr=subprocess.STDOUT, stdout=subprocess.PIPE, close_fds=True, env=env) except OSError: return (255, '') (output, err_output) = process.communicate(input_string) output = output.decode('utf-8', 'replace') return (process.returncode, output) PK ���Z�rz z core/fw_nm.pynu �[��� # -*- coding: utf-8 -*- # # Copyright (C) 2010-2016 Red Hat, Inc. # # Authors: # Thomas Woerner <twoerner@redhat.com> # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see <http://www.gnu.org/licenses/>. # """Functions for NetworkManager interaction""" __all__ = [ "check_nm_imported", "nm_is_imported", "nm_get_zone_of_connection", "nm_set_zone_of_connection", "nm_get_connections", "nm_get_connection_of_interface", "nm_get_bus_name", "nm_get_dbus_interface" ] import gi from gi.repository import GLib try: gi.require_version('NM', '1.0') except ValueError: _nm_imported = False else: try: from gi.repository import NM _nm_imported = True except (ImportError, ValueError, GLib.Error): _nm_imported = False _nm_client = None from firewall import errors from firewall.errors import FirewallError from firewall.core.logger import log import dbus def check_nm_imported(): """Check function to raise a MISSING_IMPORT error if the import of NM failed """ if not _nm_imported: raise FirewallError(errors.MISSING_IMPORT, "gi.repository.NM = 1.0") def nm_is_imported(): """Returns true if NM has been properly imported @return True if import was successful, False otherwirse """ return _nm_imported def nm_get_client(): """Returns the NM client object or None if the import of NM failed @return NM.Client instance if import was successful, None otherwise """ global _nm_client if not _nm_client: _nm_client = NM.Client.new(None) return _nm_client def nm_get_zone_of_connection(connection): """Get zone of connection from NM @param connection name @return zone string setting of connection, empty string if not set, None if connection is unknown """ check_nm_imported() con = nm_get_client().get_connection_by_uuid(connection) if con is None: return None setting_con = con.get_setting_connection() if setting_con is None: return None try: if con.get_flags() & (NM.SettingsConnectionFlags.NM_GENERATED | NM.SettingsConnectionFlags.NM_VOLATILE): return "" except AttributeError: # Prior to NetworkManager 1.12, we can only guess # that a connection was generated/volatile. if con.get_unsaved(): return "" zone = setting_con.get_zone() if zone is None: zone = "" return zone def nm_set_zone_of_connection(zone, connection): """Set the zone for a connection @param zone name @param connection name @return True if zone was set, else False """ check_nm_imported() con = nm_get_client().get_connection_by_uuid(connection) if con is None: return False setting_con = con.get_setting_connection() if setting_con is None: return False if zone == "": zone = None setting_con.set_property("zone", zone) return con.commit_changes(True, None) def nm_get_connections(connections, connections_name): """Get active connections from NM @param connections return dict @param connections_name return dict """ connections.clear() connections_name.clear() check_nm_imported() active_connections = nm_get_client().get_active_connections() for active_con in active_connections: # ignore vpn devices for now if active_con.get_vpn(): continue name = active_con.get_id() uuid = active_con.get_uuid() devices = active_con.get_devices() connections_name[uuid] = name for dev in devices: ip_iface = dev.get_ip_iface() if ip_iface: connections[ip_iface] = uuid def nm_get_interfaces(): """Get active interfaces from NM @returns list of interface names """ check_nm_imported() active_interfaces = [] for active_con in nm_get_client().get_active_connections(): # ignore vpn devices for now if active_con.get_vpn(): continue try: con = active_con.get_connection() if con.get_flags() & (NM.SettingsConnectionFlags.NM_GENERATED | NM.SettingsConnectionFlags.NM_VOLATILE): continue except AttributeError: # Prior to NetworkManager 1.12, we can only guess # that a connection was generated/volatile. if con.get_unsaved(): continue for dev in active_con.get_devices(): ip_iface = dev.get_ip_iface() if ip_iface: active_interfaces.append(ip_iface) return active_interfaces def nm_get_interfaces_in_zone(zone): interfaces = [] for interface in nm_get_interfaces(): conn = nm_get_connection_of_interface(interface) if zone == nm_get_zone_of_connection(conn): interfaces.append(interface) return interfaces def nm_get_connection_of_interface(interface): """Get connection from NM that is using the interface @param interface name @returns connection that is using interface or None """ check_nm_imported() device = nm_get_client().get_device_by_iface(interface) if device is None: return None active_con = device.get_active_connection() if active_con is None: return None try: con = active_con.get_connection() if con.get_flags() & NM.SettingsConnectionFlags.NM_GENERATED: return None except AttributeError: # Prior to NetworkManager 1.12, we can only guess # that a connection was generated. if con.get_unsaved(): return None return active_con.get_uuid() def nm_get_bus_name(): if not _nm_imported: return None try: bus = dbus.SystemBus() obj = bus.get_object(NM.DBUS_INTERFACE, NM.DBUS_PATH) name = obj.bus_name del obj, bus return name except Exception: log.debug2("Failed to get bus name of NetworkManager") return None def nm_get_dbus_interface(): if not _nm_imported: return "" return NM.DBUS_INTERFACE PK ���Z �M V V core/fw_direct.pynu �[��� # -*- coding: utf-8 -*- # # Copyright (C) 2010-2016 Red Hat, Inc. # # Authors: # Thomas Woerner <twoerner@redhat.com> # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see <http://www.gnu.org/licenses/>. # __all__ = [ "FirewallDirect" ] from firewall.fw_types import LastUpdatedOrderedDict from firewall.core import ipXtables from firewall.core import ebtables from firewall.core.fw_transaction import FirewallTransaction from firewall.core.logger import log from firewall import errors from firewall.errors import FirewallError ############################################################################ # # class Firewall # ############################################################################ class FirewallDirect(object): def __init__(self, fw): self._fw = fw self.__init_vars() def __repr__(self): return '%s(%r, %r, %r)' % (self.__class__, self._chains, self._rules, self._rule_priority_positions) def __init_vars(self): self._chains = { } self._rules = { } self._rule_priority_positions = { } self._passthroughs = { } self._obj = None def cleanup(self): self.__init_vars() # transaction def new_transaction(self): return FirewallTransaction(self._fw) # configuration def set_permanent_config(self, obj): self._obj = obj def has_configuration(self): if len(self._chains) + len(self._rules) + len(self._passthroughs) > 0: return True if len(self._obj.get_all_chains()) + \ len(self._obj.get_all_rules()) + \ len(self._obj.get_all_passthroughs()) > 0: return True return False def apply_direct(self, use_transaction=None): if use_transaction is None: transaction = self.new_transaction() else: transaction = use_transaction # Apply permanent configuration and save the obj to be able to # remove permanent configuration settings within get_runtime_config # for use in firewalld reload. self.set_config((self._obj.get_all_chains(), self._obj.get_all_rules(), self._obj.get_all_passthroughs()), transaction) if use_transaction is None: transaction.execute(True) def get_runtime_config(self): # Return only runtime changes # Remove all chains, rules and passthroughs that are in self._obj # (permanent config applied in firewalld _start. chains = { } rules = { } passthroughs = { } for table_id in self._chains: (ipv, table) = table_id for chain in self._chains[table_id]: if not self._obj.query_chain(ipv, table, chain): chains.setdefault(table_id, [ ]).append(chain) for chain_id in self._rules: (ipv, table, chain) = chain_id for (priority, args) in self._rules[chain_id]: if not self._obj.query_rule(ipv, table, chain, priority, args): if chain_id not in rules: rules[chain_id] = LastUpdatedOrderedDict() rules[chain_id][(priority, args)] = priority for ipv in self._passthroughs: for args in self._passthroughs[ipv]: if not self._obj.query_passthrough(ipv, args): if ipv not in passthroughs: passthroughs[ipv] = [ ] passthroughs[ipv].append(args) return (chains, rules, passthroughs) def get_config(self): return (self._chains, self._rules, self._passthroughs) def set_config(self, conf, use_transaction=None): if use_transaction is None: transaction = self.new_transaction() else: transaction = use_transaction (_chains, _rules, _passthroughs) = conf for table_id in _chains: (ipv, table) = table_id for chain in _chains[table_id]: if not self.query_chain(ipv, table, chain): try: self.add_chain(ipv, table, chain, use_transaction=transaction) except FirewallError as error: log.warning(str(error)) for chain_id in _rules: (ipv, table, chain) = chain_id for (priority, args) in _rules[chain_id]: if not self.query_rule(ipv, table, chain, priority, args): try: self.add_rule(ipv, table, chain, priority, args, use_transaction=transaction) except FirewallError as error: log.warning(str(error)) for ipv in _passthroughs: for args in _passthroughs[ipv]: if not self.query_passthrough(ipv, args): try: self.add_passthrough(ipv, args, use_transaction=transaction) except FirewallError as error: log.warning(str(error)) if use_transaction is None: transaction.execute(True) def _check_ipv(self, ipv): ipvs = ['ipv4', 'ipv6', 'eb'] if ipv not in ipvs: raise FirewallError(errors.INVALID_IPV, "'%s' not in '%s'" % (ipv, ipvs)) def _check_ipv_table(self, ipv, table): self._check_ipv(ipv) tables = ipXtables.BUILT_IN_CHAINS.keys() if ipv in [ 'ipv4', 'ipv6' ] \ else ebtables.BUILT_IN_CHAINS.keys() if table not in tables: raise FirewallError(errors.INVALID_TABLE, "'%s' not in '%s'" % (table, tables)) def _check_builtin_chain(self, ipv, table, chain): if ipv in ['ipv4', 'ipv6']: built_in_chains = ipXtables.BUILT_IN_CHAINS[table] if self._fw.nftables_enabled: our_chains = {} else: our_chains = self._fw.get_direct_backend_by_ipv(ipv).our_chains[table] else: built_in_chains = ebtables.BUILT_IN_CHAINS[table] our_chains = ebtables.OUR_CHAINS[table] if chain in built_in_chains: raise FirewallError(errors.BUILTIN_CHAIN, "chain '%s' is built-in chain" % chain) if chain in our_chains: raise FirewallError(errors.BUILTIN_CHAIN, "chain '%s' is reserved" % chain) if ipv in [ "ipv4", "ipv6" ]: if self._fw.zone.zone_from_chain(chain) is not None: raise FirewallError(errors.INVALID_CHAIN, "Chain '%s' is reserved" % chain) def _register_chain(self, table_id, chain, add): if add: self._chains.setdefault(table_id, [ ]).append(chain) else: self._chains[table_id].remove(chain) if len(self._chains[table_id]) == 0: del self._chains[table_id] def add_chain(self, ipv, table, chain, use_transaction=None): if use_transaction is None: transaction = self.new_transaction() else: transaction = use_transaction #TODO: policy="ACCEPT" self._chain(True, ipv, table, chain, transaction) if use_transaction is None: transaction.execute(True) def remove_chain(self, ipv, table, chain, use_transaction=None): if use_transaction is None: transaction = self.new_transaction() else: transaction = use_transaction self._chain(False, ipv, table, chain, transaction) if use_transaction is None: transaction.execute(True) def query_chain(self, ipv, table, chain): self._check_ipv_table(ipv, table) self._check_builtin_chain(ipv, table, chain) table_id = (ipv, table) return (table_id in self._chains and chain in self._chains[table_id]) def get_chains(self, ipv, table): self._check_ipv_table(ipv, table) table_id = (ipv, table) if table_id in self._chains: return self._chains[table_id] return [ ] def get_all_chains(self): r = [ ] for key in self._chains: (ipv, table) = key for chain in self._chains[key]: r.append((ipv, table, chain)) return r def add_rule(self, ipv, table, chain, priority, args, use_transaction=None): if use_transaction is None: transaction = self.new_transaction() else: transaction = use_transaction self._rule(True, ipv, table, chain, priority, args, transaction) if use_transaction is None: transaction.execute(True) def remove_rule(self, ipv, table, chain, priority, args, use_transaction=None): if use_transaction is None: transaction = self.new_transaction() else: transaction = use_transaction self._rule(False, ipv, table, chain, priority, args, transaction) if use_transaction is None: transaction.execute(True) def query_rule(self, ipv, table, chain, priority, args): self._check_ipv_table(ipv, table) chain_id = (ipv, table, chain) return chain_id in self._rules and \ (priority, args) in self._rules[chain_id] def get_rules(self, ipv, table, chain): self._check_ipv_table(ipv, table) chain_id = (ipv, table, chain) if chain_id in self._rules: return list(self._rules[chain_id].keys()) return [ ] def get_all_rules(self): r = [ ] for key in self._rules: (ipv, table, chain) = key for (priority, args) in self._rules[key]: r.append((ipv, table, chain, priority, list(args))) return r def _register_rule(self, rule_id, chain_id, priority, enable, count): if enable: if chain_id not in self._rules: self._rules[chain_id] = LastUpdatedOrderedDict() self._rules[chain_id][rule_id] = priority if chain_id not in self._rule_priority_positions: self._rule_priority_positions[chain_id] = { } if priority in self._rule_priority_positions[chain_id]: self._rule_priority_positions[chain_id][priority] += count else: self._rule_priority_positions[chain_id][priority] = count else: del self._rules[chain_id][rule_id] if len(self._rules[chain_id]) == 0: del self._rules[chain_id] self._rule_priority_positions[chain_id][priority] -= count # DIRECT PASSTHROUGH (untracked) def passthrough(self, ipv, args): try: return self._fw.rule(self._fw.get_direct_backend_by_ipv(ipv).name, args) except Exception as msg: log.debug2(msg) raise FirewallError(errors.COMMAND_FAILED, msg) def _register_passthrough(self, ipv, args, enable): if enable: if ipv not in self._passthroughs: self._passthroughs[ipv] = [ ] self._passthroughs[ipv].append(args) else: self._passthroughs[ipv].remove(args) if len(self._passthroughs[ipv]) == 0: del self._passthroughs[ipv] def add_passthrough(self, ipv, args, use_transaction=None): if use_transaction is None: transaction = self.new_transaction() else: transaction = use_transaction self._passthrough(True, ipv, list(args), transaction) if use_transaction is None: transaction.execute(True) def remove_passthrough(self, ipv, args, use_transaction=None): if use_transaction is None: transaction = self.new_transaction() else: transaction = use_transaction self._passthrough(False, ipv, list(args), transaction) if use_transaction is None: transaction.execute(True) def query_passthrough(self, ipv, args): return ipv in self._passthroughs and \ tuple(args) in self._passthroughs[ipv] def get_all_passthroughs(self): r = [ ] for ipv in self._passthroughs: for args in self._passthroughs[ipv]: r.append((ipv, list(args))) return r def get_passthroughs(self, ipv): r = [ ] if ipv in self._passthroughs: for args in self._passthroughs[ipv]: r.append(list(args)) return r def split_value(self, rules, opts): """Split values combined with commas for options in opts""" out_rules = [ ] for rule in rules: processed = False for opt in opts: try: i = rule.index(opt) except ValueError: pass else: if len(rule) > i and "," in rule[i+1]: # For all items in the comma separated list in index # i of the rule, a new rule is created with a single # item from this list processed = True items = rule[i+1].split(",") for item in items: _rule = rule[:] _rule[i+1] = item out_rules.append(_rule) if not processed: out_rules.append(rule) return out_rules def _rule(self, enable, ipv, table, chain, priority, args, transaction): self._check_ipv_table(ipv, table) # Do not create zone chains if we're using nftables. Only allow direct # rules in the built in chains. if not self._fw.nftables_enabled \ and ipv in [ "ipv4", "ipv6" ]: self._fw.zone.create_zone_base_by_chain(ipv, table, chain, transaction) _chain = chain backend = self._fw.get_direct_backend_by_ipv(ipv) # if nftables is in use, just put the direct rules in the chain # specified by the user. i.e. don't append _direct. if not self._fw.nftables_enabled \ and backend.is_chain_builtin(ipv, table, chain): _chain = "%s_direct" % (chain) elif self._fw.nftables_enabled and chain[-7:] == "_direct" \ and backend.is_chain_builtin(ipv, table, chain[:-7]): # strip _direct suffix. If we're using nftables we don't bother # creating the *_direct chains for builtin chains. _chain = chain[:-7] chain_id = (ipv, table, chain) rule_id = (priority, args) if enable: if chain_id in self._rules and \ rule_id in self._rules[chain_id]: raise FirewallError(errors.ALREADY_ENABLED, "rule '%s' already is in '%s:%s:%s'" % \ (args, ipv, table, chain)) else: if chain_id not in self._rules or \ rule_id not in self._rules[chain_id]: raise FirewallError(errors.NOT_ENABLED, "rule '%s' is not in '%s:%s:%s'" % \ (args, ipv, table, chain)) # get priority of rule priority = self._rules[chain_id][rule_id] # If a rule gets added, the initial rule index position within the # ipv, table and chain combination (chain_id) is 1. # Tf the chain_id exists in _rule_priority_positions, there are already # other rules for this chain_id. The number of rules for a priority # less or equal to the priority of the new rule will increase the # index of the new rule. The index is the ip*tables -I insert rule # number. # # Example: We have the following rules for chain_id (ipv4, filter, # INPUT) already: # ipv4, filter, INPUT, 1, -i, foo1, -j, ACCEPT # ipv4, filter, INPUT, 2, -i, foo2, -j, ACCEPT # ipv4, filter, INPUT, 2, -i, foo2_1, -j, ACCEPT # ipv4, filter, INPUT, 3, -i, foo3, -j, ACCEPT # This results in the following _rule_priority_positions structure: # _rule_priority_positions[(ipv4,filter,INPUT)][1] = 1 # _rule_priority_positions[(ipv4,filter,INPUT)][2] = 2 # _rule_priority_positions[(ipv4,filter,INPUT)][3] = 1 # The new rule # ipv4, filter, INPUT, 2, -i, foo2_2, -j, ACCEPT # has the same pritority as the second rule before and will be added # right after it. # The initial index is 1 and the chain_id is already in # _rule_priority_positions. Therefore the index will increase for # the number of rules in every rule position in # _rule_priority_positions[(ipv4,filter,INPUT)].keys() # where position is smaller or equal to the entry in keys. # With the example from above: # The priority of the new rule is 2. Therefore for all keys in # _rule_priority_positions[chain_id] where priority is 1 or 2, the # number of the rules will increase the index of the rule. # For _rule_priority_positions[chain_id][1]: index += 1 # _rule_priority_positions[chain_id][2]: index += 2 # index will be 4 in the end and the rule in the table chain # combination will be added at index 4. # If there are no rules in the table chain combination, a new rule # has index 1. index = 1 count = 0 if chain_id in self._rule_priority_positions: positions = sorted(self._rule_priority_positions[chain_id].keys()) j = 0 while j < len(positions) and priority >= positions[j]: index += self._rule_priority_positions[chain_id][positions[j]] j += 1 # split the direct rule in some cases as iptables-restore can't handle # compound args. # args_list = [list(args)] args_list = self.split_value(args_list, [ "-s", "--source" ]) args_list = self.split_value(args_list, [ "-d", "--destination" ]) for _args in args_list: transaction.add_rule(backend, backend.build_rule(enable, table, _chain, index, tuple(_args))) index += 1 count += 1 self._register_rule(rule_id, chain_id, priority, enable, count) transaction.add_fail(self._register_rule, rule_id, chain_id, priority, not enable, count) def _chain(self, add, ipv, table, chain, transaction): self._check_ipv_table(ipv, table) self._check_builtin_chain(ipv, table, chain) table_id = (ipv, table) if add: if table_id in self._chains and \ chain in self._chains[table_id]: raise FirewallError(errors.ALREADY_ENABLED, "chain '%s' already is in '%s:%s'" % \ (chain, ipv, table)) else: if table_id not in self._chains or \ chain not in self._chains[table_id]: raise FirewallError(errors.NOT_ENABLED, "chain '%s' is not in '%s:%s'" % \ (chain, ipv, table)) backend = self._fw.get_direct_backend_by_ipv(ipv) transaction.add_rules(backend, backend.build_chain_rules(add, table, chain)) self._register_chain(table_id, chain, add) transaction.add_fail(self._register_chain, table_id, chain, not add) def _passthrough(self, enable, ipv, args, transaction): self._check_ipv(ipv) tuple_args = tuple(args) if enable: if ipv in self._passthroughs and \ tuple_args in self._passthroughs[ipv]: raise FirewallError(errors.ALREADY_ENABLED, "passthrough '%s', '%s'" % (ipv, args)) else: if ipv not in self._passthroughs or \ tuple_args not in self._passthroughs[ipv]: raise FirewallError(errors.NOT_ENABLED, "passthrough '%s', '%s'" % (ipv, args)) backend = self._fw.get_direct_backend_by_ipv(ipv) if enable: backend.check_passthrough(args) # try to find out if a zone chain should be used if ipv in [ "ipv4", "ipv6" ]: table, chain = backend.passthrough_parse_table_chain(args) if table and chain: self._fw.zone.create_zone_base_by_chain(ipv, table, chain) _args = args else: _args = backend.reverse_passthrough(args) transaction.add_rule(backend, _args) self._register_passthrough(ipv, tuple_args, enable) transaction.add_fail(self._register_passthrough, ipv, tuple_args, not enable) PK ���Zӊ�%� %� * core/__pycache__/fw_policy.cpython-310.pycnu �[��� o bhAb�. � @ s� d dl Z d dlmZ d dlmZmZmZmZmZm Z m Z m Z m Z m Z mZ d dlmZmZmZmZmZmZmZmZmZmZmZ d dlm Z d dl m Z d dl m Z d dl!m"Z" G d d � d e#�Z$dS ) � N)�log) �portStr� checkIPnMask� checkIP6nMask� checkProtocol�enable_ip_forwarding�check_single_address�portInPortRange�get_nf_conntrack_short_name�coalescePortRange�breakPortRange�checkTcpMssClamp) � Rich_Rule� Rich_Accept� Rich_Service� Rich_Port� Rich_Protocol�Rich_Masquerade�Rich_ForwardPort�Rich_SourcePort�Rich_IcmpBlock� Rich_IcmpType�Rich_Tcp_Mss_Clamp)�FirewallTransaction)�errors)� FirewallError)�SOURCE_IPSET_TYPESc @ s� e Zd Zdd� Zdd� Zdd� Zdd� Zd d � Zd d � Zd d� Z dd� Z dd� Z dd� Z �ddd�Z dd� Z�ddd�Z�dd d �Z�dd d �Zd d!� Zd"d#� Zd$d%� Zd&d'� Z )�dd*d+�Zd,d-� Z�dd.d/�Zd0d1� Zd2d3� Zd4d5� Zd6d7� Z d8d9� Z )�dd:d;�Z d<d=� Z �dd>d?�Z d@dA� Z!dBdC� Z"dDdE� Z#dFdG� Z$dHdI� Z%dJdK� Z&dLdM� Z' �ddNdO�Z(dPdQ� Z) �ddRdS�Z*dTdU� Z+dVdW� Z,dXdY� Z-dZd[� Z.d\d]� Z/ �dd^d_�Z0d`da� Z1 �ddbdc�Z2ddde� Z3dfdg� Z4dhdi� Z5djdk� Z6dldm� Z7dndo� Z8dpdq� Z9 �ddrds�Z:dtdu� Z; �ddvdw�Z<dxdy� Z=dzd{� Z>d|d}� Z?d~d� Z@d�d�� ZAd�d�� ZB �dd�d��ZCd�d�� ZD �dd�d��ZEd�d�� ZFd�d�� ZGd�d�� ZHd�d�� ZI �dd�d��ZJd�d�� ZK �dd�d��ZLd�d�� ZMd�d�� ZNd�d�� ZO �dd�d��ZPd�d�� ZQ�dd�d��ZRd�d�� ZSd�d�� ZT�dd�d��ZU�dd�d��ZV �dd�d��ZWd�d�� ZX �dd�d��ZYd�d�� ZZ �dd�d��Z[d�d�� Z\d�d�� Z]d�d�� Z^ �dd�d��Z_d�d�� Z`�dd�d��Zad�dÄ Zbd�dń Zcd�dDŽ Zd �dd�dɄZed�d˄ Zfd�d̈́ Zg�dd�dτZhd�dф Zid�dӄ Zjd�dՄ Zkd�dׄ Zld�dل Zmd�dۄ Znd�d݄ Zod�d߄ Zpd�d� Zqd�d� Zr�dd�d�Zsd�d� Ztd�d� Zud�d� Zvd�d� Zw �dd�d�Zxd�d� Zyd�d� Zzd�d�� Z{d�d�� Z|d�d�� Z}d�d�� Z~d�d�� Zd�d�� Z��d �d�d�Z�dS ( �FirewallPolicyc C s || _ i | _i | _d S �N)�_fw�_chains� _policies)�self�fw� r$ �9/usr/lib/python3/dist-packages/firewall/core/fw_policy.py�__init__ s zFirewallPolicy.__init__c C s d| j | j| jf S )Nz %s(%r, %r))� __class__r r! �r" r$ r$ r% �__repr__ � zFirewallPolicy.__repr__c C s | j �� | j�� d S r )r �clearr! r( r$ r$ r% �cleanup s zFirewallPolicy.cleanupc C s t | j�}|�| jj� |S r )r r �add_pre�full_check_config)r" �tr$ r$ r% �new_transaction$ s z FirewallPolicy.new_transactionc C s t | j�� �S r )�sortedr! �keysr( r$ r$ r% � get_policies+ � zFirewallPolicy.get_policiesc C s4 g }| � � D ]}| �|�}|js|�|� qt|�S r )r3 � get_policy�derived_from_zone�appendr1 )r" �policies�p�p_objr$ r$ r% �"get_policies_not_derived_from_zone. s �z1FirewallPolicy.get_policies_not_derived_from_zonec C sv g }| � � D ]2}| �|�}t|j�t| jj�� �tddg�B @ r8t|j�t| jj�� �tddg�B @ r8|�|� q|S )N�HOST�ANY) r; r5 �set� ingress_zonesr �zone�get_active_zones� egress_zonesr7 )r" �active_policies�policyr: r$ r$ r% �)get_active_policies_not_derived_from_zone6 s &$� �z8FirewallPolicy.get_active_policies_not_derived_from_zonec C s | j �|�}| j| S r )r � check_policyr! )r" rD r9 r$ r$ r% r5 @ s zFirewallPolicy.get_policyc C s || j |j< d S r )r! �name)r" �objr$ r$ r% � add_policyD � zFirewallPolicy.add_policyc C s& | j | }|jr | �|� | j |= d S r )r! �applied�unapply_policy_settings)r" rD rH r$ r$ r% � remove_policyG s z FirewallPolicy.remove_policyNc C sJ | � � D ] }| j| }|jrq|| �� v r"t�d|� | j||d� qd S )NzApplying policy '%s'��use_transaction)r3 r! r6 rE r �debug1�apply_policy_settings)r" rO rD r: r$ r$ r% �apply_policiesM s ��z FirewallPolicy.apply_policiesc C s | j | }||_d S r )r! rK )r" rD rK rH r$ r$ r% �set_policy_appliedV s z!FirewallPolicy.set_policy_appliedc C s` | j �|�}| j| }|r|js|s|jsd S |r d|_|d u r%| �� }n|}|rD|js1| �|�n| �|�D ] \}}| �|d|||� q6|jsN| � |||� dD ]�} t | � |�| �} t | t �rk|rc| sh|sg| shqP| g} | D ]�} | dkr|| �||| |� qm| dkr�qm| dkr�| j|||g| �R � qm| dkr�| �||| |� qm| dkr�| �||| d | d |� qm| d kr�| �||| |� qm| d kr�| �||| d | d |� qm| d kr�| �|||� qm| d kr�| �||t| d�|� qm| dkr�qm| dkr�qmt�d|| | � qmqP|�s"|j�s | �|�n| �|�D ]\}}| �|d|||� �qd|_|d u �r.|�|� d S d S )NT) �services�ports� masquerade� forward_ports� source_ports� icmp_blocks� rules_str� protocols�icmp_block_inversionr? rB rY r\ rW rT rU r � r[ rX rV rZ ��rule_strr? rB z5Policy '%s': Unknown setting '%s:%s', unable to applyF)r rF r! rK r0 r6 �%_get_table_chains_for_policy_dispatch�#_get_table_chains_for_zone_dispatch�gen_chain_rules�_ingress_egress_zones�getattrr5 � isinstance�bool� _icmp_block� _forward_port�_service�_port� _protocol� _source_port� _masquerade�_FirewallPolicy__ruler r �warning�execute) r" �enablerD rO �_policyrH � transaction�table�chain�key� args_list�argsr$ r$ r% �_policy_settingsZ s� � ������ � �z FirewallPolicy._policy_settingsc C � | j d||d� d S )NTrN �ry �r" rD rO r$ r$ r% rQ � r* z$FirewallPolicy.apply_policy_settingsc C rz )NFrN r{ r| r$ r$ r% rL � r* z&FirewallPolicy.unapply_policy_settingsc C s | � |��� S r )r5 �export_config_dict�r" rD r$ r$ r% � get_config_with_settings_dict� r4 z,FirewallPolicy.get_config_with_settings_dictc s� ddl m� d � �fdd� }� �fdd�}�j�jf�j�jf�j�jf�j�j f�j �j f||f�j �j f�j�jf�j�jf�j�jfd� }��|�}t�|�}|�|�j�� � �j�d|gi� ��|�} �j�| |�\} } | D ]4} t | | t �r�| | D ] } t | t �r�|| d |g| �R � q�|| d || � q�qt|| d |� qt| D ]>} t | | t �r�| | D ]$} t | t �r�|| d |g| �R d|d �� q�|| d || d|d � q�q�|| d |d|d � q�d S ) Nr )r c s �j | � |d�d|d� d S )Nr^ r ��timeout�sender)�add_rule)rD r_ r� r� �r r" r$ r% �add_rule_wrapper� s zFFirewallPolicy.set_config_with_settings_dict.<locals>.add_rule_wrapperc s �� | � |d�� d S )Nr^ )� remove_rule)rD r_ r� r$ r% �remove_rule_wrapper� � zIFirewallPolicy.set_config_with_settings_dict.<locals>.remove_rule_wrapper) rT rU rY rV rW � rich_rulesr[ rX r? rB r8 r] r� )r N) �firewall.core.richr � add_service�remove_service�add_port� remove_port�add_icmp_block�remove_icmp_block�add_masquerade�remove_masquerade�add_forward_port�remove_forward_port� add_protocol�remove_protocol�add_source_port�remove_source_port�add_ingress_zone�remove_ingress_zone�add_egress_zone�remove_egress_zoner5 �copy�import_config_dictr �get_all_io_objects_dictr. r � get_added_and_removed_settingsre �list�tuple)r" rD �settingsr� r� r� � setting_to_fn�old_obj� check_obj� old_settings� add_settings�remove_settingsrv rx r$ r� r% � set_config_with_settings_dict� sJ � � "��z,FirewallPolicy.set_config_with_settings_dictc C �* |st tj��|dvr| j�|� d S d S �N)r< r= �r r � INVALID_ZONEr � check_zone�r" r@ r$ r$ r% �check_ingress_zone� � �z!FirewallPolicy.check_ingress_zonec C � | � |� |S r )r� r� r$ r$ r% �__ingress_zone_id� � z FirewallPolicy.__ingress_zone_idr Tc C � | j �|�}| j �|� | j �� | j| }| �|�} | |jv r*ttj d||f ��|d u r3| � � } n|} |rr|j rA| � d|| � | � || ||� | �| j|| � |j sj|| �� v ri| j|| d� | �| j|d� n| � d|| � n| � || ||� | �| j|| � |d u r�| �d� d S d S �N�'%s' already in '%s'FrN T)r rF � check_timeout� check_panicr! � _FirewallPolicy__ingress_zone_idr? r r �ALREADY_ENABLEDr0 rK rc �&_FirewallPolicy__register_ingress_zone�add_fail�(_FirewallPolicy__unregister_ingress_zonerE rQ rS rp � r" rD r@ r� r� rO � allow_applyrr �_obj�zone_idrs r$ r$ r% r� � �8 � ��z FirewallPolicy.add_ingress_zonec C � |j �|� d S r )r? r7 �r" r� r� r� r� r$ r$ r% �__register_ingress_zone rJ z&FirewallPolicy.__register_ingress_zonec C �� | j �|�}| j �� | j| }| �|�}||jvr$ttjd||f ��|d u r-| � � }n|}|j ret |j�dkr@| � ||� n| � d||� | �||� |�| j||d d � || �� v rd| � d||� n|�| j||� |d u rv|�d� |S �N�'%s' not in '%s'r] FT)r rF r� r! r� r? r r � NOT_ENABLEDr0 rK �lenrL rc r� r� r� rE �add_postrp �r" rD r@ rO rr r� r� rs r$ r$ r% r� �0 � � z"FirewallPolicy.remove_ingress_zonec C � ||j v r |j �|� d S d S r )r? �remove�r" r� r� r$ r$ r% �__unregister_ingress_zone4 � �z(FirewallPolicy.__unregister_ingress_zonec C � | � |�| �|�jv S r )r� r5 r? �r" rD r@ r$ r$ r% �query_ingress_zone8 r� z!FirewallPolicy.query_ingress_zonec C � | � |�jS r )r5 r? r~ r$ r$ r% �list_ingress_zones; � z!FirewallPolicy.list_ingress_zonesc C r� r� r� r� r$ r$ r% �check_egress_zone@ r� z FirewallPolicy.check_egress_zonec C r� r )r� r� r$ r$ r% �__egress_zone_idF r� z FirewallPolicy.__egress_zone_idc C r� r� )r rF r� r� r! � _FirewallPolicy__egress_zone_idrB r r r� r0 rK rc �%_FirewallPolicy__register_egress_zoner� �'_FirewallPolicy__unregister_egress_zonerE rQ rS rp r� r$ r$ r% r� J r� z FirewallPolicy.add_egress_zonec C r� r )rB r7 r� r$ r$ r% �__register_egress_zonep rJ z%FirewallPolicy.__register_egress_zonec C r� r� )r rF r� r! r� rB r r r� r0 rK r� rL rc r� r� r� rE r� rp r� r$ r$ r% r� s r� z!FirewallPolicy.remove_egress_zonec C r� r )rB r� r� r$ r$ r% �__unregister_egress_zone� r� z'FirewallPolicy.__unregister_egress_zonec C r� r )r� r5 rB r� r$ r$ r% �query_egress_zone� r� z FirewallPolicy.query_egress_zonec C r� r )r5 rB r~ r$ r$ r% �list_egress_zones� r� z FirewallPolicy.list_egress_zonesc C s |� � d S r )�check�r" �ruler$ r$ r% � check_rule� r� zFirewallPolicy.check_rulec C s | � |� t|�S r )r� �strr� r$ r$ r% � __rule_id� s zFirewallPolicy.__rule_idc C sz |sd S |j rt|j �rdS t|j �rdS d S t|d�r!|jr!dS t|d�r;|jr;| �|j� | �|j� | �|j�S d S )N�ipv4�ipv6�mac� �ipset) �addrr r �hasattrr� r� � _check_ipset_type_for_source�_check_ipset_applied� _ipset_family)r" �sourcer$ r$ r% �_rule_source_ipv� s � z FirewallPolicy._rule_source_ipvc C s | � ||||� d S r )� _rule_prepare)r" rq rD r� rs r$ r$ r% �__rule� r* zFirewallPolicy.__rulec C �� | j �|�}| j �|� | j �� | j| }| �|�}||jv r2|jr&|jn|} tt j d|| f ��|d u r;| � � } n|} |j rH| � d||| � | �||||� | �| j||� |d u ra| �d� |S �Nr� T)r rF r� r� r! �_FirewallPolicy__rule_idrZ r6 r r r� r0 rK rn � _FirewallPolicy__register_ruler� � _FirewallPolicy__unregister_rulerp ) r" rD r� r� r� rO rr r� �rule_id�_namers r$ r$ r% r� � �( � zFirewallPolicy.add_rulec C r� r )rZ r7 )r" r� r� r� r� r$ r$ r% �__register_rule� rJ z FirewallPolicy.__register_rulec C � | j �|�}| j �� | j| }| �|�}||jvr,|jr |jn|}ttj d||f ��|d u r5| � � }n|}|j rB| � d|||� |� | j||� |d u rS|�d� |S �Nr� FT)r rF r� r! r� rZ r6 r r r� r0 rK rn r� r� rp ) r" rD r� rO rr r� r� r� rs r$ r$ r% r� � �$ � zFirewallPolicy.remove_rulec C r� r )rZ r� )r" r� r� r$ r$ r% �__unregister_rule� r� z FirewallPolicy.__unregister_rulec C r� r )r� r5 rZ )r" rD r� r$ r$ r% � query_rule� r� zFirewallPolicy.query_rulec C r� r )r5 rZ r~ r$ r$ r% � list_rules r� zFirewallPolicy.list_rulesc C � | j �|� d S r )r � check_service�r" �servicer$ r$ r% r rJ z FirewallPolicy.check_servicec C r� r )r r r$ r$ r% � __service_id r� zFirewallPolicy.__service_idc C r� r� )r rF r� r� r! �_FirewallPolicy__service_idrT r6 r r r� r0 rK ri �!_FirewallPolicy__register_servicer� �#_FirewallPolicy__unregister_servicerp ) r" rD r r� r� rO rr r� � service_idr� rs r$ r$ r% r� r� zFirewallPolicy.add_servicec C r� r )rT r7 )r" r� r r� r� r$ r$ r% �__register_service) rJ z!FirewallPolicy.__register_servicec C r r )r rF r� r! r rT r6 r r r� r0 rK ri r� r rp ) r" rD r rO rr r� r r� rs r$ r$ r% r� , r z FirewallPolicy.remove_servicec C r� r )rT r� )r" r� r r$ r$ r% �__unregister_serviceG r� z#FirewallPolicy.__unregister_servicec C r� r )r r5 rT )r" rD r r$ r$ r% � query_serviceK r� z FirewallPolicy.query_servicec C r� r )r5 rT r~ r$ r$ r% � list_servicesN r� z FirewallPolicy.list_servicesc C sJ g }|D ] }z | j j�|�}W n ty ttj|��w |�|� q|S r )r �helper� get_helperr r �INVALID_HELPERr7 )r" �helpers�_helpersr �_helperr$ r$ r% � get_helpers_for_service_helpersQ s � z.FirewallPolicy.get_helpers_for_service_helpersc C s� g }|D ]K}z | j j�|�}W n ty ttj|��w t|j�dk rJt|j �}z| j j�|�}|� |� W q tyI |rGt � d| � Y qw |� |� q|S )Nr] z Helper '%s' is not available) r r r r r r r� rU r �moduler7 r ro )r" �modulesrq r r r �_module_short_namer r$ r$ r% � get_helpers_for_service_modules[ s& � � z.FirewallPolicy.get_helpers_for_service_modulesc C s | j �|� | j �|� d S r )r � check_port� check_tcpudp�r" �port�protocolr$ r$ r% r t s zFirewallPolicy.check_portc C � | � ||� t|d�|fS �N�-�r r r! r$ r$ r% � __port_idx � zFirewallPolicy.__port_idc �l | j �|�}| j �|� | j �� | j| }tt� fdd�|j��} | D ] } t|| d �r@|j r3|j n|} t t j d|� | f ��q$t |dd� | D ��\} } |d u rV| �� }n|}|jr}| D ]}| �d|t|d�� |� q]| D ]}| �d |t|d�� |� qn| D ]}| �|� �} | �|| ||� |�| j|| � q| D ]}| �|� �} |�| j|| � q�|d u r�|�d� |S ) Nc � | d � kS �Nr] r$ ��x�r# r$ r% �<lambda>� � z)FirewallPolicy.add_port.<locals>.<lambda>r �'%s:%s' already in '%s'c S � g | ]\}}|�qS r$ r$ ��.0rj rk r$ r$ r% � <listcomp>� � z+FirewallPolicy.add_port.<locals>.<listcomp>Tr& F)r rF r� r� r! r� �filterrU r r6 r r r� r r0 rK rj r �_FirewallPolicy__port_id� _FirewallPolicy__register_portr� � _FirewallPolicy__unregister_portr� rp �r" rD r" r# r� r� rO rr r� �existing_port_ids�port_idr� � added_ranges�removed_rangesrs �ranger$ r/ r% r� | �> �� zFirewallPolicy.add_portc C r� r )rU r7 �r" r� r> r� r� r$ r$ r% �__register_port� rJ z FirewallPolicy.__register_portc �d | j �|�}| j �� | j| }tt� fdd�|j��}|D ] }t||d �r) nq |jr0|jn|} t t j d|� | f ��t |dd� |D ��\} } |d u rR| � � } n|} |jry| D ]} | �d|t| d�� | � qY| D ]} | �d |t| d�� | � qj| D ]} | �| � �}| �||dd � | �| j||� q{| D ]} | �| � �}| �| j||� q�|d u r�| �d� |S ) Nc r+ r, r$ r- r/ r$ r% r0 � r1 z,FirewallPolicy.remove_port.<locals>.<lambda>r �'%s:%s' not in '%s'c S r3 r$ r$ r4 r$ r$ r% r6 � r7 z.FirewallPolicy.remove_port.<locals>.<listcomp>Tr& F)r rF r� r! r� r8 rU r r6 r r r� r r0 rK rj r r9 r: r� r; r� rp �r" rD r" r# rO rr r� r= r> r� r? r@ rs rA r$ r/ r% r� � �> � � zFirewallPolicy.remove_portc C r� r )rU r� �r" r� r> r$ r$ r% �__unregister_port� r� z FirewallPolicy.__unregister_portc C �2 | � |�jD ]\}}t||�r||kr dS qdS �NTF)r5 rU r �r" rD r" r# rj rk r$ r$ r% � query_port� � �zFirewallPolicy.query_portc C r� r )r5 rU r~ r$ r$ r% � list_ports� r� zFirewallPolicy.list_portsc C s t |�s ttj|��d S r )r r r �INVALID_PROTOCOL�r" r# r$ r$ r% �check_protocol� s �z FirewallPolicy.check_protocolc C s t |�s ttjd| ��d S )Nzatcp-mss-clamp value must be greater than or equal to 536, or the value 'pmtu'. Invalid value '%s')r r r � INVALID_RULE)r" �tcp_mss_clamp_valuer$ r$ r% �check_tcp_mss_clamp� s �z"FirewallPolicy.check_tcp_mss_clampc C r� r )rS rR r$ r$ r% � __protocol_id� r� z FirewallPolicy.__protocol_idc C r� r� )r rF r� r� r! � _FirewallPolicy__protocol_idr[ r6 r r r� r0 rK rk �"_FirewallPolicy__register_protocolr� �$_FirewallPolicy__unregister_protocolrp ) r" rD r# r� r� rO rr r� � protocol_idr� rs r$ r$ r% r� � r� zFirewallPolicy.add_protocolc C r� r )r[ r7 )r" r� r[ r� r� r$ r$ r% �__register_protocol rJ z"FirewallPolicy.__register_protocolc C r r )r rF r� r! rX r[ r6 r r r� r0 rK rk r� rZ rp ) r" rD r# rO rr r� r[ r� rs r$ r$ r% r� s( � � z FirewallPolicy.remove_protocolc C r� r )r[ r� )r" r� r[ r$ r$ r% �__unregister_protocol( r� z$FirewallPolicy.__unregister_protocolc C r� r )rX r5 r[ )r" rD r# r$ r$ r% �query_protocol, r� z FirewallPolicy.query_protocolc C r� r )r5 r[ r~ r$ r$ r% �list_protocols/ r� z FirewallPolicy.list_protocolsc C r$ r% r' r! r$ r$ r% �__source_port_id4 r) z FirewallPolicy.__source_port_idc r* ) Nc r+ r, r$ r- r/ r$ r% r0 ? r1 z0FirewallPolicy.add_source_port.<locals>.<lambda>r r2 c S r3 r$ r$ r4 r$ r$ r% r6 F r7 z2FirewallPolicy.add_source_port.<locals>.<listcomp>Tr& F)r rF r� r� r! r� r8 rX r r6 r r r� r r0 rK rl r � _FirewallPolicy__source_port_id�%_FirewallPolicy__register_source_portr� �'_FirewallPolicy__unregister_source_portr� rp r< r$ r/ r% r� 8 rB z FirewallPolicy.add_source_portc C r� r )rX r7 rC r$ r$ r% �__register_source_port` rJ z%FirewallPolicy.__register_source_portc rE ) Nc r+ r, r$ r- r/ r$ r% r0 i r1 z3FirewallPolicy.remove_source_port.<locals>.<lambda>r rF c S r3 r$ r$ r4 r$ r$ r% r6 r r7 z5FirewallPolicy.remove_source_port.<locals>.<listcomp>Tr& F)r rF r� r! r� r8 rX r r6 r r r� r r0 rK rl r ra rb r� rc r� rp rG r$ r/ r% r� c rH z!FirewallPolicy.remove_source_portc C r� r )rX r� rI r$ r$ r% �__unregister_source_port� r� z'FirewallPolicy.__unregister_source_portc C rK rL )r5 rX r rM r$ r$ r% �query_source_port� rO z FirewallPolicy.query_source_portc C r� r )r5 rX r~ r$ r$ r% �list_source_ports� r� z FirewallPolicy.list_source_portsc C s� | j �|�}| j �|� | j �� | j| }|jr)|jr |jn|}ttj d| ��|d u r2| � � }n|}|j r>| � d||� | � |||� |�| j|� |d u rU|�d� |S )Nz"masquerade already enabled in '%s'T)r rF r� r� r! rV r6 r r r� r0 rK rm �$_FirewallPolicy__register_masquerader� �&_FirewallPolicy__unregister_masqueraderp ) r" rD r� r� rO rr r� r� rs r$ r$ r% r� � s& � z FirewallPolicy.add_masqueradec C � d|_ d S �NT�rV )r" r� r� r� r$ r$ r% �__register_masquerade� � z$FirewallPolicy.__register_masqueradec C s� | j �|�}| j �� | j| }|js#|jr|jn|}ttjd| ��|d u r,| � � }n|}|j r8| � d||� |� | j |� |d u rH|�d� |S )Nz masquerade not enabled in '%s'FT)r rF r� r! rV r6 r r r� r0 rK rm r� ri rp )r" rD rO rr r� r� rs r$ r$ r% r� � s" � z FirewallPolicy.remove_masqueradec C rj �NFrl �r" r� r$ r$ r% �__unregister_masquerade� rn z&FirewallPolicy.__unregister_masqueradec C r� r )r5 rV r~ r$ r$ r% �query_masquerade� r� z FirewallPolicy.query_masqueradec C s^ | j �|� | j �|� |r| j �|� |r!t||�s!ttj|��|s+|s-ttjd��d S d S )Nz.port-forwarding is missing to-port AND to-addr)r r r r r r � INVALID_ADDR�INVALID_FORWARD)r" �ipvr" r# �toport�toaddrr$ r$ r% �check_forward_port� s ��z!FirewallPolicy.check_forward_portc C sL t d|�r| �d||||� n | �d||||� t|d�|t|d�t|�fS )Nr� r� r& )r rx r r� )r" r" r# rv rw r$ r$ r% �__forward_port_id� s �z FirewallPolicy.__forward_port_idc C s� | j �|�} | j �|� | j �� | j| } | �||||�} | | jv r8| jr)| jn| } tt j d||||| f ��|d u rA| � � } n|} | j rQ| � d| | ||||� | �| | ||� | �| j| | � |d u rj| �d� | S )Nz '%s:%s:%s:%s' already in '%s'T)r rF r� r� r! � _FirewallPolicy__forward_port_idrW r6 r r r� r0 rK rh �&_FirewallPolicy__register_forward_portr� �(_FirewallPolicy__unregister_forward_portrp )r" rD r" r# rv rw r� r� rO rr r� � forward_idr� rs r$ r$ r% r� � s0 �� � z FirewallPolicy.add_forward_portc C r� r )rW r7 )r" r� r} r� r� r$ r$ r% �__register_forward_port rJ z&FirewallPolicy.__register_forward_portc C s� | j �|�}| j �� | j| }| �||||�} | |jvr2|jr#|jn|} ttj d||||| f ��|d u r;| � � } n|} |j rK| � d|| ||||� | � | j|| � |d u r\| �d� |S )Nz'%s:%s:%s:%s' not in '%s'FT)r rF r� r! rz rW r6 r r r� r0 rK rh r� r| rp ) r" rD r" r# rv rw rO rr r� r} r� rs r$ r$ r% r� s, �� � z"FirewallPolicy.remove_forward_portc C r� r )rW r� )r" r� r} r$ r$ r% �__unregister_forward_port1 r� z(FirewallPolicy.__unregister_forward_portc C s | � ||||�}|| �|�jv S r )rz r5 rW )r" rD r" r# rv rw r} r$ r$ r% �query_forward_port5 s z!FirewallPolicy.query_forward_portc C r� r )r5 rW r~ r$ r$ r% �list_forward_ports: r� z!FirewallPolicy.list_forward_portsc C r r )r �check_icmptype�r" �icmpr$ r$ r% �check_icmp_block? rJ z FirewallPolicy.check_icmp_blockc C r� r )r� r� r$ r$ r% �__icmp_block_idB r� z FirewallPolicy.__icmp_block_idc C r� r� )r rF r� r� r! � _FirewallPolicy__icmp_block_idrY r6 r r r� r0 rK rg �$_FirewallPolicy__register_icmp_blockr� �&_FirewallPolicy__unregister_icmp_blockrp ) r" rD r� r� r� rO rr r� �icmp_idr� rs r$ r$ r% r� F r� z FirewallPolicy.add_icmp_blockc C r� r )rY r7 )r" r� r� r� r� r$ r$ r% �__register_icmp_blockc rJ z$FirewallPolicy.__register_icmp_blockc C r r )r rF r� r! r� rY r6 r r r� r0 rK rg r� r� rp ) r" rD r� rO rr r� r� r� rs r$ r$ r% r� f s$ � z FirewallPolicy.remove_icmp_blockc C r� r )rY r� )r" r� r� r$ r$ r% �__unregister_icmp_block� r� z&FirewallPolicy.__unregister_icmp_blockc C r� r )r� r5 rY )r" rD r� r$ r$ r% �query_icmp_block� r� z FirewallPolicy.query_icmp_blockc C r� r )r5 rY r~ r$ r$ r% �list_icmp_blocks� r� z FirewallPolicy.list_icmp_blocksc C s� | j �|�}| j �� | j| }|jr#|jr|jn|}ttjd| ��|d u r,| � � }n|}|j rF|j D ] }| � d|||� q4| � d||� | �||� |�| j||� |j rl|j D ] }| � d|||� qZ| � d||� |d u ru|�d� |S )Nz,icmp-block-inversion already enabled in '%s'FT)r rF r� r! r\ r6 r r r� r0 rK rY rg �_icmp_block_inversion�._FirewallPolicy__register_icmp_block_inversionr� �*_FirewallPolicy__undo_icmp_block_inversionrp ) r" rD r� rO rr r� r� rs rx r$ r$ r% �add_icmp_block_inversion� s2 � z'FirewallPolicy.add_icmp_block_inversionc C rj rk �r\ )r" r� r� r$ r$ r% � __register_icmp_block_inversion� rn z.FirewallPolicy.__register_icmp_block_inversionc C s` | � � }|jr|jD ] }| �d|||� q d|_|jr)|jD ] }| �d|||� q |�d� d S )NFT)r0 rK rY rg r\ rp )r" rr r� rs rx r$ r$ r% �__undo_icmp_block_inversion� s z*FirewallPolicy.__undo_icmp_block_inversionc C s� | j �|�}| j �� | j| }|js#|jr|jn|}ttjd| ��|d u r,| � � }n|}|j rF|j D ] }| � d|||� q4| � d||� | �|� |�| j|d � |j rk|j D ] }| � d|||� qY| � d||� |d u rt|�d� |S )Nz(icmp-block-inversion not enabled in '%s'FT)r rF r� r! r\ r6 r r r� r0 rK rY rg r� �0_FirewallPolicy__unregister_icmp_block_inversionr� r� rp )r" rD rO rr r� r� rs rx r$ r$ r% �remove_icmp_block_inversion� s6 � � z*FirewallPolicy.remove_icmp_block_inversionc C rj ro r� rp r$ r$ r% �!__unregister_icmp_block_inversion� rn z0FirewallPolicy.__unregister_icmp_block_inversionc C r� r )r5 r\ r~ r$ r$ r% �query_icmp_block_inversion� r� z)FirewallPolicy.query_icmp_block_inversionc C s� | j j�|�}|jr| j jj|j d }n|}|r*|| jv r)||f| j| v r)d S n|| jvs8||f| j| vr:d S | j �� D ]}|jrX||� � v rX|� ||||�} |� || � q?| � ||||fg� |� | j || ||fg� d S �Nr )r rD r5 r6 r@ �_zone_policiesr �enabled_backends�policies_supported�get_available_tables�build_policy_chain_rules� add_rules�_register_chainsr� ) r" rD �creatert ru rs rH �tracking_policy�backend�rulesr$ r$ r% rb � s( � � z FirewallPolicy.gen_chain_rulesc C s^ |D ]*\}}|r| j �|g ��||f� q| j | �||f� t| j | �dkr,| j |= qd S r� )r � setdefaultr7 r� r� )r" rD r� �tablesrt ru r$ r$ r% r� s ��z FirewallPolicy._register_chainsc C s$ | j j�|�dkr d S | j j�|�S )Nzhash:mac)r r� �get_type� get_family�r" rG r$ r$ r% r� s z FirewallPolicy._ipset_familyc C � | j j�|�S r )r r� r� r� r$ r$ r% � __ipset_type! r4 zFirewallPolicy.__ipset_typec C s d� |g| jj�|� �S )N�,)�joinr r� � get_dimension)r" rG �flagr$ r$ r% �_ipset_match_flags$ s z!FirewallPolicy._ipset_match_flagsc C r� r )r r� � check_appliedr� r$ r$ r% r� ' r4 z#FirewallPolicy._check_ipset_appliedc C s* | � |�}|tvrttjd||f ��d S )Nz.ipset '%s' with type '%s' not usable as source)�_FirewallPolicy__ipset_typer r r � INVALID_IPSET)r" rG �_typer$ r$ r% r� * s ���z+FirewallPolicy._check_ipset_type_for_sourcec s� g }|j r |j g}n$|jr.t|jt�st|jt�r.�jj�|jj�� � j r.� fdd�dD �}�� |j �}|rM|j rJ|j |krIt t jd||j f ��n|g}|sSddg}�fdd�|D �}||_t�fdd�|D ��D �]�}t|j�tk�ro�jj�|jj�}g } t|j �d kr�|j r�t t jd ��|D ]} | |j v r�|�| �r�| �|j | � q�n| �d � | D ]�} t|j�tk�r%��|j|�} | �� |j �7 } t t| �d d � d �} g } | D ]I}|j }t |�}|�!dd�}| �|� |j dkr�|�|j �s�q�t|j"�dk �r| �|� q�|j"D ]\}}|�#||||| |j|�}|�$||� �qq�|�%| � |j"D ]\}}|�&||||| |�}|�$||� �q(|j'D ]}|�(|||| |�}|�$||� �qA|j)D ]\}}|�*||||| |�}|�$||� �qWq�qjt|j�t+k�r�|jj,}|jj-}��.||� |�&||||d |�}|�$||� qjt|j�t/k�r�|jj0}��1|� |�(|||d |�}|�$||� qjt|j�t2k�r�|jj0}��3|� |�4|||d |�}|�$||� qjt|j�t5k�r|�r�|D ]} |�| ��r�|�6t7| � �q�|�8|||�}|�$||� qjt|j�t9k�rN|jj,}|jj-}|jj:}|jj;}|D ] } |�| ��r.��<| ||||� |�r:|�r:|�6t7| � �q |�=|||||||�}|�$||� qjt|j�t>k�ru|jj,}|jj-}��.||� |�*||||d |�}|�$||� qjt|j�tk�s�t|j�tk�rӈjj�|jj�� |j �r�� j �r�|j � j v�r�t t j?d|j |jjf ��t|j�tk�r�|j�r�t|j�tk�r�t t jd��|�@||� |�}|�$||� qj|jd u �r�|�A|||�}|�$||� qjt t jdt|j� ��d S )Nc s g | ] }|� j v r|�qS r$ )� destination�r5 ru )�ictr$ r% r6 9 s z0FirewallPolicy._rule_prepare.<locals>.<listcomp>�r� r� z;Source address family '%s' conflicts with rule family '%s'.r� r� c s g | ] }� j �|�r|�qS r$ )r �is_ipv_enabledr� r( r$ r% r6 J s c s g | ]}� j �|��qS r$ )r �get_backend_by_ipv)r5 r. r( r$ r% r6 O s r z"Destination conflict with service.c S � | j S r �rG r- r$ r$ r% r0 g � z.FirewallPolicy._rule_prepare.<locals>.<lambda>�rv � conntrack�natr� r] z3rich rule family '%s' conflicts with icmp type '%s'z'IcmpBlock not usable with accept actionzUnknown element %s)B�family�elementre r r r �config� get_icmptyperG r� r� r� r r rT �ipvsr> �typer r � get_servicer� �is_ipv_supportedr7 �actionr r r r r r1 r r �replacerU � build_policy_helper_ports_rulesr� � add_modules�build_policy_ports_rulesr[ �build_policy_protocol_rulesrX � build_policy_source_ports_rulesr r" r# r r �valuerS r rV � build_policy_tcp_mss_clamp_rulesr r� r � build_policy_masquerade_rulesr �to_port� to_addressrx � build_policy_forward_port_rulesr �INVALID_ICMPTYPE� build_policy_icmp_block_rules�*build_policy_rich_source_destination_rules)r" rq rD r� rs r� � source_ipvr� �svc� destinationsru r� r r r r r � nat_moduler" �protor� r# rU rv rw r$ )r� r" r% r� 2 s@ �� ��� � �� � � ���- � � � � � � � ���� �� ��z FirewallPolicy._rule_preparec C s( | j j�|�}| �|j|�}|| �|j�7 }tt|�dd� d�}|d u r'|g}|j D ]}||v r1q*| � |� |� |� | j |||||d� q*g } dD ]3} | j � | �sSqJ| j �| �} t|j�dkrp| |jv ro| � | |j| f� qJ| d f| vr}| � | d f� qJ| D ]�\} } |D ]H} | j}t|�}| j�dd�}|�|� | jd kr�| �| j�s�q�t| j�d k r�|�|� q�| jD ]\}}| �||||| | j|�}|�| |� q�q�|jD ]\}}| �||||| �}|�| |� q�|j D ]}| � |||| �}|�| |� q�|j D ]\}}| � ||||| �}|�| |� q�q�d S ) Nc S r� r r� r- r$ r$ r% r0 � r� z)FirewallPolicy._service.<locals>.<lambda>r� )�included_servicesr� r r� r� r� r] ) r r r� r r r r r1 r> �includesr r7 ri r� r� r� r� r r r� � add_moduler� r� rU r� rG r� r� r[ r� rX r� )r" rq rD r rs r� r� r �include� backends_ipvru r� r� r r r r� r" r� r� r# r$ r$ r% ri � st � � �� � � ���zFirewallPolicy._servicec C �8 | j �� D ]}|js q|�||||�}|�||� qd S r )r r� r� r� r� �r" rq rD r" r# rs r� r� r$ r$ r% rj , s ��zFirewallPolicy._portc C s6 | j �� D ]}|js q|�|||�}|�||� qd S r )r r� r� r� r� )r" rq rD r# rs r� r� r$ r$ r% rk 5 s �zFirewallPolicy._protocolc C r� r )r r� r� r� r� r� r$ r$ r% rl = s �zFirewallPolicy._source_portc C s8 d}|� t|� | j�|�}|�||�}|�||� d S )Nr� )r� r r r� r� r� )r" rq rD rs ru r� r� r$ r$ r% rm E s zFirewallPolicy._masqueradec C sX t d|�rd}nd}|r|r|�t|� | j�|�} | �||||||�} |�| | � d S )Nr� r� )r r� r r r� r� r� ) r" rq rD rs r" r# rv rw ru r� r� r$ r$ r% rh M s �z FirewallPolicy._forward_portc C sz | j j�|�}| j �� D ].}|jsq d}|jr*dD ]}||jv r)|�|�s)d} nq|r-q |�|||�} |�|| � q d S )NFr� T) r r� r� r� r� r� r� r� r� ) r" rq rD r� rs r� r� � skip_backendru r� r$ r$ r% rg \ s" ��zFirewallPolicy._icmp_blockc C sb | j | j}|dv r d S | �|�s|dkrd S | j�� D ]}|js"q |�||�}|�||� q d S )N)�DROPz %%REJECT%%�REJECT�ACCEPT)r! �targetr� r r� r� �'build_policy_icmp_block_inversion_rulesr� )r" rq rD rs r� r� r� r$ r$ r% r� q s �z$FirewallPolicy._icmp_block_inversionc C s� |D ]}| � |� q|D ]}| �|� q d|v s d|v r(t|�dkr(ttjd��d|v s0d|v r<t|�dkr<ttjd��|s@|rT|sT|sTd|vrTd|vrTttjd| ��|sX|rn|sl|spd|vrrd|vrtttjd| ��d S d S d S d S d S )Nr= r< r] zI'ingress-zones' may only contain one of: many regular zones, ANY, or HOSTzH'egress-zones' may only contain one of: many regular zones, ANY, or HOSTzpolicy "%s" has no ingresszpolicy "%s" has no egress)r� r� r� r r r� ) r" rD r? rB �ingress_interfaces�egress_interfaces�ingress_sources�egress_sourcesr@ r$ r$ r% �check_ingress_egress� s4 ���� �z#FirewallPolicy.check_ingress_egressc C s |dkr|dkr|rt tjd| ��d S d S |dkr>d|v r&t tjd| ��d|v r2t tjd| ��|r<t tjd| ��d S |d kr\d|v rNt tjd| ��d|v rZt tjd| ��d S |d krnd|vrlt tjd | ��d S |d kr~d|vr�t tjd | ��d S d S )N� PREROUTING�rawzFpolicy "%s" egress-zones may not include a zone with added interfaces.� POSTROUTINGr< z/policy "%s" ingress-zones may not include HOST.z.policy "%s" egress-zones may not include HOST.zGpolicy "%s" ingress-zones may not include a zone with added interfaces.�FORWARD�INPUTz0policy "%s" egress-zones must include only HOST.�OUTPUTz1policy "%s" ingress-zones must include only HOST.)r r r� ) r" rD rt ru r? rB r� r� r� r� r$ r$ r% �check_ingress_egress_chain� s: �����z)FirewallPolicy.check_ingress_egress_chainc C s& t | j�}| �|||� |�d� d S rk )r r rc rp )r" rq rD rs r$ r$ r% �!_ingress_egress_zones_transaction� s z0FirewallPolicy._ingress_egress_zones_transactionc C s2 | j | }|j}|j}t� }t� }t� } t� } |D ] } | dv r q|t| jj�| ��O }| t| jj�| ��O } q|D ] } | dv r@q9|t| jj�| ��O }| t| jj�| ��O } q9| �|||||| | � | j� � D ]/} | j smqg| � |�D ]#\} }| � || |||||| | � | � ||| |||| | �}|�| |� qrqgd S )N)r= r< )r! r? rB r> r r@ �list_interfaces� list_sourcesr� r� r� r` r� �!build_policy_ingress_egress_rulesr� )r" rq rD rs rH r? rB r� r� r� r� r@ r� rt ru r� r$ r$ r% rc � sJ � � ���z$FirewallPolicy._ingress_egress_zonesc C s� | j | }d|jv r d|jv r g d�}| jjs |�d� |S d|jv r1dg}| jjs/|�d� |S d|jv r:ddgS d|jv rSd|jv rSg d�}| jjsQ|�d� |S d|jv r}g d �}| jjse|�d� |jD ] }| jj�|�jru |S qh|�d � |S d|jv r�d d g}| jjs�|�d� |jD ] }| jj�|�jr� |S q�|�d � |�d � |S d g}| jjs�|�d� |jD ] }| jj�|�jr� nq�|�d � |jD ] }| jj�|�jr� |S q�|�d � |�d � |S )z:Create a list of (table, chain) needed for policy dispatchr= r< )�r8 r� �r� r� ��mangler� �r� r� r� )r8 r� )r� r� )�r8 r� r� �r� r� r� �r r� r� r r r� r� ) r! r? rB r �nftables_enabledr7 r@ �get_zone� interfaces)r" rD rH �tcr@ r$ r$ r% r` � sr � � � � z4FirewallPolicy._get_table_chains_for_policy_dispatchc C s^ | j | }d|jv rdg}| jjs|�d� |S d|jv r!g d�S d|jv r)dgS td| �S )z8Create a list of (table, chain) needed for zone dispatchr< r� r r= r r zInvalid policy: %s)r! rB r r r7 r? r )r" rD rH r r$ r$ r% ra 8 s z2FirewallPolicy._get_table_chains_for_zone_dispatchFc C sr | j j�|�}|jr|j}n|| }d|jv r3|dkr d| S |dkr'd| S |js2|dv r2d| S n}d|jv rD|jsC|dv rCd| S nld |jv rh|dkrQd | S |d kr_|r[d | S d| S |d v rgd| S nHd |jv r�|dkrud | S |d kr�|rd | S d| S |d v r�|js�d| S n!|js�|dkr�d | S |d kr�|r�d | S d| S |d v r�d| S td|||f �S )Nr< r8 �IN_r� �PRE_)r� r� )r8 r� �OUT_r= �FWD_r� �POST_)r� r� z.Can't convert policy to chain name: %s, %s, %s)r rD r5 r6 rB r? r )r" rD rt � policy_prefix�isSNATrH �suffixr$ r$ r% �policy_base_chain_nameM sb � � � �z%FirewallPolicy.policy_base_chain_namer )r NNT)r NN)NN)NNr NN)NNN)F)��__name__� __module__� __qualname__r& r) r, r0 r3 r; rE r5 rI rM rR rS ry rQ rL r r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� rn r� r� r� r� r r r r r� r r� r r r r r r r9 r� r: r� r; rN rP rS rV rX r� rY r� rZ r^ r_ ra r� rb r� rc rf rg r� rh r� ri rr rx rz r� r{ r� r| r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� rb r� r� r� r� r� r� r� ri rj rk rl rm rh rg r� r� r� r� rc r` ra r r$ r$ r$ r% r sD F 5 �& # �& # � � � � �( �) � � �( �) � � � � � �' ' ;@ � (Pr )%r� �firewall.core.loggerr �firewall.functionsr r r r r r r r r r r r� r r r r r r r r r r r � firewall.core.fw_transactionr �firewallr �firewall.errorsr �firewall.core.baser �objectr r$ r$ r$ r% �<module> s 44 PK ���Z��H H ( core/__pycache__/modules.cpython-310.pycnu �[��� o bhAb� � @ sB d Z dgZddlmZ ddlmZ ddlmZ G dd� de�Z dS )zmodules backend�modules� )�runProg)�log)�COMMANDSc @ sL e Zd Zdd� Zdd� Zdd� Zdd� Zd d � Zd d � Zd d� Z dd� Z dS )r c C s t d | _t d | _d S )N�modprobe�rmmod)r � _load_command�_unload_command��self� r �7/usr/lib/python3/dist-packages/firewall/core/modules.py�__init__ s zmodules.__init__c C s d| j S )Nz%s)� __class__r r r r �__repr__$ s zmodules.__repr__c C s� g }i }t dd��I}|D ]1}|s n6|�� }|�� }|�|d � |d dkr7|d �d�dd� ||d < q g ||d < q W d � ||fS W d � ||fS 1 sUw Y ||fS ) z6 get all loaded kernel modules and their dependencies z /proc/modules�rr � �-�,N���)�open�strip�split�append)r �mods�deps�f�line�splitsr r r �loaded_modules' s( � � � � � zmodules.loaded_modulesc C �" t �d| j| j|� t| j|g�S �Nz %s: %s %s)r �debug2r r r �r �moduler r r � load_module9 � zmodules.load_modulec C r r! )r r" r r r r# r r r � unload_module= r& zmodules.unload_modulec C sT ||vrdS || D ]}| � |||� ||vr |�|� q ||vr(|�|� dS dS )z get all dependants of a module N)�get_depsr )r r$ r �ret�modr r r r( A s ��zmodules.get_depsc C s� g }| � � \}}| �d||� dD ]}||v r"|�|� |�d|� q|D ]+}|dv sI|�d�sI|�d�sI|�d�sI|�d�sI|�d �sI|�d �rP| �|||� q%|S ) z) get all loaded firewall-related modules � nf_conntrack)�nf_conntrack_ipv4�nf_conntrack_ipv6r )� ip_tables� ip6_tables�ebtables�iptable_� ip6table_�nf_�xt_�ipt_�ip6t_)r r( �remove�insert� startswith)r r �mods2r �bad_bad_moduler* r r r �get_firewall_modulesL s2 ��������z modules.get_firewall_modulesc C s: | � � D ]}| �|�\}}|dkrt�d||f � qdS )z% unload all firewall-related modules r z Failed to unload module '%s': %sN)r< r' r �debug1)r r$ �statusr) r r r �unload_firewall_modulesa s ��z modules.unload_firewall_modulesN) �__name__� __module__� __qualname__r r r r% r' r( r< r? r r r r r s N) �__doc__�__all__�firewall.core.progr �firewall.core.loggerr �firewall.configr �objectr r r r r �<module> s PK ���Z(��� � * core/__pycache__/ipXtables.cpython-310.pycnu �[��� o bhAbI� � @ s0 d dl Zd dlZd dlmZ d dlmZ d dlmZm Z m Z m Z m Z m Z mZmZ d dlmZ d dlmZmZmZmZmZ d dlmZmZmZm Z m Z m Z m Z m Z m!Z! d dl"m#Z# d dl$Z$d Z%g d �d d gg d �g d�g d �d�Z&ddd�Z'ddd�Z(dd� Z)dd� Z*dd� Z+G dd � d e,�Z-G d d � d e-�Z.dS ) � N)�runProg)�log)�tempFile�readfile� splitArgs� check_mac�portStr�check_single_address� check_address� normalizeIP6)�config)� FirewallError�INVALID_PASSTHROUGH� INVALID_RULE� UNKNOWN_ERROR� INVALID_ADDR) � Rich_Accept� Rich_Reject� Rich_Drop� Rich_Mark� Rich_NFLog�Rich_Masquerade�Rich_ForwardPort�Rich_IcmpBlock�Rich_Tcp_Mss_Clamp)�DEFAULT_ZONE_TARGET� )�INPUT�OUTPUT�FORWARD� PREROUTINGr )r � POSTROUTINGr r r )r r! r )�security�raw�mangle�nat�filterzicmp-host-prohibitedzicmp6-adm-prohibited��ipv4�ipv6�icmp� ipv6-icmpc C s� ddddddd�}| dd� }|D ]8}z|� |�}W n ty# Y qw |dv rCz t||d � W n ty; Y nw |�|d � || ||< q|S ) z Inverse valid rule �-D�--delete�-X�--delete-chain��-A�--append�-I�--insert�-Nz --new-chainN�r3 r4 � )�index� Exception�int�pop)�args� replace_args�ret_args�arg�idx� rA �9/usr/lib/python3/dist-packages/firewall/core/ipXtables.py�common_reverse_rule: s. � � �rC c C s� ddddddd�}| dd� }|D ];}z|� |�}W n ty# Y qw |dv rCz t||d � W n ty; Y nw |�|d � || ||< | S ttd ��) z Reverse valid passthough rule r, r- r. r/ r0 Nr6 r7 �no '-A', '-I' or '-N' arg)r8 � ValueErrorr: r; r r )r< r= r> �xr@ rA rA rB �common_reverse_passthrough_ s4 � � � �rG c C sh t | �} t g d��}t| |@ �dkr ttdt| |@ �d ��t g d��}t| |@ �dkr2ttd��dS )zZ Check if passthough rule is valid (only add, insert and new chain rules are allowed) )z-Cz--checkr, r- z-Rz --replace�-Lz--listz-Sz --list-rules�-Fz--flush�-Zz--zeror. r/ �-Pz--policyz-Ez--rename-chainr zarg '%s' is not allowedr0 rD N)�set�lenr r �list)r< � not_allowed�neededrA rA rB �common_check_passthrough� s �� ��rQ c @ s� e Zd ZdZd ZdZdd� Zdd� Zdd� Zd d � Z d d � Z d d� Z dd� Z dd� Z dd� Zdd� Zdd� Zdd� Zdd � Zd d � Zd d � Zdjd"d#�Zd$d%� Zd&d'� Zd(d)� Zd*d+� Zdjd,d-�Zd.d/� Zdkd1d2�Z d3d4� Z d5d6� Z 7dld8d9�Z dld:d;�Z d<d=� Z!d>d?� Z"d@dA� Z#dBdC� Z$dDdE� Z%dFdG� Z&dHdI� Z'dJdK� Z(dLdM� Z)dNdO� Z*dPdQ� Z+dmdRdS�Z,dmdTdU�Z-dmdVdW�Z. !dmdXdY�Z/dZd[� Z0dmd\d]�Z1djd^d_�Z2 !djd`da�Z3djdbdc�Z4ddde� Z5dfdg� Z6dhdi� Z7d!S )n� ip4tablesr( Tc C sd || _ tj| j | _tjd| j | _| �� | _| �� | _ | � � g | _ i | _ i | _ g | _i | _d S )Nz %s-restore)�_fwr �COMMANDS�ipv�_command�_restore_command�_detect_wait_option� wait_option�_detect_restore_wait_option�restore_wait_option� fill_exists�available_tables�rich_rule_priority_counts�policy_priority_counts�zone_source_index_cache� our_chains)�self�fwrA rA rB �__init__� s zip4tables.__init__c C s$ t j�| j�| _t j�| j�| _d S �N)�os�path�existsrV �command_existsrW �restore_command_exists�rb rA rA rB r\ � s zip4tables.fill_existsc C s� | j r| j |vr| j gdd� |D � }ndd� |D �}t�d| j| jd�|�� t| j|�\}}|dkrAtd| jd�|�|f ��|S )Nc S � g | ]}d | �qS ��%srA ��.0�itemrA rA rB � <listcomp>� � z#ip4tables.__run.<locals>.<listcomp>c S rl rm rA ro rA rA rB rr � rs � %s: %s %s� r �'%s %s' failed: %s)rY r �debug2� __class__rV �joinr rE )rb r< �_args�status�retrA rA rB �__run� s �zip4tables.__runc C s8 z|� |�}W n ty Y dS w ||||d �< dS )NF� T)r8 rE )rb �rule�pattern� replacement�irA rA rB � _rule_replace� s �zip4tables._rule_replacec C s |t v o |t | v S re )�BUILT_IN_CHAINS)rb rU �table�chainrA rA rB �is_chain_builtin� s �zip4tables.is_chain_builtinc C s2 d|g}|r |� d� n|� d� |� |� |gS )N�-tr5 r. ��append)rb �addr� r� r rA rA rB �build_chain_rules� s zip4tables.build_chain_rulesc C s8 d|g}|r|d|t |�g7 }n|d|g7 }||7 }|S )Nr� r3 r, )�str)rb r� r� r� r8 r< r rA rA rB � build_rule� s zip4tables.build_rulec C � t |�S re )rC �rb r< rA rA rB � reverse_rule� � zip4tables.reverse_rulec C s t |� d S re )rQ r� rA rA rB �check_passthrough� s zip4tables.check_passthroughc C r� re )rG r� rA rA rB �reverse_passthrough� r� z ip4tables.reverse_passthroughc C s� d}z|� d�}W n ty Y nw t|�|d kr!||d }d }dD ]!}z|� |�}W n ty7 Y q%w t|�|d krF||d }q%||fS )Nr& r� r~ r0 )r8 rE rM )rb r< r� r� r� �optrA rA rB � passthrough_parse_table_chain� s& � � �z'ip4tables.passthrough_parse_table_chainc C s( z$|� d�}|�|� |�|�}d|d kr ||d f}n||d f}W n# tyG z|� d�}|�|� d }W n tyD Y Y d S w Y nw d}|d d v rRd }|rc|sc||v ra|�|� d S d S |r�|r~||vrx|�|� |jd d � d � |� |�}nt|�}d|d< |�dd|d � d S d S )N�%%ZONE_SOURCE%%�-m� � � �%%ZONE_INTERFACE%%Tr �r, r- Fc S s | d S )Nr rA )rF rA rA rB �<lambda>' s z4ip4tables._run_replace_zone_source.<locals>.<lambda>)�keyr3 r7 �%dr~ )r8 r; rE �remover� �sortrM �insert)rb r r` r� �zone� zone_source�rule_addr8 rA rA rB �_run_replace_zone_source sF � ��� � �z"ip4tables._run_replace_zone_sourcec C s� z|� |�}W n ty Y dS w d}d}d}|�|� |�|�}t|�tkr-ttd��d} dD ]!} z|� | �} W n tyC Y q1w t|�| d krR|| d } q1dD ]-} z|� | �}W n tyg Y qUw t|�|d krv||d } | d v r|d}| d v r�d}qU| | f} |s�| |vs�||| vs�|| | d kr�ttd ��|| | d8 < dS | |vr�i || < ||| vr�d || |< d} t || � � �D ]}||kr�|r� n| || | 7 } ||kr� nq�|| | d7 < d ||< |� |d d| � dS )a Change something like -t filter -I public_IN %%RICH_RULE_PRIORITY%% 123 or -t filter -A public_IN %%RICH_RULE_PRIORITY%% 321 into -t filter -I public_IN 4 or -t filter -I public_IN TF���z%priority must be followed by a numberr& �r� z--tabler~ )r1 r2 r3 r4 r, r- r6 r� r z*nonexistent or underflow of priority countr3 r7 r� N) r8 rE r; �typer: r r rM r �sorted�keysr� )rb r �priority_counts�tokenr� r� r� �insert_add_index�priorityr� r� �jr� r8 �prA rA rB �_set_rule_replace_priority0 sr � � � � � �z$ip4tables._set_rule_replace_priorityc C s t � }i }t�| j�}t�| j�}t�| j�}|D ]�}|d d � } | �| dddt| j g� | �| dt | j g� z| � d�} W n t yI Y n w |dkrOq|dv r`dd d |g| | | d �< n| � | � | � | |d � | � | |d � | �| |� d} dD ]%} z| � | �} W n t y� Y q}w t| �| d kr�| � | � | � | �} q}tt| ��D ]$} tjD ] } | | | v r�| | �d�r�| | �d�s�d| | | | < q�q�|�| g ��| � q|D ]!} || }|�d| � |D ] } |�d�| �d � q�|�d� q�|�� t�|j �}t � d| j | j d|j |j!f � g }| j"�r"|�| j"� |�d� t#| j ||j d�\}}t �$� dk�rht%|j �}|d u�rhd } |D ] }t j&d| |f d d d � |�d��sbt j&d d d � | d 7 } �qGt�'|j � |d k�r�t d | j d�|�|f ��|| _|| _|| _d S )!N� %%REJECT%%�REJECT� --reject-with�%%ICMP%%� %%LOGTYPE%%�off��unicast� broadcast� multicastr� �pkttype� --pkt-typer~ �%%RICH_RULE_PRIORITY%%�%%POLICY_PRIORITY%%r& r� �"z"%s"z*%s ru � zCOMMIT rt z%s: %d�-n��stdinr7 z%8d: %sr )�nofmt�nlr )r� rv )(r �copy�deepcopyr^ r_ r` r� �DEFAULT_REJECT_TYPErU �ICMPr8 rE r; r� r� rM �range�string� whitespace� startswith�endswith� setdefaultr� �writery �closerf �stat�namer rw rx rW �st_sizer[ r �getDebugLogLevelr �debug3�unlink)rb �rules� log_denied� temp_file� table_rulesr^ r_ r` �_ruler r� r� r� �cr� r< r{ r| �lines�linerA rA rB � set_rules� s� � � � � ��� � � � zip4tables.set_rulesc C s� | � |dddt| j g� | � |dt| j g� z|�d�}W n ty( Y n w |dkr/dS |dv r@d d d |g|||d �< n|�|� t�| j �}t�| j �}t�| j �}| � ||d � | � ||d� | � ||� | �|�}|| _ || _ || _ |S )Nr� r� r� r� r� r� r r� r� r� r� r~ r� r� )r� r� rU r� r8 rE r; r� r� r^ r_ r` r� r� �_ip4tables__run)rb r r� r� r^ r_ r` �outputrA rA rB �set_rule� s2 � � zip4tables.set_ruleNc C s� g }|r|gnt �� }|D ]6}|| jv r|�|� q z| �d|ddg� | j�|� |�|� W q tyC t�d| j|f � Y q w |S )Nr� rH r� zA%s table '%s' does not exist (or not enough permission to check).) r� r� r] r� r� rE r �debug1rU )rb r� r| �tablesrA rA rB �get_available_tables s �z ip4tables.get_available_tablesc C s� d}t | jg d��}t�d| j| jd|d |d � |d dkrLd}t | jg d��}t�d| j| jd|d |d � |d dkrBd}t�d | j| j|� |S ) Nr )�-wrH r� �7%s: %s: probe for wait option (%s): ret=%u, output="%s"r� r r~ )�-w10rH r� r� � %s: %s will be using %s option.)r rV r r� rx rw )rb rY r| rA rA rB rX s z ip4tables._detect_wait_optionc C s� t � }|�d� |�� d}dD ]2}t| j|g|jd�}t�d| j| j ||d |d � |d dkrBd|d vrBd |d vrB|} nqt� d | j| j|� t � |j� |S ) Nz#foor )r� z--wait=2r� r� r r~ zinvalid optionzunrecognized optionr� ) r r� r� r rW r� r r� rx rV rw rf r� )rb r� rY � test_optionr| rA rA rB rZ " s � z%ip4tables._detect_restore_wait_optionc C sN i | _ i | _g | _g }t�� D ]}| �|�sqdD ] }|�d||g� qq|S )N)rI r. rJ r� )r^ r_ r` r� r� r� r� )rb r� r� �flagrA rA rB �build_flush_rules6 s �zip4tables.build_flush_rulesc C s^ g }|dkrdn|}t �� D ] }| �|�sq|dkrqt | D ] }|�d|d||g� q q|S )N�PANIC�DROPr% r� rK )r� r� r� r� )rb �policyr� �_policyr� r� rA rA rB �build_set_policy_rulesE s �z ip4tables.build_set_policy_rulesc C s g }d}z| � d| jdkrdnddg�}W n& ty; } z| jdkr*t�d| � nt�d| � W Y d }~nd }~ww |�� }d }|D ]E}|rs|�� �� }|�� }|D ] } | � d �rg| � d �rg| d d� } n| } | |vrr|� | � qT| jdkr}|� d�s�| jdkr�|� d�r�d}qD|S )zQReturn ICMP types that are supported by the iptables/ip6tables command and kernelr �-pr( r* r+ z--helpziptables error: %szip6tables error: %sNF�(�)r~ r� zValid ICMP Types:r) zValid ICMPv6 Types:T) r� rU rE r r� � splitlines�strip�lower�splitr� r� r� ) rb rU r| r� �exr� �in_typesr� �splitsr� rF rA rA rB �supported_icmp_typesQ s> � �� ��z ip4tables.supported_icmp_typesc C s g S re rA rk rA rA rB �build_default_tablesr s z ip4tables.build_default_tablesr� c C s� i }| � d�r6g |d< t� | jd< td D ] }|d �d| � |d �d||f � | jd �d| � q| � d�r�g |d< t� | jd< td D ]T}|d �d| � |d �d||f � | jd �d| � |dkr�dD ] }|d �d||f � | jd �td ||f g�� qod D ]}|d �d |||f � q�qI| � d ��rg |d < t� | jd < td D ]U}|d �d| � |d �d||f � | jd �d| � |dk�rdD ] }|d �d||f � | jd �td ||f g�� q�d D ]}|d �d |||f � q�q�| � d ��r�g |d < t� | jd < td D ]�}|d �d| � |d �d||f � | jd �d| � |dv �rodD ])}|d �d||f � | jd �td ||f g�� |d �d |||f � �qC�q dD ] }|d �d||f � | jd �td ||f g�� �qqd D ]}|d �d |||f � �q��q g |d< t� | jd< |d �d� |d �d� |d �d� |d �d� | jd �td�� dD ]}|d �d| � | jd �td| �� �q�d D ] }|d �d| � �q�|dk�r |d �d� |d �d� |dk�r |d �d � |d �d � |d �d � |d �d � |d �d � |d �d!� | jd �td"�� d#D ]}|d �d$| � | jd �td%| �� �qKd D ]!}|d �d$| � |d �d&| � | jd �td%| �� �qfd'D ]}|d �d$| � | jd �td%| �� �q�|dk�r�|d �d(� |d �d)� |dk�r�|d �d*� |d �d+� |d g d,�7 < | jd �td-�� d#D ]!}|d �d.| � |d �d/| � | jd �td0| �� �q�d'D ]!}|d �d.| � |d �d/| � | jd �td0| �� �qg }|D ] }|| � � v�r4�q)|| D ]}|�d1|gt|� � �q8�q)|S )2Nr" z -N %s_directz-A %s -j %s_directz %s_directr# r )� POLICIES_pre�ZONES� POLICIES_postz-N %s_%s�%s_%s)r z-A %s -j %s_%sr$ r% )r )r r r& zB-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED,DNAT -j ACCEPTz-A INPUT -i lo -j ACCEPTz-N INPUT_directz-A INPUT -j INPUT_direct� INPUT_directz -N INPUT_%szINPUT_%sz-A INPUT -j INPUT_%sr� z^-A INPUT -m conntrack --ctstate INVALID %%LOGTYPE%% -j LOG --log-prefix 'STATE_INVALID_DROP: 'z/-A INPUT -m conntrack --ctstate INVALID -j DROPz9-A INPUT %%LOGTYPE%% -j LOG --log-prefix 'FINAL_REJECT: 'z-A INPUT -j %%REJECT%%zD-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED,DNAT -j ACCEPTz-A FORWARD -i lo -j ACCEPTz-N FORWARD_directz -A FORWARD -j FORWARD_direct�FORWARD_direct)r z -N FORWARD_%sz FORWARD_%sz-A FORWARD -j FORWARD_%s)r z`-A FORWARD -m conntrack --ctstate INVALID %%LOGTYPE%% -j LOG --log-prefix 'STATE_INVALID_DROP: 'z1-A FORWARD -m conntrack --ctstate INVALID -j DROPz;-A FORWARD %%LOGTYPE%% -j LOG --log-prefix 'FINAL_REJECT: 'z-A FORWARD -j %%REJECT%%)z-N OUTPUT_directz>-A OUTPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPTz-A OUTPUT -o lo -j ACCEPTz-A OUTPUT -j OUTPUT_direct� OUTPUT_directz -N OUTPUT_%sz-A OUTPUT -j OUTPUT_%sz OUTPUT_%sr� )r� rL ra r� r� r� �updater )rb r� � default_rulesr� �dispatch_suffix�final_default_rulesr� r rA rA rB �build_default_rulesv s� � � �" � �z ip4tables.build_default_rulesc C sd |dkrddhS |dkrd| � � v rdhS |dkr#d| � � v r#ddhS |dkr0d| � � v r0dhS i S ) Nr& r r r$ r r% r! r# )r� )rb r� rA rA rB �get_zone_table_chains� s z ip4tables.get_zone_table_chainsc s� | j j�|���jdk rdnd��dkr�dkrdnd} | j j�|�t| �� g } g } |D ] } | �d| g� q,|D ] } | �d | g� q8|D ] } | j j�| �}|d v rW| � |�sWqD| �| � d | �� qD|D ]%} | j j�| �}|d v rv| � |�svqct | �r�d v rqc| �| � d | �� qc� �����fdd�}g }| r�| D ] }| r�| D ] }|�|||�� q�q�|r�q�|�||d �� q�|S |r� |S | r�| D ] }|�|d |�� q�|S |r� |S |�|d d �� |S )Nr �pre�postr% r! TF�-i�-or' �-s�r! r r �-dc sV ddd�� }d�|d��f d�j g}| r|�| � |r"|�|� |�d� g� |S )Nr1 r, �TFr� z%s_POLICIES_%sr� �-j)r� �extend)�ingress_fragment�egress_fragment�add_delr �r� r� � chain_suffix�enable�p_objr� rA rB � _generate_policy_dispatch_rule# s � zSip4tables.build_policy_ingress_egress_rules.<locals>._generate_policy_dispatch_rule) rS r� � get_policyr� �policy_base_chain_name�POLICY_CHAIN_PREFIXr� r� � check_source�is_ipv_supported�_rule_addr_fragmentr )rb r r� r� r� �ingress_interfaces�egress_interfaces�ingress_sources�egress_sources�isSNAT�ingress_fragments�egress_fragments� interface�addrrU r r� r r rA r rB �!build_policy_ingress_egress_rules s\ ��� ��z+ip4tables.build_policy_ingress_egress_rulesFc C s� |dkr |dkr dnd}| j jj||t|d�} dddddd�| } d } |r/|s/d d | d g} n|r8d d | g} n dd | g} |sE| d g7 } | d|| || | g7 } | gS )Nr% r! TF�r+ r r �r r! r r r �-gr3 �%s_ZONESr� r1 r, r� )rS r� r" r# ) rb r r� r� r. r� r� r� r+ r� r� �actionr rA rA rB �!build_zone_source_interface_rulesS s( �� z+ip4tables.build_zone_source_interface_rulesc C s� |� d�r(|dd � }|dkrd}nd}d�|g| jj�|� �}ddd ||gS t|�r=|dkr5ttd ��dd d |�� gS t d |�rJt |�}||gS t d |�r`|� d�}t |d �d |d }||gS )Nzipset:� r �dst�src�,r� rL � --match-setz Can't match a destination MAC.�mac� --mac-sourcer) �/r r~ ) r� ry rS �ipset� get_dimensionr r r �upperr r r r� )rb r� �address�invertr� �flags� addr_splitrA rA rB r& l s$ � z ip4tables._rule_addr_fragmentc C s� ddd�| }|dkr|dkrdnd}| j jj||t|d�} d d d d d d �| } t|�r2|d v r2g S |d | d|d|g} | �| �| |�� | �d| g� | gS )Nr3 r, r r% r! TFr1 r r r2 r r4 r� r� r3 )rS r� r" r# r r r& ) rb r r� r� rB r� r� r r+ r� r� r rA rA rB � build_zone_source_address_rules� s" �� z)ip4tables.build_zone_source_address_rulesc C s� ddd�| }ddd�| }|dkr|dkrdnd }| j jj||t|d �}| j j�|�} | j| �t|d | d | d | d| d| g�� g } | �||d|g� | �|d | d|g� | �|d | d|g� | �|d | d|g� | �|d| d|g� | �|d| d|g� | j r�| �||d|dd|df g� | �||d|dd | g� | �||d|dd | g� | �||d|dd | g� | �||d|dd| g� | �||d|dd| g� | j r�| �||d|dd|df g� | j jj | j } | j � � dk�r/|dk�r/| t ddfv �r| �||d|ddddd | g � | d k�r/| �||d|ddddd | g � |dk�rT| t d ddd fv �rT| t fv �rGd} n| } | �||d|d| g� |�s[| �� | S ) Nr5 r. r r1 r, r% r! TFr1 z%s_log�%s_denyz%s_prez%s_post�%s_allowr� r r r r r� r& r� r� r� �LOG� --log-prefixz "%s_REJECT: "r� z "%s_DROP: "�ACCEPT)rS r� r" r# r! ra r rL r� �derived_from_zone� _policies�target�get_log_deniedr �reverse) rb r r� r� r� � add_del_chain� add_del_ruler+ r� r r� rN �_targetrA rA rB �build_policy_chain_rules� sd � � � z"ip4tables.build_policy_chain_rulesc C s |r ddd|j gS g S )Nr� �limitz--limit)�value)rb rU rA rA rB � _rule_limit� s zip4tables._rule_limitc C s� t |j�ttttfv r n |jr%t |j�ttt t fvr$t t dt |j� ��nt t d��|j dkrYt |j�tttfv sBt |j�tt fv rDdS t |j�tfv sUt |j�tt fv rWdS d S |j dk r`dS dS )N�Unknown action %szNo rule action specified.r �allow�denyr r )r� �elementr r r r r5 r r r r r r r� �rb � rich_rulerA rA rB �_rich_rule_chain_suffix� s$ � � z!ip4tables._rich_rule_chain_suffixc C s6 |j s |js ttd��|jdkrdS |jdk rdS dS )NzNot log or auditr r r r )r �auditr r r� r\ rA rA rB � _rich_rule_chain_suffix_from_log� s z*ip4tables._rich_rule_chain_suffix_from_logc C s |j dkrg S d|j gS )Nr r� )r� r\ rA rA rB � _rich_rule_priority_fragment� s z&ip4tables._rich_rule_priority_fragmentc C s |j sg S | jj�||t�}ddd�| }| �|�}d||d||f g} | | �|�7 } t|j �tkra| |ddg 7 } |j j rF| d|j j g7 } |j j rT| d d |j j g7 } |j j r`| d |j j g7 } n$| |dd g 7 } |j j rw| d d|j j g7 } |j j r�| dd |j j g7 } | | � |j j�7 } | S )Nr1 r, r r� r r �NFLOGz --nflog-groupz--nflog-prefixrn z--nflog-thresholdrI rJ z'%s'z --log-level)r rS r� r" r# r` ra r� r �group�prefix� threshold�levelrW rU ) rb r� r] r r� � rule_fragmentr� r r r rA rA rB �_rich_rule_log� s. �zip4tables._rich_rule_logc C s� |j sg S ddd�| }| jj�||t�}| �|�}d||d||f g} | | �|�7 } | |7 } t|j�t kr9d} nt|j�t krCd} n t|j�t krMd} nd } | d d d | g7 } | | � |j j �7 } | S ) Nr1 r, r r� r �accept�reject�drop�unknownr �AUDITz--type)r_ rS r� r" r# r` ra r� r5 r r r rW rU ) rb r� r] r r� rg r r� r r �_typerA rA rB �_rich_rule_audit s$ zip4tables._rich_rule_auditc C s2 |j sg S ddd�| }| jj�||t�}| �|�}d||f } t|j �tkr,ddg} nOt|j �tkrDddg} |j jrC| d|j jg7 } n7t|j �t krPdd g} n+t|j �t krqd }| jj�||t�}d||f } dd d |j j g} n t t d t|j � ��d||| g} | | �|�7 } | || 7 } | | �|j j�7 } | S )Nr1 r, r r r rK r� r� r� r$ �MARKz --set-xmarkrX r� )r5 rS r� r" r# r^ r� r r r r rL r r ra rW rU ) rb r� r] r r� rg r r� r r� � rule_actionr rA rA rB �_rich_rule_action4 s8 � � zip4tables._rich_rule_actionc C s� |sg S g }|j rI|jr|�d� td|j �r"|dt|j �g7 }|S td|j �r@|j �d�}|dt|d �d |d g7 }|S |d|j g7 }|S |jrk|ddg7 }|jrZ|�d� | jj � |jd �}|d |j|g7 }|S ) N�!r) r r> r r~ r� rL r8 r; ) r/ rC r� r r r r� r? rS r� �_ipset_match_flags)rb � rich_destrg rE rD rA rA rB � _rich_rule_destination_fragmentV s, � �� z)ip4tables._rich_rule_destination_fragmentc C s" |sg S g }|j rI|jr|�d� td|j �r"|dt|j �g7 }|S td|j �r@|j �d�}|dt|d �d |d g7 }|S |d|j g7 }|S t|d�rh|jrh|ddg7 }|jr_|�d� |d |jg7 }|S t|d �r�|j r�|dd g7 }|jr~|�d� | j j � |j d �}|d |j |g7 }|S )Nrs r) r r> r r~ r< r� r= r? rL r9 r; ) r/ rC r� r r r r� �hasattrr< r? rS r� rt )rb � rich_sourcerg rE rD rA rA rB �_rich_rule_source_fragmentn s8 � � � � z$ip4tables._rich_rule_source_fragmentc C � ddd�| }d}| j j�||t�} d|g} |r"| ddt|� g7 } |r*| d|g7 } |r<| | �|j�7 } | | �|j�7 } |rEt |j �t krK| g d �7 } g } |ru| � | � ||||| �� | � | �||||| �� | � | �||||| �� | S | � |d | d |g| d d g � | S )Nr1 r, r r& r� �--dportrn r �r� � conntrackz --ctstatez NEW,UNTRACKEDrH r� r rK �rS r� r" r# r rv � destinationry �sourcer� r5 r r� rh ro rr � rb r r� �proto�portr r] r r� r� rg r� rA rA rB �build_policy_ports_rules� s2 ���z"ip4tables.build_policy_ports_rulesc C s� ddd�| }d}| j j�||t�}d|g} |r | d|g7 } |r0| | �|j�7 } | | �|j�7 } |r9t|j �t kr?| g d�7 } g } |ri| � | � ||||| �� | � | � ||||| �� | � | �||||| �� | S | � |d| d |g| d d g � | S ) Nr1 r, r r& r� r r| rH r� r rK )rS r� r" r# rv r ry r� r� r5 r r� rh ro rr ) rb r r� �protocolr r] r r� r� rg r� rA rA rB �build_policy_protocol_rules� s. ���z%ip4tables.build_policy_protocol_rulesc C s d}| j j�||t�}ddd�| }g } |r2| �|�} | | �|�7 } | | �|j�7 } | | �|j �7 } g } ddg} |dks@|d u rG| g d�7 } n | d d d d d d|g7 } |rp| �|�} | | �|�7 } | | �|j�7 } | | �|j �7 } | � dd|d|| f g| � | S )Nr& r1 r, r r� �tcp�pmtu)� --tcp-flags�SYN,RST�SYNr �TCPMSSz--clamp-mss-to-pmtur� r� r� r r� z --set-mssr� r � rS r� r" r# r^ ra rv r ry r� r� ) rb r r� �tcp_mss_clamp_valuer r] r� r� r rg r r� rA rA rB � build_policy_tcp_mss_clamp_rules� s. �z*ip4tables.build_policy_tcp_mss_clamp_rulesc C rz )Nr1 r, r r& r� z--sportrn r r| rH r� r rK r~ r� rA rA rB � build_policy_source_ports_rules� s2 ���z)ip4tables.build_policy_source_ports_rulesc C sv d}| j j�||t�} ddd�| } | d| ddd|g} |r(| dd t|� g7 } |r0| d |g7 } | d d d |g7 } | gS )Nr# r1 r, r rH r� r� r{ rn r r �CTz--helper)rS r� r" r# r ) rb r r� r� r� r � helper_name�module_short_namer� r� r r rA rA rB � build_policy_helper_ports_rules� s z)ip4tables.build_policy_helper_ports_rulesc C s� ddd�| }| j j�||t�}g } |r%| �dd|d| d|dd g� | S t|�r+g S | �dd|d| g| �d |� dd g � | S ) Nr1 r, r r� r& rH r r rK r )rS r� r" r# r� r r& ) rb r r� r� r� r. r� r r� r� rA rA rB �build_zone_forward_rules s � � ��z"ip4tables.build_zone_forward_rulesc C s� d}| j jj||tdd�}ddd�| }g }|r5| �|�}|| �|�7 }|| �|j�7 }|| �|j �7 }nd}g } | � dd|d ||f g| g d � � | S ) Nr% Tr1 r1 r, r rY r� r )rs r �lor � MASQUERADEr� ) rb r r� r] r� r� r rg r r� rA rA rB � build_policy_masquerade_rules s" ��z'ip4tables.build_policy_masquerade_rulesc C s d}| j j�||t�} ddd�| } d} |r(td|�r$| dt|� 7 } n| |7 } |r7|dkr7| dt|d � 7 } g } |rV| �|�} | �|�} | | � |j �7 } | | � |j �7 } nd } g }|rh|� | �|||d| �� |� d d| d | | f g| d |dt|�ddd| g � |S )Nr% r1 r, r r r) z[%s]z:%s�-rY r� r r� r{ r �DNATz--to-destination)rS r� r" r# r r r r^ ra rv r ry r� r� rh )rb r r� r� r� �toport�toaddrr] r� r� r �torg r r� rA rA rB � build_policy_forward_port_rules. s8 � ��z)ip4tables.build_policy_forward_port_rulesc C s� d}| j j�||t�}ddd�| }| jdkr#ddg}ddd |jg} n dd g}dd d |jg} g } | j j�|�r>d | } d} nd| } d} g } |rX| | �|j�7 } | | � |j �7 } | || 7 } |r�| � | � ||||| �� | � | � ||||| �� |jr�| � | �||||| �� | S | �|�}| � d||d||f g| �|� | ddg � | S | j �� dkr�| dkr�| � || d|g| ddddd| g � | � || d|g| d| g � | S )Nr& r1 r, r r( r� r* r� z --icmp-typer+ �icmp6z --icmpv6-typerH rK rG r� r� r r r� r� rI rJ �"%s_ICMP_BLOCK: ")rS r� r" r# rU r� �query_icmp_block_inversionrv r ry r� r� rh ro r5 rr r^ ra rO )rb r r� �ictr] r� r� r r� �matchr� � final_chain� final_targetrg r rA rA rB � build_policy_icmp_block_rulesP s` ����������z'ip4tables.build_policy_icmp_block_rulesc C s� d}| j j�||t�}g }d}| j j�|�rFd}| j �� dkrE|r)d|t|�g}nd|g}|d|dd d d d d d| g }|�|� |d7 }nd}|rRd|t|�g}nd|g}|d|dd d |g }|�|� |S )Nr& � r� r� r3 r, r� r� r� r� r rI rJ r� r~ rK )rS r� r" r# r� rO r� r� ) rb r r� r� r� r� �rule_idx� ibi_targetr rA rA rB �'build_policy_icmp_block_inversion_rules� s2 � � z1ip4tables.build_policy_icmp_block_inversion_rulesc C sx d}g }|| � |j�7 }|| �|j�7 }g }|�| �|||||�� |�| �|||||�� |�| �|||||�� |S )Nr& )rv r ry r� r� rh ro rr )rb r r� r] r� rg r� rA rA rB �*build_policy_rich_source_destination_rules� s z4ip4tables.build_policy_rich_source_destination_rulesc C s || j kS re )rU )rb rU rA rA rB r% � s zip4tables.is_ipv_supportedre )r� �F)NN)8�__name__� __module__� __qualname__rU r� �policies_supportedrd r\ r� r� r� r� r� r� r� r� r� r� r� r� r� r� rX rZ r� r� r r r r r0 r6 r& rF rT rW r^ r` ra rh ro rr rv ry r� r� r� r� r� r� r� r� r� r� r� r% rA rA rA rB rR � st &Pa # ! N � 9 " � � "1" rR c @ s& e Zd ZdZd Zddd�Zdd� ZdS ) � ip6tablesr) Fc C sH g }|� g d�� |dkr|� g d�� |� g d�� |� g d�� |S )N) r3 r r� r$ r� �rpfilter�--invert� --validmarkr r� r� ) r3 r r� r$ r� r� r� r� r rI rJ zrpfilter_DROP: ) r3 r r� r$ r� r+ z$--icmpv6-type=neighbour-solicitationr rK ) r3 r r� r$ r� r+ z"--icmpv6-type=router-advertisementr rK r� )rb r� r� rA rA rB �build_rpfilter_rules� s z ip6tables.build_rpfilter_rulesc C s� g d�}d}| j d �|� g }|�ddd|g� |D ]&}|�ddd|d|dd d d g � | jjd v rA|�ddd|d|dd ddg � q|�dddddd|g� |�dddddd|g� |S )N) z ::0.0.0.0/96z::ffff:0.0.0.0/96z2002:0000::/24z2002:0a00::/24z2002:7f00::/24z2002:ac10::/28z2002:c0a8::/32z2002:a9fe::/32z2002:e000::/19� RFC3964_IPv4r& r� r5 r3 r r r� r� z addr-unreach)r� �allrI rJ z"RFC3964_IPv4_REJECT: "r �4r )ra r� r� rS � _log_denied)rb � daddr_list� chain_namer� �daddrrA rA rB �build_rfc3964_ipv4_rules� s. � ����z"ip6tables.build_rfc3964_ipv4_rulesNr� )r� r� r� rU r� r� r� rA rA rA rB r� � s r� )/�os.pathrf r� �firewall.core.progr �firewall.core.loggerr �firewall.functionsr r r r r r r r �firewallr �firewall.errorsr r r r r �firewall.core.richr r r r r r r r r �firewall.core.baser r� r# r� r� r� rC rG rQ �objectrR r� rA rA rA rB �<module> sL ( , � ��%* PK ���Z�2*�_ _ , core/__pycache__/fw_policies.cpython-310.pycnu �[��� o bhAb� � @ sV d gZ ddlmZ ddlmZ ddlmZ ddlmZ ddlm Z G dd � d e �Z dS ) �FirewallPolicies� )�config)�log)�LockdownWhitelist)�errors)� FirewallErrorc @ sD e Zd Zdd� Zdd� Zdd� Zdd� Zd d � Zd d � Zd d� Z dS )r c C s d| _ ttj�| _d S �NF)� _lockdownr r �LOCKDOWN_WHITELIST�lockdown_whitelist��self� r �;/usr/lib/python3/dist-packages/firewall/core/fw_policies.py�__init__ s zFirewallPolicies.__init__c C s d| j | j| jf S )Nz %s(%r, %r))� __class__r r r r r r �__repr__# s �zFirewallPolicies.__repr__c C s d| _ | j�� d S r )r r �cleanupr r r r r ' s zFirewallPolicies.cleanupc C s� |dkrt �d| � | j�|�rt �d� dS dS |dkr4t �d| � | j�|�r2t �d� dS dS |dkrNt �d | � | j�|�rLt �d � dS dS |d krft �d | � | j�|�rft �d � dS dS )N�contextz#Doing access check for context "%s"zcontext matches.T�uidz Doing access check for uid %dz uid matches.�userz Doing access check for user "%s"z user matches.�commandz#Doing access check for command "%s"zcommand matches.F)r �debug2r � match_context�debug3� match_uid� match_user� match_command)r �key�valuer r r � access_check- s0 � � � z FirewallPolicies.access_checkc C s | j r ttjd��d| _ d S )Nzenable_lockdown()T)r r r �ALREADY_ENABLEDr r r r �enable_lockdownD � z FirewallPolicies.enable_lockdownc C s | j s ttjd��d| _ d S )Nzdisable_lockdown()F)r r r � NOT_ENABLEDr r r r �disable_lockdownI r# z!FirewallPolicies.disable_lockdownc C s | j S )N)r r r r r �query_lockdownN s z FirewallPolicies.query_lockdownN) �__name__� __module__� __qualname__r r r r r" r% r& r r r r r s N) �__all__�firewallr �firewall.core.loggerr �#firewall.core.io.lockdown_whitelistr r �firewall.errorsr �objectr r r r r �<module> s PK ���Z��<� � + core/__pycache__/fw_service.cpython-310.pycnu �[��� o bhAbg � @ s2 d gZ ddlmZ ddlmZ G dd � d e�ZdS )�FirewallService� )�errors)� FirewallErrorc @ sL e Zd Zdd� Zdd� Zdd� Zdd� Zd d � Zd d � Zd d� Z dd� Z dS )r c C s || _ i | _d S �N)�_fw� _services)�self�fw� r �:/usr/lib/python3/dist-packages/firewall/core/fw_service.py�__init__ s zFirewallService.__init__c C s d| j | jf S )Nz%s(%r))� __class__r �r r r r �__repr__ � zFirewallService.__repr__c C s | j �� d S r )r �clearr r r r �cleanup# � zFirewallService.cleanupc C s t | j�� �S r )�sortedr �keysr r r r � get_services( r z FirewallService.get_servicesc C s || j vr ttj|��d S r )r r r �INVALID_SERVICE�r �servicer r r � check_service+ s �z FirewallService.check_servicec C s | � |� | j| S r �r r r r r r � get_service/ s zFirewallService.get_servicec C s || j |j< d S r )r �name)r �objr r r � add_service3 r zFirewallService.add_servicec C s | � |� | j|= d S r r r r r r �remove_service6 s z FirewallService.remove_serviceN) �__name__� __module__� __qualname__r r r r r r r r r r r r r s N)�__all__�firewallr �firewall.errorsr �objectr r r r r �<module> s PK ���Z=m��� � ) core/__pycache__/ebtables.cpython-310.pycnu �[��� o bhAb�$ � @ s d gZ ddlZddlmZ ddlmZ ddlmZm Z m Z ddl m Z ddl mZ ddlmZmZ ddlZd gg d �g d �d �Zi Zi Zi Ze�� D ]8Zg ee< e� ee< ee D ](Zee �d e � ee �deef � ee �de � ee � de � qYqJG dd � d e �Z dS )�ebtables� N)�runProg)�log)�tempFile�readfile� splitArgs)�COMMANDS)� ipXtables�� FirewallError� INVALID_IPV�BROUTING)� PREROUTING� POSTROUTING�OUTPUT)�INPUTr �FORWARD)�broute�nat�filterz -N %s_directz-I %s 1 -j %s_directz-I %s_direct 1 -j RETURNz %s_directc @ s� e Zd ZdZd ZdZdd� Zdd� Zdd� Zd d � Z d d � Z d d� Z dd� Z dd� Z dd� Zdd� Zdd� Zdd� Zdd � Zd d � Zd/d d!�Zd"d#� Zd$d%� Zd&d'� Zd(d)� Zd0d+d,�Zd-d.� Zd S )1r �ebFc C sB t | j | _t d| j | _| �� | _| �� | _| �� g | _ d S )Nz %s-restore) r �ipv�_command�_restore_command� _detect_restore_noflush_option�restore_noflush_option�_detect_concurrent_option�concurrent_option� fill_exists�available_tables��self� r" �8/usr/lib/python3/dist-packages/firewall/core/ebtables.py�__init__9 s zebtables.__init__c C s$ t j�| j�| _t j�| j�| _d S �N)�os�path�existsr �command_existsr �restore_command_existsr r" r" r# r A s zebtables.fill_existsc C s( d}t | jddg�}|d dkrd}|S )N� z --concurrent�-Lr )r r )r! r �retr" r" r# r E s z"ebtables._detect_concurrent_optionc C s, g }z | � |d� W dS ty Y dS w )N�offFT)� set_rules� ValueError)r! �rulesr" r" r# r O s ��z'ebtables._detect_restore_noflush_optionc C s� g }| j r| j |vr|�| j � |dd� |D �7 }t�d| j| jd�|�� t| j|�\}}|dkr?td| jd�|�|f ��|S )Nc S s g | ]}d | �qS )z%sr" )�.0�itemr" r" r# � <listcomp>^ s z"ebtables.__run.<locals>.<listcomp>� %s: %s %s� r �'%s %s' failed: %s) r �appendr �debug2� __class__r �joinr r0 )r! �args�_args�statusr- r" r" r# �__runY s �zebtables.__runc C s$ dD ] }||v rt td| ��qd S )N)z %%REJECT%%z%%ICMP%%z %%LOGTYPE%%z'%s' invalid for ebtablesr )r! �rule�strr" r" r# �_rule_validatef s ���zebtables._rule_validatec C s |t v o |t | v S r% )�BUILT_IN_CHAINS)r! r �table�chainr" r" r# �is_chain_builtinl s �zebtables.is_chain_builtinc C sL g }|r|� d|d|g� |� d|d|dddg� |S |� d|d|g� |S )N�-tz-N�-I�1z-j�RETURN�-X)r8 )r! �addrD rE r1 r" r" r# �build_chain_rulesp s �zebtables.build_chain_rulesc C s8 d|g}|r|d|t |�g7 }n|d|g7 }||7 }|S )NrG rH z-D)rA )r! rL rD rE �indexr< r@ r" r" r# � build_rule{ s zebtables.build_rulec C � t �|�S r% )r �common_reverse_rule�r! r< r" r" r# � reverse_rule� � zebtables.reverse_rulec C s t �|� d S r% )r �common_check_passthroughrR r" r" r# �check_passthrough� s zebtables.check_passthroughc C rP r% )r �common_reverse_passthroughrR r" r" r# �reverse_passthrough� rT z ebtables.reverse_passthroughc C s t � }d}i }|D ]i}|d d � }| �|� dD ]%}z|�|�} W n ty* Y qw t|�| d kr=|�| � |�| �}qtt|��D ]$} tjD ] } | || v rg|| � d�r_|| � d�sgd|| || < qIqD|� |g �� |� q |D ]}|� d| � || D ] }|� d�|�d � q�qu|�� t�|j�} t�d | j| jd |j| jf � g } | � d � t| j| |jd �\} }t�� d kr�t|j�}|d ur�d} |D ] }tjd| |f ddd� |� d�s�tjddd� | d7 } q�t� |j� | dk�rtd| jd�| �|f ��d S )Nr )rG z--table� �"z"%s"z*%s r6 � r5 z%s: %dz --noflush)�stdin� z%8d: %sr )�nofmt�nlr+ )r^ r7 ) r rB rN r0 �len�pop�range�string� whitespace� startswith�endswith� setdefaultr8 �writer; �closer& �stat�namer r9 r: r �st_sizer �getDebugLogLevelr �debug3�unlink)r! r1 � log_denied� temp_filerD � table_rules�_ruler@ �opt�i�crj r< r> r- �lines�liner" r" r# r/ � sn � � ��� � � � ��zebtables.set_rulesc C s | � |� | �|�S r% )rB �_ebtables__run)r! r@ rp r" r" r# �set_rule� s zebtables.set_ruleNc C s� g }|r|gnt �� }|D ]2}|| jv r|�|� q z| �d|dg� | j�|� |�|� W q ty? t�d| � Y q w |S )NrG r, z#ebtables table '%s' does not exist.)rC �keysr r8 ry r0 r �debug1)r! rD r- �tablesr" r" r# �get_available_tables� s �z ebtables.get_available_tablesc C s i S r% r" )r! rD r" r" r# �get_zone_table_chains� s z ebtables.get_zone_table_chainsc C s> g }t �� D ]}|| �� vrqdD ] }|�d||g� qq|S )N)z-FrK z-ZrG �rC r{ r~ r8 )r! r1 rD �flagr" r" r# �build_flush_rules� s �zebtables.build_flush_rulesc C sV g }|dkrdn|}t �� D ]}|| �� vrqt | D ] }|�d|d||g� qq|S )N�PANIC�DROPrG z-Pr� )r! �policyr1 �_policyrD rE r" r" r# �build_set_policy_rules� s �z ebtables.build_set_policy_rulesc C s g S r% r" r r" r" r# �build_default_tables� s z ebtables.build_default_tablesr. c C s� g }t D ]@}|| �� vr qt | d d � }|dkr$|tv r$|�t| � d|g}|D ]}t|�tkr:|�|| � q*|�|t|� � q*q|S )Nr. rG )� DEFAULT_RULESr~ � LOG_RULES�extend�type�listr8 r )r! rp � default_rulesrD �_default_rules�prefixr@ r" r" r# �build_default_rules� s �z ebtables.build_default_rulesc C s || j kS r% )r )r! r r" r" r# �is_ipv_supported rT zebtables.is_ipv_supportedr% )r. )�__name__� __module__� __qualname__r rk �policies_supportedr$ r r r ry rB rF rM rO rS rV rX r/ rz r~ r r� r� r� r� r� r" r" r" r# r 4 s2 @ ) �__all__�os.pathr& �firewall.core.progr �firewall.core.loggerr �firewall.functionsr r r �firewall.configr � firewall.corer �firewall.errorsr r rc rC r� r� � OUR_CHAINSr{ rD �setrE r8 rL �objectr r" r" r" r# �<module> s4 � �PK ���Z���� � % core/__pycache__/prog.cpython-310.pycnu �[��� o bhAb� � @ s d dl Z dgZddd�ZdS )� N�runProgc C s� |d u rg }| g| }d }|r*t |d��}|�� �� }W d � n1 s%w Y ddi}ztj|tjtjtjd|d�}W n tyH Y dS w |�|�\}} |� dd�}|j |fS ) N�r�LANG�CT)�stdin�stderr�stdout� close_fds�env)� � zutf-8�replace) �open�read�encode� subprocess�Popen�PIPE�STDOUT�OSError� communicate�decode� returncode) �prog�argvr �args� input_string�handler �process�output� err_output� r! �4/usr/lib/python3/dist-packages/firewall/core/prog.pyr s* � � � )NN)r �__all__r r! r! r! r" �<module> s PK ���Zڙ� � � ) core/__pycache__/__init__.cpython-310.pycnu �[��� o bhAb � @ s d S )N� r r r �8/usr/lib/python3/dist-packages/firewall/core/__init__.py�<module> s PK ���Z��#_@s @s # core/__pycache__/fw.cpython-310.pycnu �[��� o bhAbO� � @ s� d gZ ddlZddlZddlZddlZddlZddlmZm Z ddl m Z ddl m Z ddl mZ ddl mZ ddl mZ dd l mZ dd l mZ dd lmZ dd lmZ dd lmZ ddlmZ ddlm Z ddl m Z ddl m Z ddl!m"Z" ddl#m$Z$ ddl%m&Z& ddl'm(Z(m)Z) ddl*m+Z+ ddl,m-Z- ddl.m/Z/ ddl0m1Z1 ddl2m3Z3 ddl4m5Z5 dd l6m7Z7m8Z8 dd l9m:Z: dd l;m<Z< dd l=m>Z> dd l?m@Z@ dd!lAmBZB dd"l mCZC dd#lDmEZE G d$d � d eF�ZGdS )%�Firewall� N)�Dict�List)�config)� functions)� ipXtables)�ebtables)�nftables)�ipset)�modules)�FirewallIcmpType)�FirewallService)� FirewallZone)�FirewallDirect)�FirewallConfig)�FirewallPolicies)� FirewallIPSet)�FirewallTransaction)�FirewallHelper)�FirewallPolicy)�nm_get_bus_name�nm_get_interfaces_in_zone)�log)� IO_Object)�firewalld_conf)�Direct)�service_reader)�icmptype_reader)� zone_reader�Zone)� ipset_reader)� IPSET_TYPES)� helper_reader)� policy_reader)� Rich_Rule)�errors)� FirewallErrorc @ s� e Zd Zdfdd�Zdd� Zdd� Zdd � Zi fd eee e f fd d �Z d d� Z dd� Z dgdd�Zdd� Zdfdd�Zdd� Zdd� Zdd � Zd d � Zd d � Zd!d"� Zd#d$� Zd%d&� Zd'd(� Zd)d*� Zd+d,� Zdhd.d/�Z dhd0d1�Z dhd2d3�Z dhd4d5�Z d6d7� Z d8d9� Z!d:d;� Z"d<d=� Z#d>d?� Z$d@dA� Z%dBdC� Z&dDdE� Z'dFdG� Z(dHdI� Z)dJdK� Z*dLdM� Z+dNdO� Z,dfdPdQ�Z-dRdS� Z.dTdU� Z/dVdW� Z0dXdY� Z1dZd[� Z2d\d]� Z3d^d_� Z4d`da� Z5dbdc� Z6ddde� Z7d-S )ir Fc C s t tj�| _|| _| jr d| _d| _d| _d| _t | _ d| _ n9t � | �| _d| _g | _t �| �| _d| _g | _t�� | _d| _t�� | _d| _t | _ t�| �| _d| _ t�� | _t| �| _ t | �| _ t | �| _ t!| �| _"t#| �| _t$� | _%t&| �| _t'| �| _(t)| �| _*| �+� d S )NFT),r r �FIREWALLD_CONF�_firewalld_conf�_offline�ip4tables_enabled�ip6tables_enabled�ebtables_enabled� ipset_enabledr! �ipset_supported_types�nftables_enabledr � ip4tables�ip4tables_backend�ipv4_supported_icmp_types� ip6tables�ip6tables_backend�ipv6_supported_icmp_typesr �ebtables_backendr � ipset_backendr �nftables_backendr �modules_backendr �icmptyper �servicer �zoner �directr r �policiesr r �helperr �policy�_Firewall__init_vars)�self�offline� rD �2/usr/lib/python3/dist-packages/firewall/core/fw.py�__init__F sB zFirewall.__init__c C sD d| j | j| j| j| j| j| j| j| j| j | j | j | j | j | jf S )Nz:%s(%r, %r, %r, %r, %r, %r, %r, %r, %r, %r, %r, %r, %r, %r))� __class__r* r+ r, �_state�_panic� _default_zone�_module_refcount�_marks�cleanup_on_exit�cleanup_modules_on_exit�ipv6_rpfilter_enabledr- �_individual_calls� _log_denied�rB rD rD rE �__repr__n s ��zFirewall.__repr__c C sv d| _ d| _d| _g | _g | _i | _g | _tj| _ tj | _ tj | _ tj| _tj| _tj| _tj| _tj| _tj| _d S )N�INITF� )rH rI rJ �_default_zone_interfaces�_nm_assigned_interfacesrK rL r �FALLBACK_CLEANUP_ON_EXITrM � FALLBACK_CLEANUP_MODULES_ON_EXITrN �FALLBACK_IPV6_RPFILTERrO �FALLBACK_INDIVIDUAL_CALLSrP �FALLBACK_LOG_DENIEDrQ �FALLBACK_FIREWALL_BACKEND�_firewall_backend� FALLBACK_FLUSH_ALL_ON_RELOAD�_flush_all_on_reload�FALLBACK_RFC3964_IPV4� _rfc3964_ipv4� FALLBACK_ALLOW_ZONE_DRIFTING�_allow_zone_driftingrR rD rD rE � __init_varsw s zFirewall.__init_varsc s� i }� fdd�� j �� D �|d< � fdd�� j�� D �|d< � fdd�� j�� D �|d< � fdd�� j�� D �|d < � fd d�� j� � D �|d < � fd d�� j � � D �|d < i |d< t � j �� ��t � j�� ��D ] }� j �|�|d |< qit � j �� ��t � j�� ��D ]>}|� jvs�|� jvr�t�� j �|��|d |< g |d | _|� jvr�|d | j�d� |� jvr�|d | j�d� q�|S )zH Returns a dict of dicts of all runtime config objects. c � i | ] }|� j �|��qS rD )r � get_ipset)�.0�_ipsetrR rD rE � <dictcomp>� � z4Firewall.get_all_io_objects_dict.<locals>.<dictcomp>�ipsetsc rf rD )r? � get_helper)rh r? rR rD rE rj � rk �helpersc rf rD )r: � get_icmptype)rh r: rR rD rE rj � rk � icmptypesc rf rD )r; � get_service)rh r; rR rD rE rj � rk �servicesc rf rD )r< �get_zone)rh r< rR rD rE rj � rk �zonesc rf rD )r@ � get_policy)rh r@ rR rD rE rj � rk r> �icmptypes_unsupported�ipv4�ipv6)r � get_ipsetsr? � get_helpersr: � get_icmptypesr; � get_servicesr< � get_zonesr@ �"get_policies_not_derived_from_zone�setr � differencero � intersectionr2 r5 �copy� destination�append)rB � conf_dictr: rD rR rE �get_all_io_objects_dict� s2 � � �z Firewall.get_all_io_objects_dict�extra_io_objectsc C sn | � � }|D ]}|| D ] }||| |j< q qg d�}|D ]}|| }|�� D ] \}} | �| �� |� q'q d S )N)rl rn rp rr rt r> )r� �name�items�check_config_dict�export_config_dict) rB r� �all_io_objects�type_key�obj�order� io_obj_type�io_objsr� �io_objrD rD rE �full_check_config� s ���zFirewall.full_check_configc C s� | j rd| j�� vrt�d� d| _ | jr$d| j�� vr$t�d� d| _| jr6d| j�� vr6t�d� d| _| j sK| jsM| j sOt� d� t � d� d S d S d S d S )N�filterziptables is not usable.Fzip6tables is not usable.zebtables is not usable.zNo IPv4 and IPv6 firewall.� ) r* r1 �get_available_tablesr �info1r+ r4 r, r6 r/ �fatal�sys�exitrR rD rD rE � _check_tables� s$ � �zFirewall._check_tablesc C s� z| j �� W n ty$ | jrt�d� nt�d� g | _d| _Y nw | j � � | _| j � � | j j sO| j j r>t�d� n| jrGt�d� nt�d� d| _| jrZ| j�d�| _n | jrd| j �� | _ng | _| j� � | jj s�| jj rzt�d� n| jr�t�d � nt�d � d| _| jr�| j�d �| _n | jr�| j�� | _ng | _| j� � | jj s�| jj r�t�d � n| jr�t�d � nt�d� d| _| jr�| js�| jjs�t�d� d S d S d S d S )Nzaipset not usable, disabling ipset usage in firewall. Other set backends (nftables) remain usable.z4ipset not usable, disabling ipset usage in firewall.FzFiptables-restore is missing, using individual calls for IPv4 firewall.zMiptables-restore and iptables are missing, IPv4 direct rules won't be usable.zCiptables-restore and iptables are missing, disabling IPv4 firewall.rw zGip6tables-restore is missing, using individual calls for IPv6 firewall.zOip6tables-restore and ip6tables are missing, IPv6 direct rules won't be usable.zEip6tables-restore and ip6tables are missing, disabling IPv6 firewall.rx zHebtables-restore is missing, using individual calls for bridge firewall.zKebtables-restore and ebtables are missing, eb direct rules won't be usable.zEebtables-restore and ebtables are missing, disabling bridge firewall.zSebtables-restore is not supporting the --noflush option, will therefore not be used)r7 �set_list� ValueErrorr/ r r� �warningr. r- �set_supported_typesr1 � fill_exists�restore_command_exists�command_existsr* r8 �supported_icmp_typesr2 r4 r+ r5 r6 r, rP �restore_noflush_option�debug1rR rD rD rE � _start_check� sb � � �zFirewall._start_checkc C s� t j}t�dt j� z| j�� W n ty. } zt�|� t�d� W Y d }~�nMd }~ww | j� d�r;| j� d�}| j� d�r[| j� d�}|d urT|� � dv rTd| _ t�d| j � | j� d�r{| j� d�}|d urt|� � d v rtd | _ t�d | j � | j� d �r�| j� d �}|d ur�|� � d v r�t�d � z| j �� W n ty� Y nw | j� d�r�| j� d�}|d ur�|� � dv r�d| _|� � d v r�d | _| jr�t�d� nt�d� | j� d�r�| j� d�}|d ur�|� � d v r�t�d� d | _| j� d��r | j� d�}|d u �s|� � dk�rd| _n |� � | _t�d| j� | j� d��r3| j� d�| _t�d| j� | j� d��rU| j� d�}|� � dv �rKd| _nd | _t�d| j� | j� d��rw| j� d�}|� � dv �rmd| _nd | _t�d | j� | j �t�| j�� | �| j� | j�s�| �� t�d � z| j j �� W n. t�y� } z!| j � � �r�t� d | j j j |� n t�d | j j j |� W Y d }~nd }~ww | j � t�| j �� | �!t j"d � | �!t j#d � | �!t j$d � | �!t j%d � t&| j'�(� �d!k�r t� d"� | �!t j)d#� | �!t j*d#� | �!t j+d$� | �!t j,d$� t&| j-�.� �d!k�r+t� d%� | �!t j/d&� | �!t j0d&� t&| j1�2� �d!k�rMt�3d'� t4�5d(� | �!t j6d)� | �!t j7d)� d}d*D ]}|| j1�2� v�rqt�3d+|� d }�q_|�r{t4�5d(� || j1�2� v�r�d,| j1�2� v �r�d,}n d-| j1�2� v �r�d-}nd.}t� d/||� |}nt�d0|� t8t j9�} t:j;�<t j9��r�t�d1t j9 � z| �� W n t�y� } zt� d2t j9|� W Y d }~nd }~ww | j=�>| � | j �?t�| �� | �@|�| _A| j�r�d S | �B� t�C� d!k�r tD�D� } tE| �} | jF| d3� |�r |�s(| jG�H� �r1| jG�I� �r1| �Jd � | �K� |�rA|�rAt�d4� | jL�M� | jN| d3� | �Jd � | �K� | jG�H� �rf| jG�I� �rft�d5� | jG�O� t�d6� | jP| d3� t�d7� | j1jQ| d3� | j1jRd | jA| d3� t�d8� | jSjT| d3� | �Jd � | �K� | j=�U� �r�t�d9� | j=�V| � z | �Jd � | �K� W n& t�y� } zt| jWd:| jX�r�| jX ��d; ��d } ~ w t�y� � w ~ t�C� d(k�r�tD�D� } t�Yd<| | � d S d S )=Nz"Loading firewalld config file '%s'z0Using fallback firewalld configuration settings.� DefaultZone� CleanupOnExit)�no�falseFz CleanupOnExit is set to '%s'�CleanupModulesOnExit)�yes�trueTz#CleanupModulesOnExit is set to '%s'�LockdownzLockdown is enabled� IPv6_rpfilterzIPv6 rpfilter is enabledzIPV6 rpfilter is disabled�IndividualCallszIndividualCalls is enabled� LogDeniedr� �offzLogDenied is set to '%s'�FirewallBackendz FirewallBackend is set to '%s'�FlushAllOnReloadz FlushAllOnReload is set to '%s'� RFC3964_IPv4zRFC3964_IPv4 is set to '%s'zLoading lockdown whitelistz*Failed to load lockdown whitelist '%s': %sr r: r zNo icmptypes found.r? r; zNo services found.r< zNo zones found.r� r@ )�block�drop�trustedzZone '%s' is not available.�public�externalr� z+Default zone '%s' is not valid. Using '%s'.zUsing default zone '%s'z Loading direct rules file '%s'z)Failed to load direct rules file '%s': %s)�use_transactionzUnloading firewall moduleszApplying ipsetszApplying default rule setzApplying used zoneszApplying used policiesz2Applying direct chains rules and passthrough rulesz Direct: %srU z%Flushing and applying took %f seconds)Zr � FALLBACK_ZONEr r� r' r( �read� Exceptionr� �get�lowerrM rN r> �enable_lockdownr& rO rP rQ r^ r` rb �set_firewalld_confr� �deepcopy�_select_firewall_backendr) r� �lockdown_whitelist�query_lockdown�error�filename� set_policies�_loader�FIREWALLD_IPSETS�ETC_FIREWALLD_IPSETS�FIREWALLD_ICMPTYPES�ETC_FIREWALLD_ICMPTYPES�lenr: r{ �FIREWALLD_HELPERS�ETC_FIREWALLD_HELPERS�FIREWALLD_SERVICES�ETC_FIREWALLD_SERVICESr; r| �FIREWALLD_ZONES�ETC_FIREWALLD_ZONESr< r} r� r� r� �FIREWALLD_POLICIES�ETC_FIREWALLD_POLICIESr �FIREWALLD_DIRECT�os�path�existsr= �set_permanent_config� set_direct� check_zonerJ r� �getDebugLogLevel�timer �flushr �backends� has_ipsets�execute�clearr9 �unload_firewall_modules�apply_default_tables� apply_ipsets�apply_default_rules� apply_zones�change_default_zoner@ �apply_policies�has_configuration� apply_direct�code�msg�debug2)rB �reload�complete_reload� default_zoner� �valuer� �zr< r� �tm1� transaction�e�tm2rD rD rE �_start s� �� � � � � � � � ��� � � � ��� �� � "���zFirewall._startc C sB z| � � W n ty d| _| �d� � w d| _| �d� d S )N�FAILED�ACCEPT�RUNNING)r� r� rH � set_policyrR rD rD rE �start- s �zFirewall.startc C sb t j�|�sd S |r-|�tj�r+|dkr+t� }t j�|�|_|� |j� ||_d|_ nd}t t � |��D �]�}|� d�s]|�tj�r\|dkr\t j�d||f �r\| jd||f |dd� q4d||f }t�d||� �zL|dkr�t||�}|j| j�� v r�| j�|j�}t�d ||j|j|j� | j�|j� n |j�tj�r�d|_ z| j�|� W n ty� } zt�d |jt| �f � W Y d } ~ nd } ~ ww | j�t� |�� �n�|d k�r t ||�}|j| j � � v �r| j � |j�}t�d ||j|j|j� | j �!|j� n |j�tj��r d|_ | j �"|� | j�"t� |�� �n�|dk�r�t#|||d �}|�rFdt j�|�t j�|�d d� f |_|� |j� t� |�} |j| j$�%� v �r�| j$�&|j�}| j$�'|j� |j(�rvt�d||j||� |�)|� nt�d ||j|j|j� n|j�tj��r�d|_ d| _ | j�*| � |�r�t�d||j||� |�)|� �n | j$�*|� �n|dk�r t+||�}|j| j,�-� v �r�| j,�.|j�}t�d ||j|j|j� | j,�/|j� n |j�tj��r�d|_ z| j,�0|� W n t�y } zt�1d |jt| �f � W Y d } ~ nd } ~ ww | j�0t� |�� n�|dk�rgt2||�}|j| j3�4� v �rL| j3�5|j�}t�d ||j|j|j� | j3�6|j� n |j�tj��rWd|_ | j3�7|� | j�7t� |�� nO|dk�r�t8||�}|j| j9�:� v �r�| j9�;|j�}t�d ||j|j|j� | j9�<|j� n |j�tj��r�d|_ | j9�=|� | j�>t� |�� nt�?d|� W q4 t�y� } zt�@d||| � W Y d } ~ q4d } ~ w tA�y� t�@d||� t�B� Y q4w |�r-|j(�r/|j| j$�%� v �r%| j$�&|j�}t�d||j|j|j� z | j$�'|j� W n tA�y Y nw | j�C|j� | j$�*|� d S d S d S )Nr< Fz.xmlz%s/%sT)�combinezLoading %s file '%s'r: z Overloads %s '%s' ('%s/%s')z %s: %s, ignoring for run-time.r; )� no_check_namer ���z Combining %s '%s' ('%s/%s')r r? r@ zUnknown reader type %sz Failed to load %s file '%s': %sz Failed to load %s file '%s':z0 Overloading and deactivating %s '%s' ('%s/%s'))Dr� r� �isdir� startswithr � ETC_FIREWALLDr �basenamer� � check_name�default�sorted�listdir�endswithr� r r� r r: r{ ro r� �remove_icmptype� add_icmptyper& r� �strr� r� r r; r| rq �remove_service� add_servicer r< r} rs � remove_zone�combinedr �add_zoner r ry rg � remove_ipset� add_ipsetr� r" r? rz rm � remove_helper� add_helperr# r@ � get_policiesru � remove_policy� add_policy�add_policy_objectr� r� r� � exception� forget_zone) rB r� � reader_typer � combined_zoner� r� r� �orig_objr� � config_objr� rD rD rE r� 8 sD �� � ��� � � � � � � ��� � � ��� � ���zFirewall._loaderc C sp | j �� | j�� | j�� | j�� | j�� | j�� | j�� | j�� | j �� | j �� | � � d S �N) r: �cleanupr; r< r r? r r= r> r@ r( rA rR rD rD rE r$ � s zFirewall.cleanupc C sN | j s!| jr| �� | j�� | �d� | jr!t�d� | j� � | � � d S )Nr� z!Unloading firewall kernel modules) r) rM r� r r� rN r r� r9 r� r$ rR rD rD rE �stop� s z Firewall.stopc C s� d}d}t |�D ]Z\}}|r| j�|�\}}n| j| dkr!d}n| j�|�\}}|dkr6|d7 }||7 }q|rI| j�|d� | j| d7 < q|| jv rb| j| d8 < | j| dkrb| j|= q||fS )Nr rU r� )� enumerater9 � load_modulerK � unload_module� setdefault) rB �_modules�enable� num_failed� error_msgs�i�module�statusr� rD rD rE �handle_modules� s* �zFirewall.handle_modulesc C s |dkr d| _ d S d S )Nr F)r/ )rB �backendrD rD rE r� s �z!Firewall._select_firewall_backendc C s0 | � � D ] }|j|kr| S qttjd| ��)Nz'%s' backend does not exist)� all_backendsr� r& r% � UNKNOWN_ERROR)rB r� r2 rD rD rE �get_backend_by_name s ��z Firewall.get_backend_by_namec C sX | j r| jS |dkr| jr| jS |dkr| jr| jS |dkr$| jr$| jS tt j d| ���Nrw rx �ebz-'%s' is not a valid backend or is unavailable) r/ r8 r* r1 r+ r4 r, r6 r& r% � INVALID_IPV�rB �ipvrD rD rE �get_backend_by_ipv s �zFirewall.get_backend_by_ipvc C sL |dkr | j r | jS |dkr| jr| jS |dkr | jr | jS ttjd| ��r6 ) r* r1 r+ r4 r, r6 r& r% r8 r9 rD rD rE �get_direct_backend_by_ipv# s �z"Firewall.get_direct_backend_by_ipvc C s< |dkr| j S |dkr| jS |dkr| jS |dkr | jS dS )Nr0 r3 r r F)r* r+ r, r/ )rB r� rD rD rE �is_backend_enabled- s zFirewall.is_backend_enabledc C s8 | j rdS |dkr | jS |dkr| jS |dkr| jS dS )NTrw rx r7 F)r/ r* r+ r, r9 rD rD rE �is_ipv_enabled8 s zFirewall.is_ipv_enabledc C sT g }| j r |�| j� |S | jr|�| j� | jr |�| j� | jr(|�| j� |S r# ) r/ r� r8 r* r1 r+ r4 r, r6 �rB r� rD rD rE �enabled_backendsC s � zFirewall.enabled_backendsc C sP g }| j r |�| j� | jr|�| j� | jr |�| j� | jr&|�| j� |S r# ) r* r� r1 r+ r4 r, r6 r/ r8 r? rD rD rE r3 P s zFirewall.all_backendsNc C sN |d u r t | �}n|}| �� D ] }|�||�� � q|d u r%|�d� d S d S )NT)r r@ � add_rules�build_default_tablesr� )rB r� r� r2 rD rD rE r� \ s �z Firewall.apply_default_tablesc C s� |d u r t | �}n|}| �� D ]}|�| j�}|�||� q| �d�r=| �d�}d|�� v r=| jr=|� | j�}|�||� | �d�rO| j rO|� � }|�||� |d u rZ|� d� d S d S )Nrx �rawT) r r@ �build_default_rulesrQ rA r> r; r� rO �build_rpfilter_rulesrb �build_rfc3964_ipv4_rulesr� )rB r� r� r2 �rules� ipv6_backendrD rD rE r� h s$ �z Firewall.apply_default_rulesc C s\ |d u r t | �}n|}t�d� | �� D ] }|�� }|�||� q|d u r,|�d� d S d S )NzFlushing rule setT)r r r� r3 �build_flush_rulesrA r� )rB r� r� r2 rG rD rD rE r� � s �zFirewall.flushc C s` |d u r t | �}n|}t�d|� | �� D ] }|�|�}|�||� q|d u r.|�d� d S d S )NzSetting policy to '%s'T)r r r� r@ �build_set_policy_rulesrA r� )rB r@ r� r� r2 rG rD rD rE r� � s �zFirewall.set_policyc C sB |sdS | � |�}|sttjd| ��| �|�sdS |�|| j�S )NrU �'%s' is not a valid backend)r5 r& r% r8 r= �set_rulerQ )rB � backend_name�ruler2 rD rD rE rN � s � z Firewall.rulec C s t td |��}| �|�}|sttjd| ��| �|�s d S | js+|jr+|dkry| j j syt |�D ]G\}}z |� || j � W q/ tyv } z.t�t�� � t�|� t|d |� �D ]}z |� |�|�| j � W qX tyo Y qXw |�d }~ww d S |�|| j � d S )NrK r )�listr� r5 r& r% r8 r= rP r� r6 r� r& rL rQ r� r r� � traceback� format_excr� �reversed� reverse_rule� set_rules)rB rM rG �_rulesr2 r. rN r� rD rD rE rG � s: � � ����zFirewall.rulesc C s | j rttj��d S r# )rI r& r% � PANIC_MODErR rD rD rE � check_panic� s �zFirewall.check_panicc C s" |}|| j �� vrttj|��|S r# )r@ r r& r% �INVALID_POLICY)rB r@ �_policyrD rD rE � check_policy� s zFirewall.check_policyc C s6 |}|r|dkr | � � }|| j�� vrttj|��|S )NrU )�get_default_zoner< r} r& r% � INVALID_ZONE)rB r< �_zonerD rD rE r� � s zFirewall.check_zonec C � t �|�s ttj|��d S r# )r �checkInterfacer& r% �INVALID_INTERFACE)rB � interfacerD rD rE �check_interface� � �zFirewall.check_interfacec C � | j �|� d S r# )r; � check_service)rB r; rD rD rE re � � zFirewall.check_servicec C r^ r# )r � check_portr& r% � INVALID_PORT)rB �portrD rD rE rg � rc zFirewall.check_portc C s* |st tj��|dvrt tjd| ��d S )N)�tcp�udp�sctp�dccpz''%s' not in {'tcp'|'udp'|'sctp'|'dccp'})r& r% �MISSING_PROTOCOL�INVALID_PROTOCOL)rB �protocolrD rD rE � check_tcpudp� s ���zFirewall.check_tcpudpc C r^ r# )r �checkIPr& r% � INVALID_ADDR)rB �iprD rD rE �check_ip� rc zFirewall.check_ipc C sP |dkrt �|�sttj|��d S |dkr"t �|�s ttj|��d S ttjd��)Nrw rx z'%s' not in {'ipv4'|'ipv6'})r � checkIPnMaskr& r% rs � checkIP6nMaskr8 )rB r: �sourcerD rD rE � check_address� s � ��zFirewall.check_addressc C rd r# )r: �check_icmptype)rB �icmprD rD rE rz rf zFirewall.check_icmptypec C s> t |t�std|t|�f ��t|�dk r ttjd| ��d S )Nz%s is %s, expected intr z#timeout '%d' is not positive number)� isinstance�int� TypeError�typer& r% � INVALID_VALUE)rB �timeoutrD rD rE � check_timeout s ��zFirewall.check_timeoutc C s� | j }| j}|s$i }| j�� D ] }| j�|�j||< q| j�� }| �� }g }| j � � D ] } |� | j � | �� q+|s>| � d� | �� d } z | jd|d� W n tya } z| } W Y d } ~ nd } ~ ww |r�|D ] } | j �| j�s�| j �� D ]} | jdkr|qt| �| j� qtqf|�s<| �� }||kr�||vr�i ||< || D ]}|| jv r�|| | || |< || |= q�| j�� D ] }||v r�|| D ] }| j�||� q�||= q�t�d|� q�t|�dkr�t|�� �D ] }t�d|� ||= q�~|D ]D} | j �| j��r(| j D ](}z | j � | j|� W q� t �y& } z|j t j!k�r |�W Y d }~q�d }~ww q�| j �"| � | j �#| j� q�| j�$|� t%� }|�r_| j�� dg D ]}t&|�D ] }| jj|||d � �qP�qJ|| _ | j �sk| � d � | �rsd | _'| �d | _'d S ) N�DROPT)r� r� r zNew zone '%s'.r z(Lost zone '%s', zone interfaces dropped.rU )�senderr� r� r� )(rI r` r< r} rs � interfacesr= �get_runtime_configr[ r ry r� rg r� r$ r� r� � query_ipsetr� r� � set_destroyrV �change_zone_of_interfacer r� r� rO �keys�entries� add_entryr& r� r% �ALREADY_ENABLEDr � apply_ipset� set_configr r rH )rB r% rI � flush_all�_zone_interfacesr< �_direct_config�_old_dz� _ipset_objs�_name�start_exceptionr� r� r2 �_new_dz�iface� interface_id�entryr� � nm_bus_namera rD rD rE r� s� �� � � � ���� � zFirewall.reloadc C � | j S r# )rH rR rD rD rE � get_state� � zFirewall.get_statec C sP | j r ttjd��z| �d� W n ty" } zttj|��d }~ww d| _ d S )Nzpanic mode already enabled�PANICT)rI r& r% r� r� r� �COMMAND_FAILED�rB r� rD rD rE �enable_panic_mode� � � �� zFirewall.enable_panic_modec C sP | j s ttjd��z| �d� W n ty" } zttj|��d }~ww d| _ d S )Nzpanic mode is not enabledr� F)rI r& r% � NOT_ENABLEDr� r� r� r� rD rD rE �disable_panic_mode� r� zFirewall.disable_panic_modec C r� r# )rI rR rD rD rE �query_panic_mode� r� zFirewall.query_panic_modec C r� r# )rQ rR rD rD rE �get_log_denied� r� zFirewall.get_log_deniedc C s` |t jvrttjd|d�t j�f ��|| �� kr*|| _| j� d|� | j� � d S ttj |��)Nz'%s', choose from '%s'z','r� ) r �LOG_DENIED_VALUESr& r% r� �joinr� rQ r( r �write� ALREADY_SET)rB r� rD rD rE �set_log_denied� s �� zFirewall.set_log_deniedc C r� r# )rJ rR rD rD rE r[ � r� zFirewall.get_default_zonec C s� | � |�}|| jkr@| j}|| _| j�d|� | j�� | jr!d S | j�||� | j�|�j D ]}|| j v r=| j� d|� q/d S t t j|��)Nr� rU )r� rJ r( r r� r) r< r� rs r� rV r� r& r% �ZONE_ALREADY_SET)rB r< r] r� r� rD rD rE �set_default_zone� s �� zFirewall.set_default_zonec C sD |� � }|�� D ]\}}|st|t�r|||< q||v r ||= q|S r# )r� r� r| �bool)rB � permanent�runtimer �keyr� rD rD rE �'combine_runtime_with_permanent_settings� s �z0Firewall.combine_runtime_with_permanent_settingsc C s& dD ]}||v rdd� || D �||< qi }i }t |�� �t |�� �B D ]j}||v r�t|| t�rXt ||v r:|| ng �}tt || �| �||< t|t || �A |@ �||< q$t|| t�sft|| t�r�|| ss|| rsd||< q$|| r|| sd||< q$ttjd� t || �|���q$||fS )N)� rich_rules� rules_strc S s g | ] }t t|d ���qS ))�rule_str)r r$ )rh r� rD rD rE � <listcomp>� rk z;Firewall.get_added_and_removed_settings.<locals>.<listcomp>TFz Unhandled setting type {} key {}) r r� r| rO r� r} r& r% �INVALID_SETTING�formatr )rB � old_settings� new_settings�rich_key� add_settings�remove_settingsr� �oldrD rD rE � get_added_and_removed_settings� s* � � �z'Firewall.get_added_and_removed_settings)F)FFr# )8�__name__� __module__� __qualname__rF rS rA r� r r r r r� r� r� r� r r� r$ r% r1 r� r5 r; r< r= r> r@ r3 r� r� r� r� rN rG rW rZ r� rb re rg rq ru ry rz r� r� r� r� r� r� r� r� r[ r� r� r� rD rD rD rE r E sj ( & J r )H�__all__�os.pathr� r� r� r� rP �typingr r �firewallr r � firewall.corer r r r r �firewall.core.fw_icmptyper �firewall.core.fw_servicer �firewall.core.fw_zoner �firewall.core.fw_directr �firewall.core.fw_configr �firewall.core.fw_policiesr �firewall.core.fw_ipsetr � firewall.core.fw_transactionr �firewall.core.fw_helperr �firewall.core.fw_policyr �firewall.core.fw_nmr r �firewall.core.loggerr �firewall.core.io.io_objectr � firewall.core.io.firewalld_confr �firewall.core.io.directr �firewall.core.io.servicer �firewall.core.io.icmptyper �firewall.core.io.zoner r �firewall.core.io.ipsetr �firewall.core.ipsetr! �firewall.core.io.helperr" �firewall.core.io.policyr# �firewall.core.richr$ r% �firewall.errorsr& �objectr rD rD rD rE �<module> sP PK ���Z��V�Ns Ns ( core/__pycache__/fw_zone.cpython-310.pycnu �[��� o bhAbʩ � @ s� d dl Z d dlmZmZmZ d dlmZ d dlmZ d dl m Z d dl m Z m Z mZmZmZmZmZmZmZmZmZ d dlmZ d dlmZmZm Z d d l m Z d d l m Z G d d � d e!�Z"dS ) � N)� SHORTCUTS�DEFAULT_ZONE_TARGET�SOURCE_IPSET_TYPES)�FirewallTransaction)�Policy)�log) �Rich_ForwardPort�Rich_IcmpBlock� Rich_IcmpType� Rich_Mark�Rich_Masquerade� Rich_Port� Rich_Protocol� Rich_Rule� Rich_Service�Rich_SourcePort�Rich_Tcp_Mss_Clamp)�nm_get_bus_name)� checkIPnMask� checkIP6nMask� check_mac)�errors)� FirewallErrorc @ sD e Zd ZdZdd� Zdd� Zdd� Zdd � Zd d � Zd d � Z dd� Z dd� Z dd� Z dd� Z dd� Zdd� Zdd� Zd�d d �Zd d � Zd!d"� Zd#d$� Z d�d%d&�Zd'd(� Zd�d)d*�Zd�d+d,�Zd-d.� Zd/d0� Zd1d2� Zd3d4� Z d5d6� Z 7d�d8d9�Z d:d;� Z d�d<d=�Z d�d>d?�Z! d�d@dA�Z"dBdC� Z#dDdE� Z$dFdG� Z%d�dIdJ�Z&d�dKdL�Z' 7d�dMdN�Z(dOdP� Z)d�dQdR�Z* d�dSdT�Z+dUdV� Z,dWdX� Z-dYdZ� Z.d�d[d\�Z/d]d^� Z0d_d`� Z1dadb� Z2dcdd� Z3dedf� Z4dgdh� Z5d�didj�Z6dkdl� Z7dmdn� Z8dodp� Z9d�dqdr�Z:dsdt� Z;dudv� Z<dwdx� Z=d�dydz�Z>d{d|� Z?d}d~� Z@dd�� ZAd�d�� ZBd�d�d��ZCd�d�� ZDd�d�� ZEd�d�� ZFd�d�d��ZGd�d�� ZHd�d�� ZId�d�� ZJd�d�d��ZKd�d�� ZLd�d�� ZM d�d�d��ZN d�d�d��ZO d�d�d��ZPd�d�� ZQd�d�d��ZRd�d�� ZSd�d�� ZTd�d�� ZUd�d�d��ZVd�d�� ZWd�d�� ZXd�d�� ZYd�d�� ZZ d�d�d��Z[d�d�� Z\d�d�d��Z]d�d�� Z^d�d�� Z_d S )�� FirewallZoner c C s || _ i | _i | _d S �N)�_fw�_zones�_zone_policies)�self�fw� r �7/usr/lib/python3/dist-packages/firewall/core/fw_zone.py�__init__0 s zFirewallZone.__init__c C s d| j | jf S )Nz%s(%r))� __class__r �r r r r! �__repr__5 � zFirewallZone.__repr__c C s | j �� | j�� d S r )r �clearr r$ r r r! �cleanup8 s zFirewallZone.cleanupc C s t | j�}|�| jj� |S r )r r �add_pre�full_check_config)r �tr r r! �new_transaction< s z FirewallZone.new_transactionc C s dj ||d�S )Nzzone_{fromZone}_{toZone})�fromZone�toZone)�format)r r- r. r r r! �policy_name_from_zonesA � z#FirewallZone.policy_name_from_zonesc C s t | j�� �S r )�sortedr �keysr$ r r r! � get_zonesF r1 zFirewallZone.get_zonesc C s4 g }| � � D ]}| �|�s| �|�r|�|� q|S r )r4 �list_interfaces� list_sources�append)r � active_zones�zoner r r! �get_active_zonesI s �z FirewallZone.get_active_zonesc C �2 | � |�}| jD ]}|| j| jv r| S qd S r )�_FirewallZone__interface_idr � interfaces)r � interface� interface_idr9 r r r! �get_zone_of_interfaceP � �z"FirewallZone.get_zone_of_interfacec C r; r )�_FirewallZone__source_idr �sources)r �source� source_idr9 r r r! �get_zone_of_sourceX rA z FirewallZone.get_zone_of_sourcec C s | j �|�}| j| S r )r � check_zoner )r r9 �zr r r! �get_zone` s zFirewallZone.get_zonec C sF t � }|j|_| �||�|_| j|_|j|_|g|_|g|_dD ]�}||jkr<|dkr<|dv r<t ||t � t ||��� q |dkrV||jkrV|dv rVt ||t � t ||��� q ||jkrp|dkrp|dv rpt ||t � t ||��� q |dv r�g |_ g |_|j D ]"}| �||�}t|d�}|| �|j|�v r�|j �|� |j�|� q}q |S ) N) �services�ports� masquerade� forward_ports� source_ports� icmp_blocks�icmp_block_inversion� rules_str� protocols�HOST)rJ rK rN rO rP rR �ANY)rL )rM )rQ ��rule_str)r �name�derived_from_zoner0 �ZONE_POLICY_PRIORITY�priority�target� ingress_zones� egress_zones�setattr�copy�deepcopy�getattrrQ �rulesr �_rich_rule_to_policiesr7 ) r �z_objr- r. �p_obj�settingrV �current_policy�ruler r r! �policy_obj_from_zone_objd s6 �z%FirewallZone.policy_obj_from_zone_objc C sr || j |j< g | j|j< |jdfd|jf|jdffD ] \}}| �|||�}| jj�|� | j|j �|j� qd S )NrS rT )r rW r ri r �policy� add_policyr7 )r �objr- r. re r r r! �add_zone� s ��zFirewallZone.add_zonec C s. | j | }|jr | �|� | j |= | j|= d S r )r �applied�unapply_zone_settingsr )r r9 rl r r r! � remove_zone� s zFirewallZone.remove_zoneNc C sR | � � D ]"}| j| }t|j�dkst|j�dkr&t�d|� | j||d� qd S )Nr zApplying zone '%s'��use_transaction)r4 r �lenr= rC r �debug1�apply_zone_settings)r rr r9 rd r r r! � apply_zones� s ��zFirewallZone.apply_zonesc C s | j | }||_d S r )r rn )r r9 rn rl r r r! �set_zone_applied� s z FirewallZone.set_zone_appliedc C s� d|vrd S |� d�}t|�dk rd S d }tD ] }|d t| kr#|}q|d urJ|d | �� vr2d S t|�dksDt|�dkrJ|d dv rJ|d |fS d S )N�_� r � � )�prer �deny�allow�post)�splitrs r r4 )r �chain�splits�_chain�xr r r! �zone_from_chain� s" � z FirewallZone.zone_from_chainc C st | � |�}|d u r d S |\}}|dv r|}d}n|dv r!|}d}n|dv r*d}|}nttjd| ��| �||�|fS )N)� PREROUTING�FORWARDrT )�INPUTrS )� POSTROUTINGz&chain '%s' can't be mapped to a policy)r� r r � INVALID_CHAINr0 )r r� r� r9 r� r- r. r r r! �policy_from_chain� s z FirewallZone.policy_from_chainc C sv |dv r5| � |�}|d ur7| � |�\}}|d u r | �� }n|}| jj�|d|||� |d u r9|�d� d S d S d S d S )N)�ipv4�ipv6T)r� r, r rj �gen_chain_rules�execute) r �ipv�tabler� rr r� rj r� � transactionr r r! �create_zone_base_by_chain� s �� z&FirewallZone.create_zone_base_by_chainc C s� dD ]I}t | �|�|�}t|t�r|g}|D ]4}|dkr%| �||||� q|dkr8| �|�}| �|||||� q|dkr=q|dkrBqt�d|||� qq|rW| � |||� d S d S )N)r= rC �forwardrP r= rC rP r� z3Zone '%s': Unknown setting '%s:%s', unable to apply) ra rI � isinstance�bool� _interface� check_source�_sourcer �warning�_icmp_block_inversion)r �enabler9 r� �key� args_list�argsr� r r r! �_zone_settings� s* ���zFirewallZone._zone_settingsc C s� | j �|�}| j| }|jrd S d|_|d u r | �� }n|}| j| D ]}t�d||� | j jj ||d� q#| � d||� |d u rH|� d� d S d S )NTz+Applying policy (%s) derived from zone '%s'rq ) r rG r rn r, r r rt rj �apply_policy_settingsr� r� �r r9 rr �_zonerl r� rj r r r! ru s �z FirewallZone.apply_zone_settingsc C s� | j �|�}| j| }|jsd S |d u r| �� }n|}| j| D ] }| j jj||d� q | �d||� |d u r>|� d� d S d S )Nrq FT) r rG r rn r, r rj �unapply_policy_settingsr� r� r� r r r! ro s �z"FirewallZone.unapply_zone_settingsc C sz | � |�}| �|�}g }td�D ](}|j| d |vr,|�t�t||j| d ��� q|�||j| d � qt|�S )�H :return: exported config updated with runtime settings � r ) rI � get_config_with_settings_dict�range�IMPORT_EXPORT_STRUCTUREr7 r_ r` ra �tuple)r r9 rl � conf_dict� conf_list�ir r r! �get_config_with_settings1 s "z%FirewallZone.get_config_with_settingsc C s� | � |��� }|d tkrd|d< | �|�| �|�| �|�| �|�| �|�| �|�| � |�| � |�| � |�| � |�| � |�| �|�d� }| j�||�S )r� r[ �default� rJ rK rO rL rM r= rC rQ rR rN rP r� )rI �export_config_dictr � list_services� list_ports�list_icmp_blocks�query_masquerade�list_forward_portsr5 r6 � list_rules�list_protocols�list_source_ports�query_icmp_block_inversion� query_forwardr �'combine_runtime_with_permanent_settings)r r9 � permanent�runtimer r r! r� A s" � z*FirewallZone.get_config_with_settings_dictc s d � fdd� }� fdd�}� j � jf� j� jf� j� jf� j� jf� j� j f� j � j f� j � j f||f� j� jf� j� jf� j� jf� j� jfd� }� �|�}t�|�}|�|� j�� � � j�d|gi� � � |�} � j� | |�\} } | D ]4} t | | t �r�| | D ] } t | t �r�|| d |g| �R � q�|| d || � q�qv|| d |� qv| D ]]} t | | t �r�| | D ]4} | d v r�|| d || |d � q�t | t �r�|| d |g| �R d|d �� q�|| d || d|d � q�q�| d v r�|| d ||d � q�|| d |d|d � q�d S )Nr c s � j | t|d�d|d� d S )NrU r ��timeout�sender)�add_ruler )r9 rV r� r� r$ r r! �add_rule_wrapperY s zDFirewallZone.set_config_with_settings_dict.<locals>.add_rule_wrapperc s � � | t|d�� d S )NrU )� remove_ruler )r9 rV r$ r r! �remove_rule_wrapper[ � zGFirewallZone.set_config_with_settings_dict.<locals>.remove_rule_wrapperr� �zonesrz )r= rC )r� r� )rP �r N)!� add_service�remove_service�add_port� remove_port�add_icmp_block�remove_icmp_block�add_masquerade�remove_masquerade�add_forward_port�remove_forward_port� add_interface�remove_interface� add_source� remove_source� add_protocol�remove_protocol�add_source_port�remove_source_port�add_icmp_block_inversion�remove_icmp_block_inversion� add_forward�remove_forwardrI r_ �import_config_dictr �get_all_io_objects_dictr* r� � get_added_and_removed_settingsr� �listr� )r r9 �settingsr� r� r� � setting_to_fn�old_obj� check_obj� old_settings� add_settings�remove_settingsr� r� r r$ r! � set_config_with_settings_dictW sT � � "� �z*FirewallZone.set_config_with_settings_dictc C s | j �|� d S r )r �check_interface�r r> r r r! r� � r& z FirewallZone.check_interfacec C s | � |� |S r )r� r� r r r! �__interface_id� s zFirewallZone.__interface_idTc C s | j �� | j �|�}| j| }| �|�}||jv r$ttjd||f ��| � |�} | d ur7ttj d|| f ��t � d||f � |d u rI| � � } n|} |js_|r_| j|| d� | �| j|d� |ri| �d||| � | �||||� | �| j||� |d u r�| �d� |S )N�'%s' already bound to '%s'z&Setting zone of interface '%s' to '%s'rq FT)r � check_panicrG r r< r= r r �ZONE_ALREADY_SETr@ � ZONE_CONFLICTr rt r, rn ru �add_failrw r� �!_FirewallZone__register_interface�#_FirewallZone__unregister_interfacer� ) r r9 r> r� rr � allow_applyr� �_objr? �zoir� r r r! r� � sJ �� ��� � � zFirewallZone.add_interfacec C sF |j �|� |r |dkr| jj�|� |t� kr!| jj�|� d S d S )N� )r= r7 r �_default_zone_interfacesr �_nm_assigned_interfaces)r r� r? r9 r� r r r! �__register_interface� s �z!FirewallZone.__register_interfacec C sR | j �� | �|�}| j �|�}||kr|S |d ur | �||� | �|||�}|S r )r r� r@ rG r� r� )r r9 r> r� � _old_zone� _new_zoner� r r r! �change_zone_of_interface� s z%FirewallZone.change_zone_of_interfacec C s~ | j �� |d u r| �� }n|}| �||� | jd|d|dd� |d ur2|dkr2| jd|d|dd� |d u r=|�d� d S d S )NT�+)r7 r� F)r r� r, ru r� r� )r �old_zone�new_zonerr r� r r r! �change_default_zone� s �z FirewallZone.change_default_zonec C s� | j �� | �|�}|d u rttjd| ��|dkr |n| j �|�}||kr1ttjd|||f ��|d u r:| �� }n|}| j | }| � |�}|� | j ||� | � d|||� |d u r_|�d� |S )N�'%s' is not in any zoner� z"remove_interface(%s, %s): zoi='%s'FT)r r� r@ r r �UNKNOWN_INTERFACErG r� r, r r< �add_postr� r� r� ) r r9 r> rr r� r� r� r� r? r r r! r� � s. ��� z FirewallZone.remove_interfacec C sR ||j v r |j �|� || jjv r| jj�|� || jjv r'| jj�|� d S d S r )r= �remover r� r� )r r� r? r r r! �__unregister_interface s �z#FirewallZone.__unregister_interfacec C s | � |�| �|�jv S r )r< rI r= )r r9 r> r r r! �query_interface r� z FirewallZone.query_interfacec C � | � |�jS r )rI r= �r r9 r r r! r5 � z FirewallZone.list_interfacesFc C st t |�rdS t|�r dS t|�rdS |�d�r4| �|dd � � |r+| �|dd � � | �|dd � �S ttj |��)Nr� r� r� zipset:� ) r r r � startswith� _check_ipset_type_for_source�_check_ipset_applied� _ipset_familyr r � INVALID_ADDR�r rD rn r r r! r� s zFirewallZone.check_sourcec C s | j ||d� |S )N�rn )r� r r r r! � __source_id( s zFirewallZone.__source_idc C s | j �� | j �|�}| j| }t|�r|�� }| j||d�}| j||d�} | |jv r5t t j d||f ��| � |�d urDt t j d| ��|d u rM| �� } n|} |jsc|rc| j|| d� | �| j|d� |rn| �d||| | � | �|| ||� | �| j|| � |d u r�| �d� |S )Nr r� z '%s' already bound to a zonerq FT)r r� rG r r �upperr� rB rC r r r� rF r� r, rn ru r� rw r� � _FirewallZone__register_source� _FirewallZone__unregister_sourcer� ) r r9 rD r� rr r� r� r� r� rE r� r r r! r� , s< �� � zFirewallZone.add_sourcec C s |j �|� d S r )rC r7 )r r� rE r9 r� r r r! �__register_sourceT r& z FirewallZone.__register_sourcec C sb | j �� | �|�}| j �|�}||kr|S t|�r |�� }|d ur(| �||� | �|||�}|S r )r r� rF rG r r r� r� )r r9 rD r� r� r� r� r r r! �change_zone_of_sourceW s z"FirewallZone.change_zone_of_sourcec C s� | j �� t|�r |�� }| �|�}|d u r ttjd| ��|dkr$|n| j �|�}||kr9ttj d|||f ��|d u rB| � � }n|}| j | }| � |�}| � |�} |�| j|| � | �d||| |� |d u rm|�d� |S )Nr r� z remove_source(%s, %s): zos='%s'FT)r r� r r rF r r �UNKNOWN_SOURCErG r� r, r r� rB r r r� r� ) r r9 rD rr �zosr� r� r� r� rE r r r! r� i s4 ��� zFirewallZone.remove_sourcec C s ||j v r |j �|� d S d S r )rC r )r r� rE r r r! �__unregister_source� s �z FirewallZone.__unregister_sourcec C s& t |�r|�� }| �|�| �|�jv S r )r r rB rI rC )r r9 rD r r r! � query_source� s zFirewallZone.query_sourcec C r r )rI rC r r r r! r6 � r zFirewallZone.list_sourcesc sh � j �� D ]K}|js q� j| D ] }� j j�|�D ]\}} |�|||||| |�} |�|| � qq� �|d�}� � |�j rP|dvrP|j |||d|d�} |�|| � q� j j� � D ]Z}|� j j� |�vrl|� j j�|�vrlqW|� j j�� v r�� j j�|�jr�|s�t� �|��dkr�� j jj||d� qW� j j�d||� |�� fdd �|� qW|r�|�� fd d �|� qWd S ) NrT )r� �*�filter�r> rz rq Fc � | � j j�� v o� j j�d| �S �NT�r rj �)get_active_policies_not_derived_from_zone�!_ingress_egress_zones_transaction��pr$ r r! �<lambda>� � z)FirewallZone._interface.<locals>.<lambda>c � | � j j�� v o� j j�| �S r �r rj r$ r� r& r$ r r! r( � � )r �enabled_backends�policies_supportedr rj �#_get_table_chains_for_zone_dispatch�!build_zone_source_interface_rules� add_rulesr0 rI r� �build_zone_forward_rules�"get_policies_not_derived_from_zone�list_ingress_zones�list_egress_zonesr$ � get_policyrn rs r5 r� �_ingress_egress_zonesr ) r r� r9 r> r� r7 �backendrj r� r� rb r r$ r! r� � s@ �� � ����zFirewallZone._interfacec C s$ | � |�dkr d S | jjj|dd�S )Nzhash:macFr )� _ipset_typer �ipset� get_family�r rW r r r! r � s zFirewallZone._ipset_familyc C s | j jj|dd�S )NFr )r r: �get_typer< r r r! r9 � s zFirewallZone._ipset_typec C s d� |g| jj�|� �S )N�,)�joinr r: � get_dimension)r rW �flagr r r! �_ipset_match_flags� s z FirewallZone._ipset_match_flagsc C s | j j�|�S r )r r: � check_appliedr< r r r! r � r1 z!FirewallZone._check_ipset_appliedc C s* | � |�}|tvrttjd||f ��d S )Nz.ipset '%s' with type '%s' not usable as source)r9 r r r � INVALID_IPSET)r rW �_typer r r! r � s ���z)FirewallZone._check_ipset_type_for_sourcec sp |r � j �|�gn� j �� D ]F}|jsq� j| D ] }� j j�|�D ]\}} |�|||||| �} |�|| � q"q� � |d�}� � |�j rT|j |||d|d�} |�|| � q� j j� � D ]Z}|� j j�|�vrp|� j j�|�vrpq[|� j j�� v r�� j j�|�jr�|s�t� �|��dkr�� j jj||d� q[� j j�d||� |�� fdd�|� q[|r�|�� fd d�|� q[d S ) NrT r �rD rz rq Fc r! r" r# r& r$ r r! r( � r) z&FirewallZone._source.<locals>.<lambda>c r* r r+ r& r$ r r! r( � r, )r �get_backend_by_ipvr- r. r rj r/ � build_zone_source_address_rulesr1 r0 rI r� r2 r3 r4 r5 r$ r6 rn rs r6 r� r7 r ) r r� r9 r� rD r� r8 rj r� r� rb r r$ r! r� � s@ �� � ����zFirewallZone._sourcec C �0 | j �|�}| �|d�}| j j�||||� |S �NrS )r rG r0 rj r� )r r9 �servicer� r� �p_namer r r! r� � � zFirewallZone.add_servicec C �, | j �|�}| �|d�}| j j�||� |S rJ )r rG r0 rj r� �r r9 rK rL r r r! r� � zFirewallZone.remove_servicec C �( | j �|�}| �|d�}| j j�||�S rJ )r rG r0 rj � query_servicerO r r r! rR � zFirewallZone.query_servicec C �& | j �|�}| �|d�}| j j�|�S rJ )r rG r0 rj r� �r r9 rL r r r! r� � zFirewallZone.list_servicesc C �2 | j �|�}| �|d�}| j j�|||||� |S rJ )r rG r0 rj r� )r r9 �port�protocolr� r� rL r r r! r� � zFirewallZone.add_portc C �. | j �|�}| �|d�}| j j�|||� |S rJ )r rG r0 rj r� �r r9 rX rY rL r r r! r� � zFirewallZone.remove_portc C �* | j �|�}| �|d�}| j j�|||�S rJ )r rG r0 rj � query_portr\ r r r! r_ � zFirewallZone.query_portc C rT rJ )r rG r0 rj r� rU r r r! r� % rV zFirewallZone.list_portsc C rW rJ )r rG r0 rj r� )r r9 � source_portrY r� r� rL r r r! r� * rZ z FirewallZone.add_source_portc C r[ rJ )r rG r0 rj r� �r r9 ra rY rL r r r! r� 0 r] z FirewallZone.remove_source_portc C r^ rJ )r rG r0 rj �query_source_portrb r r r! rc 6 r` z FirewallZone.query_source_portc C rT rJ )r rG r0 rj r� rU r r r! r� ; rV z FirewallZone.list_source_portsc C s� | j �|�}t|j�tkr| �|d�gS t|j�ttt t t t fv r(| �|d�gS t|j�t fv r7| �|d�gS t|j�tfv rF| �d|�gS t|j�tfv rU| �|d�gS |jd u ra| �|d�gS tdt|j� ��)NrT rS z Rich rule type (%s) not handled.)r rG �type�actionr r0 �elementr r r r r r r r r r )r r9 rh r r r! rc @ s � z#FirewallZone._rich_rule_to_policiesc C s* | � ||�D ] }| jj�||||� q|S r )rc r rj r� )r r9 rh r� r� rL r r r! r� R s zFirewallZone.add_rulec C s& | � ||�D ] }| jj�||� q|S r )rc r rj r� )r r9 rh rL r r r! r� W s zFirewallZone.remove_rulec C s. d}| � ||�D ] }|o| jj�||�}q|S r" )rc r rj � query_rule)r r9 rh �retrL r r r! rg \ s zFirewallZone.query_rulec C sZ | j �|�}t� }| �|d�| �|d�| �d|�fD ]}|�t| j j�|��� qt|�S )NrT rS )r rG �setr0 �updaterj r� r� )r r9 rh rL r r r! r� b s �zFirewallZone.list_rulesc C rI rJ )r rG r0 rj r� )r r9 rY r� r� rL r r r! r� k rM zFirewallZone.add_protocolc C rN rJ )r rG r0 rj r� �r r9 rY rL r r r! r� q rP z FirewallZone.remove_protocolc C rQ rJ )r rG r0 rj �query_protocolrk r r r! rl w rS zFirewallZone.query_protocolc C rT rJ )r rG r0 rj r� rU r r r! r� | rV zFirewallZone.list_protocolsc C s. | j �|�}| �d|�}| j j�|||� |S �NrT )r rG r0 rj r� )r r9 r� r� rL r r r! r� � r] zFirewallZone.add_masqueradec C s* | j �|�}| �d|�}| j j�|� |S rm )r rG r0 rj r� rU r r r! r� � s z FirewallZone.remove_masqueradec C s& | j �|�}| �d|�}| j j�|�S rm )r rG r0 rj r� rU r r r! r� � rV z FirewallZone.query_masqueradec C s6 | j �|�}| �|d�}| j j�|||||||� |S rm )r rG r0 rj r� ) r r9 rX rY �toport�toaddrr� r� rL r r r! r� � s �z FirewallZone.add_forward_portc C rW rm )r rG r0 rj r� �r r9 rX rY rn ro rL r r r! r� � s z FirewallZone.remove_forward_portc C s. | j �|�}| �|d�}| j j�|||||�S rm )r rG r0 rj �query_forward_portrp r r r! rq � s �z FirewallZone.query_forward_portc C rT rm )r rG r0 rj r� rU r r r! r� � rV z FirewallZone.list_forward_portsc C rI rJ )r rG r0 rj r� )r r9 �icmpr� r� rL r r r! r� � s zFirewallZone.add_icmp_blockc C rN rJ )r rG r0 rj r� )r r9 rr rL r r r! r� � � z FirewallZone.remove_icmp_blockc C rQ rJ )r rG r0 rj �query_icmp_block)r r9 rr � p_name_hostr r r! rt � rS z FirewallZone.query_icmp_blockc C s. | j �|�}| �|d�}tt| j j�|���S rJ )r rG r0 r2 ri rj r� �r r9 ru r r r! r� � � z FirewallZone.list_icmp_blocksc C rN rJ )r rG r0 rj r� )r r9 r� rL r r r! r� � rs z%FirewallZone.add_icmp_block_inversionc C s. | j �|�}| �|d�}| j j�|||� d S rJ )r rG r0 rj r� )r r� r9 r� rL r r r! r� � rw z"FirewallZone._icmp_block_inversionc C s* | j �|�}| �|d�}| j j�|� |S rJ )r rG r0 rj r� rU r r r! r� � s z(FirewallZone.remove_icmp_block_inversionc C rT rJ )r rG r0 rj r� rv r r r! r� � rV z'FirewallZone.query_icmp_block_inversionc C s� | � |d�}| j| jD ] }| j�� D ]}|jsq|j|||d|d�}|�||� qq | j| jD ],}| � |�} | rA| j� | �gn| j�� D ]}|jsLqF|j|||d|d�}|�||� qFq1d S )NrT r r rF ) r0 r r= r r- r. r2 r1 rC r� rG ) r r� r9 r� rL r> r8 rb rD r� r r r! �_forward� s" � ��zFirewallZone._forwardc C s� | j �|�}| j �|� | j �� | j| }|jr!ttjd| ��|d u r*| � � }n|}|j r6| � d||� | � |||� |� | j|� |d u rM|�d� |S )Nz forward already enabled in '%s'T)r rG � check_timeoutr� r r� r r �ALREADY_ENABLEDr, rn rx � _FirewallZone__register_forwardr� �!_FirewallZone__unregister_forwardr� )r r9 r� r� rr r� r� r� r r r! r� � s$ � zFirewallZone.add_forwardc C � d|_ d S r" �r� )r r� r� r� r r r! �__register_forward � z FirewallZone.__register_forwardc C s� | j �|�}| j �� | j| }|jsttjd| ��|d u r$| �� }n|}|j r0| � d||� |� | j |� |d u r@|� d� |S )Nzforward not enabled in '%s'FT)r rG r� r r� r r � NOT_ENABLEDr, rn rx r r| r� )r r9 rr r� r� r� r r r! r� s � zFirewallZone.remove_forwardc C r} )NFr~ )r r� r r r! �__unregister_forward% r� z!FirewallZone.__unregister_forwardc C r r )rI r� r r r r! r� ( r zFirewallZone.query_forwardr )NNT)Fr� )NNr N)NN)r NN)`�__name__� __module__� __qualname__rY r" r% r( r, r0 r4 r: r@ rF rI ri rm rp rv rw r� r� r� r� ru ro r� r� r� r� r< r� r� r� r r� r� r r5 r� rB r� r r r� r r r6 r� r r9 rB r r r� r� r� rR r� r� r� r_ r� r� r� rc r� rc r� r� rg r� r� r� rl r� r� r� r� r� r� rq r� r� r� rt r� r� r� r� r� rx r� r{ r� r| r� r r r r! r - s� * � > �+ � �( � , ( � � � � r )#r_ �firewall.core.baser r r � firewall.core.fw_transactionr �firewall.core.io.policyr �firewall.core.loggerr �firewall.core.richr r r r r r r r r r r �firewall.core.fw_nmr �firewall.functionsr r r �firewallr �firewall.errorsr �objectr r r r r! �<module> s 4 PK ���Z�g�d ) core/__pycache__/fw_ipset.cpython-310.pycnu �[��� o bhAb�% � @ sf d Z dgZddlmZ ddlmZmZmZm Z ddl m Z ddl m Z ddlmZ G dd� de�Zd S ) z ipset backend� FirewallIPSet� )�log)� remove_default_create_options�normalize_ipset_entry� check_entry_overlaps_existing� check_for_overlapping_entries)�IPSet)�errors)� FirewallErrorc @ s� e Zd Zdd� Zdd� Zdd� Zdd� Zd d � Zd d � Zd d� Z d4dd�Z dd� Z dd� Z d4dd�Z dd� Zdd� Zd d � Zd5d d �Zd!d"� Zd#d$� Zd%d&� Zd5d'd(�Zd)d*� Zd+d,� Zd-d.� Zd/d0� Zd1d2� Zd3S )6r c C s || _ i | _d S �N)�_fw�_ipsets)�self�fw� r �8/usr/lib/python3/dist-packages/firewall/core/fw_ipset.py�__init__# s zFirewallIPSet.__init__c C s d| j | jf S )Nz%s(%r))� __class__r �r r r r �__repr__' � zFirewallIPSet.__repr__c C s | j �� d S r )r �clearr r r r �cleanup, � zFirewallIPSet.cleanupc C s || � � vr ttj|��d S r )� get_ipsetsr r � INVALID_IPSET�r �namer r r � check_ipset/ s �zFirewallIPSet.check_ipsetc C s || � � v S r )r r r r r � query_ipset3 s zFirewallIPSet.query_ipsetc C s t | j�� �S r )�sortedr �keysr r r r r 6 r zFirewallIPSet.get_ipsetsc C s t | j�dkS )Nr )�lenr r r r r � has_ipsets9 r zFirewallIPSet.has_ipsetsFc C s& | � |� | j| }|r| �|� |S r )r r �check_applied_obj�r r �applied�objr r r � get_ipset< s zFirewallIPSet.get_ipsetc C s4 g }| j jr |�| j j� | j jr|�| j j� |S r )r �nftables_enabled�append�nftables_backend� ipset_enabled� ipset_backend)r �backendsr r r r. C s zFirewallIPSet.backendsc C s0 |j | jjvrttjd|j ��|| j|j< d S )Nz '%s' is not supported by ipset.)�typer �ipset_supported_typesr r � INVALID_TYPEr r �r r' r r r � add_ipsetK s �zFirewallIPSet.add_ipsetc C sn | j | }|jr+|s+z| �� D ]}|�|� qW n ty* } zttj|��d }~ww t� d|� | j |= d S )Nz,Keeping ipset '%s' because of timeout option) r r& r. � set_destroy� Exceptionr r �COMMAND_FAILEDr �debug1)r r �keepr' �backend�msgr r r � remove_ipsetQ s � �� zFirewallIPSet.remove_ipsetc C s� | j | }| �� D ]�}|jdkrR|�� }||v rRd|jvs8|jd dks8|j|| d ks8t|j�|| d krRz|�|� W n tyQ } zt t j |��d }~ww | j j r�z |�|j|j|j� W n tyt } zt t j |��d }~ww d|_d|jv r�|jd dkr�q z|�|j� W n ty� } zt t j |��d }~ww |jD ] }z |�|j|� W q� ty� } zt t j |��d }~ww q z|�|j|j|j|jd � W n ty� } zt t j |��d }~ww d|_q d S )N�ipset�timeout�0r � T)r r. r �set_get_active_terse�optionsr/ �rm_def_cr_optsr4 r5 r r r6 r �_individual_calls� set_creater& � set_flush�entries�set_add� set_restore)r r r' r9 �activer: �entryr r r � apply_ipset] sh � �� �� �� ��� � ���zFirewallIPSet.apply_ipsetc C s: | � � D ]}| j| }d|_t�d| � | �|� qd S )NFzApplying ipset '%s')r r r& r r7 rK �r r r' r r r � apply_ipsets� s �zFirewallIPSet.apply_ipsetsc C sx | � � D ]5}|jdkr q| �� D ](}z | �|� |�|� W q ty8 } z|jtjkr.|�W Y d }~qd }~ww qd S )N�nftables) r. r r � check_appliedr4 r �coder � NOT_APPLIED)r r9 r< r: r r r �flush� s �����zFirewallIPSet.flushTc C s | j ||d�jS )N�r& )r( r/ )r r r& r r r �get_type� r zFirewallIPSet.get_typec C s t | j|dd�j�d��S )NTrS �,)r" r( r/ �splitr r r r � get_dimension� s zFirewallIPSet.get_dimensionc C s | � |�}| �|� d S r )r( r$ rL r r r rO � s zFirewallIPSet.check_appliedc C s |j s ttj|j��d S r )r& r r rQ r r2 r r r r$ � s ��z FirewallIPSet.check_applied_objc C s. | j ||d�}d|jv r|jd dkrdS dS )NrS �family�inet6�ipv6�ipv4)r( rA r% r r r � get_family� s zFirewallIPSet.get_familyc C s� | j |dd�}t|�}t�||j|j� ||jv r#ttj d||f ��t ||j� z| � � D ] }|� |j |� q.W n tyK } zttj|��d }~ww d|jvsX|jd dkr`|j�|� d S d S )NTrS z'%s' already is in '%s'r= r> )r( r r � check_entryrA r/ rF r r �ALREADY_ENABLEDr r. rG r r5 r6 r* �r r rJ r' r9 r: r r r � add_entry� s& � � ���zFirewallIPSet.add_entryc C s� | j |dd�}t|�}||jvrttjd||f ��z| �� D ] }|�|j|� q W n t y< } zttj |��d }~ww d|j vsI|j d dkrQ|j� |� d S d S )NTrS z'%s' not in '%s'r= r> ) r( r rF r r � NOT_ENABLEDr. � set_deleter r5 r6 rA �remover_ r r r � remove_entry� s" � � ���zFirewallIPSet.remove_entryc C sD | j |dd�}t|�}d|jv r |jd dkr ttj|��||jv S �NTrS r= r> )r( r rA r r �IPSET_WITH_TIMEOUTrF )r r rJ r' r r r � query_entry� s zFirewallIPSet.query_entryc C s | j |dd�}|jS )NTrS )r( rF rL r r r � get_entries� s zFirewallIPSet.get_entriesc C s | j |dd�}t|� |D ] }t�||j|j� q d|jvs%|jd dkr(||_z| �� D ]}|�|j � q-W n t yI } zt t j |��d }~ww d|_z(| �� D ]!}| jjrf|jD ] }|�|j |� q[qR|�|j |j|j|jd � qRW n t y� } zt t j |��d }~ww d|_d S re )r( r r r] rA r/ rF r. rE r r5 r r r6 r& r rC rG rH )r r rF r' rJ r9 r: r r r � set_entries� s> � �� ��� ��zFirewallIPSet.set_entriesN)F)T)�__name__� __module__� __qualname__r r r r r r r# r( r. r3 r; rK rM rR rT rW rO r$ r\ r` rd rg rh ri r r r r r " s2 1 N)�__doc__�__all__�firewall.core.loggerr �firewall.core.ipsetr rB r r r �firewall.core.io.ipsetr �firewallr �firewall.errorsr �objectr r r r r �<module> s PK ���Z���Q Q % core/__pycache__/rich.cpython-310.pycnu �[��� o bhAb,� � @ s� g d �Z ddlmZ ddlmZ ddlmZ ddlmZ ddlm Z G dd� de �Z G d d � d e �Z G d d � d e �Z G d d� de �ZG dd� de�ZG dd� de �ZG dd� de �ZG dd� de �ZG dd� de �ZG dd� de �ZG dd � d e �ZG d d � d e �ZG d d � d e �ZG d!d"� d"e �ZG d#d$� d$e �ZG d%d&� d&e �ZG d'd(� d(e�ZG d)d*� d*e �Z G d+d,� d,e �Z G d-d.� d.e �Z d/S )0)� Rich_Source�Rich_Destination� Rich_Service� Rich_Port� Rich_Protocol�Rich_Masquerade�Rich_IcmpBlock� Rich_IcmpType�Rich_SourcePort�Rich_ForwardPort�Rich_Log� Rich_NFLog� Rich_Accept� Rich_Reject� Rich_Drop� Rich_Mark� Rich_Audit� Rich_Limit� Rich_Rule�Rich_Tcp_Mss_Clamp� )� functions)�check_ipset_name)� REJECT_TYPES)�errors)� FirewallErrorc @ � e Zd Zddd�Zdd� ZdS )r Fc C s� || _ | j dkr d | _ || _| jdks| jd u r d | _n | jd ur'| j�� | _|| _| jdkr2d | _|| _| j d u rJ| jd u rL| jd u rNttjd��d S d S d S )N� �no address, mac and ipset)�addr�mac�upper�ipset�invertr r � INVALID_RULE)�selfr r r! r" � r% �4/usr/lib/python3/dist-packages/firewall/core/rich.py�__init__$ s" � �zRich_Source.__init__c C sf d| j rdnd }| jd ur|d| j S | jd ur!|d| j S | jd ur-|d| j S ttjd��)Nz source%s � NOTr � address="%s"zmac="%s"� ipset="%s"r )r" r r r! r r r# �r$ �retr% r% r& �__str__5 s �zRich_Source.__str__N�F��__name__� __module__� __qualname__r' r- r% r% r% r& r # s r c @ r )r Fc C sZ || _ | j dkr d | _ || _| jdkrd | _|| _| j d u r)| jd u r+ttjd��d S d S )Nr �no address and ipset)r r! r" r r r# )r$ r r! r" r% r% r& r' B s ��zRich_Destination.__init__c C sN d| j rdnd }| jd ur|d| j S | jd ur!|d| j S ttjd��)Nzdestination%s r( r r) r* r3 )r" r r! r r r# r+ r% r% r& r- N s �zRich_Destination.__str__Nr. r/ r% r% r% r& r A s r c @ � e Zd Zdd� Zdd� ZdS )r c C � || _ d S �N��name�r$ r8 r% r% r& r' Y � zRich_Service.__init__c C � d| j S )Nzservice name="%s"r7 �r$ r% r% r& r- \ r: zRich_Service.__str__Nr/ r% r% r% r& r X � r c @ r4 )r c C � || _ || _d S r6 ��port�protocol)r$ r@ rA r% r% r& r' ` � zRich_Port.__init__c C � d| j | jf S )Nz port port="%s" protocol="%s"r? r< r% r% r& r- d s zRich_Port.__str__Nr/ r% r% r% r& r _ s r c @ � e Zd Zdd� ZdS )r c C rC )Nz#source-port port="%s" protocol="%s"r? r< r% r% r& r- h s �zRich_SourcePort.__str__N�r0 r1 r2 r- r% r% r% r& r g � r c @ r4 )r c C r5 r6 ��value�r$ rH r% r% r& r' m r: zRich_Protocol.__init__c C r; )Nzprotocol value="%s"rG r< r% r% r& r- p r: zRich_Protocol.__str__Nr/ r% r% r% r& r l r= r c @ r4 )r c C s d S r6 r% r< r% r% r& r' t � zRich_Masquerade.__init__c C � dS )N� masquerader% r< r% r% r& r- w rJ zRich_Masquerade.__str__Nr/ r% r% r% r& r s r= r c @ r4 )r c C r5 r6 r7 r9 r% r% r& r' { r: zRich_IcmpBlock.__init__c C r; )Nzicmp-block name="%s"r7 r< r% r% r& r- ~ r: zRich_IcmpBlock.__str__Nr/ r% r% r% r& r z r= r c @ r4 )r c C r5 r6 r7 r9 r% r% r& r' � r: zRich_IcmpType.__init__c C r; )Nzicmp-type name="%s"r7 r< r% r% r& r- � r: zRich_IcmpType.__str__Nr/ r% r% r% r& r � r= r c @ r4 )r c C r5 r6 rG rI r% r% r& r' � r: zRich_Tcp_Mss_Clamp.__init__c C r; )Nztcp-mss-clamp value="%s"rG r< r% r% r& r- � r: zRich_Tcp_Mss_Clamp.__str__Nr/ r% r% r% r& r � r= r c @ r4 )r c C s@ || _ || _|| _|| _| jd u rd| _| jd u r d| _d S d S �Nr �r@ rA �to_port� to_address)r$ r@ rA rO rP r% r% r& r' � s �zRich_ForwardPort.__init__c C s@ d| j | j| jdkrd| j nd| jdkr d| j f S df S )Nz(forward-port port="%s" protocol="%s"%s%sr z to-port="%s"z to-addr="%s"rN r< r% r% r& r- � s ����zRich_ForwardPort.__str__Nr/ r% r% r% r& r � s r c @ �& e Zd Zddd�Zdd� Zdd� ZdS ) r Nc C s || _ || _|| _d S r6 ��prefix�level�limit)r$ rS rT rU r% r% r& r' � s zRich_Log.__init__c C sB d| j r d| j nd| jrd| j nd| jr d| j f S df S )Nz log%s%s%s� prefix="%s"r z level="%s"� %srR r< r% r% r& r- � s ����zRich_Log.__str__c C sZ | j rt| j �dkrttjd��| jr | jdvr ttj| j��| jd ur+| j�� d S d S )N� �+maximum accepted length of 'prefix' is 127.)�emerg�alert�crit�error�warning�notice�info�debug) rS �lenr r �INVALID_LOG_PREFIXrT �INVALID_LOG_LEVELrU �checkr< r% r% r& re � s �zRich_Log.check)NNN�r0 r1 r2 r' r- re r% r% r% r& r � s r c @ rQ ) r Nc C s || _ || _|| _|| _d S r6 ��grouprS � thresholdrU )r$ rh rS � queue_sizerU r% r% r& r' � s zRich_NFLog.__init__c C sT d| j r d| j nd| jrd| j nd| jrd| j nd| jr&d| j f S df S )Nz nflog%s%s%s%sz group="%s"r rV z queue-size="%s"rW rg r< r% r% r& r- � s ����zRich_NFLog.__str__c C sx | j rt�| j �sttjd��| jr t| j�dkr ttjd��| j r.t�| j �s.ttj d��| j d ur:| j � � d S d S )Nz5nflog 'group' must be an integer between 0 and 65535.rX rY z:nflog 'queue-size' must be an integer between 0 and 65535.) rh r � checkUINT16r r �INVALID_NFLOG_GROUPrS rb rc ri �INVALID_NFLOG_QUEUErU re r< r% r% r& re � s �zRich_NFLog.check)NNNNrf r% r% r% r& r � s r c @ � e Zd Zddd�Zdd� ZdS )r Nc C r5 r6 �rU �r$ rU r% r% r& r' � s zRich_Audit.__init__c C � d| j r d| j S d S )Nzaudit%srW r ro r< r% r% r& r- � � zRich_Audit.__str__r6 r/ r% r% r% r& r � s r c @ rn )r Nc C r5 r6 ro rp r% r% r& r' � r: zRich_Accept.__init__c C rq )Nzaccept%srW r ro r< r% r% r& r- � rr zRich_Accept.__str__r6 r/ r% r% r% r& r � s r c @ rQ ) r Nc C r> r6 ��typerU )r$ �_typerU r% r% r& r' � rB zRich_Reject.__init__c C s0 d| j r d| j nd| jrd| j f S df S )Nz reject%s%sz type="%s"r rW rs r< r% r% r& r- � s ��zRich_Reject.__str__c C s\ | j r(|s ttjd��|dv r*| j t| vr,d�t| �}ttjd| j |f ��d S d S d S )Nz9When using reject type you must specify also rule family.��ipv4�ipv6z, z%Wrong reject type %s. Use one of: %s.)rt r r r# r �join)r$ �family� valid_typesr% r% r& re � s �zRich_Reject.check)NNrf r% r% r% r& r � � r c @ rD )r c C rq )Nzdrop%srW r ro r< r% r% r& r- � rr zRich_Drop.__str__NrE r% r% r% r& r � rF r c @ rQ ) r Nc C r> r6 ��setrU )r$ �_setrU r% r% r& r' � rB zRich_Mark.__init__c C s" d| j | jr d| j f S df S )Nz mark set=%s%srW r r} r< r% r% r& r- s ��zRich_Mark.__str__c C s� | j d ur | j }nttjd��d|v r:|�d�}t|�dkr$ttj|��t�|d �r2t�|d �s8ttj|��d S t�|�sEttj|��d S )Nz no value set�/� r � )r~ r r � INVALID_MARK�splitrb r � checkUINT32)r$ �x�splitsr% r% r& re s � � �zRich_Mark.checkr6 rf r% r% r% r& r � r| r c @ s, e Zd Zdd� Zdd� Zdd� Zdd� Zd S ) r c C sb || _ d| j v r+| j �d�}t|�dkr-|d dv r/d|d |d d d� f | _ d S d S d S d S )Nr� r� r� )�second�minute�hour�dayz%s/%sr )rH r� rb )r$ rH r� r% r% r& r' s "�zRich_Limit.__init__c C s d }d| j v r | j �d�}|rt|�dkr ttj| j ��|\}}zt|�}W n ttj| j ��|dk s9|dvr@ttj| j ��d}|dkrId}n|dkrPd}n |dkrWd }n|d kr]d }d | | d krnttjd| j ��|dkr|d kr�ttjd| j ��d S d S )Nr� r� r� )�s�m�h�dr� r� �< r� i r� i�Q i' r z %s too fastz %s too slow)rH r� rb r r � INVALID_LIMIT�int)r$ r� �rate�duration�multr% r% r& re s< ���zRich_Limit.checkc C r; )Nzlimit value="%s"rG r< r% r% r& r- B r: zRich_Limit.__str__c C rK rM r% r< r% r% r& �commandE rJ zRich_Limit.commandN)r0 r1 r2 r' re r- r� r% r% r% r& r s " r c @ s> e Zd ZdZdZddd�Zdd� Zd d � Zd d � Zd d� Z dS )r i ���i� Nr c C sZ |d ur t |�| _nd | _|| _d | _d | _d | _d | _d | _d | _|r+| � |� d S d S r6 ) �strrz �priority�source� destination�element�log�audit�action�_import_from_string)r$ rz �rule_strr� r% r% r& r' L s �zRich_Rule.__init__c C s� g }t �|�D ]5}d|v r5|�d�}t|�dks |d r |d s(ttjd| ��|�|d |d d�� q|�d|i� q|�ddi� |S ) z Lexical analysis �=r� r r� z internal error in _lexer(): %s)� attr_name� attr_valuer� �EOL)r � splitArgsr� rb r r r# �append)r$ r� �tokens�r�attrr% r% r& �_lexer] s �zRich_Rule._lexerc C sN |st tjd��t�|�}d| _d | _d | _d | _d | _ d | _ d | _ d | _ | � |�}|r;|d �d�dkr;t tjd��i }g }d}|| �d�dkrP|dgk�s�|| �d�}|| �d�}|| �d�}|rt|dvrst tjd | ��ne|d v r�|d kr�| jr�t tjd ��|d kr�| jr�t tjd��|dv r�| j r�t tjd|| j f ��|dv r�| j r�t tjd��|dkr�| j r�t tjd��|dv r�| j r�t tjd|| j f ��nt tjd| ��t|�dkr�|t|�d nd} | dk�r)|�s|�r|dkr�t tjd��|d k�r t tjd ��t tjd ||f ��d|v�r"t tjd ||f ��|�d� �nf| dk�r�|dk�rE|d v�r@t tjd!| ��|| _�nJ|d k�rczt|�| _W �n< t�yb t tjd"| ��w |�rz|d#k�rnd$} nd%||f } t tj| ��|�|� �n| d k�r�|d&v �r�|||< �n�|d'v �r�d(|d)< �n�t|�d*�|�d+�|�d,�|�d)d-��| _|�� |�� |d }�n�| d k�r�|d.v �r�|||< �n�|d'v �r�d(|d)< �n�t|�d*�|�d,�|�d)d-��| _|�� |�� |d }�n�| d#k�r|d/k�rt|�| _ |�� �n�t tjd0��| d1k�r:|d/k�r$|||< �nkt|�d/��| _ |�� |�� |d }�nU| d2k�rU|d3k�rOt|�| _ |�� �n@t tjd4��| d5k�r|d6v �re|||< �n*t|�d5�|�d#��| _ |�� |�� |d }�n| d7k�r�|d3k�r�t |�| _ |�� �n�t tjd8��| d9k�r�|d3k�r�t |�| _ |�� �n�t tjd:��| d;k�r�t � | _ |�� |�� |d }�n�| d<k�r�|d=v �r�|||< �n�t |�d5�|�d#�|�d>�|�d?��| _ |�� |�� |d }�n�| d@k�r(|d6v �r|||< �n�t |�d5�|�d#��| _ |�� |�� |d }�ng| dAk�rb|dBv �r8|||< �nW|dCk�rD|�dC� �nKt!|�dD�|�dE�|�dC��| _ |�� |�� |d }�n-| dFk�r�|dGv �rr|||< �n |dCk�r~|�dC� �nt"|�dH�|�dD�|�dI�|�dC��| _ |�� |�� |d }n�| dk�r�|dCk�r�|�dC� n�t#|�dC��| _ |�� |�� |d }n�| dJk�r�|dCk�r�|�dC� n�t$|�dC��| _ |�� |�� |d }n�| dKk�r|dCk�r�|�dC� n�t%|�dC��| _ |�� |�� |d }n�| dLk�rA|dMk�r |||< nr|dCk�r(|�dC� ngt&|�dM�|�dC��| _ |�� |�� |d }nN| dNk�rt|dOk�rP|||< n?|dCk�r[|�dC� n4t'|�dO�|�dC��| _ |�� |�� |d }n| dCk�r�|d/k�r�t(|�|dC< |�� nt tjdP��|d }|| �d�dkrP|dgkrP| �)� d S )QNz empty ruler r� r� �ruler� r� )r� rz �addressr r! r" rH r@ rA �to-port�to-addrr8 rh rS rT � queue-sizert r~ zbad attribute '%s')r� r� r� rA �servicer@ � icmp-block� icmp-typerL � forward-port� source-portr� �nflogr� �accept�drop�reject�markrU �not�NOTr� � tcp-mss-clampr� z more than one 'source' elementr� z#more than one 'destination' element)rA r� r@ r� r� rL r� r� zFmore than one element. There cannot be both '%s' and '%s' in one rule.)r� r� z more than one logging elementr� z more than one 'audit' element)r� r� r� r� zOmore than one 'action' element. There cannot be both '%s' and '%s' in one rule.zunknown element %sr� r rz z0'family' outside of rule. Use 'rule family=...'.r� z4'priority' outside of rule. Use 'rule priority=...'.z:'%s' outside of any element. Use 'rule <element> %s= ...'.z,'%s' outside of rule. Use 'rule ... %s ...'.rv zH'family' attribute cannot have '%s' value. Use 'ipv4' or 'ipv6' instead.z(invalid 'priority' attribute value '%s'.rA zdwrong 'protocol' usage. Use either 'rule protocol value=...' or 'rule [forward-]port protocol=...'.zDattribute '%s' outside of any element. Use 'rule <element> %s= ...'.)r� r r! r" )r� r� Tr" r� r r! F)r� r! r" rH zinvalid 'protocol' elementr� r� r8 zinvalid 'service' elementr@ r? r� z invalid 'icmp-block' elementr� zinvalid 'icmp-type' elementrL r� )r@ rA r� r� r� r� r� r� )rS rT rU rS rT r� )rh rS r� rh r� r� r� r� rt r� r~ zinvalid 'limit' element)*r r r# r �stripNonPrintableCharactersr� rz r� r� r� r� r� r� r� �getrb r� r� � ValueError�INVALID_PRIORITYr �pop�clearr r r r r r r r r r r r r r r r r r re ) r$ r� r� �attrs� in_elements�indexr� r� r� � in_element�err_msgr% r% r& r� n s� � � � � * " ( ( � � � `z Rich_Rule._import_from_stringc C sn | j d ur| j dvrttj| j ��| j d u r7| jd ur!| jjd us&| jd ur+ttj��t| j �t kr7ttj��| j | j k sC| j | j krOttjd| j | j f ��| j d u r�| jd u sc| jd ur�| j dkr�| jd u rnttjd��| jd u r�| jd u r�| j dkr�ttjd��t| j �tt ttfvr�| jd u r�| jd u r�| jd u r�ttjd��| jd u�r*| jjd ur�| j d u r�ttj��| jjd ur�ttjd��| jjd ur�ttjd��t�| j | jj�s�ttjt| jj���nE| jjd u�r | jjd ur�ttjd ��t� | jj��s ttj t| jj���n | jjd u�r$t | jj��s#ttj t| jj���nttjd ��| jd u�r�| jjd u�rd| j d u �rBttj��| jjd u�rOttj d��t�| j | jj��scttjt| jj���n | jjd u�r}t | jj��s|ttj t| jj���nttjd ��t| j �t!k�r�| j j"d u �s�t#| j j"�d k �r�ttj$t| j j"����n�t| j �t%k�r�t�&| j j'��s�ttj(| j j'��| j j)d v�r�ttj*| j j)���nt| j �t+k�r�t�,| j j-��s�ttj*| j j-���net| j �tk�r| jd u�r�ttjd��| jd u�r| jjd u�rttjd���n<t| j �tk�rA| j j"d u �s+t#| j j"�d k �r5ttj.t| j j"���| j�r?ttjd���nt| j �t/k�rd| j j"d u �sYt#| j j"�d k �rcttj.t| j j"���n�t| j �t k�r�t�&| j j'��s|ttj(| j j'��| j j)d v�r�ttj*| j j)��| j j0dk�r�| j j1dk�r�ttj(| j j0��| j j0dk�r�t�&| j j0��s�ttj(| j j0��| j j1dk�r�t�2| j | j j1��s�ttj| j j1��| j d u �r�ttj��| jd u�r�ttjd��nft| j �t3k�rt�&| j j'��sttj(| j j'��| j j)d v�rttj*| j j)��n>t| j �tk�r>| jd u�r(ttjd| j ��| j j-�r=t�4| j j-��s=ttj| j j-��n| j d u�rOttjdt| j � ��| jd u�rZ| j�5� | jd u�r�t| j�t6t7t8fv�rtttj9t| j���| jj:d u�r�| jj:�5� | jd u�r�t| j�t7k�r�| j�5| j � n t| j�t;k�r�| j�5� | jj:d u�r�| jj:�5� d S d S d S )Nrv z/'priority' attribute must be between %d and %d.r zno element, no actionz%no element, no source, no destinationzno action, no log, no auditzaddress and maczaddress and ipsetz mac and ipsetzinvalid sourcezinvalid destinationr� )�tcp�udp�sctp�dccpzmasquerade and actionzmasquerade and mac sourcezicmp-block and actionr zforward-port and actionz+tcp-mss-clamp and %s are mutually exclusivezUnknown element %s)<rz r r �INVALID_FAMILYr� r r� �MISSING_FAMILYrt r� r r� � priority_min� priority_maxr� r� r� r# r r r r� r r! r � check_address� INVALID_ADDRr� � check_mac� INVALID_MACr � INVALID_IPSET�INVALID_DESTINATIONr r8 rb �INVALID_SERVICEr � check_portr@ � INVALID_PORTrA �INVALID_PROTOCOLr � checkProtocolrH �INVALID_ICMPTYPEr rO rP �check_single_addressr �checkTcpMssClampre r r r �INVALID_AUDIT_TYPErU r r< r% r% r& re e s& � � � �� �� ��� � � � ��� �� � � �zRich_Rule.checkc C s� d}| j r |d| j 7 }| jr|d| j 7 }| jr |d| j 7 }| jr*|d| j 7 }| jr4|d| j 7 }| jr>|d| j 7 }| jrH|d| j 7 }| jrR|d| j 7 }|S )Nr� z priority="%d"z family="%s"rW )r� rz r� r� r� r� r� r� r+ r% r% r& r- s$ zRich_Rule.__str__)NNr ) r0 r1 r2 r� r� r' r� r� re r- r% r% r% r& r H s x 0r N) �__all__�firewallr �firewall.core.ipsetr �firewall.core.baser r �firewall.errorsr �objectr r r r r r r r r r r r r r r r r r r r r% r% r% r& �<module> s4 1PK ���Z�En� * core/__pycache__/fw_helper.cpython-310.pycnu �[��� o bhAb) � @ s6 d Z dgZddlmZ ddlmZ G dd� de�ZdS )zhelper backend�FirewallHelper� )�errors)� FirewallErrorc @ s\ e Zd Zdd� Zdd� Zdd� Zdd� Zd d � Zd d � Zd d� Z dd� Z dd� Z dd� Z dS )r c C s || _ i | _d S �N)�_fw�_helpers)�self�fw� r �9/usr/lib/python3/dist-packages/firewall/core/fw_helper.py�__init__ s zFirewallHelper.__init__c C s d| j | jf S )Nz%s(%r))� __class__r �r r r r �__repr__" � zFirewallHelper.__repr__c C s | j �� d S r )r �clearr r r r �cleanup' � zFirewallHelper.cleanupc C s || � � vr ttj|��d S r )� get_helpersr r �INVALID_HELPER�r �namer r r � check_helper* s �zFirewallHelper.check_helperc C s || � � v S r )r r r r r � query_helper. s zFirewallHelper.query_helperc C s t | j�� �S r )�sortedr �keysr r r r r 1 r zFirewallHelper.get_helpersc C s t | j�dkS )Nr )�lenr r r r r � has_helpers4 r zFirewallHelper.has_helpersc C s | � |� | j| S r )r r r r r r � get_helper7 s zFirewallHelper.get_helperc C s || j |j< d S r )r r )r �objr r r � add_helper; r zFirewallHelper.add_helperc C s" || j vr ttj|��| j |= d S r )r r r r r r r r � remove_helper> s z FirewallHelper.remove_helperN) �__name__� __module__� __qualname__r r r r r r r r r r! r r r r r s N)�__doc__�__all__�firewallr �firewall.errorsr �objectr r r r r �<module> s PK ���Zv��cW cW ' core/__pycache__/logger.cpython-310.pycnu �[��� o bhAb>y � @ s� g d �Z ddlZddlZddlZddlZddlZddlZddlZddlZddl Z ddl Z G dd� de �Z G dd� de �Z G dd� de �ZG d d � d e �ZG d d � d e �ZG d d� de �Ze� ZdS ))� LogTarget�FileLog�Logger�log� Nc @ s2 e Zd ZdZdd� Zd dd�Zdd� Zd d � Zd S ) r z% Abstract class for logging targets. c C s d | _ d S �N)�fd��self� r �6/usr/lib/python3/dist-packages/firewall/core/logger.py�__init__( � zLogTarget.__init__r c C � t d��)Nz%LogTarget.write is an abstract method��NotImplementedError�r �data�level�logger�is_debugr r r �write+ � zLogTarget.writec C r )Nz%LogTarget.flush is an abstract methodr r r r r �flush. r zLogTarget.flushc C r )Nz%LogTarget.close is an abstract methodr r r r r �close1 r zLogTarget.closeN�r )�__name__� __module__� __qualname__�__doc__r r r r r r r r r & s r c @ �. e Zd Zdd� Zd dd�Zdd� Zdd � Zd S ) � _StdoutLogc C � t �| � tj| _d S r )r r �sys�stdoutr r r r r r 8 � z_StdoutLog.__init__r c C s | j �|� | �� d S r )r r r r r r r r < s z_StdoutLog.writec C s | � � d S r )r r r r r r A � z_StdoutLog.closec C s | j �� d S r �r r r r r r r D � z_StdoutLog.flushNr �r r r r r r r r r r r r 7 s r c @ s e Zd Zdd� ZdS )� _StderrLogc C r! r )r r r" �stderrr r r r r r K r$ z_StderrLog.__init__N)r r r r r r r r r) J s r) c @ r ) � _SyslogLogc C s. t �| � t�tj�tjd �tj tj � d S )Nr ) r r �syslog�openlog�os�path�basenamer" �argv�LOG_PID� LOG_DAEMONr r r r r S s �z_SyslogLog.__init__r c C s� d }|rt j}n#||jkrt j}n||jkrt j}n||jkr#t j}n||jkr+t j }|� d�r:|d t |�d � }t |�dkrS|d u rKt � |� d S t � ||� d S d S )N� � r ) r, � LOG_DEBUG�INFO1�LOG_INFO�WARNING� LOG_WARNING�ERROR�LOG_ERR�FATAL�LOG_CRIT�endswith�len)r r r r r �priorityr r r r a s$ �z_SyslogLog.writec C s t �� d S r )r, �closelogr r r r r w r% z_SyslogLog.closec C s d S r r r r r r r z s z_SyslogLog.flushNr r( r r r r r+ R s r+ c @ s< e Zd ZdZddd�Zdd� Zddd �Zd d � Zd d � ZdS )r z< FileLog class. File will be opened on the first write. �wc C s t �| � || _|| _d S r )r r �filename�mode)r rD rE r r r r � s zFileLog.__init__c C sv | j rd S tjtjB }| j�d�r|tjO }t�| j|d�| _ t� | j d� t� | j | j�| _ t � | j t j t j � d S )N�ai� )r r. �O_CREAT�O_WRONLYrE � startswith�O_APPEND�openrD �fchmod�fdopen�fcntl�F_SETFD� FD_CLOEXEC)r �flagsr r r rK � s z FileLog.openr c C s( | j s| �� | j �|� | j �� d S r )r rK r r r r r r r � s z FileLog.writec C s | j sd S | j �� d | _ d S r )r r r r r r r � s z FileLog.closec C s | j sd S | j �� d S r r& r r r r r � s z FileLog.flushN)rC r ) r r r r r rK r r r r r r r r s r c @ s� e Zd ZdZdZdZdZdZdZdZ e � Z e � Z e� Zd\d d �Zd d � Zd]dd�Zd]dd�Zd]dd�Zd]dd�Zdd� Zdd� Zdd � Zd d � Zd d � Zd!d"� Zed#fd$d%�Z ed#fd&d'�Z ed#fd(d)�Z ed#fd*d+�Z ed#fd,d-�Z ed#fd.d/�Z!d0d1� Z"d2d3� Z#d4d5� Z$d6d7� Z%d8d9� Z&d:d;� Z'd<d=� Z(d>d?� Z)d@dA� Z*dBdC� Z+dDdE� Z,d^dFdG�Z-dHdI� Z.d^dJdK�Z/ed#dfdLdM�Z0ed#dfdNdO�Z1ed#dfdPdQ�Z2d^dRdS�Z3dTdU� Z4dVdW� Z5dXdY� Z6d^dZd[�Z7d#S )_r aL Format string: %(class)s Calling class the function belongs to, else empty %(date)s Date using Logger.date_format, see time module %(domain)s Full Domain: %(module)s.%(class)s.%(function)s %(file)s Filename of the module %(function)s Function name, empty in __main__ %(label)s Label according to log function call from Logger.label %(level)d Internal logging level %(line)d Line number in module %(module)s Module name %(message)s Log message Standard levels: FATAL Fatal error messages ERROR Error messages WARNING Warning messages INFOx, x in [1..5] Information DEBUGy, y in [1..10] Debug messages NO_INFO No info output NO_DEBUG No debug output INFO_MAX Maximum info level DEBUG_MAX Maximum debug level x and y depend on info_max and debug_max from Logger class initialization. See __init__ function. Default logging targets: stdout Logs to stdout stderr Logs to stderr syslog Logs to syslog Additional arguments for logging functions (fatal, error, warning, info and debug): nl Disable newline at the end with nl=0, default is nl=1. fmt Format string for this logging entry, overloads global format string. Example: fmt="%(file)s:%(line)d %(message)s" nofmt Only output message with nofmt=1. The nofmt argument wins over the fmt argument. Example: from logger import log log.setInfoLogLevel(log.INFO1) log.setDebugLogLevel(log.DEBUG1) for i in range(1, log.INFO_MAX+1): log.setInfoLogLabel(i, "INFO%d: " % i) log.setFormat("%(date)s %(module)s:%(line)d [%(domain)s] %(label)s: " "%(level)d %(message)s") log.setDateFormat("%Y-%m-%d %H:%M:%S") fl = FileLog("/tmp/log", "a") log.addInfoLogging("*", fl) log.addDebugLogging("*", fl) log.addInfoLogging("*", log.syslog, fmt="%(label)s%(message)s") log.debug3("debug3") log.debug2("debug2") log.debug1("debug1") log.info2("info2") log.info1("info1") log.warning("warning\n", nl=0) log.error("error\n", nl=0) log.fatal("fatal") log.info(log.INFO1, "nofmt info", nofmt=1) ���������������r � � c C s� i | _ i | _d| _d| _i | _i | _i | _i | _i | _i | _ |dk r(t d| ��|dk r2t d| ��| j | _ || _ d| _|| _| �| jd� | �| jd� | �| jd� | �| j d� td| j d �D ] }t| d | |� | �|d� t| d | d d � | |�� qctd| jd �D ] }t| d | |� | �|d| � t| d| dd � | |�� q�| �| j� | �| j� | �d� | �d� | � d| j | j| j| j g� | � d| j dd� t| j| j d �D �� | � d| j dd� td| jd �D �� dS )z Logger class initialization � r5 z Logger: info_max %d is too lowr z Logger: debug_max %d is too lowz FATAL ERROR: zERROR: z WARNING: zINFO%dzinfo%dc � � �fdd�S )Nc � � j �| g|�R i |��S r )�info��message�args�kwargs�r �xr r �<lambda> � �3Logger.__init__.<locals>.<lambda>.<locals>.<lambda>r ra r ra r rc r' z!Logger.__init__.<locals>.<lambda>zDEBUG%dz DEBUG%d: zdebug%dc rZ )Nc r[ r )�debugr] ra r r rc ) rd re r ra r ra r rc ( r' z%(label)s%(message)sz%d %b %Y %H:%M:%S�*c S � g | ]}|�qS r r ��.0�ir r r � <listcomp>4 � z#Logger.__init__.<locals>.<listcomp>c S rh r r ri r r r rl 6 rm N) �_level� _debug_level�_format� _date_format�_label� _debug_label�_logging�_debug_logging�_domains�_debug_domains� ValueErrorr9 �NO_INFO�INFO_MAX�NO_DEBUG� DEBUG_MAX�setInfoLogLabelr= � TRACEBACKr; �range�setattr�setDebugLogLabel�setInfoLogLevelr7 �setDebugLogLevel� setFormat� setDateFormat�setInfoLoggingr* r# �setDebugLogging)r �info_max� debug_maxrn r r r r � sf �� �� � � �zLogger.__init__c C sF t | j| jd �D ]}|| jvrq | j| D ] \}}}|�� qq dS )z Close all logging targets r5 N)r r= r| rt r )r r �dummy�targetr r r r 8 s ��z Logger.closerg c C s$ | � |� || jv r| j| S | jS )z Get info log level. )� _checkDomainrn �NOTHING�r �domainr r r �getInfoLogLevel@ s zLogger.getInfoLogLevelc C s8 | � |� || jk r | j}|| jkr| j}|| j|< dS )z% Set log level [NOTHING .. INFO_MAX] N)r� r� rz rn �r r r� r r r r� G s zLogger.setInfoLogLevelc C s* | � |� || jv r| j| | j S | jS )z Get debug log level. )r� ro r{ r� r r r �getDebugLogLevelP s zLogger.getDebugLogLevelc C s: | � |� |dk r d}|| jkr| j}|| j | j|< dS )z- Set debug log level [NO_DEBUG .. DEBUG_MAX] r N)r� r| r{ ro r� r r r r� W s zLogger.setDebugLogLevelc C � | j S r �rp r r r r � getFormat` � zLogger.getFormatc C � || _ d S r r� �r rp r r r r� c r zLogger.setFormatc C r� r �rq r r r r � getDateFormatf r� zLogger.getDateFormatc C r� r r� r� r r r r� i r zLogger.setDateFormatc C s6 | � |�}|D ]}| j|| j| jd� || j|< qdS )�U Set log label for level. Level can be a single level or an array of levels. �� min_level� max_levelN)� _getLevels�_checkLogLevelr= rz rr �r r �label�levelsr r r r} l s � �zLogger.setInfoLogLabelc C s: | j |dd�}|D ]}| j|| j| jd� || j|< q dS )r� r5 �r r� N)r� r� r7 r| rs r� r r r r� u s � �zLogger.setDebugLogLabelNc C � | j ||||dd� dS )z� Set info log target for domain and level. Level can be a single level or an array of levels. Use level ALL to set for all levels. If no format is specified, the default format will be used. r r� N�� _setLogging�r r� r� r �fmtr r r r� ~ � zLogger.setInfoLoggingc C r� )z� Set debug log target for domain and level. Level can be a single level or an array of levels. Use level ALL to set for all levels. If no format is specified, the default format will be used. r5 r� Nr� r� r r r r� � r� zLogger.setDebugLoggingc C r� )z� Add info log target for domain and level. Level can be a single level or an array of levels. Use level ALL to set for all levels. If no format is specified, the default format will be used. r r� N�� _addLoggingr� r r r �addInfoLogging� r� zLogger.addInfoLoggingc C r� )z� Add debg log target for domain and level. Level can be a single level or an array of levels. Use level ALL to set for all levels. If no format is specified, the default format will be used. r5 r� Nr� r� r r r �addDebugLogging� r� zLogger.addDebugLoggingc C r� )z� Delete info log target for domain and level. Level can be a single level or an array of levels. Use level ALL to set for all levels. If no format is specified, the default format will be used. r r� N�� _delLoggingr� r r r �delInfoLogging� r� zLogger.delInfoLoggingc C r� )z� Delete debug log target for domain and level. Level can be a single level or an array of levels. Use level ALL to set for all levels. If no format is specified, the default format will be used. r5 r� Nr� r� r r r �delDebugLogging� r� zLogger.delDebugLoggingc C � | j |dd�S )zN Is there currently any info logging for this log level (and domain)? r r� ��_isLoggingHere�r r r r r �isInfoLoggingHere� � zLogger.isInfoLoggingHerec C r� )zO Is there currently any debug logging for this log level (and domain)? r5 r� r� r� r r r �isDebugLoggingHere� r� zLogger.isDebugLoggingHerec O �2 | � |� d|d< | j| j|g|�R i |�� dS )z Fatal error log. r r N)� _checkKWargs�_logr= �r rp r_ r` r r r �fatal� � z Logger.fatalc O r� )z Error log. r r N)r� r� r; r� r r r �error� r� z Logger.errorc O r� )z Warning log. r r N)r� r� r9 r� r r r �warning� r� zLogger.warningc O sH | j |d| jd� | �|� d|d< | j|| j |g|�R i |�� dS )z� Information log using info level [1..info_max]. There are additional infox functions according to info_max from __init__r5 r� r r N)r� rz r� r� ry �r r rp r_ r` r r r r\ � s $z Logger.infoc O sB | j |d| jd� | �|� d|d< | j||g|�R i |�� dS )z� Debug log using debug level [1..debug_max]. There are additional debugx functions according to debug_max from __init__r5 r� r N)r� r| r� r� r� r r r rf � s z Logger.debugc C s | j | jt�� g i d� d S )N)r_ r` )r� r~ � traceback� format_excr r r r � exception� s zLogger.exceptionc C s& ||k s||krt d|||f ��d S )Nz*Level %d out of range, should be [%d..%d].�rx )r r r� r� r r r r� � s ��zLogger._checkLogLevelc C s. |sd S |� � D ] }|dvrtd| ��qd S )N)�nlr� �nofmtz0Key '%s' is not allowed as argument for logging.)�keysrx )r r` �keyr r r r� � s ��zLogger._checkKWargsc C s |r|dkr t d| ��d S )NrY zDomain '%s' is not valid.r� r� r r r r� � s �zLogger._checkDomainc C s� || j kr2t|t�st|t�r|}n|g}|D ]}|r%| j|d| jd� q| j|| j| jd� q|S |rBdd� t| j | j�D �}|S dd� t| j| j�D �}|S )z Generate log level array. r5 r� c S rh r r ri r r r rl � rm z%Logger._getLevels.<locals>.<listcomp>c S rh r r ri r r r rl � rm ) �ALL� isinstance�list�tupler� r| r= rz r �DEBUG1)r r r r� r r r r� � s$ � ���zLogger._getLevelsc C sJ t |t�s t |t�r |}n|g}|D ]}t|jt�s"td|jj ��q|S )z Generate target array. z '%s' is no valid logging target.)r� r� r� � issubclass� __class__r rx r )r r� �targets�_targetr r r � _getTargets� s ��zLogger._getTargetsc C s� |r| j }| j}d| jd f}n| j}| j}| j| jd f}t|�dkr(|�� t |d |d �D ] }||vr8q1|| D ]\}}}||vrN|� |g �� |� q<q1dS )z% Generate dict with domain by level. r5 r N) rw ru r| rv rt r= rz r@ �clearr � setdefault�append)r r rv rt �_ranger r� r� r r r � _genDomains s$ ���zLogger._genDomainsc C sd | � |� | �||�}| �|�}|r| j}n| j}|D ]}|D ] }|||fg||< q q| �|� d S r )r� r� r� ru rt r� � r r� r� r r� r r� r� rt r r r r� s �zLogger._setLoggingc C sl | � |� | �||�}| �|�}|r| j}n| j}|D ]}|D ]}|�|g ��|||f� q q| �|� d S r )r� r� r� ru rt r� r� r� r� r r r r� - s �zLogger._addLoggingc C s� | � |� | �||�}| �|�}|r| j}n| j}|D ]<} |D ]7}| |vr&q |||f|| v rE|| �|||f� t|| �dkrE|| = q || jkrVtd| ||j j |f ��q q| � |� d S )Nr zDNo mathing logging for level %d, domain %s, target %s and format %s.) r� r� r� ru rt �remover@ r� rx r� r r� ) r r� r� r r� r r� r� rt rn r r r r� < s, ��� zLogger._delLoggingc C sr | � ||�}|s dS |d d }|r| j}n| j}|| D ]\}}}|dks3|�|�s3t�|d |�r6 dS q dS )NFr� �.rg T)�_genDictru rt rI �fnmatch� fnmatchcase)r r r �_dict� point_domainrt r� r� r r r r� U s ���zLogger._isLoggingHerec C s� |j jdkr"|j jd }||jv r"|j| }| �|j|j �}|r"|S t�|j �}|j }|j|j v rEt |j |j d�rE|j |j j |krEdS |j � � D ]%\}}t |tj�rot ||j�rot||j�}t |tj�ro|j |kro| S qJdS )z7 Function to get calling class. Returns class or None. r � func_codeN)�f_code� co_argcount� co_varnames�f_locals� _getClass2r� �inspect� getmodule�co_name�__dict__�hasattr�__code__�itemsr� �types� ClassType�getattr� FunctionType) r �frame�selfname�_self�obj�module�coder� �valuer r r � _getClassi s, �zLogger._getClassc C sV |j �� D ]}t|tj�r|j|kr| S q|jD ]}| �||�}|r(| S qdS )z@ Internal function to get calling class. Returns class or None. N)r� �valuesr� r� r� r� � __bases__r� )r r� r� r� �base�_objr r r r� � s � �zLogger._getClass2c O s` d}d|v r |d }d}d|v r|d }d}d|v r |d }| � ||�}|s(d S t|�dkr5|| |d< nt|�dkrD||d |d< n||d< |d d } |rT| j} n| j} g } | | D ]P\} } }| | v rgq]| d ksz| �| d �szt�|d | �r�|s| j}d |v r�|d }|r�| �|d || |� n | �|| || |� |r�| �d || |� | � | � q]d S ) Nr r r5 r� r� r^ r� r� rg r� r4 ) r� r@ ru rt rI r� r� rp r r� )r r rp r_ r` r r� r� r� r� rt � used_targetsr� r� r r r r� � sT �� ��z Logger._logc C s g }d}|r| j }| j}| j}n | j}| j}| j}|D ]$}|dkr4|| |kr3d}t|�dkr1g } n q|| |kr?|�|� q|sJt|�dk rJdS ||vrPdS t� � } | rq| j rq| j d | j krq| j } | rq| j rq| j d | j ksa| swt d��| j d } | d } |D ] }| �|�r�g } nq�| j} t| �} || D ]0}|�d�}|dkr�q�|dkr�|d|� }n|}| t|�kr�| �|�s� dS q�|�| �s� dS q�d }||v r�|| }| j| j| d | jd ||t�| jt�� �d � }|d d kr�d |d < d}|| D ] }|dk�rq�d} | j�d�dk�s!| j�d�dk�s!|�s!t|�dk�r.| �| �}|�r.|j|d< d |d |d< |d d k�rI|d d |d 7 < |d d k�r\|d d |d 7 < t|�dk �re|S |d d }|D ]}|�|��s~t� |d |��r�| S �qmdS )z Internal function. Frg Tr r5 Nr z Frame information not available.r� rY ) �file�liner� �class�functionr� r� r �dater �?z %(domain)z%(class)r r� r� ) ro rw rs rn rv rr r@ r� r� � currentframe�f_back� f_globalsr rx rI r� �find� co_filename�f_linenor� �time�strftimerq � localtimerp r� r r� r� )r r r � check_domains� simple_matchr� rv rr r� �f� module_name� point_module�co�_lenrk �d� level_str� domain_neededr� r� r r r r� � s� � �� � � �� � ��zLogger._genDict)rW rX )rg r )8r r r r r� r� r= r~ r; r9 r r# r) r* r+ r, r r r� r� r� r� r� r� r� r� r} r� r� r� r� r� r� r� r� r� r� r� r� r\ rf r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r r r r r � sf H ; 4r )�__all__r" r� r r� r� r, r� rN �os.pathr. �objectr r r) r+ r r r r r r r �<module> s0 -( *PK ���Zz��� � , core/__pycache__/fw_icmptype.cpython-310.pycnu �[��� o bhAbR � @ sF d gZ ddlZddlmZ ddlmZ ddlmZ G dd � d e�Z dS )�FirewallIcmpType� N)�log)�errors)� FirewallErrorc @ sL e Zd Zdd� Zdd� Zdd� Zdd� Zd d � Zd d � Zd d� Z dd� Z dS )r c C s || _ i | _d S �N)�_fw� _icmptypes)�self�fw� r �;/usr/lib/python3/dist-packages/firewall/core/fw_icmptype.py�__init__ s zFirewallIcmpType.__init__c C s d| j | jf S )Nz%s(%r))� __class__r �r r r r �__repr__" s zFirewallIcmpType.__repr__c C s | j �� d S r )r �clearr r r r �cleanup% � zFirewallIcmpType.cleanupc C s t | j�� �S r )�sortedr �keysr r r r � get_icmptypes* r z FirewallIcmpType.get_icmptypesc C s || j vr ttj|��d S r )r r r �INVALID_ICMPTYPE�r �icmptyper r r �check_icmptype- s �z FirewallIcmpType.check_icmptypec C s | � |� | j| S r �r r r r r r � get_icmptype1 s z FirewallIcmpType.get_icmptypec C s |j }t|�dkr ddg}|d d � }|D ]>}|dkr)| jjs$| jjs$q| jj}n|dkr;| jjs6| jjs6q| jj}ng }|j� � |vrSt � d|j|f � |� |� qt|�t|�krxt|�dk rht tjd��t�|�}||_ || j|j< d S || j|j< d S )Nr �ipv4�ipv6z5ICMP type '%s' is not supported by the kernel for %s.� zNo supported ICMP type.)� destination�lenr �ip4tables_enabled�nftables_enabled�ipv4_supported_icmp_types�ip6tables_enabled�ipv6_supported_icmp_types�name�lowerr �info1�remover r r �copy�deepcopyr )r �obj� orig_ipvs�ipvs�ipv�supported_icmps�new_objr r r � add_icmptype5 s6 � � z FirewallIcmpType.add_icmptypec C s | � |� | j|= d S r r r r r r �remove_icmptypeR s z FirewallIcmpType.remove_icmptypeN) �__name__� __module__� __qualname__r r r r r r r3 r4 r r r r r s ) �__all__r+ �firewall.core.loggerr �firewallr �firewall.errorsr �objectr r r r r �<module> s PK ���Z���Oe Oe * core/__pycache__/fw_config.cpython-310.pycnu �[��� o bhAb]� � @ s� d gZ ddlZddlZddlZddlZddlmZmZ ddlm Z ddl m Z ddl m Z ddlmZmZmZ ddlmZmZmZ dd lmZmZmZ dd lmZm Z m Z dd l m Z m Z m!Z! dd l"m#Z#m$Z$m%Z% dd lm&Z& ddl'm(Z( G dd � d e)�Z*dS )�FirewallConfig� N)�Dict�List)�config)�log)� IO_Object)�IcmpType�icmptype_reader�icmptype_writer)�Service�service_reader�service_writer)�Zone� zone_reader� zone_writer)�IPSet� ipset_reader� ipset_writer)�Helper� helper_reader� helper_writer)�Policy� policy_reader� policy_writer)�errors)� FirewallErrorc @ sJ e Zd Zdd� Zdd� Zdd� Zdd� Zd d � Zi fd ee e e f fd d �Z dd� Z dd� Zdd� Zdd� Zdd� Zdd� Zdd� Zd d � Zd d � Zd d!� Zd"d#� Zd$d%� Zd&d'� Zd(d)� Zd*d+� Zd,d-� Z d.d/� Z d0d1� Z d2d3� Z d4d5� Z d6d7� Z!d8d9� Z"d:d;� Z#d<d=� Z$d>d?� Z%d@dA� Z&dBdC� Z'dDdE� Z(dFdG� Z)dHdI� Z*dJdK� Z+dLdM� Z,dNdO� Z-dPdQ� Z.dRdS� Z/dTdU� Z0dVdW� Z1dXdY� Z2dZd[� Z3d\d]� Z4d^d_� Z5d`da� Z6dbdc� Z7ddde� Z8dfdg� Z9dhdi� Z:djdk� Z;dldm� Z<dndo� Z=dpdq� Z>drds� Z?dtdu� Z@dvdw� ZAdxdy� ZBdzd{� ZCd|d}� ZDd~d� ZEd�d�� ZFd�d�� ZGd�d�� ZHd�d�� ZId�d�� ZJd�d�� ZKd�d�� ZLd�d�� ZMd�d�� ZNd�d�� ZOd�d�� ZPd�d�� ZQd�d�� ZRd�d�� ZSd�d�� ZTd�d�� ZUd�d�� ZVd�d�� ZWd�d�� ZXd�d�� ZYd�d�� ZZd�d�� Z[d�d�� Z\d�d�� Z]d�d�� Z^d�d�� Z_d�d�� Z`d�d�� Zad�d�� Zbd�d�� Zcd�d�� Zdd�d�� Zed�d�� Zfd�dÄ Zgd�dń Zhd�dDŽ Zid�dɄ Zjd�d˄ Zkd�S )�r c C s || _ | �� d S �N)�_fw�_FirewallConfig__init_vars)�self�fw� r! �9/usr/lib/python3/dist-packages/firewall/core/fw_config.py�__init__* s zFirewallConfig.__init__c C sH d| j | j| j| j| j| j| j| j| j| j | j | j | j | j | j| jf S )Nz>%s(%r, %r, %r, %r, %r, %r, %r, %r, %r, %r, %r, %r, %r, %r, %r))� __class__�_ipsets� _icmptypes� _services�_zones�_helpers�policy_objects�_builtin_ipsets�_builtin_icmptypes�_builtin_services�_builtin_zones�_builtin_helpers�_builtin_policy_objects�_firewalld_conf� _policies�_direct�r r! r! r" �__repr__. s ��zFirewallConfig.__repr__c C s^ i | _ i | _i | _i | _i | _i | _i | _i | _i | _i | _ i | _ i | _ d | _ d | _ d | _d S r )r% r& r' r( r) �_policy_objectsr+ r, r- r. r/ r0 r1 r2 r3 r4 r! r! r" � __init_vars8 s zFirewallConfig.__init_varsc C s� t | j�� �D ] }| j| �� | j|= qt | j�� �D ] }| j| �� | j|= q t | j�� �D ] }| j| �� | j|= q1t | j�� �D ] }| j| �� | j|= qFt | j�� �D ] }| j| �� | j|= q[t | j�� �D ] }| j| �� | j|= qpt | j �� �D ] }| j | �� | j |= q�t | j �� �D ] }| j | �� | j |= q�t | j �� �D ] }| j | �� | j |= q�t | j �� �D ] }| j | �� | j |= q�| j r�| j �� | ` d | _ | jr�| j�� | `d | _| jr�| j�� | `d | _| �� d S r )�listr+ �keys�cleanupr% r, r& r- r' r. r( r/ r) r1 r2 r3 r )r �xr! r! r" r: I sV zFirewallConfig.cleanupc s� i }� fdd�� � � D �|d< � fdd�� �� D �|d< � fdd�� �� D �|d< � fdd�� �� D �|d < � fd d�� �� D �|d < � fd d�� �� D �|d < |S )zJ Returns a dict of dicts of all permanent config objects. c � i | ]}|� � |��qS r! )� get_ipset)�.0�ipsetr4 r! r" � <dictcomp>� � z:FirewallConfig.get_all_io_objects_dict.<locals>.<dictcomp>�ipsetsc r< r! )� get_helper)r> �helperr4 r! r" r@ � rA �helpersc r< r! )� get_icmptype)r> �icmptyper4 r! r" r@ � rA � icmptypesc r< r! )� get_service)r> �servicer4 r! r" r@ � rA �servicesc r< r! )�get_zone)r> �zoner4 r! r" r@ � rA �zonesc r< r! )�get_policy_object)r> �policyr4 r! r" r@ � rA �policies)� get_ipsets� get_helpers� get_icmptypes� get_services� get_zones�get_policy_objects)r � conf_dictr! r4 r" �get_all_io_objects_dict~ s z&FirewallConfig.get_all_io_objects_dict�extra_io_objectsc C sn | � � }|D ]}|| D ] }||| |j< q qg d�}|D ]}|| }|�� D ] \}} | �| �� |� q'q d S )N)rB rE rH rK rN rQ )rY �name�items�check_config_dict�export_config_dict) r rZ �all_io_objects�type_key�obj�order� io_obj_type�io_objsr[ �io_objr! r! r" �full_check_config� s ���z FirewallConfig.full_check_configc C s | j j�� S r )r rQ �query_lockdownr4 r! r! r" �lockdown_enabled� s z FirewallConfig.lockdown_enabledc C s | j j�||�S r )r rQ � access_check)r �key�valuer! r! r" ri � � zFirewallConfig.access_checkc C � || _ d S r �r1 )r �confr! r! r" �set_firewalld_conf� � z!FirewallConfig.set_firewalld_confc C � | j S r rn r4 r! r! r" �get_firewalld_conf� � z!FirewallConfig.get_firewalld_confc C �* t j�tj�s| j�� d S | j�� d S r )�os�path�existsr �FIREWALLD_CONFr1 �clear�readr4 r! r! r" �update_firewalld_conf� � z$FirewallConfig.update_firewalld_confc C rm r �r2 )r rQ r! r! r" � set_policies� rq zFirewallConfig.set_policiesc C rr r r~ r4 r! r! r" � get_policies� rt zFirewallConfig.get_policiesc C s. t j�tj�s| jj�� d S | jj�� d S r ) rv rw rx r �LOCKDOWN_WHITELISTr2 �lockdown_whitelistr: r{ r4 r! r! r" �update_lockdown_whitelist� s z(FirewallConfig.update_lockdown_whitelistc C rm r �r3 )r �directr! r! r" � set_direct� rq zFirewallConfig.set_directc C rr r r� r4 r! r! r" � get_direct� rt zFirewallConfig.get_directc C ru r )rv rw rx r �FIREWALLD_DIRECTr3 r: r{ r4 r! r! r" � update_direct� r} z FirewallConfig.update_directc C �$ t tt| j�� �t| j�� � ��S r )�sorted�setr8 r% r9 r+ r4 r! r! r" rR � � �zFirewallConfig.get_ipsetsc C �& |j r || j|j< d S || j|j< d S r )�builtinr+ r[ r% �r ra r! r! r" � add_ipset� � zFirewallConfig.add_ipsetc C �4 || j v r | j | S || jv r| j| S ttj|��r )r% r+ r r � INVALID_IPSET�r r[ r! r! r" r= � � zFirewallConfig.get_ipsetc C �p |j | jvr ttj|j ��| j|j |kr ttjd|j ��|j | jvr-ttjd|j ��| �|� | j|j S )Nzself._ipsets[%s] != objz'%s' not a built-in ipset)r[ r% r r � NO_DEFAULTSr+ � _remove_ipsetr� r! r! r" �load_ipset_defaults� � � � z"FirewallConfig.load_ipset_defaultsc C � |� � S r �� export_configr� r! r! r" �get_ipset_config� � z FirewallConfig.get_ipset_configc C �f t � |�}|jrtj|_d|_|j|jkrd|_|�|| �� � | �d|gi� | � |� t |� |S )NFrB ) �copyr� r �ETC_FIREWALLD_IPSETSrw �default� import_configrY rf r� r �r ra ro r; r! r! r" �set_ipset_config� � z FirewallConfig.set_ipset_configc C � || j v s || jv rttjd| ��t� }|�|� ||_d| |_t j |_ d|_ d|_ |�|| �� � | �d|gi� | �|� t|� |S )Nznew_ipset(): '%s'�%s.xmlFTrB )r% r+ r r � NAME_CONFLICTr � check_namer[ �filenamer r� rw r� r� r� rY rf r� r �r r[ ro r; r! r! r" � new_ipset� � � zFirewallConfig.new_ipsetc C �� t j�|�}t j�|�}t j�|�sl|tjkrE| j�� D ]&}| j| }|j |krB| j|= |j | j v r<d| j |j f S d|f S q dS | j �� D ] }| j | }|j |kri| j |= |j | jvrfd|f S dS qJdS t � d|� zt||�}W n ty� } zt �d||� W Y d }~dS d }~ww |j | j vr�|j | jvr�| �|� d|fS |tjkr�|j | jv r�| j|j j|_|| j|j < d|fS |j | j v r�| j |j = || j |j < |j | jvr�d|fS dS dS )N�update�remove�NNzLoading ipset file '%s'z"Failed to load ipset file '%s': %s�new)rv rw �basename�dirnamerx r r� r% r9 r� r[ r+ r �debug1r � Exception�errorr� r� �r r[ r� rw r; ra �msgr! r! r" �update_ipset_from_path �Z �� � �� z%FirewallConfig.update_ipset_from_pathc C � |j | jvr ttj|j ��|jtjkr ttjd|jtjf ��d|j|j f }z t � |d| � W n t yO } zt � d||� t�|� W Y d }~nd }~ww | j|j = d S �Nz '%s' != '%s'� %s/%s.xml�%s.old� Backup of file '%s' failed: %s)r[ r% r r r� rw r r� �INVALID_DIRECTORY�shutil�mover� r r� rv r� �r ra r[ r� r! r! r" r� V �" ����z FirewallConfig._remove_ipsetc C �" |j s|jsttjd|j ��d S )Nz'%s' is built-in ipset)r� r� r r � BUILTIN_IPSETr[ r� r! r! r" �check_builtin_ipsetg � ��z"FirewallConfig.check_builtin_ipsetc C � | � |� | �|� d S r )r� r� r� r! r! r" � remove_ipsetl � zFirewallConfig.remove_ipsetc C �$ | � |� | �||�}| �|� |S r )r� � _copy_ipsetr� )r ra r[ r� r! r! r" � rename_ipsetp � zFirewallConfig.rename_ipsetc C � | � ||�� �S r )r� r� �r ra r[ r! r! r" r� v rl zFirewallConfig._copy_ipsetc C r� r )r� r� r8 r& r9 r, r4 r! r! r" rT { r� z FirewallConfig.get_icmptypesc C r� r )r� r, r[ r& r� r! r! r" � add_icmptype r� zFirewallConfig.add_icmptypec C r� r )r& r, r r �INVALID_ICMPTYPEr� r! r! r" rF � r� zFirewallConfig.get_icmptypec C r� )Nzself._icmptypes[%s] != objz '%s' not a built-in icmptype)r[ r& r r r� r, �_remove_icmptyper� r! r! r" �load_icmptype_defaults� r� z%FirewallConfig.load_icmptype_defaultsc C r� r r� r� r! r! r" �get_icmptype_config� r� z"FirewallConfig.get_icmptype_configc C r� )NFrH ) r� r� r �ETC_FIREWALLD_ICMPTYPESrw r� r� rY rf r� r r� r! r! r" �set_icmptype_config� r� z"FirewallConfig.set_icmptype_configc C r� )Nznew_icmptype(): '%s'r� FTrH )r& r, r r r� r r� r[ r� r r� rw r� r� r� rY rf r� r r� r! r! r" � new_icmptype� r� zFirewallConfig.new_icmptypec C r� )Nr� r� r� zLoading icmptype file '%s'z%Failed to load icmptype file '%s': %sr� )rv rw r� r� rx r r� r& r9 r� r[ r, r r� r r� r� r� r� r� r! r! r" �update_icmptype_from_path� r� z(FirewallConfig.update_icmptype_from_pathc C r� r� )r[ r& r r r� rw r r� r� r� r� r� r r� rv r� r� r! r! r" r� �" ����z FirewallConfig._remove_icmptypec C r� )Nz'%s' is built-in icmp type)r� r� r r �BUILTIN_ICMPTYPEr[ r� r! r! r" �check_builtin_icmptype r� z%FirewallConfig.check_builtin_icmptypec C r� r )r� r� r� r! r! r" �remove_icmptype r� z FirewallConfig.remove_icmptypec C r� r )r� �_copy_icmptyper� )r ra r[ r� r! r! r" �rename_icmptype r� z FirewallConfig.rename_icmptypec C r� r )r� r� r� r! r! r" r� " rl z FirewallConfig._copy_icmptypec C r� r )r� r� r8 r' r9 r- r4 r! r! r" rU ' r� zFirewallConfig.get_servicesc C r� r )r� r- r[ r' r� r! r! r" � add_service+ r� zFirewallConfig.add_servicec C �8 || j v r | j | S || jv r| j| S ttjd| ��)Nzget_service(): '%s')r' r- r r �INVALID_SERVICEr� r! r! r" rI 1 � zFirewallConfig.get_servicec C r� )Nzself._services[%s] != objz'%s' not a built-in service)r[ r' r r r� r- �_remove_servicer� r! r! r" �load_service_defaults8 r� z$FirewallConfig.load_service_defaultsc C �n |� � }g }td�D ](}|j| d |vr&|�t�t||j| d ��� q |�||j| d � q t|�S )N� r �r^ �range�IMPORT_EXPORT_STRUCTURE�appendr� �deepcopy�getattr�tuple�r ra rX � conf_list�ir! r! r" �get_service_configD � "z!FirewallConfig.get_service_configc C r� r �r^ r� r! r! r" �get_service_config_dictP r� z&FirewallConfig.get_service_config_dictc C �4 i }t |�D ] \}}|||j| d < q| �||�S �Nr )� enumerater� �set_service_config_dict�r ra ro rX r� rk r! r! r" �set_service_configS � z!FirewallConfig.set_service_configc C r� )NFrK ) r� r� r �ETC_FIREWALLD_SERVICESrw r� �import_config_dictrY rf r� r r� r! r! r" r� Z r� z&FirewallConfig.set_service_config_dictc C �X || j v s || jv rttjd| ��i }t|�D ] \}}||tj| d < q| �||�S )N�new_service(): '%s'r ) r' r- r r r� r� r r� �new_service_dict�r r[ ro rX r� rk r! r! r" � new_serviceh s � zFirewallConfig.new_servicec C r� )Nr r� FTrK )r' r- r r r� r r� r[ r� r r rw r� r� r rY rf r� r r� r! r! r" r s r� z FirewallConfig.new_service_dictc C r� )Nr� r� r� zLoading service file '%s'z$Failed to load service file '%s': %sr� )rv rw r� r� rx r r r' r9 r� r[ r- r r� r r� r� r� r� r� r! r! r" �update_service_from_path� r� z'FirewallConfig.update_service_from_pathc C r� r� )r[ r' r r r� rw r r r� r� r� r� r r� rv r� r� r! r! r" r� � r� z FirewallConfig._remove_servicec C r� )Nz'%s' is built-in service)r� r� r r �BUILTIN_SERVICEr[ r� r! r! r" �check_builtin_service� r� z$FirewallConfig.check_builtin_servicec C r� r )r r� r� r! r! r" �remove_service� r� z FirewallConfig.remove_servicec C r� r )r � _copy_servicer� )r ra r[ r r! r! r" �rename_service� r� z FirewallConfig.rename_servicec C r� r )r r^ r� r! r! r" r � rl z FirewallConfig._copy_servicec C r� r )r� r� r8 r( r9 r. r4 r! r! r" rV � r� zFirewallConfig.get_zonesc C r� r )r� r. r[ r( r� r! r! r" �add_zone� r� zFirewallConfig.add_zonec C s, || j v r | j |= || jv r| j|= d S d S r )r. r( r� r! r! r" � forget_zone� s �zFirewallConfig.forget_zonec C r� )Nzget_zone(): %s)r( r. r r � INVALID_ZONEr� r! r! r" rL r� zFirewallConfig.get_zonec C r� )Nzself._zones[%s] != objz'%s' not a built-in zone)r[ r( r r r� r. � _remove_zoner� r! r! r" �load_zone_defaults r� z!FirewallConfig.load_zone_defaultsc C r� )N� r r� r� r! r! r" �get_zone_config r� z FirewallConfig.get_zone_configc C r� r r� r� r! r! r" �get_zone_config_dict r� z#FirewallConfig.get_zone_config_dictc C r� r� )r� r� �set_zone_config_dictr� r! r! r" �set_zone_config# r z FirewallConfig.set_zone_configc C r� )NFrN ) r� r� r �ETC_FIREWALLD_ZONESrw r� r rY rf r r r� r! r! r" r * r� z#FirewallConfig.set_zone_config_dictc C r )N�new_zone(): '%s'r ) r( r. r r r� r� r r� � new_zone_dictr r! r! r" �new_zone8 s zFirewallConfig.new_zonec C r� )Nr r� FTrN )r( r. r r r� r r� r[ r� r r rw r� r� r rY rf r r r� r! r! r" r B � z FirewallConfig.new_zone_dictc C � t j�|�}t j�|�}t j�|�sm|�tj�rF| j� � D ]&}| j| }|j |krC| j|= |j | j v r=d| j |j f S d|f S q dS | j � � D ] }| j | }|j |krj| j |= |j | jvrgd|f S dS qKdS t �d|� zt||�}W n ty� } zt �d||� W Y d }~dS d }~ww |�tj�r�t|�ttj�kr�dt j�|�t j�|�dd� f |_ |j | j vr�|j | jvr�| �|� d |fS |�tj�r�|j | jv r�| j|j j|_|| j|j < d|fS |j | j v �r | j |j = || j |j < |j | jv�rd|fS dS dS ) Nr� r� r� zLoading zone file '%s'z!Failed to load zone file '%s': %s�%s/%sr ���r� )rv rw r� r� rx � startswithr r r( r9 r� r[ r. r r� r r� r� �lenr r� r� r! r! r" �update_zone_from_pathU �d �� � �� � z$FirewallConfig.update_zone_from_pathc C � |j | jvr ttj|j ��|j�tj�s ttj d|jtjf ��d|j|j f }z t � |d| � W n t yP } zt �d||� t�|� W Y d }~nd }~ww | j|j = d S �Nz '%s' doesn't start with '%s'r� r� r� )r[ r( r r r rw r! r r r� r� r� r� r r� rv r� r� r! r! r" r � �" ����zFirewallConfig._remove_zonec C r� )Nz'%s' is built-in zone)r� r� r r � BUILTIN_ZONEr[ r� r! r! r" �check_builtin_zone� r� z!FirewallConfig.check_builtin_zonec C r� r )r) r r� r! r! r" � remove_zone� r� zFirewallConfig.remove_zonec C sF | � |� |�� }| �|� z | �||�}W |S | �|j|� � r )r) r^ r r r[ )r ra r[ �obj_confr r! r! r" � rename_zone� s �zFirewallConfig.rename_zonec C r� r )r� r� r8 r6 r9 r0 r4 r! r! r" rW � r� z!FirewallConfig.get_policy_objectsc C r� r )r� r0 r[ r6 r� r! r! r" �add_policy_object� r� z FirewallConfig.add_policy_objectc C r� )Nzget_policy_object(): %s)r6 r0 r r �INVALID_POLICYr� r! r! r" rO � r� z FirewallConfig.get_policy_objectc C r� )Nz self._policy_objects[%s] != objz'%s' not a built-in policy)r[ r6 r r r� r0 �_remove_policy_objectr� r! r! r" �load_policy_object_defaults� r� z*FirewallConfig.load_policy_object_defaultsc C r� r r� r� r! r! r" � get_policy_object_config_dict� r� z,FirewallConfig.get_policy_object_config_dictc C r� )NFrQ ) r� r� r �ETC_FIREWALLD_POLICIESrw r� r rY rf r- r r� r! r! r" � set_policy_object_config_dict� r� z,FirewallConfig.set_policy_object_config_dictc C r� )Nznew_policy_object(): '%s'r� FTrQ )r6 r0 r r r� r r� r[ r� r r2 rw r� r� r rY rf r- r r� r! r! r" �new_policy_object_dict� r z%FirewallConfig.new_policy_object_dictc C r ) Nr� r� r� zLoading policy file '%s'z#Failed to load policy file '%s': %sr r r r� )rv rw r� r� rx r! r r2 r6 r9 r� r[ r0 r r� r r� r� r" r- r� r� r! r! r" � update_policy_object_from_path r$ z-FirewallConfig.update_policy_object_from_pathc C r% r& )r[ r6 r r r. rw r! r r2 r� r� r� r� r r� rv r� r� r! r! r" r/ T r' z$FirewallConfig._remove_policy_objectc C r� )Nz'%s' is built-in policy)r� r� r r �BUILTIN_POLICYr[ r� r! r! r" �check_builtin_policy_objecte r� z*FirewallConfig.check_builtin_policy_objectc C r� r )r7 r/ r� r! r! r" �remove_policy_objectj r� z#FirewallConfig.remove_policy_objectc C r� r )r7 �_copy_policy_objectr/ )r ra r[ �new_policy_objectr! r! r" �rename_policy_objectn r� z#FirewallConfig.rename_policy_objectc C r� r )r4 r^ r� r! r! r" r9 t rl z"FirewallConfig._copy_policy_objectc C r� r )r� r� r8 r) r9 r/ r4 r! r! r" rS y r� zFirewallConfig.get_helpersc C r� r )r� r/ r[ r) r� r! r! r" � add_helper} r� zFirewallConfig.add_helperc C r� r )r) r/ r r �INVALID_HELPERr� r! r! r" rC � r� zFirewallConfig.get_helperc C r� )Nzself._helpers[%s] != objz'%s' not a built-in helper)r[ r) r r r� r/ �_remove_helperr� r! r! r" �load_helper_defaults� r� z#FirewallConfig.load_helper_defaultsc C r� r r� r� r! r! r" �get_helper_config� r� z FirewallConfig.get_helper_configc C r� )NFrE ) r� r� r �ETC_FIREWALLD_HELPERSrw r� r� rY rf r< r r� r! r! r" �set_helper_config� r� z FirewallConfig.set_helper_configc C r� )Nznew_helper(): '%s'r� FTrE )r) r/ r r r� r r� r[ r� r rA rw r� r� r� rY rf r< r r� r! r! r" � new_helper� r� zFirewallConfig.new_helperc C r� )Nr� r� r� zLoading helper file '%s'z#Failed to load helper file '%s': %sr� )rv rw r� r� rx r rA r) r9 r� r[ r/ r r� r r� r� r< r� r� r! r! r" �update_helper_from_path� r� z&FirewallConfig.update_helper_from_pathc C r� r� )r[ r) r r r= rw r rA r� r� r� r� r r� rv r� r� r! r! r" r> r� z FirewallConfig._remove_helperc C r� )Nz'%s' is built-in helper)r� r� r r �BUILTIN_HELPERr[ r� r! r! r" �check_builtin_helper r� z#FirewallConfig.check_builtin_helperc C r� r )rF r> r� r! r! r" � remove_helper r� z FirewallConfig.remove_helperc C r� r )rF � _copy_helperr> )r ra r[ rC r! r! r" � rename_helper r� z FirewallConfig.rename_helperc C r� r )rC r� r� r! r! r" rH rl zFirewallConfig._copy_helperN)l�__name__� __module__� __qualname__r# r5 r r: rY r �strr r rf rh ri rp rs r| r r� r� r� r� r� rR r� r= r� r� r� r� r� r� r� r� r� r� rT r� rF r� r� r� r� r� r� r� r� r� r� rU r� rI r� r� r� r r� r r r r� r r r r rV r r rL r r r r r r r r# r r) r* r, rW r- rO r0 r1 r3 r4 r5 r/ r7 r8 r; r9 rS r< rC r? r@ rB rC rD r> rF rG rI rH r! r! r! r" r ) s� 5 E E E K K E )+�__all__r� rv �os.pathr� �typingr r �firewallr �firewall.core.loggerr �firewall.core.io.io_objectr �firewall.core.io.icmptyper r r �firewall.core.io.servicer r r �firewall.core.io.zoner r r �firewall.core.io.ipsetr r r �firewall.core.io.helperr r r �firewall.core.io.policyr r r r �firewall.errorsr �objectr r! r! r! r" �<module> s$ PK ���Z���[@1 @1 * core/__pycache__/fw_direct.cpython-310.pycnu �[��� o bhAb V � @ sn d gZ ddlmZ ddlmZ ddlmZ ddlmZ ddlm Z ddl m Z ddl m Z G d d � d e�Zd S ) �FirewallDirect� )�LastUpdatedOrderedDict)� ipXtables)�ebtables)�FirewallTransaction)�log)�errors)� FirewallErrorc @ sF e Zd Zdd� Zdd� Zdd� Zdd� Zd d � Zd d � Zd d� Z dLdd�Z dd� Z dd� Z dLdd�Z dd� Zdd� Zd d � Zd d � ZdLd d!�ZdLd"d#�Zd$d%� Zd&d'� Zd(d)� ZdLd*d+�Z dLd,d-�Zd.d/� Zd0d1� Zd2d3� Zd4d5� Z d6d7� Z d8d9� Z dLd:d;�Z dLd<d=�Z d>d?� Z!d@dA� Z"dBdC� Z#dDdE� Z$dFdG� Z%dHdI� Z&dJdK� Z'dS )Mr c C s || _ | �� d S �N)�_fw�_FirewallDirect__init_vars)�self�fw� r �9/usr/lib/python3/dist-packages/firewall/core/fw_direct.py�__init__' s zFirewallDirect.__init__c C s d| j | j| j| jf S )Nz%s(%r, %r, %r))� __class__�_chains�_rules�_rule_priority_positions�r r r r �__repr__+ s �zFirewallDirect.__repr__c C s" i | _ i | _i | _i | _d | _d S r )r r r � _passthroughs�_objr r r r � __init_vars/ s zFirewallDirect.__init_varsc C s | � � d S r )r r r r r �cleanup6 s zFirewallDirect.cleanupc C s t | j�S r )r r r r r r �new_transaction; � z FirewallDirect.new_transactionc C s || _ d S r )r )r �objr r r �set_permanent_config@ r z#FirewallDirect.set_permanent_configc C s\ t | j�t | j� t | j� dkrdS t | j�� �t | j�� � t | j�� � dkr,dS dS )Nr TF)�lenr r r r �get_all_chains� get_all_rules�get_all_passthroughsr r r r �has_configurationC s " � ��z FirewallDirect.has_configurationNc C sT |d u r | � � }n|}| �| j�� | j�� | j�� f|� |d u r(|�d� d S d S �NT)r � set_configr r! r" r# �execute)r �use_transaction� transactionr r r � apply_directL s ���zFirewallDirect.apply_directc C s i }i }i }| j D ] }|\}}| j | D ]}| j�|||�s'|�|g ��|� qq | jD ],}|\}}}| j| D ] \} } | j�|||| | �sW||vrOt� ||< | || | | f< q8q,| jD ] }| j| D ]} | j� || �s{||vrtg ||< || �| � qcq\|||fS r ) r r � query_chain� setdefault�appendr � query_ruler r �query_passthrough) r �chains�rules� passthroughs�table_id�ipv�table�chain�chain_id�priority�argsr r r �get_runtime_config] s8 �� �� �� z!FirewallDirect.get_runtime_configc C s | j | j| jfS r )r r r r r r r � get_config| s zFirewallDirect.get_configc C s� |d u r | � � }n|}|\}}}|D ]9}|\}} || D ].} | �|| | �sJz | j|| | |d� W q tyI } z t�t| �� W Y d } ~ q d } ~ ww q q|D ]@} | \}} } || D ]4\} }| �|| | | |�s�z | j|| | | ||d� W qY ty� } z t�t| �� W Y d } ~ qYd } ~ ww qYqN|D ]3}|| D ],}| � ||�s�z | j |||d� W q� ty� } z t�t| �� W Y d } ~ q�d } ~ ww q�q�|d u r�|� d� d S d S )N)r( T) r r+ � add_chainr r �warning�strr. �add_ruler/ �add_passthroughr' )r �confr( r) r r r r3 r4 r5 r6 �errorr7 r8 r9 r r r r& s` ����� ����� ������zFirewallDirect.set_configc C s( g d�}||vrt tjd||f ��d S )N)�ipv4�ipv6�eb�'%s' not in '%s')r r � INVALID_IPV)r r4 �ipvsr r r � _check_ipv� s ��zFirewallDirect._check_ipvc C sF | � |� |dv rtj�� ntj�� }||vr!ttjd||f ��d S )N�rC rD rF )rI r �BUILT_IN_CHAINS�keysr r r � INVALID_TABLE)r r4 r5 �tablesr r r �_check_ipv_table� s � ��z FirewallDirect._check_ipv_tablec C s� |dv rt j| }| jjri }n| j�|�j| }n tj| }tj| }||v r0tt j d| ��||v r<tt j d| ��|dv rQ| jj � |�d urStt j d| ��d S d S )NrJ z chain '%s' is built-in chainzchain '%s' is reservedzChain '%s' is reserved)r rK r �nftables_enabled�get_direct_backend_by_ipv� our_chainsr � OUR_CHAINSr r � BUILTIN_CHAIN�zone�zone_from_chain� INVALID_CHAIN)r r4 r5 r6 �built_in_chainsrR r r r �_check_builtin_chain� s, ����z#FirewallDirect._check_builtin_chainc C sN |r| j �|g ��|� d S | j | �|� t| j | �dkr%| j |= d S d S �Nr )r r, r- �remover )r r3 r6 �addr r r �_register_chain� s �z FirewallDirect._register_chainc C sB |d u r | � � }n|}| �d||||� |d u r |�d� d S d S r% �r �_chainr' �r r4 r5 r6 r( r) r r r r< � s �zFirewallDirect.add_chainc C sB |d u r | � � }n|}| �d||||� |d u r |�d� d S d S �NFTr^ r` r r r � remove_chain� s �zFirewallDirect.remove_chainc C s: | � ||� | �|||� ||f}|| jv o || j| v S r )rO rY r )r r4 r5 r6 r3 r r r r+ � s �zFirewallDirect.query_chainc C s, | � ||� ||f}|| jv r| j| S g S r )rO r )r r4 r5 r3 r r r � get_chains� s zFirewallDirect.get_chainsc C s< g }| j D ]}|\}}| j | D ] }|�|||f� qq|S r )r r- )r �r�keyr4 r5 r6 r r r r! � s �z FirewallDirect.get_all_chainsc C sF |d u r | � � }n|}| �d||||||� |d u r!|�d� d S d S r% �r �_ruler' �r r4 r5 r6 r8 r9 r( r) r r r r? s �zFirewallDirect.add_rulec C sF |d u r | � � }n|}| �d||||||� |d u r!|�d� d S d S ra rf rh r r r � remove_rule s �zFirewallDirect.remove_rulec C s2 | � ||� |||f}|| jv o||f| j| v S r )rO r )r r4 r5 r6 r8 r9 r7 r r r r. s �zFirewallDirect.query_rulec C s6 | � ||� |||f}|| jv rt| j| �� �S g S r )rO r �listrL )r r4 r5 r6 r7 r r r � get_rules s zFirewallDirect.get_rulesc C sJ g }| j D ] }|\}}}| j | D ]\}}|�||||t|�f� qq|S r )r r- rj )r rd re r4 r5 r6 r8 r9 r r r r" % s �z FirewallDirect.get_all_rulesc C s� |r;|| j vr t� | j |< || j | |< || jvr i | j|< || j| v r2| j| | |7 < d S || j| |< d S | j | |= t| j | �dkrN| j |= | j| | |8 < d S rZ )r r r r )r �rule_idr7 r8 �enable�countr r r �_register_rule- s z FirewallDirect._register_rulec C sJ z | j �| j �|�j|�W S ty$ } z t�|� ttj |��d }~ww r ) r �rulerQ �name� Exceptionr �debug2r r �COMMAND_FAILED)r r4 r9 �msgr r r � passthroughA s ��zFirewallDirect.passthroughc C s^ |r|| j vr g | j |< | j | �|� d S | j | �|� t| j | �dkr-| j |= d S d S rZ )r r- r[ r )r r4 r9 rm r r r �_register_passthroughI s �z$FirewallDirect._register_passthroughc C sD |d u r | � � }n|}| �d|t|�|� |d u r |�d� d S d S r% �r � _passthroughrj r' �r r4 r9 r( r) r r r r@ S � �z FirewallDirect.add_passthroughc C sD |d u r | � � }n|}| �d|t|�|� |d u r |�d� d S d S ra rx rz r r r �remove_passthrough^ r{ z!FirewallDirect.remove_passthroughc C s || j v o t|�| j | v S r )r �tuple)r r4 r9 r r r r/ i s �z FirewallDirect.query_passthroughc C s6 g }| j D ]}| j | D ] }|�|t|�f� q q|S r �r r- rj )r rd r4 r9 r r r r# m s �z#FirewallDirect.get_all_passthroughsc C s0 g }|| j v r| j | D ] }|�t|�� q |S r r~ )r r4 rd r9 r r r �get_passthroughst s z FirewallDirect.get_passthroughsc C s� g }|D ]P}d}|D ]B}z|� |�}W n ty Y q w t|�|krLd||d v rLd}||d �d�}|D ]} |dd� } | | |d < |�| � q8q |sT|�|� q|S )z5Split values combined with commas for options in optsF�,� TN)�index� ValueErrorr �splitr- ) r r1 �opts� out_rulesrp � processed�opt�i�items�itemrg r r r � split_value{ s* � � �zFirewallDirect.split_valuec C s& | � ||� | jjs|dv r| jj�||||� |}| j�|�} | jjs0| �|||�r0d| }n | jjrM|dd � dkrM| �|||d d� �rM|d d� }|||f} ||f} |rq| | jv rp| | j| v rptt j d||||f ��n | | jvs}| | j| vr�tt j d||||f ��| j| | }d} d} | | j v r�t | j | �� �}d}|t|�k r�||| kr�| | j | || 7 } |d7 }|t|�k r�||| ks�t|�g}| �|d d g�}| �|d d g�}|D ]}|�| | �|||| t|��� | d7 } | d7 } q�| �| | ||| � |�| j| | || | � d S ) NrJ z %s_directi�����_directz"rule '%s' already is in '%s:%s:%s'z rule '%s' is not in '%s:%s:%s'r� r z-sz--sourcez-dz --destination)rO r rP rU �create_zone_base_by_chainrQ �is_chain_builtinr r r �ALREADY_ENABLED� NOT_ENABLEDr �sortedrL r rj r� r? � build_ruler} ro �add_fail)r rm r4 r5 r6 r8 r9 r) r_ �backendr7 rl r� rn � positions�j� args_list�_argsr r r rg � sn � � � ��� ��( � �zFirewallDirect._rulec C s� | � ||� | �|||� ||f}|r+|| jv r*|| j| v r*ttjd|||f ��n|| jvs7|| j| vrBttjd|||f ��| j�|�}|� ||� |||�� | � |||� |� | j ||| � d S )Nz chain '%s' already is in '%s:%s'z chain '%s' is not in '%s:%s') rO rY r r r r� r� r rQ � add_rules�build_chain_rulesr] r� )r r\ r4 r5 r6 r) r3 r� r r r r_ s. ��� �� zFirewallDirect._chainc C s� | � |� t|�}|r"|| jv r!|| j| v r!ttjd||f ��n|| jvs.|| j| vr8ttjd||f ��| j�|�}|r`|� |� |dv r]|� |�\}}|r]|r]| jj � |||� |} n|� |�} |�|| � | �|||� |�| j||| � d S )Nzpassthrough '%s', '%s'rJ )rI r} r r r r� r� r rQ �check_passthrough� passthrough_parse_table_chainrU r� �reverse_passthroughr? rw r� ) r rm r4 r9 r) � tuple_argsr� r5 r6 r� r r r ry s8 �� � �zFirewallDirect._passthroughr )(�__name__� __module__� __qualname__r r r r r r r$ r* r: r; r& rI rO rY r] r< rb r+ rc r! r? ri r. rk r" ro rv rw r@ r| r/ r# r r� rg r_ ry r r r r r & sN ' � j N)�__all__�firewall.fw_typesr � firewall.corer r � firewall.core.fw_transactionr �firewall.core.loggerr �firewallr �firewall.errorsr �objectr r r r r �<module> s PK ���Z2�?)� � ' core/__pycache__/helper.cpython-310.pycnu �[��� o bhAb$ � @ s d Z dZdS )zThe helper maxnamelen� N)�__doc__�HELPER_MAXNAMELEN� r r �6/usr/lib/python3/dist-packages/firewall/core/helper.py�<module> s PK ���Z�υ�" " & core/__pycache__/ipset.cpython-310.pycnu �[��� o bhAbG2 � @ s� d Z g d�ZddlZddlZddlmZ ddlmZ ddl m Z ddl m Z ddl mZmZ dd lmZ d Zg d �Zd d d dd�Zdddd�ZG dd� de�Zdd� Zdd� Zdd� Zd d � Zd d � Z dS ) zThe ipset command wrapper)�ipset�check_ipset_name� remove_default_create_options� N)�errors)� FirewallError)�runProg)�log)�tempFile�readfile)�COMMANDS� ) zhash:ipz hash:ip,portzhash:ip,port,ipzhash:ip,port,netz hash:ip,markzhash:netz hash:net,netz hash:net,portzhash:net,port,netzhash:net,ifacezhash:macz inet|inet6�valuez value in secs)�family�hashsize�maxelem�timeout�inet�1024�65536)r r r c @ s� e Zd ZdZdd� Zdd� Zdd� Zdd � Zd d � Zd'd d�Z dd� Z dd� Z dd� Z d'dd�Z d(dd�Zdd� Zd'dd �Z d(d d �Zd d � Zd!d"� Zd#d$� Zd%d&� Zd S ))r zipset command wrapper classc C s t d | _d| _d S )Nr )r �_command�name��self� r �5/usr/lib/python3/dist-packages/firewall/core/ipset.py�__init__K � zipset.__init__c C s^ dd� |D �}t �d| j| jd�|�� t| j|�\}}|dkr-td| jd�|�|f ��|S )zCall ipset with argsc S s g | ]}d | �qS )�%sr )�.0�itemr r r � <listcomp>R � z ipset.__run.<locals>.<listcomp>z %s: %s %s� r �'%s %s' failed: %s)r �debug2� __class__r �joinr � ValueError)r �args�_args�status�retr r r �__runO s �z ipset.__runc C s t |�tkrttjd| ��dS )zCheck ipset namez ipset name '%s' is not validN)�len�IPSET_MAXNAMELENr r � INVALID_NAME)r r r r r � check_nameZ s ��zipset.check_namec C s� g }d}z| � dg�}W n ty% } z t�d| � W Y d}~nd}~ww |�� }d}|D ]&}|rM|�� �dd�}|d |vrM|d tv rM|�|d � |� d�rTd }q.|S ) z?Return types that are supported by the ipset command and kernel� z--helpzipset error: %sNF� r zSupported set types:T) � _ipset__runr' r �debug1� splitlines�strip�split� IPSET_TYPES�append� startswith)r r+ �output�ex�lines�in_types�line�splitsr r r �set_supported_types` s& �� �zipset.set_supported_typesc C s( t |�tks |tvrttjd| ��dS )zCheck ipset typez!ipset type name '%s' is not validN)r- r. r8 r r � INVALID_TYPE)r � type_namer r r � check_typeu s ��zipset.check_typeNc C s` | � |� | �|� d||g}t|t�r+|�� D ]\}}|�|� |dkr*|�|� q| �|�S )z+Create an ipset with name, type and options�creater1 )r0 rD � isinstance�dict�itemsr9 r3 )r �set_namerC �optionsr( �key�valr r r � set_create{ s � zipset.set_createc C s | � |� | �d|g�S )N�destroy)r0 r3 )r rI r r r � set_destroy� s zipset.set_destroyc C � d||g}| � |�S )N�add�r3 �r rI �entryr( r r r �set_add� r z ipset.set_addc C rP )N�delrR rS r r r � set_delete� r zipset.set_deletec C s, d||g}|r|� dd�|� � | �|�S )N�testr r" )r9 r& r3 )r rI rT rJ r( r r r rX � s z ipset.testc C s2 dg}|r |� |� |r|�|� | �|��d�S )N�list� )r9 �extendr3 r7 )r rI rJ r( r r r �set_list� s zipset.set_listc C s4 | j dgd�}i }d }}i }|D ]�}t|�dk rqdd� |�dd�D �}t|�dkr,q|d d kr7|d }q|d d krB|d }q|d d kr�|d �� }d } | t|�k r�|| } | d v ryt|�| kro| d7 } || || < n t�d|� i S | d7 } | t|�k sV|r�|r�|t|�f||< d }}|�� q|S )z" Get active ipsets (only headers) z-terse)rJ N� c S s g | ]}|� � �qS r )r6 �r �xr r r r � r! z.ipset.set_get_active_terse.<locals>.<listcomp>�:r2 r �Name�Type�Header)r r r r �netmaskz&Malformed ipset list -terse output: %s)r\ r- r7 r �errorr �clear) r r= r+ �_name�_type�_optionsr? �pairr@ �i�optr r r �set_get_active_terse� sJ � � ��zipset.set_get_active_tersec C � dg}|r |� |� | �|�S )N�save�r9 r3 �r rI r( r r r ro � � z ipset.savec C s� | � |� | �|� t� }d|v rd| }d||dg}|r4|�� D ]\}} |�|� | dkr3|�| � q!|�dd�|� � |�d| � |D ]#} d| v rQd| } |ra|�d|| d�|�f � qG|�d || f � qG|�� t� |j �} t � d | j | jd |j | jf � d g}t| j||j d �\} } t �� dkr�zt|j � W n ty� Y n'w d}t|j �D ] }t jd||f ddd� |�d�s�t jddd� |d7 }q�t�|j � | dkr�td| jd�|�| f ��| S )Nr" z'%s'rE z-existr1 z%s z flush %s z add %s %s %s z add %s %s z%s: %s restore %sz%s: %d�restore)�stdinr2 r] z%8d: %sr )�nofmt�nlrZ )ru r# )r0 rD r rH r9 �writer& �close�os�statr r r$ r% r �st_sizer �getDebugLogLevelr � Exception�debug3�endswith�unlinkr' )r rI rC �entries�create_options� entry_options� temp_filer( rK rL rT rz r* r+ rk r? r r r � set_restore� sb �� � � � �zipset.set_restorec C rn )N�flushrp rq r r r � set_flush rr zipset.set_flushc C � | � d||g�S )N�renamerR )r � old_set_name� new_set_namer r r r� � z ipset.renamec C r� )N�swaprR )r � set_name_1� set_name_2r r r r� r� z ipset.swapc C s | � dg�S )N�versionrR r r r r r� s z ipset.version)N)NN)�__name__� __module__� __qualname__�__doc__r r3 r0 rA rD rM rO rU rW rX r\ rm ro r� r� r� r� r� r r r r r H s* ' �8 r c C s t | �tkrdS dS )z"Return true if ipset name is validFT)r- r. )r r r r r s r c C s4 | � � }tD ]}||v rt| || kr||= q|S )z( Return only non default create options )�copy� IPSET_DEFAULT_CREATE_OPTIONS)rJ ri rl r r r r s �r c C s` g }| � d�D ]#}z|�d� |�ttj|dd��� W q ty* |�|� Y qw d�|�S )z! Normalize IP addresses in entry �,�/F��strict)r7 �indexr9 �str� ipaddress� ip_networkr' r& )rT �_entry�_partr r r �normalize_ipset_entry& s � r� c C st t | �d��dkr dS z tj| dd�}W n ty Y dS w |D ]}|�tj|dd��r7ttjd� | |���q!dS )z: Check if entry overlaps any entry in the list of entries r� r] NFr� z,Entry '{}' overlaps with existing entry '{}') r- r7 r� r� r' �overlapsr r � INVALID_ENTRY�format)rT r� � entry_network�itrr r r � check_entry_overlaps_existing2 s ���r� c C sj z dd� | D �} W n t y Y dS w | �� | �d�}| D ]}|�|�r0ttjd�||���|}q dS )z> Check if any entry overlaps any entry in the list of entries c S s g | ] }t j|d d��qS )Fr� )r� r� r^ r r r r E s z1check_for_overlapping_entries.<locals>.<listcomp>Nr z Entry '{}' overlaps entry '{}')r' �sort�popr� r r r� r� )r� � prev_network�current_networkr r r � check_for_overlapping_entriesB s �4 �r� ) r� �__all__�os.pathry r� �firewallr �firewall.errorsr �firewall.core.progr �firewall.core.loggerr �firewall.functionsr r �firewall.configr r. r8 �IPSET_CREATE_OPTIONSr� �objectr r r r� r� r� r r r r �<module> s8 � � P PK ���Z�y�� � ) core/__pycache__/fw_ifcfg.cpython-310.pycnu �[��� o bhAb � @ sT d Z ddgZddlZddlZddlmZ ddlmZ ddlm Z dd� Z d d� Z dS ) z.Functions to search for and change ifcfg files�search_ifcfg_of_interface�ifcfg_set_zone_of_interface� N)�config)�log)�ifcfgc C s� t j�tj�s dS tt �tj��D ]0}|�d�sqdD ]}|�|�r#qqd|v r)qt dtj|f �}|� � |� d�| krA| S qdtj| f }t j�|�rYt |�}|� � |S dS )z6search ifcfg file for the interface in config.IFCFGDIRNzifcfg-)z.bakz.origz.rpmnewz.rpmorigz.rpmsavez-range�.z%s/%s�DEVICEz %s/ifcfg-%s) �os�path�existsr �IFCFGDIR�sorted�listdir� startswith�endswithr �read�get)� interface�filename�ignored� ifcfg_file� r �8/usr/lib/python3/dist-packages/firewall/core/fw_ifcfg.pyr ! s, �� c C sx | du rd} t |�}|dur6|�d�| kr8|�d�du r | dks:t�d| |jf � |�d| � |�� dS dS dS dS )zYSet zone (ZONE=<zone>) in the ifcfg file that uses the interface (DEVICE=<interface>)N� �ZONEzSetting ZONE=%s in '%s')r r r �debug1r �set�write)�zoner r r r r r ? s �) �__doc__�__all__r �os.path�firewallr �firewall.core.loggerr �firewall.core.io.ifcfgr r r r r r r �<module> s PK ���Z��o9 & core/__pycache__/fw_nm.cpython-310.pycnu �[��� o bhAbz � @ s d Z g d�ZddlZddlmZ ze�dd� W n ey# dZY nw z ddlmZ d ZW n e eej fy= dZY nw da dd l m Z dd lmZ dd lmZ ddlZd d� Zdd� Zdd� Zdd� Zdd� Zdd� Zdd� Zdd � Zd d � Zd d � Z d!d"� Z dS )#z(Functions for NetworkManager interaction)�check_nm_imported�nm_is_imported�nm_get_zone_of_connection�nm_set_zone_of_connection�nm_get_connections� nm_get_connection_of_interface�nm_get_bus_name�nm_get_dbus_interface� N)�GLib�NMz1.0F)r T)�errors)� FirewallError)�logc C s t sttjd��dS )zNCheck function to raise a MISSING_IMPORT error if the import of NM failed zgi.repository.NM = 1.0N)� _nm_importedr r �MISSING_IMPORT� r r �5/usr/lib/python3/dist-packages/firewall/core/fw_nm.pyr 0 s �r c C s t S )znReturns true if NM has been properly imported @return True if import was successful, False otherwirse )r r r r r r 6 s r c C s t stj�d�a t S )z�Returns the NM client object or None if the import of NM failed @return NM.Client instance if import was successful, None otherwise N)� _nm_clientr �Client�newr r r r � nm_get_client< s r c C s� t � t� �| �}|du rdS |�� }|du rdS z|�� tjjtjjB @ r)W dS W n t y: |� � r8Y dS Y nw |� � }|du rEd}|S )z�Get zone of connection from NM @param connection name @return zone string setting of connection, empty string if not set, None if connection is unknown N� ) r r �get_connection_by_uuid�get_setting_connection� get_flagsr �SettingsConnectionFlags� NM_GENERATED� NM_VOLATILE�AttributeError� get_unsaved�get_zone)� connection�con� setting_con�zoner r r r E s, �� ��r c C sV t � t� �|�}|du rdS |�� }|du rdS | dkr d} |�d| � |�dd�S )zSet the zone for a connection @param zone name @param connection name @return True if zone was set, else False NFr r$ T)r r r r � set_property�commit_changes)r$ r! r" r# r r r r c s r c C sv | � � |� � t� t� �� }|D ]&}|�� rq|�� }|�� }|�� }|||< |D ] }|�� }|r7|| |< q+qdS )znGet active connections from NM @param connections return dict @param connections_name return dict N) �clearr r �get_active_connections�get_vpn�get_id�get_uuid� get_devices� get_ip_iface) � connections�connections_name�active_connections� active_con�name�uuid�devices�dev�ip_ifacer r r r x s$ ���r c C s� t � g } t� �� D ]=}|�� rq z|�� }|�� tjjtjj B @ r$W q W n t y4 |� � r2Y q Y nw |� � D ] }|� � }|rF| �|� q9q | S )zGGet active interfaces from NM @returns list of interface names )r r r( r) �get_connectionr r r r r r r r, r- �append)�active_interfacesr1 r" r5 r6 r r r �nm_get_interfaces� s0 �� �� ��r: c C s2 g }t � D ]}t|�}| t|�kr|�|� q|S )N)r: r r r8 )r$ � interfaces� interface�connr r r �nm_get_interfaces_in_zone� s �r> c C s� t � t� �| �}|du rdS |�� }|du rdS z|�� }|�� tjj@ r)W dS W |� � S t y@ |� � r;Y dS Y |� � S w )z�Get connection from NM that is using the interface @param interface name @returns connection that is using interface or None N) r r �get_device_by_iface�get_active_connectionr7 r r r r r r r+ )r< �devicer1 r" r r r r � s& � ���r c C sP t sd S zt�� } | �tjtj�}|j}~~ |W S ty' t � d� Y d S w )Nz(Failed to get bus name of NetworkManager) r �dbus� SystemBus� get_objectr �DBUS_INTERFACE� DBUS_PATH�bus_name� Exceptionr �debug2)�bus�objr2 r r r r � s �r c C s t sdS tjS )Nr )r r rE r r r r r � s r ) �__doc__�__all__�gi� gi.repositoryr �require_version� ValueErrorr r � ImportError�Errorr �firewallr �firewall.errorsr �firewall.core.loggerr rB r r r r r r r: r> r r r r r r r �<module> s> � � PK ���Z�W�] ] % core/__pycache__/base.cpython-310.pycnu �[��� o bhAb � @ sT d Z dZdZdZdddedgZg d�Zd d d d d d�Zg d�g d�d�Zg d�ZdS )zBase firewall settingsz{chain}_{zone}�CONTINUE����ACCEPTz %%REJECT%%�DROP�default)r �REJECTr r �PRE�POST�IN�FWD�OUT)� PREROUTING� POSTROUTING�INPUT�FORWARD�OUTPUT)zicmp-host-prohibitedz host-prohibzicmp-net-unreachablez net-unreachzicmp-host-unreachablez host-unreachzicmp-port-unreachable� port-unreachzicmp-proto-unreachablez proto-unreachzicmp-net-prohibitedz net-prohib� tcp-resetztcp-rstzicmp-admin-prohibitedz admin-prohib) zicmp6-adm-prohibitedzadm-prohibitedzicmp6-no-routezno-routezicmp6-addr-unreachablez addr-unreachzicmp6-port-unreachabler r )�ipv4�ipv6)zhash:ipz hash:ip,portz hash:ip,markzhash:netz hash:net,portzhash:net,ifacezhash:macN) �__doc__�DEFAULT_ZONE_TARGET�DEFAULT_POLICY_TARGET�DEFAULT_POLICY_PRIORITY� ZONE_TARGETS�POLICY_TARGETS� SHORTCUTS� REJECT_TYPES�SOURCE_IPSET_TYPES� r r �4/usr/lib/python3/dist-packages/firewall/core/base.py�<module> s$ �� � PK ���Z}�䋶 � ( core/__pycache__/watcher.cpython-310.pycnu �[��� o bhAb� � @ s* d gZ ddlmZmZ G dd � d e�ZdS )�Watcher� )�Gio�GLibc @ sd e Zd Zdd� Zdd� Zdd� Zdd� Zd d � Zd d � Zd d� Z dd� Z dd� Z dd� Z dd� Z dS )r c C s" || _ || _i | _i | _g | _d S �N)� _callback�_timeout� _monitors� _timeouts�_blocked)�self�callback�timeout� r �7/usr/lib/python3/dist-packages/firewall/core/watcher.py�__init__ s zWatcher.__init__c C �: t j�|�}|�t jjd �| j|< | j| �d| j� d S �N�changed) r �File� new_for_path�monitor_directory�FileMonitorFlags�NONEr �connect�_file_changed_cb)r � directory�gfiler r r � add_watch_dir" � �zWatcher.add_watch_dirc C r r ) r r r � monitor_filer r r r r )r �filenamer r r r �add_watch_file( r zWatcher.add_watch_filec C s | j �� S r )r �keys)r r r r � get_watches. � zWatcher.get_watchesc C s || j v S r �r �r r r r r � has_watch1 r$ zWatcher.has_watchc C s | j |= d S r r% r& r r r � remove_watch4 s zWatcher.remove_watchc C s || j vr | j �|� d S d S r )r �appendr& r r r � block_source7 � �zWatcher.block_sourcec C s || j v r | j �|� d S d S r )r �remover& r r r �unblock_source; r+ zWatcher.unblock_sourcec C s0 t | j�� �D ]}t�| j| � | j|= qd S r )�listr r" r � source_remover& r r r �clear_timeouts? s �zWatcher.clear_timeoutsc C s || j vr | �|� | j|= d S r )r r r r& r r r �_call_callbackD s zWatcher._call_callbackc C s� |� � }|| jv r || jv rt�| j| � | j|= d S |tjjks4|tjjks4|tjj ks4|tjj krS|| jv rEt�| j| � | j|= t� | j | j |�| j|< d S d S r )�get_parse_namer r r r/ r �FileMonitorEvent�CHANGED�CREATED�DELETED�ATTRIBUTE_CHANGED�timeout_add_secondsr r1 )r �monitor�gio_file�gio_other_file�eventr r r r r I s" ��zWatcher._file_changed_cbN)�__name__� __module__� __qualname__r r r! r# r' r( r* r- r0 r1 r r r r r r s N)�__all__� gi.repositoryr r �objectr r r r r �<module> s PK ���Z�l� / core/__pycache__/fw_transaction.cpython-310.pycnu �[��� o bhAb� � @ sJ d Z dgZddlZddlmZ ddlmZ ddlmZ G dd� de �Z dS )z!Transaction classes for firewalld�FirewallTransaction� N)�log)�errors)� FirewallErrorc @ s� e Zd Zdd� Zdd� Zdd� Zdd� Zd d � Zd d � Zd d� Z dd� Z dd� Z dd� Z dd� Z dd� Zdd� Zdd � Zd d � Zd d � Zd!d"� Zd#S )$r c C s( || _ i | _g | _g | _g | _g | _d S �N)�fw�rules� pre_funcs� post_funcs� fail_funcs�modules)�selfr � r �>/usr/lib/python3/dist-packages/firewall/core/fw_transaction.py�__init__! s z FirewallTransaction.__init__c C s2 | j �� | jd d �= | jd d �= | jd d �= d S r )r �clearr r r )r r r r r ) s zFirewallTransaction.clearc C s | j �|jg ��|� d S r )r � setdefault�name�append�r �backend�ruler r r �add_rule/ s z FirewallTransaction.add_rulec C s |D ]}| � ||� qd S r )r )r r r r r r r � add_rules2 s �z FirewallTransaction.add_rulesc C s |j | jv o || j|j v S r )r r r r r r � query_rule6 s z FirewallTransaction.query_rulec C s: |j | jv r|| j|j v r| j|j �|� d S d S d S r )r r �remover r r r � remove_rule9 s �z FirewallTransaction.remove_rulec G � | j �||f� d S r )r r �r �func�argsr r r �add_pre= � zFirewallTransaction.add_prec G r r )r r r r r r �add_post@ r" z FirewallTransaction.add_postc G r r )r r r r r r �add_failC r" z FirewallTransaction.add_failc C s || j vr | j �|� d S d S r )r r �r �moduler r r � add_moduleF � �z FirewallTransaction.add_modulec C s || j v r | j �|� d S d S r )r r r% r r r � remove_moduleJ r( z!FirewallTransaction.remove_modulec C � |D ]}| � |� qd S r )r' �r r r& r r r � add_modulesN � �z FirewallTransaction.add_modulesc C r* r )r) r+ r r r �remove_modulesR r- z"FirewallTransaction.remove_modulesc C s� t �dt| �|df � i }|s1| jD ] }t| j| �D ]}|�|g ��| j�|�� |�� q qn| jD ]}|�|g �� | j| � q4|| j fS )Nz%s.prepare(%s, %s)z...) r �debug4�typer �reversedr r r �get_backend_by_name� reverse_rule�extendr )r �enabler � backend_namer r r r �prepareV s ��� zFirewallTransaction.preparec C s� t �dt| �|f � | �|�\}}| �� d}d}g }|D ]5}z | j�||| � W n" tyM } zd}|}t �t � � � t � |� W Y d }~q d }~ww |� |� q |sj| j� ||�} | rj| \} }| rjt �|� |r�i } |D ] }g | |< t|| �D ]} | | � | j�|��| �� q|qp| D ]+}z | j�|| | � W q� ty� } zt �t � � � t � |� W Y d }~q�d }~ww | jD ]-\} }z| |� W q� ty� } zt �t � � � t � d| ||f � W Y d }~q�d }~ww ttj|��| �� d S )Nz%s.execute(%s)F� Tz#Calling fail func %s(%s) failed: %s)r r/ r0 r7 �prer r � Exception�debug1� traceback� format_exc�errorr �handle_modulesr1 r2 r3 r r r �COMMAND_FAILED�post)r r5 r r r> �errorMsg�doner6 �msg� module_return�status� undo_rulesr r r r r r �executef sh �� ���� ��� zFirewallTransaction.executec C �. t �dt| � � | jD ]\}}||� q d S )Nz%s.pre())r r/ r0 r r r r r r9 � � �zFirewallTransaction.prec C rI )Nz %s.post())r r/ r0 r r r r r rA � rJ zFirewallTransaction.postN)�__name__� __module__� __qualname__r r r r r r r! r# r$ r' r) r, r. r7 rH r9 rA r r r r r s$ @ ) �__doc__�__all__r< �firewall.core.loggerr �firewallr �firewall.errorsr �objectr r r r r �<module> s PK ���Z�t,�� �� ) core/__pycache__/nftables.cpython-310.pycnu �[��� o bhAb�t � @ s0 d dl Z d dlZd dlZd dlmZ d dlmZmZmZm Z m Z d dl m Z m Z mZmZmZmZmZ d dlmZmZmZmZmZmZmZmZm Z d dl m Z d dl m Z dZ!e!d d Z"d Z#d Z$i d dde$ fidde$ fdde$ fdde$ fd�dd e$ fdd e$ fdd e$ fdd e$ fd�d�Z%d^dd�Z&i de&d d d ��d e&d d ��d e&d d ��d e&d d ��d!e&d d d"��d#e&d d d$��d%e&d d d ��d&e&d d'd(��d)e&d d d*��d+e&d d d(��d,e&d d-d(��d.e&d d d/��d0e&d d'd ��d1e&d d d2��d3e&d d d ��d-e&d d-��d4e&d d d5��i d6e&d d d7��d8e&d d d9��d'e&d d'��d:e&d d-d(��d;e&d d;��d<e&d d<��d=e&d d=��d>e&d d d?��d@e&d d@��dAe&d dA��dBe&d dB��dCe&d d'd5��dDe&d d dE��dFe&d d'd9��dGe&d d dH��dIe&d d@d(��dJe&d d@d ���i dKe&dLd d5��dMe&dLd-d ��dNe&dLd d9��de&dLd d(��d e&dLd ��d e&dLd ��d e&dLd ��dOe&dLd d?��dPe&dLdQ��dRe&dLdS��dTe&dLd d ��dUe&dLdU��d-e&dLd-��d4e&dLd d"��d'e&dLdV��dWe&dLd d2��d;e&dLdX��e&dLdY�e&dLd@�e&dLd@d(�e&dLd@d �e&dLd-d(�e&dLd-d9�dZ��d[�Z'G d\d]� d]e(�Z)dS )_� N)�log)� check_mac� getPortRange� normalizeIP6�check_single_address� check_address)� FirewallError� UNKNOWN_ERROR� INVALID_RULE�INVALID_ICMPTYPE� INVALID_TYPE� INVALID_ENTRY� INVALID_PORT) � Rich_Accept� Rich_Reject� Rich_Drop� Rich_Mark�Rich_Masquerade�Rich_ForwardPort�Rich_IcmpBlock�Rich_Tcp_Mss_Clamp� Rich_NFLog)�DEFAULT_ZONE_TARGET)�Nftables� firewalld�_� policy_drop�policy_� � PREROUTING� preroutingij���i����� postrouting�d �output)r � POSTROUTING�OUTPUT�input�forward)r �INPUT�FORWARDr% )�raw�mangle�nat�filterc C sH dd| dd�id|d�ig}|d ur"|� dd| dd�id|d�i� |S )N�match�payload�type��protocol�field�==��left�op�right�code)�append)r2 r0 r9 � fragments� r< �8/usr/lib/python3/dist-packages/firewall/core/nftables.py�_icmp_types_fragmentsS s � �r> zcommunication-prohibited�icmpzdestination-unreachable� z echo-replyz echo-requestzfragmentation-needed� zhost-precedence-violation� �host-prohibitedz host-redirect�redirect� z host-unknown� �host-unreachablez ip-header-badzparameter-problemznetwork-prohibited� znetwork-redirectznetwork-unknown� znetwork-unreachable�port-unreachable� zprecedence-cutoff� zprotocol-unreachable� zrequired-option-missingzrouter-advertisement�router-solicitationz source-quenchzsource-route-failed� � time-exceededztimestamp-replyztimestamp-requestztos-host-redirectztos-host-unreachable� ztos-network-redirectztos-network-unreachable� �ttl-zero-during-reassembly�ttl-zero-during-transitzaddress-unreachable�icmpv6z bad-headerz beyond-scopez failed-policyzneighbour-advertisementznd-neighbor-advertzneighbour-solicitation�nd-neighbor-solicit�no-routezpacket-too-bigz nd-redirectz reject-route�nd-router-advertznd-router-solicit)rN rP rS rT zunknown-header-typezunknown-option��ipv4�ipv6c @ sR e Zd Zd ZdZdd� Zdd� Zdd� Zdd � Zd d � Z d d � Z dd� Z d�dd�Z dd� Z dd� Zdd� Zd�dd�Zdd � Zd�d d �Zd d!� Zd"d#� Z $d�d%d&�Zd'd(� Zd)d*� Zd+d,� Zd-d.� Zd/d0� Zd1d2� Zd3d4� Z d5d6� Z d7d8� Z d9d:� Z d;d<� Z d=d>� Z!d?d@� Z"dAdB� Z#dCdD� Z$dEdF� Z%d�dGdH�Z&dIdJ� Z'dKdL� Z(dMdN� Z)dOdP� Z*d�dQdR�Z+d�dSdT�Z, d�dUdV�Z- d�dWdX�Z.dYdZ� Z/d�d[d\�Z0d�d]d^�Z1 d�d_d`�Z2dadb� Z3d�dcdd�Z4dedf� Z5d�dgdh�Z6didj� Z7dkdl� Z8dmdn� Z9dodp� Z:d�dqdr�Z;d�dsdt�Z<dudv� Z=d�dwdx�Z>dydz� Z?d{d|� Z@d}d~� ZAdd�� ZBd�d�� ZCd�d�� ZDd�d�� ZE d�d�d��ZFdS )��nftablesTc C s^ || _ d| _g | _i | _i | _i | _i | _i | _dg i| _t � | _ | j � d� | j � d� d S )NT�inet) �_fw�restore_command_exists�available_tables�rule_to_handle�rule_ref_count�rich_rule_priority_counts�policy_priority_counts�zone_source_index_cache�created_tablesr r\ �set_echo_output�set_handle_output)�self�fwr< r< r= �__init__� s znftables.__init__c C s� dD ]}||v r nqd|| d v r/|| d d d || d d d f}|| d d= nd|| d v rAd }|| d d= nd S || d d }|rh|dkrh||v rd||| v rf|| � |� d S d S d S |dkr�||vrtg ||< |r�||| vr�|| �|� || jd d � d � || �|�}nt|| �}|| }||= |d kr�||d < d S |d8 }||d< ||d d d< d S d S )N��add�insert�delete�%%ZONE_SOURCE%%�rule�zone�address�%%ZONE_INTERFACE%%�familyro c S s | d S )Nr r< )�xr< r< r= �<lambda>� s z3nftables._run_replace_zone_source.<locals>.<lambda>)�keyr rn rE rm �index)�remover: �sortry �len)ri rq re �verb� zone_sourceru ry � _verb_snippetr< r< r= �_run_replace_zone_source� sJ �� � �z!nftables._run_replace_zone_sourcec C s> d|v r dt �|d �iS d|v rdt �|d �iS ttd��)Nrn ro rm zFailed to reverse rule)�copy�deepcopyr r )ri �dictr< r< r= � reverse_rule� s znftables.reverse_rulec C s� dD ]}||v r nq||| d v r�|| d | }|| d |= t |�tkr-ttd��|| d d || d d f}|dkrd||vsS||| vsS|| | dkrXttd��|| | d 8 < d S ||vrli ||< ||| vrxd|| |< d}t|| �� �D ] }||kr�|d kr� n||| | 7 }||kr�|d kr� nq�|| | d 7 < || } ||= |dkr�| |d < d S |d 8 }| |d < ||d d d < d S d S ) Nrl rq z%priority must be followed by a numberru �chainro r z*nonexistent or underflow of priority countrE rn rm ry )r0 �intr r r �sorted�keys) ri rq �priority_counts�tokenr} �priorityr� ry �pr r< r< r= �_set_rule_replace_priority� sJ � � �z#nftables._set_rule_replace_priorityc C sb dD ],}||v r.d|| v r.t �|| d �}dD ] }||v r"||= qtj|dd�}| S qd S )Nrl rq )ry �handle�positionT)� sort_keys)r� r� �json�dumps)ri rq r} �rule_key�non_keyr< r< r= � _get_rule_key s ��znftables._get_rule_keyc C s g d�}g d�}g }g }t �| j�}t �| j�}t �| j�} | j� � } |D ]�} t| �tkr4tt d| ��|D ]} | | v r> nq6| | vrJtt d| ��| � | �} | | v r�t � d| j| | | � | dkrk| | d7 < q%| | dkrz| | d8 < q%| | dkr�| | d8 < ntt d| | | f ��| r�| dkr�d| | < |�| � t �| �}| r�ttd || d d ��|| d d < | �||d � | �||d � | �|| � | dkr�dd |d d d |d d d |d d d | j| d�ii}|�|� q%ddddiig| i}t �� dk�rt �d| jt�|�� | j�|�\}}}|dk�r2tdd|t�|�f ��|| _|| _| | _| | _d}|D ]K} |d7 }| � | �} | �sR�qBd| v �ra| j| = | j| = �qB|D ]} | |d | v �rp n�qc| |d | v�r}�qB|d | | d d | j| < �qBd S )N)rm rn ro �flush�replace)rm rn r� z#rule must be a dictionary, rule: %sz no valid verb found, rule: %sz %s: prev rule ref cnt %d, %sro rE z)rule ref count bug: rule_key '%s', cnt %drq �expr�%%RICH_RULE_PRIORITY%%�%%POLICY_PRIORITY%%ru �tabler� )ru r� r� r� r\ �metainfo�json_schema_versionrK z.%s: calling python-nftables with JSON blob: %sr z '%s' failed: %s JSON blob: %szpython-nftablesr� ) r� r� rc rd re rb r0 r� r r r r� r �debug2� __class__r: �listr- r� r� ra �getDebugLogLevel�debug3r� r� r\ �json_cmd� ValueError)ri �rules� log_denied� _valid_verbs�_valid_add_verbs�_deduplicated_rules�_executed_rulesrc rd re rb rq r} r� �_rule� json_blob�rcr# �errorry r< r< r= � set_rules$ s� � � � & � � �"�znftables.set_rulesc C s | � |g|� dS )N� )r� )ri rq r� r< r< r= �set_rule� s znftables.set_ruleNc C s |r|gS t �� S �N)�IPTABLES_TO_NFT_HOOKr� �ri r� r< r< r= �get_available_tables� s z nftables.get_available_tablesc C s� i }i }| � d�D ]}| �|�}|| jv r#| j| ||< | j| ||< q || _|| _i | _i | _i | _g }t| jd v rP|� dddtd�ii� | jd � t� |S )NTr] ro r� �ru �name) � _build_set_policy_rules_ct_rulesr� ra rb rc rd re � TABLE_NAMErf r: rz )ri �saved_rule_to_handle�saved_rule_ref_countrq � policy_keyr� r< r< r= �build_flush_rules� s( � �znftables.build_flush_rulesc C sh ddd�| }g }dD ]&}|� |ddtdd|f d d d d iid dddgid�idd igd�ii� q |S )Nrm ro �TF�r& r' r# rq r] �%s_%sr- r. �ctrx �state�in�set� established�relatedr5 �accept�ru r� r� r� )r: �TABLE_NAME_POLICY)ri �enable�add_delr� �hookr< r< r= r� � s ���z)nftables._build_set_policy_rules_ct_rulesc C sl g }|dkr8|� dddtd�ii� | jd � t� dD ]}|� dddtdd |f d |d t d d d�ii� q |dkrw|� dddtd�ii� | jd � t� dD ]}|� dddtdd |f d |dt d d d�ii� qR|| �d�7 }|S |dkr�| �d�D ]}| �|�}|| jv r�|� |� q�t| jd v r�|� dddtd�ii� | jd �t� |S tt d� |S )N�PANICrm r� r] r� )r r# r� r� r* r- i���rE �drop)ru r� r� r0 r� �prio�policy�DROPr� r T�ACCEPTFro znot implemented) r: r� rf �NFT_HOOK_OFFSETr� r� ra rz r r )ri r� r� r� rq r� r< r< r= �build_set_policy_rules� sZ � � � �� � � �z nftables.build_set_policy_rulesc C s8 t � }|r|gnt�� D ] }|�t| �� � q t|�S r� )r� �ICMP_TYPES_FRAGMENTSr� �updater� )ri �ipv� supported�_ipvr< r< r= �supported_icmp_types� s z nftables.supported_icmp_typesc C s0 g }|� dddtd�ii� | jd � t� |S )Nrm r� r] r� )r: r� rf )ri �default_tablesr< r< r= �build_default_tables� s �z nftables.build_default_tables�offc C s g }t d �� D ]V}|�dddtd| ddt d | d t d | d d �ii� d D ]}|�dddtd ||f d �ii� q,dD ]}|�dddtd| ddd ||f iigd�ii� qBqt d �� D ]�}|�dddtd| ddt d | d t d | d d �ii� |dv r�dD ],}|�dddtd||f d �ii� |�dddtd| ddd||f iigd�ii� q�qed D ]}|�dddtd||f d �ii� q�dD ]}|�dddtd| ddd||f iigd�ii� q�qet d �� D ]"}|�dddtd| ddt d | d t d | d d �ii� q�|�dddtdd ddd d iid d d d!gid"�id#d igd�ii� |�dddtdd ddd d$iid d%d"�id#d igd�ii� |�dddtdd dd&d d'iid(d)d"�id#d igd�ii� d D ]}|�dddtd*d|f d �ii� �qydD ] }|�dddtdd ddd*d|f iigd�ii� �q�|d+k�r�|�dddtdd ddd d iid d d,gid"�i| �|�d-d.d/iigd�ii� |�dddtdd ddd d iid d d,gid"�id0d igd�ii� |d+k�r|�dddtdd | �|�d-d.d1iigd�ii� |�dddtdd d2d3d4d5�igd�ii� |�dddtdd6 ddd d iid d d d!gid"�id#d igd�ii� |�dddtdd6 ddd d$iid d%d"�id#d igd�ii� |�dddtdd6 dd&d d'iid(d)d"�id#d igd�ii� d7D ]}|�dddtd*d6|f d �ii� �q�dD ]-}|�dddtd*d6|f d �ii� |�dddtdd6 ddd*d6|f iigd�ii� �q�d8D ]}|�dddtd*d6|f d �ii� �q�|d+k�r|�dddtdd6 ddd d iid d d,gid"�i| �|�d-d.d/iigd�ii� |�dddtdd6 ddd d iid d d,gid"�id0d igd�ii� |d+k�rU|�dddtdd6 | �|�d-d.d1iigd�ii� |�dddtdd6 d2d3d4d5�igd�ii� |�dddtdd9 ddd d iid d d d!gid"�id#d igd�ii� |�dddtd:dd&d d;iid(d)d"�id#d igd�ii� d7D ]-}|�dddtd*d9|f d �ii� |�dddtdd9 ddd*d9|f iigd�ii� �q�d8D ]-}|�dddtd*d9|f d �ii� |�dddtdd9 ddd*d9|f iigd�ii� �q�|S )<Nr+ rm r� r] z mangle_%sr- �%sr rE )ru r� r� r0 r� r� )� POLICIES_pre�ZONES� POLICIES_postz mangle_%s_%s�ru r� r� )r� rq �jump�targetr� r, znat_%s)r% )r� r� � nat_%s_%sz filter_%sr( r. r� rx r� r� r� r� r� r5 r� �status�dnat�meta�iifnamer4 �lo� filter_%s_%sr� �invalidr �prefixzSTATE_INVALID_DROP: r� zFINAL_REJECT: �reject�icmpx�admin-prohibited�r0 r� r) )r� )r� r% � filter_OUTPUT�oifname)r� r� r: r� �_pkttype_match_fragment)ri r� � default_rulesr� �dispatch_suffixr< r< r= �build_default_rules� s � � �� � � �� � �� � �� � �� � �� � � � � � � �� � � � � �� � �� � �� � � � � � � � � �� � � � � �� � �� � � � � �z nftables.build_default_rulesc C s2 |dkrddgS |dkrdgS |dkrddgS g S )Nr- r( r) r+ r r, r$ r< r� r< r< r= �get_zone_table_chains� s z nftables.get_zone_table_chainsc s| �j j�|���jdk rdnd��dkr�dkrdnd} �j j�|�t| �� g } g } |r?| �dd d d iid d t|�id�i� |rT| �dd d diid d t|�id�i� |rd|D ] } | ���d| �� qX|rt|D ] } | ���d| �� qh� ������fdd�}g }| r�| D ]}| r�| D ] }|�|||�� q�q�|�||d �� q�|S | r�| D ] }|�|d |�� q�|S |�|d d �� |S )Nr �pre�postr, r$ TFr. r� rx r� r4 r� r5 r� �saddr�daddrc s~ g }| r |� | � |r|� |� |� ddd�� f ii� dtd���f |d�}|������ �r9dd|iiS d d|iiS ) Nr� r� r� r] z%s_%s_POLICIES_%sr� rm rq ro )r: r� r� �_policy_priority_fragment)�ingress_fragment�egress_fragment�expr_fragmentsrq ��_policyr� � chain_suffixr� �p_objri r� r< r= � _generate_policy_dispatch_rule� s � zRnftables.build_policy_ingress_egress_rules.<locals>._generate_policy_dispatch_rule) r^ r� � get_policyr� �policy_base_chain_name�POLICY_CHAIN_PREFIXr: r� �_rule_addr_fragment)ri r� r� r� r� �ingress_interfaces�egress_interfaces�ingress_sources�egress_sources�isSNAT�ingress_fragments�egress_fragments�src�dstr r� r� r� r< r r= �!build_policy_ingress_egress_rules� sL � �� ��z*nftables.build_policy_ingress_egress_rulesFc C sJ |dkr |dkr dnd}| j jj||t|d�} dddddd�| } |t|�d d kr7|d t|�d � d }d } |d krI| d d|| f iig} nddd| iid|d�i| d d|| f iig} |rx|sxd} dtd||f | d�}|�| �� � n&|r�d} dtd||f | d�}nd} dtd||f | d�}|s�|�| �� � | d|iigS )Nr, r$ TF�r r� r� �r r$ r( r) r% rE �+�*�gotor� r� r. r� rx r4 r5 rn r] � %s_%s_ZONESr� rm ro rq )r^ r� r r r| r� r� �_zone_interface_fragment)ri r� rr r� � interfacer� r� r: r r �opt�actionr r} rq r< r< r= �!build_zone_source_interface_rules sZ �� �� � � �z*nftables.build_zone_source_interface_rulesc C s� |dkr |dkr dnd}| j jj||t|d�}ddd�| } d d d d d d �| } d } d td||f | �| |�| dd||f iigd�} | �| �||�� | d| iigS )Nr, r$ TFr rn ro r� r� r� r r r] r r� r� r� rq )r^ r� r r r� r r� �_zone_source_fragment) ri r� rr r� rs r� r� r r r� r r rq r< r< r= � build_zone_source_address_rulesI s* �� ��z(nftables.build_zone_source_address_rulesc C sf ddd�| }|dkr|dkrdnd}| j jj||t|d�}| j j�|�}g } | �|d d td ||f d �ii� d D ]} | �|d d td||| f d �ii� q:|jrn| �ddd td ||f ddd||df iigd�ii� d D ] } | �|dd td ||f ddd||| f iigd�ii� qp|jr�| �ddd td ||f ddd||df iigd�ii� | j jj| j } | j � � dkr�|dkr�| t dddfv r�| } | t dfv r�d} | �|dd td ||f | � | j � � �ddd || f iigd�ii� |dk�r*| t d dddfv �r*| t ddfv �r| � � } n| �� d i} | �|dd td ||f | gd�ii� |�s1| �� | S ) Nrm ro r� r, r$ TFr r� r] r� r� )r� r �deny�allowr� �%s_%s_%srq r� r� r� r� r� r� r- �REJECTz %%REJECT%%r� r r� z"filter_%s_%s: "r� )r^ r� r r r r: r� �derived_from_zone� _policiesr� �get_log_deniedr r� �_reject_fragment�lower�reverse)ri r� r� r� r� r� r r r r� r r� � log_suffix�target_fragmentr< r< r= �build_policy_chain_rulesa sv � � � � � � � �z!nftables.build_policy_chain_rulesc C s8 |dkri S |dv rddddiid|d�iS t td |��) N�all)�unicast� broadcast� multicastr. r� rx �pkttyper4 r5 zInvalid pkttype "%s"�r r )ri r2 r< r< r= r� � s � z nftables._pkttype_match_fragmentc C sf i ddddd�i�ddddd�i�ddddd�i�d dddd�i�d ddd d�i�d ddd d�i�d ddd d�i�dddd d�i�ddddd�i�ddddd�i�ddddd�i�ddddd�i�ddddd�i�ddddd�i�ddddd�i�dddd d�i�d ddd d�i�ddd d�iddd d�iddd d�iddd d�idd d!iidd d!iid"��}|| S )#Nzicmp-host-prohibitedr� r? rC r� z host-prohibzicmp-net-prohibitedznet-prohibitedz net-prohibzicmp-admin-prohibitedr� z admin-prohibzicmp6-adm-prohibitedrU zadm-prohibitedzicmp-net-unreachableznet-unreachablez net-unreachzicmp-host-unreachablerG z host-unreachzicmp-port-unreachablerJ zicmp6-port-unreachablez port-unreachr� zicmp-proto-unreachablezprot-unreachablez proto-unreachzaddr-unreachablerW r0 z tcp reset)zicmp6-addr-unreachable� addr-unreachzicmp6-no-routerW z tcp-resetztcp-rstr< )ri � reject_type�fragsr< r< r= �_reject_types_fragment� sV ������� � � � ������� � z nftables._reject_types_fragmentc C s dddd�iS )Nr� r� r� r� r< �ri r< r< r= r( � s �znftables._reject_fragmentc C s ddddiiddddgid �iS ) Nr. r� rx �l4protor4 r� r? rU r5 r< r8 r< r< r= �_icmp_match_fragment� s �z nftables._icmp_match_fragmentc C sj |si S ddddd�}z|j �d�}W n ty ttd��w dt|j d |� �||j |d d �iS ) N�second�minute�hour�day)�s�m�h�d�/zExpected '/' in limit�limitr rE )�rate�per)�valuery r� r r r� )ri rD � rich_to_nft�ir< r< r= �_rich_rule_limit_fragment� s � ��z"nftables._rich_rule_limit_fragmentc C s� t |j�ttttfv r n |jr%t |j�ttt t fvr$t t dt |j� ��nt t d��|j dkrYt |j�tttfv sBt |j�tt fv rDdS t |j�tfv sUt |j�tt fv rWdS d S |j dk r`dS dS )N�Unknown action %szNo rule action specified.r r" r! r� r� )r0 �elementr r r r r r r r r r r r� �ri � rich_ruler< r< r= �_rich_rule_chain_suffix� s$ � � z nftables._rich_rule_chain_suffixc C s6 |j s |js ttd��|jdkrdS |jdk rdS dS )NzNot log or auditr r r� r� )r �auditr r r� rM r< r< r= � _rich_rule_chain_suffix_from_log� s z)nftables._rich_rule_chain_suffix_from_logc C s dd iS )Nrt r< r8 r< r< r= r s z!nftables._zone_interface_fragmentc C sN t d|�r t|�}ntd|�r |�d�}t|d �d |d }d||d�iS )Nr[ rC r rE rp )rr rs )r r r �split)ri rr rs � addr_splitr< r< r= r s z nftables._zone_source_fragmentc C s d|j iS )Nr� �r� )ri r� r< r< r= r� s z"nftables._policy_priority_fragmentc C s |r|j dkr i S d|j iS )Nr r� rT rM r< r< r= � _rich_rule_priority_fragment s z%nftables._rich_rule_priority_fragmentc C s |j si S | jj�||t�}ddd�| }| �|�}i } t|j �tkr>|j jr-t |j j�nd| d< |j j r=t |j j �| d< n|j j rTd|j j krJdn|j j } d | | d < |j j r`d |j j | d < d t d |||f |d| i| �|j j�g d�} | �| �|�� |d| iiS )Nrm ro r� r �groupzqueue-threshold�warning�warnr� �levelr� r] r# r r� rq )r r^ r� r r rQ r0 r rV r� � thresholdrY r� r� rJ rD r� rU ) ri r� rN r� r� r r r� r � log_optionsrY rq r< r< r= �_rich_rule_log s6 � ��� znftables._rich_rule_logc C s� |j si S | jj�||t�}ddd�| }| �|�}dtd|||f |dddii| �|j j�g d �} | � | � |�� |d | iiS ) Nrm ro r� r] r# r rY rP r� rq ) rP r^ r� r r rQ r� rJ rD r� rU ) ri r� rN r� r� r r r� r rq r< r< r= �_rich_rule_audit= s ��� znftables._rich_rule_auditc C s� |j si S | jj�||t�}ddd�| }| �|�}d|||f } t|j �tkr-dd i} n~t|j �tkrE|j jr@| � |j j�} nkdd i} nft|j �t krQdd i} nZt|j �t kr�d}| jj�||t�}d|||f } |j j � d �} t| �d kr�dd d d iiddd d d ii| d gi| d gid�i} ndd d d ii| d d�i} n ttdt|j � ��dt| || �|j j�| g d�} | �| �|�� |d| iiS )Nrm ro r� r# r� r� r� r+ rC rE r� rx �mark�^�&r �rx rG rK r] r� rq )r r^ r� r r rO r0 r r r7 r r r� rR r| r r r� rJ rD r� rU ) ri r� rN r� r� r r r� r r� � rule_actionrG rq r< r< r= �_rich_rule_actionO sL " � � ��� znftables._rich_rule_actionc C s� |� d�r| �|td�d � d|krd|�S d|�S t|�r!d}nCtd|�r)d}n;td|�rBd}tj|dd�}d |jj |j d �i}n"td |�rNd }t |�}nd }|� d �}d t |d �t |d �d �i}dd||d�i|rodnd|d�iS )N�ipset:r� TF�etherrZ �ip)�strictr� ��addrr| r[ �ip6rC r rE r. r/ r1 �!=r4 r5 )� startswith�_set_match_fragmentr| r r r � ipaddress� IPv4Network�network_address� compressed� prefixlenr rR r� )ri � addr_fieldrs �invertru �normalized_address�addr_lenr< r< r= r z s, * � �z nftables._rule_addr_fragmentc C s6 |si S |dvrt td| ��ddddiid|d�iS ) NrY zInvalid familyr. r� rx �nfprotor4 r5 r3 )ri � rich_familyr< r< r= �_rich_rule_family_fragment� s � �z#nftables._rich_rule_family_fragmentc C s8 |si S |j r |j }n|jrd|j }| jd||jd�S )Nrd r� �rt )ri �ipsetr rt )ri � rich_destrs r< r< r= � _rich_rule_destination_fragment� s z(nftables._rich_rule_destination_fragmentc C sZ |si S |j r |j }nt|d�r|jr|j}n t|d�r$|jr$d|j }| jd||jd�S )N�macr{ rd r� rz )ri �hasattrr~ r{ r rt )ri � rich_sourcers r< r< r= �_rich_rule_source_fragment� s z#nftables._rich_rule_source_fragmentc C sJ t |�}t|t�r|dk rtt��t|�dkr|d S d|d |d giS )Nr rE �range)r � isinstancer� r r r| )ri �portr� r< r< r= �_port_fragment� s znftables._port_fragmentc C �` ddd�| }d}| j j�||t�} g } |r | �| �|j�� |r*| �| �d|�� |r>| �| �|j �� | �| � |j �� | �dd|dd �id | � |�d �i� |rZt |j�tkrm| �dd d diiddddgid �i� g } |r�| �| �||||| �� | �| �||||| �� | �| �||||| �� | S | �|ddtd|| f | dd ig d�ii� | S )Nrm ro r� r- r� r. r/ �dportr1 r4 r5 r� rx r� r� r� �new� untrackedrq r] � %s_%s_allowr� r� �r^ r� r r r: ry ru r r} � destinationr� �sourcer� r0 r r r\ r] rc r� � ri r� r� �protor� r� rN r� r� r r r� r< r< r= �build_policy_ports_rules� sD � � � � �z!nftables.build_policy_ports_rulesc C sX ddd�| }d}| j j�||t�}g } |r | �| �|j�� |r*| �| �d|�� |r>| �| �|j �� | �| � |j �� | �dddd iid |d �i� |rVt |j �tkri| �dd dd iiddddgid �i� g } |r�| �| �||||| �� | �| �||||| �� | �| �||||| �� | S | �|ddtd||f | dd ig d�ii� | S )Nrm ro r� r- r� r. r� rx r9 r4 r5 r� r� r� r� r� r� rq r] r� r� r� )r^ r� r r r: ry ru r r} r� r� r� r0 r r r\ r] rc r� ) ri r� r� r2 r� rN r� r� r r r� r< r< r= �build_policy_protocol_rules� s@ � � � �z$nftables.build_policy_protocol_rulesc C s� d}| j j�||t�}ddd�| }g } |r-| �| �|j�� | �| �|j�� | � |�} | �ddddd d �id d �i� |d ksE|d u rY| �ddddd�idddiid�i� n| �ddddd�i|d�i� g } | �|ddt d|| f | d�ii� | S )Nr- rm ro r� r. r� r/ �tcp�flagsr1 �syn)r7 r6 r8 �pmtur+ z tcp option�maxseg�size)r� r3 �rtrx �mtura rq r] r� r� ) r^ r� r r r: r} r� r� r� rO r� ) ri r� r� �tcp_mss_clamp_valuer� rN r� r r� r r r� r< r< r= � build_policy_tcp_mss_clamp_rules s4 � � � �z)nftables.build_policy_tcp_mss_clamp_rulesc C r� )Nrm ro r� r- r� r. r/ �sportr1 r4 r5 r� rx r� r� r� r� r� rq r] r� r� r� r� r� r< r< r= � build_policy_source_ports_rules# sD � � � � �z(nftables.build_policy_source_ports_rulesc C s� d}| j j�||t�} ddd�| } g } |r)| �dddtd||f ||d�ii� g } |r6| �| �d |�� | �d d |d d �id| �|�d�i� | �dd||f i� | �| ddtd| | d�ii� | S )Nr- rm ro r� z ct helperr] z helper-%s-%s)ru r� r� r0 r2 r� r. r/ r� r1 r4 r5 rq �filter_%s_allowr� )r^ r� r r r: r� r r� ) ri r� r� r� r� r� � helper_name�module_short_namer� r r� r� r r< r< r= � build_policy_helper_ports_rulesH s6 � � � �z(nftables.build_policy_helper_ports_rulesc C s� ddd�| }| j j�||t�}g } |r;|t|�d dkr*|d t|�d � d }ddd d iid |d �id d ig} n | �d|�d d ig} dtd| | d�} | �|d| ii� | S )Nrm ro r� rE r r r. r� rx r� r4 r5 r� r� r] r� r� rq )r^ r� r r r| r r� r: ) ri r� rr r� r� r r� r� r r� r� rq r< r< r= �build_zone_forward_rulese s( ���z!nftables.build_zone_forward_rulesc C s� ddd�| }g }g }|r.|� | �|j�� |� | �|j�� |� | �|j�� | �|�}n|� ddddiidd d �i� d }d }| jj j ||t d d�} dt d| |f |ddddiiddd �idd ig d�} | � | �|�� |� |d| ii� |S )Nrm ro r� r. r� rx rw r4 rZ r5 r" r, Tr r] r� r� rk r� � masquerader� rq )r: ry ru r} r� r� r� rO r^ r� r r r� r� rU ) ri r� r� rN r� r� r r r� r rq r< r< r= � build_policy_masquerade_rules~ s< � ����z&nftables.build_policy_masquerade_rulesc C sj d}| j j�||t�} ddd�| } g } |r7| �| �|j�� | �| �|j�� | �| � |j �� | � |�} n d} |rBt d|�rBd} | �ddd d iid | d �i� d } | �dd|dd�id | � |�d �i� |r�t d|�rqt|�}|r�|dkr�| �d|| � |�d�i� n| �dd|ii� n | �dd| � |�ii� dtd| | f | d�}|�| �|�� | d|iigS )Nr, rm ro r� rZ r[ r. r� rx rw r4 r5 r" r/ r� r1 r� r� )ri r� ri rD r� r] r� r� rq )r^ r� r r r: ry ru r} r� r� r� rO r r� r r� r� rU )ri r� r� r� r2 �toport�toaddrrN r� r r� r r rw rq r< r< r= � build_policy_forward_port_rules� sJ � � � �z(nftables.build_policy_forward_port_rulesc C s. |t | v r t | | S ttd|| j|f ��)Nz)ICMP type '%s' not supported by %s for %s)r� r r r� )ri r� � icmp_typer< r< r= � _icmp_types_to_nft_fragments� s �z%nftables._icmp_types_to_nft_fragmentsc C s4 d}| j j�||t�}ddd�| }|r|jr|j}n |jr5g }d|jv r*|�d� d|jv r4|�d� nddg}g } |D ]�} | j j�|�rQd||f } dd i} n d ||f } | �� } g } |rz| �| � |j �� | �| � |j�� | �| � |j �� | �| �| |j�� |r�| �| �||||| �� | �| �||||| �� |jr�| �| �||||| �� q=| �|�}d td |||f | | �� g d �}|�| �|�� | �|d |ii� q=| j �� dk�r| j j�|��s| �|d d t| | | �| j �� �ddd||f iig d �ii� | �|d d t| | | g d �ii� q=| S )Nr- rm ro r� rZ r[ r� r� z %s_%s_denyr] r# r� rq r� r r� z"%s_%s_ICMP_BLOCK: ")r^ r� r r �ipvsr� r: �query_icmp_block_inversionr( ry ru r} r� r� �extendr� r� r\ r] r rc rO r� r� rU r' r� )ri r� r� �ictrN r� r r� r� r� r� � final_chainr, r r rq r< r< r= � build_policy_icmp_block_rules� sn � � �� � �z&nftables.build_policy_icmp_block_rulesc C s� d}| j j�||t�}g }ddd�| }| j j�|�r | �� }ndd i}|�|ddtd||f d | �� |gd �ii� | j � � d kro| j j�|�ro|�|ddtd||f d | �� | � | j � � �d d d||f iigd �ii� |S )Nr- rm ro r� r� rq r] r� rI �ru r� r� ry r� r� r r� z%s_%s_ICMP_BLOCK: ) r^ r� r r r� r( r: r� r: r' r� )ri r� r� r� r r� r� r, r< r< r= �'build_policy_icmp_block_inversion_rules s4 � � � �z0nftables.build_policy_icmp_block_inversion_rulesc C s� g }ddddiiddd�iddg d �d d �idd d�ig}|d kr*|� dddii� |� dd i� |� dddtd|d�ii� |� dddtdddddd�iddd d gid�id d igd�ii� |S ) Nr. r� rx rw r4 r[ r5 �fib)r� �iifr^ �oif)r� �resultFr� r r� zrpfilter_DROP: r� rn rq r] �filter_PREROUTINGr� r/ rU r0 r1 r� rX rV r� )r: r� )ri r� r� r r< r< r= �build_rpfilter_rules+ sB � ��� � � �� �z nftables.build_rpfilter_rulesc C s� g d�}dd� |D �}ddddd�id d |id �ig}| j jd v r*|�d ddii� |�| �d�� g }|�dddtdd|d�ii� |�dddtdd|d�ii� |S )N) z ::0.0.0.0/96z::ffff:0.0.0.0/96z2002:0000::/24z2002:0a00::/24z2002:7f00::/24z2002:ac10::/28z2002:c0a8::/32z2002:a9fe::/32z2002:e000::/19c S s2 g | ]}d |� d�d t|� d�d �d�i�qS )r� rC r rE rh )rR r� )�.0rv r< r< r= � <listcomp>R s 2 z5nftables.build_rfc3964_ipv4_rules.<locals>.<listcomp>r. r/ rj r� r1 r4 r� r5 )r/ r. r r� zRFC3964_IPv4_REJECT: r4 rm rq r] r� rE r� �filter_FORWARDrM )r^ � _log_deniedr: r7 r� )ri � daddr_setr r� r< r< r= �build_rfc3964_ipv4_rulesG s2 � � � �z!nftables.build_rfc3964_ipv4_rulesc C s� d}g }|� | �|j�� |� | �|j�� |� | �|j�� g }|� | �|||||�� |� | �|||||�� |� | � |||||�� |S )Nr- ) r: ry ru r} r� r� r� r\ r] rc )ri r� r� rN r� r r� r< r< r= �*build_policy_rich_source_destination_rulesj s z3nftables.build_policy_rich_source_destination_rulesc C s |dv rdS dS )N)rZ r[ �ebTFr< )ri r� r< r< r= �is_ipv_supportedy s znftables.is_ipv_supportedc C s� ddd�}|| || ddg|| dd|| g|| dd|| g|| dg|| || || g|| ddg|| dd|| g|| dgdd � }||v rO|| S t td | ��) N� ipv4_addr� ipv6_addrrY � inet_proto� inet_servicer^ �ifname� ether_addr) zhash:ipz hash:ip,portzhash:ip,port,ipzhash:ip,port,netz hash:ip,markzhash:netz hash:net,netz hash:net,portzhash:net,port,netzhash:net,iface�hash:macz!ipset type name '%s' is not valid)r r )ri r� r0 �ipv_addr�typesr< r< r= �_set_type_list~ s( � ��znftables._set_type_listc C s� |rd|v r|d dkrd}nd}dt || �||�d�}|�d�d �d �D ] }|d v r3d g|d < nq&|rJd |v r@|d |d < d|v rJ|d |d< dd|iigS )Nru �inet6r[ rZ r] )ru r� r� r0 �:rE �,)rf �netr� �intervalr� �timeout�maxelemr� rm r� )r� r� rR )ri r� r0 �optionsr� �set_dict�tr< r< r= �build_set_create_rules� s& � � z nftables.build_set_create_rulesc C s$ | � |||�}| �|| j�� � d S r� )r� r� r^ r' )ri r� r0 r� r� r< r< r= � set_create� s znftables.set_createc C s* dddt |d�ii}| �|| j�� � d S )Nro r� r] r� )r� r� r^ r' )ri r� rq r< r< r= � set_destroy� s �znftables.set_destroyc C s, | j j�|�j�d�d �d�}g }tt|��D ]c}|| dkr8|�dddii� |�dd |r1d nd d �i� q|| d v rP|�d| �|�|rIdndd �i� q|| dkrd|�dd|r^dndii� q|| dkrt|�dddii� qt d|| ��dt|�dkr�d|in|d |r�dndd| d�iS ) Nr� rE r� r� r� rx r9 r/ �thr� r� r1 )rf r� r~ r� r� �ifacer� r� r^ z-Unsupported ipset type for match fragment: %sr. �concatr rk r4 �@r5 ) r^ r{ � get_ipsetr0 rR r� r| r: �_set_get_familyr )ri r� � match_destrt � type_formatr; rI r< r< r= rm � s* � � �z nftables._set_match_fragmentc C s | j j�|�}|j�d�d �d�}|�d�}t|�t|�kr$ttd��g }tt|��D ]�}|| dkr�z || � d�}W n t yO |� d� || } Y nw |� || d |� � || |d d � } z| � d�}W n t yz |� | � Y q,w |� d| d |� | |d d � gi� q,|| d v r�z || � d �}W n" t y� || } d |j v r�|j d d kr�t | �} |� | � Y q,w || d |� } d |j v r�|j d d kr�t | �} |� d | t|| |d d � �d�i� q,|� || � q,t|�dk�rd|igS |S )Nr� rE r� z+Number of values does not match ipset type.r� r� �-r� )rf r� rC ru r� r� rh r� )r^ r{ r� r0 rR r| r r r� ry r� r: r� r r� ) ri r� �entry�objr� � entry_tokens�fragmentrI ry �port_strri r< r< r= �_set_entry_fragment� sR � � �( � � z nftables._set_entry_fragmentc C s0 g }| � ||�}|�dddt||d�ii� |S )Nrm rL r] �ru r� r� �elem)r� r: r� )ri r� r� r� rL r< r< r= �build_set_add_rules s �z nftables.build_set_add_rulesc C s" | � ||�}| �|| j�� � d S r� )r� r� r^ r' )ri r� r� r� r< r< r= �set_add s znftables.set_addc C s8 | � ||�}dddt||d�ii}| �|| j�� � d S )Nro rL r] r� )r� r� r� r^ r' )ri r� r� rL rq r< r< r= � set_delete s �znftables.set_deletec C s dddt |d�iigS )Nr� r� r] r� )r� )ri r� r< r< r= �build_set_flush_rules s �z nftables.build_set_flush_rulesc C s | � |�}| �|| j�� � d S r� )r� r� r^ r' )ri r� r� r< r< r= � set_flush s znftables.set_flushc C sN | j j�|�}|jdkrd}|S |jr#d|jv r#|jd dkr#d}|S d}|S )Nr� re ru r� rj rf )r^ r{ r� r0 r� )ri r� r{ ru r< r< r= r� ! s ��znftables._set_get_familyc C sZ g }|� | �|||�� |� | �|�� |D ] }|� | �||�� q| �|| j�� � d S r� )r� r� r� r� r� r^ r' )ri �set_name� type_name�entries�create_options� entry_optionsr� r� r< r< r= � set_restore. s znftables.set_restorer� )r� )F)NN)G�__name__� __module__� __qualname__r� �policies_supportedrk r� r� r� r� r� r� r� r� r� r� r� r� r� r� r r r r- r� r7 r( r: rJ rO rQ r r r� rU r\ r] rc r ry r} r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� rm r� r� r� r� r� r� r� r� r< r< r< r= r\ � s� ,.` 4 V C �2B + $$ � �% ! �+ < # 1 �r\ r� )*r� r� rn �firewall.core.loggerr �firewall.functionsr r r r r �firewall.errorsr r r r r r r �firewall.core.richr r r r r r r r r �firewall.core.baser �nftables.nftablesr r� r� r r� r� r> r� �objectr\ r< r< r< r= �<module> s $, � � �� � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � !� "�% � � � � � � � � � � � � � � � � � ��APK ���Z,3�E E % core/__pycache__/icmp.cpython-310.pycnu �[��� o bhAb � @ sx g d �Z i dd�dd�dd�dd�dd �d d �d d �dd�dd�dd�dd�dd�dd�dd�d d �d d �d d!�i d"d#�d$d%�d&d'�d(d)�d*d+�d,d-�d.d-�d/d0�d1d2�d3d4�d5d6�d7d8�d9d:�d;d<�d=d>�d?d@�dAdB��Zi dCdD�d dE�dFdG�d dH�dIdJ�d3d�d5d�dKd#�dLdM�dNdO�d,dP�d.dP�ddQ�ddQ�d1dR�d/dS�dTdU�dUdVdVdWdX��ZdYdZ� Zd[d\� Zd]d^� Zd_d`� ZdaS )b)� ICMP_TYPES� ICMPV6_TYPES�check_icmp_type�check_icmpv6_typez echo-replyz0/0�pongznetwork-unreachablez3/0zhost-unreachablez3/1zprotocol-unreachablez3/2zport-unreachablez3/3zfragmentation-neededz3/4zsource-route-failedz3/5znetwork-unknownz3/6z host-unknownz3/7znetwork-prohibitedz3/9zhost-prohibitedz3/10zTOS-network-unreachablez3/11zTOS-host-unreachablez3/12zcommunication-prohibitedz3/13zhost-precedence-violationz3/14zprecedence-cutoffz3/15z source-quenchz4/0znetwork-redirectz5/0z host-redirectz5/1zTOS-network-redirectz5/2zTOS-host-redirectz5/3z echo-requestz8/0�pingzrouter-advertisementz9/0zrouter-solicitationz10/0zttl-zero-during-transitz11/0zttl-zero-during-reassemblyz11/1z ip-header-badz12/0zrequired-option-missingz12/1ztimestamp-requestz13/0ztimestamp-replyz14/0zaddress-mask-requestz17/0zaddress-mask-replyz18/0zno-routez1/0z1/1zaddress-unreachablez1/3z1/4zpacket-too-bigz2/0z bad-headerzunknown-header-typez4/1zunknown-optionz4/2z128/0z129/0z133/0z134/0zneighbour-solicitationz135/0z136/0z137/0)zneigbour-solicitationzneighbour-advertisementzneigbour-advertisement�redirectc C � | t v rdS dS �NTF�r ��_name� r �4/usr/lib/python3/dist-packages/firewall/core/icmp.py�check_icmp_nameV � r c C � | t �� v rdS dS r )r �values��_typer r r r [ � r c C r r r r r r r �check_icmpv6_name` r r c C r r )r r r r r r r e r r N)�__all__r r r r r r r r r r �<module> s� �������� � � � � ��������������� � � � � �!�"�%�������� � � � � ������ PK ���ZC-{I� I� core/ipXtables.pynu �[��� # -*- coding: utf-8 -*- # # Copyright (C) 2010-2016 Red Hat, Inc. # # Authors: # Thomas Woerner <twoerner@redhat.com> # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see <http://www.gnu.org/licenses/>. # import os.path import copy from firewall.core.prog import runProg from firewall.core.logger import log from firewall.functions import tempFile, readfile, splitArgs, check_mac, portStr, \ check_single_address, check_address, normalizeIP6 from firewall import config from firewall.errors import FirewallError, INVALID_PASSTHROUGH, INVALID_RULE, UNKNOWN_ERROR, INVALID_ADDR from firewall.core.rich import Rich_Accept, Rich_Reject, Rich_Drop, Rich_Mark, Rich_NFLog, \ Rich_Masquerade, Rich_ForwardPort, Rich_IcmpBlock, Rich_Tcp_Mss_Clamp from firewall.core.base import DEFAULT_ZONE_TARGET import string POLICY_CHAIN_PREFIX = "" BUILT_IN_CHAINS = { "security": [ "INPUT", "OUTPUT", "FORWARD" ], "raw": [ "PREROUTING", "OUTPUT" ], "mangle": [ "PREROUTING", "POSTROUTING", "INPUT", "OUTPUT", "FORWARD" ], "nat": [ "PREROUTING", "POSTROUTING", "OUTPUT" ], "filter": [ "INPUT", "OUTPUT", "FORWARD" ], } DEFAULT_REJECT_TYPE = { "ipv4": "icmp-host-prohibited", "ipv6": "icmp6-adm-prohibited", } ICMP = { "ipv4": "icmp", "ipv6": "ipv6-icmp", } # ipv ebtables also uses this # def common_reverse_rule(args): """ Inverse valid rule """ replace_args = { # Append "-A": "-D", "--append": "--delete", # Insert "-I": "-D", "--insert": "--delete", # New chain "-N": "-X", "--new-chain": "--delete-chain", } ret_args = args[:] for arg in replace_args: try: idx = ret_args.index(arg) except Exception: continue if arg in [ "-I", "--insert" ]: # With insert rulenum, then remove it if it is a number # Opt at position idx, chain at position idx+1, [rulenum] at # position idx+2 try: int(ret_args[idx+2]) except Exception: pass else: ret_args.pop(idx+2) ret_args[idx] = replace_args[arg] return ret_args def common_reverse_passthrough(args): """ Reverse valid passthough rule """ replace_args = { # Append "-A": "-D", "--append": "--delete", # Insert "-I": "-D", "--insert": "--delete", # New chain "-N": "-X", "--new-chain": "--delete-chain", } ret_args = args[:] for x in replace_args: try: idx = ret_args.index(x) except ValueError: continue if x in [ "-I", "--insert" ]: # With insert rulenum, then remove it if it is a number # Opt at position idx, chain at position idx+1, [rulenum] at # position idx+2 try: int(ret_args[idx+2]) except ValueError: pass else: ret_args.pop(idx+2) ret_args[idx] = replace_args[x] return ret_args raise FirewallError(INVALID_PASSTHROUGH, "no '-A', '-I' or '-N' arg") # ipv ebtables also uses this # def common_check_passthrough(args): """ Check if passthough rule is valid (only add, insert and new chain rules are allowed) """ args = set(args) not_allowed = set(["-C", "--check", # check rule "-D", "--delete", # delete rule "-R", "--replace", # replace rule "-L", "--list", # list rule "-S", "--list-rules", # print rules "-F", "--flush", # flush rules "-Z", "--zero", # zero rules "-X", "--delete-chain", # delete chain "-P", "--policy", # policy "-E", "--rename-chain"]) # rename chain) # intersection of args and not_allowed is not empty, i.e. # something from args is not allowed if len(args & not_allowed) > 0: raise FirewallError(INVALID_PASSTHROUGH, "arg '%s' is not allowed" % list(args & not_allowed)[0]) # args need to contain one of -A, -I, -N needed = set(["-A", "--append", "-I", "--insert", "-N", "--new-chain"]) # empty intersection of args and needed, i.e. # none from args contains any needed command if len(args & needed) == 0: raise FirewallError(INVALID_PASSTHROUGH, "no '-A', '-I' or '-N' arg") class ip4tables(object): ipv = "ipv4" name = "ip4tables" policies_supported = True def __init__(self, fw): self._fw = fw self._command = config.COMMANDS[self.ipv] self._restore_command = config.COMMANDS["%s-restore" % self.ipv] self.wait_option = self._detect_wait_option() self.restore_wait_option = self._detect_restore_wait_option() self.fill_exists() self.available_tables = [] self.rich_rule_priority_counts = {} self.policy_priority_counts = {} self.zone_source_index_cache = [] self.our_chains = {} # chains created by firewalld def fill_exists(self): self.command_exists = os.path.exists(self._command) self.restore_command_exists = os.path.exists(self._restore_command) def __run(self, args): # convert to string list if self.wait_option and self.wait_option not in args: _args = [self.wait_option] + ["%s" % item for item in args] else: _args = ["%s" % item for item in args] log.debug2("%s: %s %s", self.__class__, self._command, " ".join(_args)) (status, ret) = runProg(self._command, _args) if status != 0: raise ValueError("'%s %s' failed: %s" % (self._command, " ".join(_args), ret)) return ret def _rule_replace(self, rule, pattern, replacement): try: i = rule.index(pattern) except ValueError: return False else: rule[i:i+1] = replacement return True def is_chain_builtin(self, ipv, table, chain): return table in BUILT_IN_CHAINS and \ chain in BUILT_IN_CHAINS[table] def build_chain_rules(self, add, table, chain): rule = [ "-t", table ] if add: rule.append("-N") else: rule.append("-X") rule.append(chain) return [rule] def build_rule(self, add, table, chain, index, args): rule = [ "-t", table ] if add: rule += [ "-I", chain, str(index) ] else: rule += [ "-D", chain ] rule += args return rule def reverse_rule(self, args): return common_reverse_rule(args) def check_passthrough(self, args): common_check_passthrough(args) def reverse_passthrough(self, args): return common_reverse_passthrough(args) def passthrough_parse_table_chain(self, args): table = "filter" try: i = args.index("-t") except ValueError: pass else: if len(args) >= i+1: table = args[i+1] chain = None for opt in [ "-A", "--append", "-I", "--insert", "-N", "--new-chain" ]: try: i = args.index(opt) except ValueError: pass else: if len(args) >= i+1: chain = args[i+1] return (table, chain) def _run_replace_zone_source(self, rule, zone_source_index_cache): try: i = rule.index("%%ZONE_SOURCE%%") rule.pop(i) zone = rule.pop(i) if "-m" == rule[4]: # ipset/mac zone_source = (zone, rule[7]) # (zone, address) else: zone_source = (zone, rule[5]) # (zone, address) except ValueError: try: i = rule.index("%%ZONE_INTERFACE%%") rule.pop(i) zone_source = None except ValueError: return rule_add = True if rule[0] in ["-D", "--delete"]: rule_add = False if zone_source and not rule_add: if zone_source in zone_source_index_cache: zone_source_index_cache.remove(zone_source) elif rule_add: if zone_source: # order source based dispatch by zone name if zone_source not in zone_source_index_cache: zone_source_index_cache.append(zone_source) zone_source_index_cache.sort(key=lambda x: x[0]) index = zone_source_index_cache.index(zone_source) else: index = len(zone_source_index_cache) rule[0] = "-I" rule.insert(2, "%d" % (index + 1)) def _set_rule_replace_priority(self, rule, priority_counts, token): """ Change something like -t filter -I public_IN %%RICH_RULE_PRIORITY%% 123 or -t filter -A public_IN %%RICH_RULE_PRIORITY%% 321 into -t filter -I public_IN 4 or -t filter -I public_IN """ try: i = rule.index(token) except ValueError: pass else: rule_add = True insert = False insert_add_index = -1 rule.pop(i) priority = rule.pop(i) if type(priority) != int: raise FirewallError(INVALID_RULE, "priority must be followed by a number") table = "filter" for opt in [ "-t", "--table" ]: try: j = rule.index(opt) except ValueError: pass else: if len(rule) >= j+1: table = rule[j+1] for opt in [ "-A", "--append", "-I", "--insert", "-D", "--delete" ]: try: insert_add_index = rule.index(opt) except ValueError: pass else: if len(rule) >= insert_add_index+1: chain = rule[insert_add_index+1] if opt in [ "-I", "--insert" ]: insert = True if opt in [ "-D", "--delete" ]: rule_add = False chain = (table, chain) # Add the rule to the priority counts. We don't need to store the # rule, just bump the ref count for the priority value. if not rule_add: if chain not in priority_counts or \ priority not in priority_counts[chain] or \ priority_counts[chain][priority] <= 0: raise FirewallError(UNKNOWN_ERROR, "nonexistent or underflow of priority count") priority_counts[chain][priority] -= 1 else: if chain not in priority_counts: priority_counts[chain] = {} if priority not in priority_counts[chain]: priority_counts[chain][priority] = 0 # calculate index of new rule index = 1 for p in sorted(priority_counts[chain].keys()): if p == priority and insert: break index += priority_counts[chain][p] if p == priority: break priority_counts[chain][priority] += 1 rule[insert_add_index] = "-I" rule.insert(insert_add_index+2, "%d" % index) def set_rules(self, rules, log_denied): temp_file = tempFile() table_rules = { } rich_rule_priority_counts = copy.deepcopy(self.rich_rule_priority_counts) policy_priority_counts = copy.deepcopy(self.policy_priority_counts) zone_source_index_cache = copy.deepcopy(self.zone_source_index_cache) for _rule in rules: rule = _rule[:] # replace %%REJECT%% self._rule_replace(rule, "%%REJECT%%", \ ["REJECT", "--reject-with", DEFAULT_REJECT_TYPE[self.ipv]]) # replace %%ICMP%% self._rule_replace(rule, "%%ICMP%%", [ICMP[self.ipv]]) # replace %%LOGTYPE%% try: i = rule.index("%%LOGTYPE%%") except ValueError: pass else: if log_denied == "off": continue if log_denied in [ "unicast", "broadcast", "multicast" ]: rule[i:i+1] = [ "-m", "pkttype", "--pkt-type", log_denied ] else: rule.pop(i) self._set_rule_replace_priority(rule, rich_rule_priority_counts, "%%RICH_RULE_PRIORITY%%") self._set_rule_replace_priority(rule, policy_priority_counts, "%%POLICY_PRIORITY%%") self._run_replace_zone_source(rule, zone_source_index_cache) table = "filter" # get table form rule for opt in [ "-t", "--table" ]: try: i = rule.index(opt) except ValueError: pass else: if len(rule) >= i+1: rule.pop(i) table = rule.pop(i) # we can not use joinArgs here, because it would use "'" instead # of '"' for the start and end of the string, this breaks # iptables-restore for i in range(len(rule)): for c in string.whitespace: if c in rule[i] and not (rule[i].startswith('"') and rule[i].endswith('"')): rule[i] = '"%s"' % rule[i] table_rules.setdefault(table, []).append(rule) for table in table_rules: rules = table_rules[table] temp_file.write("*%s\n" % table) for rule in rules: temp_file.write(" ".join(rule) + "\n") temp_file.write("COMMIT\n") temp_file.close() stat = os.stat(temp_file.name) log.debug2("%s: %s %s", self.__class__, self._restore_command, "%s: %d" % (temp_file.name, stat.st_size)) args = [ ] if self.restore_wait_option: args.append(self.restore_wait_option) args.append("-n") (status, ret) = runProg(self._restore_command, args, stdin=temp_file.name) if log.getDebugLogLevel() > 2: lines = readfile(temp_file.name) if lines is not None: i = 1 for line in lines: log.debug3("%8d: %s" % (i, line), nofmt=1, nl=0) if not line.endswith("\n"): log.debug3("", nofmt=1) i += 1 os.unlink(temp_file.name) if status != 0: raise ValueError("'%s %s' failed: %s" % (self._restore_command, " ".join(args), ret)) self.rich_rule_priority_counts = rich_rule_priority_counts self.policy_priority_counts = policy_priority_counts self.zone_source_index_cache = zone_source_index_cache def set_rule(self, rule, log_denied): # replace %%REJECT%% self._rule_replace(rule, "%%REJECT%%", \ ["REJECT", "--reject-with", DEFAULT_REJECT_TYPE[self.ipv]]) # replace %%ICMP%% self._rule_replace(rule, "%%ICMP%%", [ICMP[self.ipv]]) # replace %%LOGTYPE%% try: i = rule.index("%%LOGTYPE%%") except ValueError: pass else: if log_denied == "off": return "" if log_denied in [ "unicast", "broadcast", "multicast" ]: rule[i:i+1] = [ "-m", "pkttype", "--pkt-type", log_denied ] else: rule.pop(i) rich_rule_priority_counts = copy.deepcopy(self.rich_rule_priority_counts) policy_priority_counts = copy.deepcopy(self.policy_priority_counts) zone_source_index_cache = copy.deepcopy(self.zone_source_index_cache) self._set_rule_replace_priority(rule, rich_rule_priority_counts, "%%RICH_RULE_PRIORITY%%") self._set_rule_replace_priority(rule, policy_priority_counts, "%%POLICY_PRIORITY%%") self._run_replace_zone_source(rule, zone_source_index_cache) output = self.__run(rule) self.rich_rule_priority_counts = rich_rule_priority_counts self.policy_priority_counts = policy_priority_counts self.zone_source_index_cache = zone_source_index_cache return output def get_available_tables(self, table=None): ret = [] tables = [ table ] if table else BUILT_IN_CHAINS.keys() for table in tables: if table in self.available_tables: ret.append(table) else: try: self.__run(["-t", table, "-L", "-n"]) self.available_tables.append(table) ret.append(table) except ValueError: log.debug1("%s table '%s' does not exist (or not enough permission to check)." % (self.ipv, table)) return ret def _detect_wait_option(self): wait_option = "" ret = runProg(self._command, ["-w", "-L", "-n"]) # since iptables-1.4.20 log.debug3("%s: %s: probe for wait option (%s): ret=%u, output=\"%s\"", self.__class__, self._command, "-w", ret[0], ret[1]) if ret[0] == 0: wait_option = "-w" # wait for xtables lock ret = runProg(self._command, ["-w10", "-L", "-n"]) # since iptables > 1.4.21 log.debug3("%s: %s: probe for wait option (%s): ret=%u, output=\"%s\"", self.__class__, self._command, "-w10", ret[0], ret[1]) if ret[0] == 0: wait_option = "-w10" # wait max 10 seconds log.debug2("%s: %s will be using %s option.", self.__class__, self._command, wait_option) return wait_option def _detect_restore_wait_option(self): temp_file = tempFile() temp_file.write("#foo") temp_file.close() wait_option = "" for test_option in ["-w", "--wait=2"]: ret = runProg(self._restore_command, [test_option], stdin=temp_file.name) log.debug3("%s: %s: probe for wait option (%s): ret=%u, output=\"%s\"", self.__class__, self._command, test_option, ret[0], ret[1]) if ret[0] == 0 and "invalid option" not in ret[1] \ and "unrecognized option" not in ret[1]: wait_option = test_option break log.debug2("%s: %s will be using %s option.", self.__class__, self._restore_command, wait_option) os.unlink(temp_file.name) return wait_option def build_flush_rules(self): self.rich_rule_priority_counts = {} self.policy_priority_counts = {} self.zone_source_index_cache = [] rules = [] for table in BUILT_IN_CHAINS.keys(): if not self.get_available_tables(table): continue # Flush firewall rules: -F # Delete firewall chains: -X # Set counter to zero: -Z for flag in [ "-F", "-X", "-Z" ]: rules.append(["-t", table, flag]) return rules def build_set_policy_rules(self, policy): rules = [] _policy = "DROP" if policy == "PANIC" else policy for table in BUILT_IN_CHAINS.keys(): if not self.get_available_tables(table): continue if table == "nat": continue for chain in BUILT_IN_CHAINS[table]: rules.append(["-t", table, "-P", chain, _policy]) return rules def supported_icmp_types(self, ipv=None): """Return ICMP types that are supported by the iptables/ip6tables command and kernel""" ret = [ ] output = "" try: output = self.__run(["-p", "icmp" if self.ipv == "ipv4" else "ipv6-icmp", "--help"]) except ValueError as ex: if self.ipv == "ipv4": log.debug1("iptables error: %s" % ex) else: log.debug1("ip6tables error: %s" % ex) lines = output.splitlines() in_types = False for line in lines: #print(line) if in_types: line = line.strip().lower() splits = line.split() for split in splits: if split.startswith("(") and split.endswith(")"): x = split[1:-1] else: x = split if x not in ret: ret.append(x) if self.ipv == "ipv4" and line.startswith("Valid ICMP Types:") or \ self.ipv == "ipv6" and line.startswith("Valid ICMPv6 Types:"): in_types = True return ret def build_default_tables(self): # nothing to do, they always exist return [] def build_default_rules(self, log_denied="off"): default_rules = {} if self.get_available_tables("security"): default_rules["security"] = [ ] self.our_chains["security"] = set() for chain in BUILT_IN_CHAINS["security"]: default_rules["security"].append("-N %s_direct" % chain) default_rules["security"].append("-A %s -j %s_direct" % (chain, chain)) self.our_chains["security"].add("%s_direct" % chain) if self.get_available_tables("raw"): default_rules["raw"] = [ ] self.our_chains["raw"] = set() for chain in BUILT_IN_CHAINS["raw"]: default_rules["raw"].append("-N %s_direct" % chain) default_rules["raw"].append("-A %s -j %s_direct" % (chain, chain)) self.our_chains["raw"].add("%s_direct" % chain) if chain == "PREROUTING": for dispatch_suffix in ["POLICIES_pre", "ZONES", "POLICIES_post"]: default_rules["raw"].append("-N %s_%s" % (chain, dispatch_suffix)) self.our_chains["raw"].update(set(["%s_%s" % (chain, dispatch_suffix)])) for dispatch_suffix in ["ZONES"]: default_rules["raw"].append("-A %s -j %s_%s" % (chain, chain, dispatch_suffix)) if self.get_available_tables("mangle"): default_rules["mangle"] = [ ] self.our_chains["mangle"] = set() for chain in BUILT_IN_CHAINS["mangle"]: default_rules["mangle"].append("-N %s_direct" % chain) default_rules["mangle"].append("-A %s -j %s_direct" % (chain, chain)) self.our_chains["mangle"].add("%s_direct" % chain) if chain == "PREROUTING": for dispatch_suffix in ["POLICIES_pre", "ZONES", "POLICIES_post"]: default_rules["mangle"].append("-N %s_%s" % (chain, dispatch_suffix)) self.our_chains["mangle"].update(set(["%s_%s" % (chain, dispatch_suffix)])) for dispatch_suffix in ["ZONES"]: default_rules["mangle"].append("-A %s -j %s_%s" % (chain, chain, dispatch_suffix)) if self.get_available_tables("nat"): default_rules["nat"] = [ ] self.our_chains["nat"] = set() for chain in BUILT_IN_CHAINS["nat"]: default_rules["nat"].append("-N %s_direct" % chain) default_rules["nat"].append("-A %s -j %s_direct" % (chain, chain)) self.our_chains["nat"].add("%s_direct" % chain) if chain in ["OUTPUT"]: # nat, output does not have zone dispatch for dispatch_suffix in ["POLICIES_pre", "POLICIES_post"]: default_rules["nat"].append("-N %s_%s" % (chain, dispatch_suffix)) self.our_chains["nat"].update(set(["%s_%s" % (chain, dispatch_suffix)])) default_rules["nat"].append("-A %s -j %s_%s" % (chain, chain, dispatch_suffix)) else: for dispatch_suffix in ["POLICIES_pre", "ZONES", "POLICIES_post"]: default_rules["nat"].append("-N %s_%s" % (chain, dispatch_suffix)) self.our_chains["nat"].update(set(["%s_%s" % (chain, dispatch_suffix)])) for dispatch_suffix in ["ZONES"]: default_rules["nat"].append("-A %s -j %s_%s" % (chain, chain, dispatch_suffix)) default_rules["filter"] = [] self.our_chains["filter"] = set() default_rules["filter"].append("-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED,DNAT -j ACCEPT") default_rules["filter"].append("-A INPUT -i lo -j ACCEPT") default_rules["filter"].append("-N INPUT_direct") default_rules["filter"].append("-A INPUT -j INPUT_direct") self.our_chains["filter"].update(set("INPUT_direct")) for dispatch_suffix in ["POLICIES_pre", "ZONES", "POLICIES_post"]: default_rules["filter"].append("-N INPUT_%s" % (dispatch_suffix)) self.our_chains["filter"].update(set("INPUT_%s" % (dispatch_suffix))) for dispatch_suffix in ["ZONES"]: default_rules["filter"].append("-A INPUT -j INPUT_%s" % (dispatch_suffix)) if log_denied != "off": default_rules["filter"].append("-A INPUT -m conntrack --ctstate INVALID %%LOGTYPE%% -j LOG --log-prefix 'STATE_INVALID_DROP: '") default_rules["filter"].append("-A INPUT -m conntrack --ctstate INVALID -j DROP") if log_denied != "off": default_rules["filter"].append("-A INPUT %%LOGTYPE%% -j LOG --log-prefix 'FINAL_REJECT: '") default_rules["filter"].append("-A INPUT -j %%REJECT%%") default_rules["filter"].append("-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED,DNAT -j ACCEPT") default_rules["filter"].append("-A FORWARD -i lo -j ACCEPT") default_rules["filter"].append("-N FORWARD_direct") default_rules["filter"].append("-A FORWARD -j FORWARD_direct") self.our_chains["filter"].update(set("FORWARD_direct")) for dispatch_suffix in ["POLICIES_pre"]: default_rules["filter"].append("-N FORWARD_%s" % (dispatch_suffix)) self.our_chains["filter"].update(set("FORWARD_%s" % (dispatch_suffix))) for dispatch_suffix in ["ZONES"]: default_rules["filter"].append("-N FORWARD_%s" % (dispatch_suffix)) default_rules["filter"].append("-A FORWARD -j FORWARD_%s" % (dispatch_suffix)) self.our_chains["filter"].update(set("FORWARD_%s" % (dispatch_suffix))) for dispatch_suffix in ["POLICIES_post"]: default_rules["filter"].append("-N FORWARD_%s" % (dispatch_suffix)) self.our_chains["filter"].update(set("FORWARD_%s" % (dispatch_suffix))) if log_denied != "off": default_rules["filter"].append("-A FORWARD -m conntrack --ctstate INVALID %%LOGTYPE%% -j LOG --log-prefix 'STATE_INVALID_DROP: '") default_rules["filter"].append("-A FORWARD -m conntrack --ctstate INVALID -j DROP") if log_denied != "off": default_rules["filter"].append("-A FORWARD %%LOGTYPE%% -j LOG --log-prefix 'FINAL_REJECT: '") default_rules["filter"].append("-A FORWARD -j %%REJECT%%") default_rules["filter"] += [ "-N OUTPUT_direct", "-A OUTPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT", "-A OUTPUT -o lo -j ACCEPT", "-A OUTPUT -j OUTPUT_direct", ] self.our_chains["filter"].update(set("OUTPUT_direct")) for dispatch_suffix in ["POLICIES_pre"]: default_rules["filter"].append("-N OUTPUT_%s" % (dispatch_suffix)) default_rules["filter"].append("-A OUTPUT -j OUTPUT_%s" % (dispatch_suffix)) self.our_chains["filter"].update(set("OUTPUT_%s" % (dispatch_suffix))) for dispatch_suffix in ["POLICIES_post"]: default_rules["filter"].append("-N OUTPUT_%s" % (dispatch_suffix)) default_rules["filter"].append("-A OUTPUT -j OUTPUT_%s" % (dispatch_suffix)) self.our_chains["filter"].update(set("OUTPUT_%s" % (dispatch_suffix))) final_default_rules = [] for table in default_rules: if table not in self.get_available_tables(): continue for rule in default_rules[table]: final_default_rules.append(["-t", table] + splitArgs(rule)) return final_default_rules def get_zone_table_chains(self, table): if table == "filter": return { "INPUT", "FORWARD" } if table == "mangle": if "mangle" in self.get_available_tables(): return { "PREROUTING" } if table == "nat": if "nat" in self.get_available_tables(): return { "PREROUTING", "POSTROUTING" } if table == "raw": if "raw" in self.get_available_tables(): return { "PREROUTING" } return {} def build_policy_ingress_egress_rules(self, enable, policy, table, chain, ingress_interfaces, egress_interfaces, ingress_sources, egress_sources): p_obj = self._fw.policy.get_policy(policy) chain_suffix = "pre" if p_obj.priority < 0 else "post" isSNAT = True if (table == "nat" and chain == "POSTROUTING") else False _policy = self._fw.policy.policy_base_chain_name(policy, table, POLICY_CHAIN_PREFIX, isSNAT) ingress_fragments = [] egress_fragments = [] for interface in ingress_interfaces: ingress_fragments.append(["-i", interface]) for interface in egress_interfaces: egress_fragments.append(["-o", interface]) for addr in ingress_sources: ipv = self._fw.zone.check_source(addr) if ipv in ["ipv4", "ipv6"] and not self.is_ipv_supported(ipv): continue ingress_fragments.append(self._rule_addr_fragment("-s", addr)) for addr in egress_sources: ipv = self._fw.zone.check_source(addr) if ipv in ["ipv4", "ipv6"] and not self.is_ipv_supported(ipv): continue # iptables can not match destination MAC if check_mac(addr) and chain in ["POSTROUTING", "FORWARD", "OUTPUT"]: continue egress_fragments.append(self._rule_addr_fragment("-d", addr)) def _generate_policy_dispatch_rule(ingress_fragment, egress_fragment): add_del = {True: "-A", False: "-D" }[enable] rule = ["-t", table, add_del, "%s_POLICIES_%s" % (chain, chain_suffix), "%%POLICY_PRIORITY%%", p_obj.priority] if ingress_fragment: rule.extend(ingress_fragment) if egress_fragment: rule.extend(egress_fragment) rule.extend(["-j", _policy]) return rule rules = [] if ingress_fragments: # zone --> [zone, ANY, HOST] for ingress_fragment in ingress_fragments: # zone --> zone if egress_fragments: for egress_fragment in egress_fragments: rules.append(_generate_policy_dispatch_rule(ingress_fragment, egress_fragment)) elif egress_sources: # if the egress source is not for the current family (there # are no egress fragments), then avoid creating an invalid # catch all rule. pass else: rules.append(_generate_policy_dispatch_rule(ingress_fragment, None)) elif ingress_sources: # if the ingress source is not for the current family (there are no # ingress fragments), then avoid creating an invalid catch all # rule. pass else: # [ANY, HOST] --> [zone, ANY, HOST] # [ANY, HOST] --> zone if egress_fragments: for egress_fragment in egress_fragments: rules.append(_generate_policy_dispatch_rule(None, egress_fragment)) elif egress_sources: # if the egress source is not for the current family (there # are no egress fragments), then avoid creating an invalid # catch all rule. pass else: # [ANY, HOST] --> [ANY, HOST] rules.append(_generate_policy_dispatch_rule(None, None)) return rules def build_zone_source_interface_rules(self, enable, zone, policy, interface, table, chain, append=False): isSNAT = True if (table == "nat" and chain == "POSTROUTING") else False _policy = self._fw.policy.policy_base_chain_name(policy, table, POLICY_CHAIN_PREFIX, isSNAT=isSNAT) opt = { "PREROUTING": "-i", "POSTROUTING": "-o", "INPUT": "-i", "FORWARD": "-i", "OUTPUT": "-o", }[chain] action = "-g" if enable and not append: rule = [ "-I", "%s_ZONES" % chain, "%%ZONE_INTERFACE%%" ] elif enable: rule = [ "-A", "%s_ZONES" % chain ] else: rule = [ "-D", "%s_ZONES" % chain ] if not append: rule += ["%%ZONE_INTERFACE%%"] rule += [ "-t", table, opt, interface, action, _policy ] return [rule] def _rule_addr_fragment(self, opt, address, invert=False): if address.startswith("ipset:"): name = address[6:] if opt == "-d": opt = "dst" else: opt = "src" flags = ",".join([opt] * self._fw.ipset.get_dimension(name)) return ["-m", "set", "--match-set", name, flags] elif check_mac(address): # outgoing can not be set if opt == "-d": raise FirewallError(INVALID_ADDR, "Can't match a destination MAC.") return ["-m", "mac", "--mac-source", address.upper()] else: if check_single_address("ipv6", address): address = normalizeIP6(address) elif check_address("ipv6", address): addr_split = address.split("/") address = normalizeIP6(addr_split[0]) + "/" + addr_split[1] return [opt, address] def build_zone_source_address_rules(self, enable, zone, policy, address, table, chain): add_del = { True: "-I", False: "-D" }[enable] isSNAT = True if (table == "nat" and chain == "POSTROUTING") else False _policy = self._fw.policy.policy_base_chain_name(policy, table, POLICY_CHAIN_PREFIX, isSNAT=isSNAT) opt = { "PREROUTING": "-s", "POSTROUTING": "-d", "INPUT": "-s", "FORWARD": "-s", "OUTPUT": "-d", }[chain] # iptables can not match destination MAC if check_mac(address) and chain in ["POSTROUTING", "FORWARD", "OUTPUT"]: return [] rule = [add_del, "%s_ZONES" % (chain), "%%ZONE_SOURCE%%", zone, "-t", table] rule.extend(self._rule_addr_fragment(opt, address)) rule.extend(["-g", _policy]) return [rule] def build_policy_chain_rules(self, enable, policy, table, chain): add_del_chain = { True: "-N", False: "-X" }[enable] add_del_rule = { True: "-A", False: "-D" }[enable] isSNAT = True if (table == "nat" and chain == "POSTROUTING") else False _policy = self._fw.policy.policy_base_chain_name(policy, table, POLICY_CHAIN_PREFIX, isSNAT=isSNAT) p_obj = self._fw.policy.get_policy(policy) self.our_chains[table].update(set([_policy, "%s_log" % _policy, "%s_deny" % _policy, "%s_pre" % _policy, "%s_post" % _policy, "%s_allow" % _policy])) rules = [] rules.append([ add_del_chain, _policy, "-t", table ]) rules.append([ add_del_chain, "%s_pre" % _policy, "-t", table ]) rules.append([ add_del_chain, "%s_log" % _policy, "-t", table ]) rules.append([ add_del_chain, "%s_deny" % _policy, "-t", table ]) rules.append([ add_del_chain, "%s_allow" % _policy, "-t", table ]) rules.append([ add_del_chain, "%s_post" % _policy, "-t", table ]) if p_obj.derived_from_zone: rules.append([ add_del_rule, _policy, "-t", table, "-j", "%s_%s" % (chain, "POLICIES_pre") ]) rules.append([ add_del_rule, _policy, "-t", table, "-j", "%s_pre" % _policy ]) rules.append([ add_del_rule, _policy, "-t", table, "-j", "%s_log" % _policy ]) rules.append([ add_del_rule, _policy, "-t", table, "-j", "%s_deny" % _policy ]) rules.append([ add_del_rule, _policy, "-t", table, "-j", "%s_allow" % _policy ]) rules.append([ add_del_rule, _policy, "-t", table, "-j", "%s_post" % _policy ]) if p_obj.derived_from_zone: rules.append([ add_del_rule, _policy, "-t", table, "-j", "%s_%s" % (chain, "POLICIES_post") ]) target = self._fw.policy._policies[policy].target if self._fw.get_log_denied() != "off": if table == "filter": if target in [DEFAULT_ZONE_TARGET, "REJECT", "%%REJECT%%" ]: rules.append([ add_del_rule, _policy, "-t", table, "%%LOGTYPE%%", "-j", "LOG", "--log-prefix", "\"%s_REJECT: \"" % _policy ]) if target == "DROP": rules.append([ add_del_rule, _policy, "-t", table, "%%LOGTYPE%%", "-j", "LOG", "--log-prefix", "\"%s_DROP: \"" % _policy ]) if table == "filter" and \ target in [DEFAULT_ZONE_TARGET, "ACCEPT", "REJECT", "%%REJECT%%", "DROP" ]: if target in [DEFAULT_ZONE_TARGET]: _target = "REJECT" else: _target = target rules.append([ add_del_rule, _policy, "-t", table, "-j", _target ]) if not enable: rules.reverse() return rules def _rule_limit(self, limit): if limit: return [ "-m", "limit", "--limit", limit.value ] return [] def _rich_rule_chain_suffix(self, rich_rule): if type(rich_rule.element) in [Rich_Masquerade, Rich_ForwardPort, Rich_IcmpBlock, Rich_Tcp_Mss_Clamp]: # These are special and don't have an explicit action pass elif rich_rule.action: if type(rich_rule.action) not in [Rich_Accept, Rich_Reject, Rich_Drop, Rich_Mark]: raise FirewallError(INVALID_RULE, "Unknown action %s" % type(rich_rule.action)) else: raise FirewallError(INVALID_RULE, "No rule action specified.") if rich_rule.priority == 0: if type(rich_rule.element) in [Rich_Masquerade, Rich_ForwardPort, Rich_Tcp_Mss_Clamp] or \ type(rich_rule.action) in [Rich_Accept, Rich_Mark]: return "allow" elif type(rich_rule.element) in [Rich_IcmpBlock] or \ type(rich_rule.action) in [Rich_Reject, Rich_Drop]: return "deny" elif rich_rule.priority < 0: return "pre" else: return "post" def _rich_rule_chain_suffix_from_log(self, rich_rule): if not rich_rule.log and not rich_rule.audit: raise FirewallError(INVALID_RULE, "Not log or audit") if rich_rule.priority == 0: return "log" elif rich_rule.priority < 0: return "pre" else: return "post" def _rich_rule_priority_fragment(self, rich_rule): if rich_rule.priority == 0: return [] return ["%%RICH_RULE_PRIORITY%%", rich_rule.priority] def _rich_rule_log(self, policy, rich_rule, enable, table, rule_fragment): if not rich_rule.log: return [] _policy = self._fw.policy.policy_base_chain_name(policy, table, POLICY_CHAIN_PREFIX) add_del = { True: "-A", False: "-D" }[enable] chain_suffix = self._rich_rule_chain_suffix_from_log(rich_rule) rule = ["-t", table, add_del, "%s_%s" % (_policy, chain_suffix)] rule += self._rich_rule_priority_fragment(rich_rule) if type(rich_rule.log) == Rich_NFLog: rule += rule_fragment + [ "-j", "NFLOG" ] if rich_rule.log.group: rule += [ "--nflog-group", rich_rule.log.group ] if rich_rule.log.prefix: rule += [ "--nflog-prefix", "%s" % rich_rule.log.prefix ] if rich_rule.log.threshold: rule += [ "--nflog-threshold", rich_rule.log.threshold ] else: rule += rule_fragment + [ "-j", "LOG" ] if rich_rule.log.prefix: rule += [ "--log-prefix", "'%s'" % rich_rule.log.prefix ] if rich_rule.log.level: rule += [ "--log-level", "%s" % rich_rule.log.level ] rule += self._rule_limit(rich_rule.log.limit) return rule def _rich_rule_audit(self, policy, rich_rule, enable, table, rule_fragment): if not rich_rule.audit: return [] add_del = { True: "-A", False: "-D" }[enable] _policy = self._fw.policy.policy_base_chain_name(policy, table, POLICY_CHAIN_PREFIX) chain_suffix = self._rich_rule_chain_suffix_from_log(rich_rule) rule = ["-t", table, add_del, "%s_%s" % (_policy, chain_suffix)] rule += self._rich_rule_priority_fragment(rich_rule) rule += rule_fragment if type(rich_rule.action) == Rich_Accept: _type = "accept" elif type(rich_rule.action) == Rich_Reject: _type = "reject" elif type(rich_rule.action) == Rich_Drop: _type = "drop" else: _type = "unknown" rule += [ "-j", "AUDIT", "--type", _type ] rule += self._rule_limit(rich_rule.audit.limit) return rule def _rich_rule_action(self, policy, rich_rule, enable, table, rule_fragment): if not rich_rule.action: return [] add_del = { True: "-A", False: "-D" }[enable] _policy = self._fw.policy.policy_base_chain_name(policy, table, POLICY_CHAIN_PREFIX) chain_suffix = self._rich_rule_chain_suffix(rich_rule) chain = "%s_%s" % (_policy, chain_suffix) if type(rich_rule.action) == Rich_Accept: rule_action = [ "-j", "ACCEPT" ] elif type(rich_rule.action) == Rich_Reject: rule_action = [ "-j", "REJECT" ] if rich_rule.action.type: rule_action += [ "--reject-with", rich_rule.action.type ] elif type(rich_rule.action) == Rich_Drop: rule_action = [ "-j", "DROP" ] elif type(rich_rule.action) == Rich_Mark: table = "mangle" _policy = self._fw.policy.policy_base_chain_name(policy, table, POLICY_CHAIN_PREFIX) chain = "%s_%s" % (_policy, chain_suffix) rule_action = [ "-j", "MARK", "--set-xmark", rich_rule.action.set ] else: raise FirewallError(INVALID_RULE, "Unknown action %s" % type(rich_rule.action)) rule = ["-t", table, add_del, chain] rule += self._rich_rule_priority_fragment(rich_rule) rule += rule_fragment + rule_action rule += self._rule_limit(rich_rule.action.limit) return rule def _rich_rule_destination_fragment(self, rich_dest): if not rich_dest: return [] rule_fragment = [] if rich_dest.addr: if rich_dest.invert: rule_fragment.append("!") if check_single_address("ipv6", rich_dest.addr): rule_fragment += [ "-d", normalizeIP6(rich_dest.addr) ] elif check_address("ipv6", rich_dest.addr): addr_split = rich_dest.addr.split("/") rule_fragment += [ "-d", normalizeIP6(addr_split[0]) + "/" + addr_split[1] ] else: rule_fragment += [ "-d", rich_dest.addr ] elif rich_dest.ipset: rule_fragment += [ "-m", "set" ] if rich_dest.invert: rule_fragment.append("!") flags = self._fw.zone._ipset_match_flags(rich_dest.ipset, "dst") rule_fragment += [ "--match-set", rich_dest.ipset, flags ] return rule_fragment def _rich_rule_source_fragment(self, rich_source): if not rich_source: return [] rule_fragment = [] if rich_source.addr: if rich_source.invert: rule_fragment.append("!") if check_single_address("ipv6", rich_source.addr): rule_fragment += [ "-s", normalizeIP6(rich_source.addr) ] elif check_address("ipv6", rich_source.addr): addr_split = rich_source.addr.split("/") rule_fragment += [ "-s", normalizeIP6(addr_split[0]) + "/" + addr_split[1] ] else: rule_fragment += [ "-s", rich_source.addr ] elif hasattr(rich_source, "mac") and rich_source.mac: rule_fragment += [ "-m", "mac" ] if rich_source.invert: rule_fragment.append("!") rule_fragment += [ "--mac-source", rich_source.mac ] elif hasattr(rich_source, "ipset") and rich_source.ipset: rule_fragment += [ "-m", "set" ] if rich_source.invert: rule_fragment.append("!") flags = self._fw.zone._ipset_match_flags(rich_source.ipset, "src") rule_fragment += [ "--match-set", rich_source.ipset, flags ] return rule_fragment def build_policy_ports_rules(self, enable, policy, proto, port, destination=None, rich_rule=None): add_del = { True: "-A", False: "-D" }[enable] table = "filter" _policy = self._fw.policy.policy_base_chain_name(policy, table, POLICY_CHAIN_PREFIX) rule_fragment = [ "-p", proto ] if port: rule_fragment += [ "--dport", "%s" % portStr(port) ] if destination: rule_fragment += [ "-d", destination ] if rich_rule: rule_fragment += self._rich_rule_destination_fragment(rich_rule.destination) rule_fragment += self._rich_rule_source_fragment(rich_rule.source) if not rich_rule or type(rich_rule.action) != Rich_Mark: rule_fragment += [ "-m", "conntrack", "--ctstate", "NEW,UNTRACKED" ] rules = [] if rich_rule: rules.append(self._rich_rule_log(policy, rich_rule, enable, table, rule_fragment)) rules.append(self._rich_rule_audit(policy, rich_rule, enable, table, rule_fragment)) rules.append(self._rich_rule_action(policy, rich_rule, enable, table, rule_fragment)) else: rules.append([add_del, "%s_allow" % (_policy), "-t", table] + rule_fragment + [ "-j", "ACCEPT" ]) return rules def build_policy_protocol_rules(self, enable, policy, protocol, destination=None, rich_rule=None): add_del = { True: "-A", False: "-D" }[enable] table = "filter" _policy = self._fw.policy.policy_base_chain_name(policy, table, POLICY_CHAIN_PREFIX) rule_fragment = [ "-p", protocol ] if destination: rule_fragment += [ "-d", destination ] if rich_rule: rule_fragment += self._rich_rule_destination_fragment(rich_rule.destination) rule_fragment += self._rich_rule_source_fragment(rich_rule.source) if not rich_rule or type(rich_rule.action) != Rich_Mark: rule_fragment += [ "-m", "conntrack", "--ctstate", "NEW,UNTRACKED" ] rules = [] if rich_rule: rules.append(self._rich_rule_log(policy, rich_rule, enable, table, rule_fragment)) rules.append(self._rich_rule_audit(policy, rich_rule, enable, table, rule_fragment)) rules.append(self._rich_rule_action(policy, rich_rule, enable, table, rule_fragment)) else: rules.append([add_del, "%s_allow" % (_policy), "-t", table] + rule_fragment + [ "-j", "ACCEPT" ]) return rules def build_policy_tcp_mss_clamp_rules(self, enable, policy, tcp_mss_clamp_value, destination=None, rich_rule=None): table = "filter" _policy = self._fw.policy.policy_base_chain_name(policy, table, POLICY_CHAIN_PREFIX) add_del = { True: "-A", False: "-D" }[enable] rule_fragment = [] if rich_rule: chain_suffix = self._rich_rule_chain_suffix(rich_rule) rule_fragment += self._rich_rule_priority_fragment(rich_rule) rule_fragment += self._rich_rule_destination_fragment(rich_rule.destination) rule_fragment += self._rich_rule_source_fragment(rich_rule.source) rules = [] rule_fragment = ["-p", "tcp"] if tcp_mss_clamp_value == "pmtu" or tcp_mss_clamp_value is None: rule_fragment += ["--tcp-flags", "SYN,RST", "SYN","-j", "TCPMSS", "--clamp-mss-to-pmtu"] else: rule_fragment += ["--tcp-flags", "SYN,RST", "SYN", "-j", "TCPMSS", "--set-mss", tcp_mss_clamp_value] if rich_rule: chain_suffix = self._rich_rule_chain_suffix(rich_rule) rule_fragment += self._rich_rule_priority_fragment(rich_rule) rule_fragment += self._rich_rule_destination_fragment(rich_rule.destination) rule_fragment += self._rich_rule_source_fragment(rich_rule.source) rules.append(["-t", "filter", add_del, "%s_%s" % (_policy, chain_suffix)] + rule_fragment) return rules def build_policy_source_ports_rules(self, enable, policy, proto, port, destination=None, rich_rule=None): add_del = { True: "-A", False: "-D" }[enable] table = "filter" _policy = self._fw.policy.policy_base_chain_name(policy, table, POLICY_CHAIN_PREFIX) rule_fragment = [ "-p", proto ] if port: rule_fragment += [ "--sport", "%s" % portStr(port) ] if destination: rule_fragment += [ "-d", destination ] if rich_rule: rule_fragment += self._rich_rule_destination_fragment(rich_rule.destination) rule_fragment += self._rich_rule_source_fragment(rich_rule.source) if not rich_rule or type(rich_rule.action) != Rich_Mark: rule_fragment += [ "-m", "conntrack", "--ctstate", "NEW,UNTRACKED" ] rules = [] if rich_rule: rules.append(self._rich_rule_log(policy, rich_rule, enable, table, rule_fragment)) rules.append(self._rich_rule_audit(policy, rich_rule, enable, table, rule_fragment)) rules.append(self._rich_rule_action(policy, rich_rule, enable, table, rule_fragment)) else: rules.append([add_del, "%s_allow" % (_policy), "-t", table] + rule_fragment + [ "-j", "ACCEPT" ]) return rules def build_policy_helper_ports_rules(self, enable, policy, proto, port, destination, helper_name, module_short_name): table = "raw" _policy = self._fw.policy.policy_base_chain_name(policy, table, POLICY_CHAIN_PREFIX) add_del = { True: "-A", False: "-D" }[enable] rule = [ add_del, "%s_allow" % (_policy), "-t", "raw", "-p", proto ] if port: rule += [ "--dport", "%s" % portStr(port) ] if destination: rule += [ "-d", destination ] rule += [ "-j", "CT", "--helper", module_short_name ] return [rule] def build_zone_forward_rules(self, enable, zone, policy, table, interface=None, source=None): add_del = { True: "-A", False: "-D" }[enable] _policy = self._fw.policy.policy_base_chain_name(policy, table, POLICY_CHAIN_PREFIX) rules = [] if interface: rules.append(["-t", "filter", add_del, "%s_allow" % _policy, "-o", interface, "-j", "ACCEPT"]) else: # source # iptables can not match destination MAC if check_mac(source): return [] rules.append(["-t", "filter", add_del, "%s_allow" % _policy] + self._rule_addr_fragment("-d", source) + ["-j", "ACCEPT"]) return rules def build_policy_masquerade_rules(self, enable, policy, rich_rule=None): table = "nat" _policy = self._fw.policy.policy_base_chain_name(policy, table, POLICY_CHAIN_PREFIX, isSNAT=True) add_del = { True: "-A", False: "-D" }[enable] rule_fragment = [] if rich_rule: chain_suffix = self._rich_rule_chain_suffix(rich_rule) rule_fragment += self._rich_rule_priority_fragment(rich_rule) rule_fragment += self._rich_rule_destination_fragment(rich_rule.destination) rule_fragment += self._rich_rule_source_fragment(rich_rule.source) else: chain_suffix = "allow" rules = [] rules.append(["-t", "nat", add_del, "%s_%s" % (_policy, chain_suffix)] + rule_fragment + [ "!", "-o", "lo", "-j", "MASQUERADE" ]) return rules def build_policy_forward_port_rules(self, enable, policy, port, protocol, toport, toaddr, rich_rule=None): table = "nat" _policy = self._fw.policy.policy_base_chain_name(policy, table, POLICY_CHAIN_PREFIX) add_del = { True: "-A", False: "-D" }[enable] to = "" if toaddr: if check_single_address("ipv6", toaddr): to += "[%s]" % normalizeIP6(toaddr) else: to += toaddr if toport and toport != "": to += ":%s" % portStr(toport, "-") rule_fragment = [] if rich_rule: chain_suffix = self._rich_rule_chain_suffix(rich_rule) rule_fragment = self._rich_rule_priority_fragment(rich_rule) rule_fragment += self._rich_rule_destination_fragment(rich_rule.destination) rule_fragment += self._rich_rule_source_fragment(rich_rule.source) else: chain_suffix = "allow" rules = [] if rich_rule: rules.append(self._rich_rule_log(policy, rich_rule, enable, "nat", rule_fragment)) rules.append(["-t", "nat", add_del, "%s_%s" % (_policy, chain_suffix)] + rule_fragment + ["-p", protocol, "--dport", portStr(port), "-j", "DNAT", "--to-destination", to]) return rules def build_policy_icmp_block_rules(self, enable, policy, ict, rich_rule=None): table = "filter" _policy = self._fw.policy.policy_base_chain_name(policy, table, POLICY_CHAIN_PREFIX) add_del = { True: "-A", False: "-D" }[enable] if self.ipv == "ipv4": proto = [ "-p", "icmp" ] match = [ "-m", "icmp", "--icmp-type", ict.name ] else: proto = [ "-p", "ipv6-icmp" ] match = [ "-m", "icmp6", "--icmpv6-type", ict.name ] rules = [] if self._fw.policy.query_icmp_block_inversion(policy): final_chain = "%s_allow" % (_policy) final_target = "ACCEPT" else: final_chain = "%s_deny" % (_policy) final_target = "%%REJECT%%" rule_fragment = [] if rich_rule: rule_fragment += self._rich_rule_destination_fragment(rich_rule.destination) rule_fragment += self._rich_rule_source_fragment(rich_rule.source) rule_fragment += proto + match if rich_rule: rules.append(self._rich_rule_log(policy, rich_rule, enable, table, rule_fragment)) rules.append(self._rich_rule_audit(policy, rich_rule, enable, table, rule_fragment)) if rich_rule.action: rules.append(self._rich_rule_action(policy, rich_rule, enable, table, rule_fragment)) else: chain_suffix = self._rich_rule_chain_suffix(rich_rule) rules.append(["-t", table, add_del, "%s_%s" % (_policy, chain_suffix)] + self._rich_rule_priority_fragment(rich_rule) + rule_fragment + [ "-j", "%%REJECT%%" ]) else: if self._fw.get_log_denied() != "off" and final_target != "ACCEPT": rules.append([ add_del, final_chain, "-t", table ] + rule_fragment + [ "%%LOGTYPE%%", "-j", "LOG", "--log-prefix", "\"%s_ICMP_BLOCK: \"" % policy ]) rules.append([ add_del, final_chain, "-t", table ] + rule_fragment + [ "-j", final_target ]) return rules def build_policy_icmp_block_inversion_rules(self, enable, policy): table = "filter" _policy = self._fw.policy.policy_base_chain_name(policy, table, POLICY_CHAIN_PREFIX) rules = [] rule_idx = 8 if self._fw.policy.query_icmp_block_inversion(policy): ibi_target = "%%REJECT%%" if self._fw.get_log_denied() != "off": if enable: rule = [ "-I", _policy, str(rule_idx) ] else: rule = [ "-D", _policy ] rule = rule + [ "-t", table, "-p", "%%ICMP%%", "%%LOGTYPE%%", "-j", "LOG", "--log-prefix", "\"%s_ICMP_BLOCK: \"" % _policy ] rules.append(rule) rule_idx += 1 else: ibi_target = "ACCEPT" if enable: rule = [ "-I", _policy, str(rule_idx) ] else: rule = [ "-D", _policy ] rule = rule + [ "-t", table, "-p", "%%ICMP%%", "-j", ibi_target ] rules.append(rule) return rules def build_policy_rich_source_destination_rules(self, enable, policy, rich_rule): table = "filter" rule_fragment = [] rule_fragment += self._rich_rule_destination_fragment(rich_rule.destination) rule_fragment += self._rich_rule_source_fragment(rich_rule.source) rules = [] rules.append(self._rich_rule_log(policy, rich_rule, enable, table, rule_fragment)) rules.append(self._rich_rule_audit(policy, rich_rule, enable, table, rule_fragment)) rules.append(self._rich_rule_action(policy, rich_rule, enable, table, rule_fragment)) return rules def is_ipv_supported(self, ipv): return ipv == self.ipv class ip6tables(ip4tables): ipv = "ipv6" name = "ip6tables" def build_rpfilter_rules(self, log_denied=False): rules = [] rules.append([ "-I", "PREROUTING", "-t", "mangle", "-m", "rpfilter", "--invert", "--validmark", "-j", "DROP" ]) if log_denied != "off": rules.append([ "-I", "PREROUTING", "-t", "mangle", "-m", "rpfilter", "--invert", "--validmark", "-j", "LOG", "--log-prefix", "rpfilter_DROP: " ]) rules.append([ "-I", "PREROUTING", "-t", "mangle", "-p", "ipv6-icmp", "--icmpv6-type=neighbour-solicitation", "-j", "ACCEPT" ]) # RHBZ#1575431, kernel bug in 4.16-4.17 rules.append([ "-I", "PREROUTING", "-t", "mangle", "-p", "ipv6-icmp", "--icmpv6-type=router-advertisement", "-j", "ACCEPT" ]) # RHBZ#1058505 return rules def build_rfc3964_ipv4_rules(self): daddr_list = [ "::0.0.0.0/96", # IPv4 compatible "::ffff:0.0.0.0/96", # IPv4 mapped "2002:0000::/24", # 0.0.0.0/8 (the system has no address assigned yet) "2002:0a00::/24", # 10.0.0.0/8 (private) "2002:7f00::/24", # 127.0.0.0/8 (loopback) "2002:ac10::/28", # 172.16.0.0/12 (private) "2002:c0a8::/32", # 192.168.0.0/16 (private) "2002:a9fe::/32", # 169.254.0.0/16 (IANA Assigned DHCP link-local) "2002:e000::/19", # 224.0.0.0/4 (multicast), 240.0.0.0/4 (reserved and broadcast) ] chain_name = "RFC3964_IPv4" self.our_chains["filter"].add(chain_name) rules = [] rules.append(["-t", "filter", "-N", chain_name]) for daddr in daddr_list: rules.append(["-t", "filter", "-I", chain_name, "-d", daddr, "-j", "REJECT", "--reject-with", "addr-unreach"]) if self._fw._log_denied in ["unicast", "all"]: rules.append(["-t", "filter", "-I", chain_name, "-d", daddr, "-j", "LOG", "--log-prefix", "\"RFC3964_IPv4_REJECT: \""]) # Inject into FORWARD and OUTPUT chains rules.append(["-t", "filter", "-I", "OUTPUT", "4", "-j", chain_name]) rules.append(["-t", "filter", "-I", "FORWARD", "4", "-j", chain_name]) return rules PK ���Z���~� � core/watcher.pynu �[��� # -*- coding: utf-8 -*- # # Copyright (C) 2012-2016 Red Hat, Inc. # # Authors: # Thomas Woerner <twoerner@redhat.com> # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see <http://www.gnu.org/licenses/>. # __all__ = [ "Watcher" ] from gi.repository import Gio, GLib class Watcher(object): def __init__(self, callback, timeout): self._callback = callback self._timeout = timeout self._monitors = { } self._timeouts = { } self._blocked = [ ] def add_watch_dir(self, directory): gfile = Gio.File.new_for_path(directory) self._monitors[directory] = gfile.monitor_directory(\ Gio.FileMonitorFlags.NONE, None) self._monitors[directory].connect("changed", self._file_changed_cb) def add_watch_file(self, filename): gfile = Gio.File.new_for_path(filename) self._monitors[filename] = gfile.monitor_file(\ Gio.FileMonitorFlags.NONE, None) self._monitors[filename].connect("changed", self._file_changed_cb) def get_watches(self): return self._monitors.keys() def has_watch(self, filename): return filename in self._monitors def remove_watch(self, filename): del self._monitors[filename] def block_source(self, filename): if filename not in self._blocked: self._blocked.append(filename) def unblock_source(self, filename): if filename in self._blocked: self._blocked.remove(filename) def clear_timeouts(self): for filename in list(self._timeouts.keys()): GLib.source_remove(self._timeouts[filename]) del self._timeouts[filename] def _call_callback(self, filename): if filename not in self._blocked: self._callback(filename) del self._timeouts[filename] def _file_changed_cb(self, monitor, gio_file, gio_other_file, event): filename = gio_file.get_parse_name() if filename in self._blocked: if filename in self._timeouts: GLib.source_remove(self._timeouts[filename]) del self._timeouts[filename] return if event == Gio.FileMonitorEvent.CHANGED or \ event == Gio.FileMonitorEvent.CREATED or \ event == Gio.FileMonitorEvent.DELETED or \ event == Gio.FileMonitorEvent.ATTRIBUTE_CHANGED: if filename in self._timeouts: GLib.source_remove(self._timeouts[filename]) del self._timeouts[filename] self._timeouts[filename] = GLib.timeout_add_seconds(\ self._timeout, self._call_callback, filename) PK ���Z�H��� � core/modules.pynu �[��� # -*- coding: utf-8 -*- # # Copyright (C) 2010-2016 Red Hat, Inc. # # Authors: # Thomas Woerner <twoerner@redhat.com> # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see <http://www.gnu.org/licenses/>. # """modules backend""" __all__ = [ "modules" ] from firewall.core.prog import runProg from firewall.core.logger import log from firewall.config import COMMANDS class modules(object): def __init__(self): self._load_command = COMMANDS["modprobe"] # Use rmmod instead of modprobe -r (RHBZ#1031102) self._unload_command = COMMANDS["rmmod"] def __repr__(self): return '%s' % (self.__class__) def loaded_modules(self): """ get all loaded kernel modules and their dependencies """ mods = [ ] deps = { } with open("/proc/modules", "r") as f: for line in f: if not line: break line = line.strip() splits = line.split() mods.append(splits[0]) if splits[3] != "-": deps[splits[0]] = splits[3].split(",")[:-1] else: deps[splits[0]] = [ ] return mods, deps # [loaded modules], {module:[dependants]} def load_module(self, module): log.debug2("%s: %s %s", self.__class__, self._load_command, module) return runProg(self._load_command, [ module ]) def unload_module(self, module): log.debug2("%s: %s %s", self.__class__, self._unload_command, module) return runProg(self._unload_command, [ module ]) def get_deps(self, module, deps, ret): """ get all dependants of a module """ if module not in deps: return for mod in deps[module]: self.get_deps(mod, deps, ret) if mod not in ret: ret.append(mod) if module not in ret: ret.append(module) def get_firewall_modules(self): """ get all loaded firewall-related modules """ mods = [ ] (mods2, deps) = self.loaded_modules() self.get_deps("nf_conntrack", deps, mods) # these modules don't have dependants listed in /proc/modules for bad_bad_module in ["nf_conntrack_ipv4", "nf_conntrack_ipv6"]: if bad_bad_module in mods: # move them to end of list, so we'll remove them later mods.remove(bad_bad_module) mods.insert(-1, bad_bad_module) for mod in mods2: if mod in [ "ip_tables", "ip6_tables", "ebtables" ] or \ mod.startswith("iptable_") or mod.startswith("ip6table_") or \ mod.startswith("nf_") or mod.startswith("xt_") or \ mod.startswith("ipt_") or mod.startswith("ip6t_") : self.get_deps(mod, deps, mods) return mods def unload_firewall_modules(self): """ unload all firewall-related modules """ for module in self.get_firewall_modules(): (status, ret) = self.unload_module(module) if status != 0: log.debug1("Failed to unload module '%s': %s" %(module, ret)) PK ���Z �~�. �. core/fw_policy.pynu �[��� # -*- coding: utf-8 -*- # # SPDX-License-Identifier: GPL-2.0-or-later import copy from firewall.core.logger import log from firewall.functions import portStr, checkIPnMask, checkIP6nMask, \ checkProtocol, enable_ip_forwarding, check_single_address, \ portInPortRange, get_nf_conntrack_short_name, coalescePortRange, breakPortRange, \ checkTcpMssClamp from firewall.core.rich import Rich_Rule, Rich_Accept, \ Rich_Service, Rich_Port, Rich_Protocol, \ Rich_Masquerade, Rich_ForwardPort, Rich_SourcePort, Rich_IcmpBlock, \ Rich_IcmpType, Rich_Tcp_Mss_Clamp from firewall.core.fw_transaction import FirewallTransaction from firewall import errors from firewall.errors import FirewallError from firewall.core.base import SOURCE_IPSET_TYPES class FirewallPolicy(object): def __init__(self, fw): self._fw = fw self._chains = { } self._policies = { } def __repr__(self): return '%s(%r, %r)' % (self.__class__, self._chains, self._policies) def cleanup(self): self._chains.clear() self._policies.clear() # transaction def new_transaction(self): t = FirewallTransaction(self._fw) t.add_pre(self._fw.full_check_config) return t # policies def get_policies(self): return sorted(self._policies.keys()) def get_policies_not_derived_from_zone(self): policies = [] for p in self.get_policies(): p_obj = self.get_policy(p) if not p_obj.derived_from_zone: policies.append(p) return sorted(policies) def get_active_policies_not_derived_from_zone(self): active_policies = [] for policy in self.get_policies_not_derived_from_zone(): p_obj = self.get_policy(policy) if (set(p_obj.ingress_zones) & (set(self._fw.zone.get_active_zones()) | set(["HOST", "ANY"]))) and \ (set(p_obj.egress_zones) & (set(self._fw.zone.get_active_zones()) | set(["HOST", "ANY"]))): active_policies.append(policy) return active_policies def get_policy(self, policy): p = self._fw.check_policy(policy) return self._policies[p] def add_policy(self, obj): self._policies[obj.name] = obj def remove_policy(self, policy): obj = self._policies[policy] if obj.applied: self.unapply_policy_settings(policy) del self._policies[policy] def apply_policies(self, use_transaction=None): for policy in self.get_policies(): p_obj = self._policies[policy] if p_obj.derived_from_zone: continue if policy in self.get_active_policies_not_derived_from_zone(): log.debug1("Applying policy '%s'", policy) self.apply_policy_settings(policy, use_transaction=use_transaction) def set_policy_applied(self, policy, applied): obj = self._policies[policy] obj.applied = applied def _policy_settings(self, enable, policy, use_transaction=None): _policy = self._fw.check_policy(policy) obj = self._policies[_policy] if (enable and obj.applied) or (not enable and not obj.applied): return if enable: obj.applied = True if use_transaction is None: transaction = self.new_transaction() else: transaction = use_transaction if enable: # build the base chain layout of the policy for (table, chain) in self._get_table_chains_for_policy_dispatch(policy) if not obj.derived_from_zone \ else self._get_table_chains_for_zone_dispatch(policy): self.gen_chain_rules(policy, True, table, chain, transaction) if not obj.derived_from_zone: self._ingress_egress_zones(enable, _policy, transaction) for key in ["services", "ports", "masquerade", "forward_ports", "source_ports", "icmp_blocks", "rules_str", "protocols", "icmp_block_inversion", "ingress_zones", "egress_zones"]: args_list = getattr(self.get_policy(policy), key) if isinstance(args_list, bool): if not ((enable and args_list) or (not enable and args_list)): continue args_list = [args_list] for args in args_list: if key == "icmp_blocks": self._icmp_block(enable, _policy, args, transaction) elif key == "icmp_block_inversion": continue elif key == "forward_ports": self._forward_port(enable, _policy, transaction, *args) elif key == "services": self._service(enable, _policy, args, transaction) elif key == "ports": self._port(enable, _policy, args[0], args[1], transaction) elif key == "protocols": self._protocol(enable, _policy, args, transaction) elif key == "source_ports": self._source_port(enable, _policy, args[0], args[1], transaction) elif key == "masquerade": self._masquerade(enable, _policy, transaction) elif key == "rules_str": self.__rule(enable, _policy, Rich_Rule(rule_str=args), transaction) elif key == "ingress_zones": continue elif key == "egress_zones": continue else: log.warning("Policy '%s': Unknown setting '%s:%s', " "unable to apply", policy, key, args) if not enable: for (table, chain) in self._get_table_chains_for_policy_dispatch(policy) if not obj.derived_from_zone \ else self._get_table_chains_for_zone_dispatch(policy): self.gen_chain_rules(policy, False, table, chain, transaction) obj.applied = False if use_transaction is None: transaction.execute(enable) def apply_policy_settings(self, policy, use_transaction=None): self._policy_settings(True, policy, use_transaction=use_transaction) def unapply_policy_settings(self, policy, use_transaction=None): self._policy_settings(False, policy, use_transaction=use_transaction) def get_config_with_settings_dict(self, policy): return self.get_policy(policy).export_config_dict() def set_config_with_settings_dict(self, policy, settings, sender): # stupid wrappers to convert rich rule string to rich rule object from firewall.core.rich import Rich_Rule def add_rule_wrapper(policy, rule_str, timeout=0, sender=None): self.add_rule(policy, Rich_Rule(rule_str=rule_str), timeout=0, sender=sender) def remove_rule_wrapper(policy, rule_str): self.remove_rule(policy, Rich_Rule(rule_str=rule_str)) setting_to_fn = { "services": (self.add_service, self.remove_service), "ports": (self.add_port, self.remove_port), "icmp_blocks": (self.add_icmp_block, self.remove_icmp_block), "masquerade": (self.add_masquerade, self.remove_masquerade), "forward_ports": (self.add_forward_port, self.remove_forward_port), "rich_rules": (add_rule_wrapper, remove_rule_wrapper), "protocols": (self.add_protocol, self.remove_protocol), "source_ports": (self.add_source_port, self.remove_source_port), "ingress_zones": (self.add_ingress_zone, self.remove_ingress_zone), "egress_zones": (self.add_egress_zone, self.remove_egress_zone), } # do a full config check on a temporary object before trying to make # the runtime changes old_obj = self.get_policy(policy) check_obj = copy.copy(old_obj) check_obj.import_config_dict(settings, self._fw.get_all_io_objects_dict()) self._fw.full_check_config({"policies": [check_obj]}) old_settings = self.get_config_with_settings_dict(policy) (add_settings, remove_settings) = self._fw.get_added_and_removed_settings(old_settings, settings) for key in remove_settings: if isinstance(remove_settings[key], list): for args in remove_settings[key]: if isinstance(args, tuple): setting_to_fn[key][1](policy, *args) else: setting_to_fn[key][1](policy, args) else: # bool setting_to_fn[key][1](policy) for key in add_settings: if isinstance(add_settings[key], list): for args in add_settings[key]: if isinstance(args, tuple): setting_to_fn[key][0](policy, *args, timeout=0, sender=sender) else: setting_to_fn[key][0](policy, args, timeout=0, sender=sender) else: # bool setting_to_fn[key][0](policy, timeout=0, sender=sender) # ingress zones def check_ingress_zone(self, zone): if not zone: raise FirewallError(errors.INVALID_ZONE) if zone not in ["HOST", "ANY"]: self._fw.check_zone(zone) def __ingress_zone_id(self, zone): self.check_ingress_zone(zone) return zone def add_ingress_zone(self, policy, zone, timeout=0, sender=None, use_transaction=None, allow_apply=True): _policy = self._fw.check_policy(policy) self._fw.check_timeout(timeout) self._fw.check_panic() _obj = self._policies[_policy] zone_id = self.__ingress_zone_id(zone) if zone_id in _obj.ingress_zones: raise FirewallError(errors.ALREADY_ENABLED, "'%s' already in '%s'" % (zone, _policy)) if use_transaction is None: transaction = self.new_transaction() else: transaction = use_transaction if allow_apply: if _obj.applied: self._ingress_egress_zones(False, _policy, transaction) # register early so backends can access updated zone list self.__register_ingress_zone(_obj, zone_id, timeout, sender) transaction.add_fail(self.__unregister_ingress_zone, _obj, zone_id) if not _obj.applied: if _policy in self.get_active_policies_not_derived_from_zone(): self.apply_policy_settings(_policy, use_transaction=transaction) transaction.add_fail(self.set_policy_applied, _policy, False) else: self._ingress_egress_zones(True, _policy, transaction) else: self.__register_ingress_zone(_obj, zone_id, timeout, sender) transaction.add_fail(self.__unregister_ingress_zone, _obj, zone_id) if use_transaction is None: transaction.execute(True) def __register_ingress_zone(self, _obj, zone_id, timeout, sender): _obj.ingress_zones.append(zone_id) def remove_ingress_zone(self, policy, zone, use_transaction=None): _policy = self._fw.check_policy(policy) self._fw.check_panic() _obj = self._policies[_policy] zone_id = self.__ingress_zone_id(zone) if zone_id not in _obj.ingress_zones: raise FirewallError(errors.NOT_ENABLED, "'%s' not in '%s'" % (zone, _policy)) if use_transaction is None: transaction = self.new_transaction() else: transaction = use_transaction if _obj.applied: if len(_obj.ingress_zones) == 1: self.unapply_policy_settings(_policy, transaction) else: self._ingress_egress_zones(False, _policy, transaction) # unregister early so backends have updated zone list self.__unregister_ingress_zone(_obj, zone_id) transaction.add_fail(self.__register_ingress_zone, _obj, zone_id, None, None) if _policy in self.get_active_policies_not_derived_from_zone(): self._ingress_egress_zones(True, _policy, transaction) else: transaction.add_post(self.__unregister_ingress_zone, _obj, zone_id) if use_transaction is None: transaction.execute(True) return _policy def __unregister_ingress_zone(self, _obj, zone_id): if zone_id in _obj.ingress_zones: _obj.ingress_zones.remove(zone_id) def query_ingress_zone(self, policy, zone): return self.__ingress_zone_id(zone) in self.get_policy(policy).ingress_zones def list_ingress_zones(self, policy): return self.get_policy(policy).ingress_zones # egress zones def check_egress_zone(self, zone): if not zone: raise FirewallError(errors.INVALID_ZONE) if zone not in ["HOST", "ANY"]: self._fw.check_zone(zone) def __egress_zone_id(self, zone): self.check_egress_zone(zone) return zone def add_egress_zone(self, policy, zone, timeout=0, sender=None, use_transaction=None, allow_apply=True): _policy = self._fw.check_policy(policy) self._fw.check_timeout(timeout) self._fw.check_panic() _obj = self._policies[_policy] zone_id = self.__egress_zone_id(zone) if zone_id in _obj.egress_zones: raise FirewallError(errors.ALREADY_ENABLED, "'%s' already in '%s'" % (zone, _policy)) if use_transaction is None: transaction = self.new_transaction() else: transaction = use_transaction if allow_apply: if _obj.applied: self._ingress_egress_zones(False, _policy, transaction) # register early so backends can access updated zone list self.__register_egress_zone(_obj, zone_id, timeout, sender) transaction.add_fail(self.__unregister_egress_zone, _obj, zone_id) if not _obj.applied: if _policy in self.get_active_policies_not_derived_from_zone(): self.apply_policy_settings(_policy, use_transaction=transaction) transaction.add_fail(self.set_policy_applied, _policy, False) else: self._ingress_egress_zones(True, _policy, transaction) else: self.__register_egress_zone(_obj, zone_id, timeout, sender) transaction.add_fail(self.__unregister_egress_zone, _obj, zone_id) if use_transaction is None: transaction.execute(True) def __register_egress_zone(self, _obj, zone_id, timeout, sender): _obj.egress_zones.append(zone_id) def remove_egress_zone(self, policy, zone, use_transaction=None): _policy = self._fw.check_policy(policy) self._fw.check_panic() _obj = self._policies[_policy] zone_id = self.__egress_zone_id(zone) if zone_id not in _obj.egress_zones: raise FirewallError(errors.NOT_ENABLED, "'%s' not in '%s'" % (zone, _policy)) if use_transaction is None: transaction = self.new_transaction() else: transaction = use_transaction if _obj.applied: if len(_obj.egress_zones) == 1: self.unapply_policy_settings(_policy, transaction) else: self._ingress_egress_zones(False, _policy, transaction) # unregister early so backends have updated zone list self.__unregister_egress_zone(_obj, zone_id) transaction.add_fail(self.__register_egress_zone, _obj, zone_id, None, None) if _policy in self.get_active_policies_not_derived_from_zone(): self._ingress_egress_zones(True, _policy, transaction) else: transaction.add_post(self.__unregister_egress_zone, _obj, zone_id) if use_transaction is None: transaction.execute(True) return _policy def __unregister_egress_zone(self, _obj, zone_id): if zone_id in _obj.egress_zones: _obj.egress_zones.remove(zone_id) def query_egress_zone(self, policy, zone): return self.__egress_zone_id(zone) in self.get_policy(policy).egress_zones def list_egress_zones(self, policy): return self.get_policy(policy).egress_zones # RICH LANGUAGE def check_rule(self, rule): rule.check() def __rule_id(self, rule): self.check_rule(rule) return str(rule) def _rule_source_ipv(self, source): if not source: return None if source.addr: if checkIPnMask(source.addr): return "ipv4" elif checkIP6nMask(source.addr): return "ipv6" elif hasattr(source, "mac") and source.mac: return "" elif hasattr(source, "ipset") and source.ipset: self._check_ipset_type_for_source(source.ipset) self._check_ipset_applied(source.ipset) return self._ipset_family(source.ipset) return None def __rule(self, enable, policy, rule, transaction): self._rule_prepare(enable, policy, rule, transaction) def add_rule(self, policy, rule, timeout=0, sender=None, use_transaction=None): _policy = self._fw.check_policy(policy) self._fw.check_timeout(timeout) self._fw.check_panic() _obj = self._policies[_policy] rule_id = self.__rule_id(rule) if rule_id in _obj.rules_str: _name = _obj.derived_from_zone if _obj.derived_from_zone else _policy raise FirewallError(errors.ALREADY_ENABLED, "'%s' already in '%s'" % (rule, _name)) if use_transaction is None: transaction = self.new_transaction() else: transaction = use_transaction if _obj.applied: self.__rule(True, _policy, rule, transaction) self.__register_rule(_obj, rule_id, timeout, sender) transaction.add_fail(self.__unregister_rule, _obj, rule_id) if use_transaction is None: transaction.execute(True) return _policy def __register_rule(self, _obj, rule_id, timeout, sender): _obj.rules_str.append(rule_id) def remove_rule(self, policy, rule, use_transaction=None): _policy = self._fw.check_policy(policy) self._fw.check_panic() _obj = self._policies[_policy] rule_id = self.__rule_id(rule) if rule_id not in _obj.rules_str: _name = _obj.derived_from_zone if _obj.derived_from_zone else _policy raise FirewallError(errors.NOT_ENABLED, "'%s' not in '%s'" % (rule, _name)) if use_transaction is None: transaction = self.new_transaction() else: transaction = use_transaction if _obj.applied: self.__rule(False, _policy, rule, transaction) transaction.add_post(self.__unregister_rule, _obj, rule_id) if use_transaction is None: transaction.execute(True) return _policy def __unregister_rule(self, _obj, rule_id): if rule_id in _obj.rules_str: _obj.rules_str.remove(rule_id) def query_rule(self, policy, rule): return self.__rule_id(rule) in self.get_policy(policy).rules_str def list_rules(self, policy): return self.get_policy(policy).rules_str # SERVICES def check_service(self, service): self._fw.check_service(service) def __service_id(self, service): self.check_service(service) return service def add_service(self, policy, service, timeout=0, sender=None, use_transaction=None): _policy = self._fw.check_policy(policy) self._fw.check_timeout(timeout) self._fw.check_panic() _obj = self._policies[_policy] service_id = self.__service_id(service) if service_id in _obj.services: _name = _obj.derived_from_zone if _obj.derived_from_zone else _policy raise FirewallError(errors.ALREADY_ENABLED, "'%s' already in '%s'" % (service, _name)) if use_transaction is None: transaction = self.new_transaction() else: transaction = use_transaction if _obj.applied: self._service(True, _policy, service, transaction) self.__register_service(_obj, service_id, timeout, sender) transaction.add_fail(self.__unregister_service, _obj, service_id) if use_transaction is None: transaction.execute(True) return _policy def __register_service(self, _obj, service_id, timeout, sender): _obj.services.append(service_id) def remove_service(self, policy, service, use_transaction=None): _policy = self._fw.check_policy(policy) self._fw.check_panic() _obj = self._policies[_policy] service_id = self.__service_id(service) if service_id not in _obj.services: _name = _obj.derived_from_zone if _obj.derived_from_zone else _policy raise FirewallError(errors.NOT_ENABLED, "'%s' not in '%s'" % (service, _name)) if use_transaction is None: transaction = self.new_transaction() else: transaction = use_transaction if _obj.applied: self._service(False, _policy, service, transaction) transaction.add_post(self.__unregister_service, _obj, service_id) if use_transaction is None: transaction.execute(True) return _policy def __unregister_service(self, _obj, service_id): if service_id in _obj.services: _obj.services.remove(service_id) def query_service(self, policy, service): return self.__service_id(service) in self.get_policy(policy).services def list_services(self, policy): return self.get_policy(policy).services def get_helpers_for_service_helpers(self, helpers): _helpers = [ ] for helper in helpers: try: _helper = self._fw.helper.get_helper(helper) except FirewallError: raise FirewallError(errors.INVALID_HELPER, helper) _helpers.append(_helper) return _helpers def get_helpers_for_service_modules(self, modules, enable): # If automatic helper assignment is turned off, helpers that # do not have ports defined will be replaced by the helpers # that the helper.module defines. _helpers = [ ] for module in modules: try: helper = self._fw.helper.get_helper(module) except FirewallError: raise FirewallError(errors.INVALID_HELPER, module) if len(helper.ports) < 1: _module_short_name = get_nf_conntrack_short_name(helper.module) try: _helper = self._fw.helper.get_helper(_module_short_name) _helpers.append(_helper) except FirewallError: if enable: log.warning("Helper '%s' is not available" % _module_short_name) continue else: _helpers.append(helper) return _helpers # PORTS def check_port(self, port, protocol): self._fw.check_port(port) self._fw.check_tcpudp(protocol) def __port_id(self, port, protocol): self.check_port(port, protocol) return (portStr(port, "-"), protocol) def add_port(self, policy, port, protocol, timeout=0, sender=None, use_transaction=None): _policy = self._fw.check_policy(policy) self._fw.check_timeout(timeout) self._fw.check_panic() _obj = self._policies[_policy] existing_port_ids = list(filter(lambda x: x[1] == protocol, _obj.ports)) for port_id in existing_port_ids: if portInPortRange(port, port_id[0]): _name = _obj.derived_from_zone if _obj.derived_from_zone else _policy raise FirewallError(errors.ALREADY_ENABLED, "'%s:%s' already in '%s'" % (port, protocol, _name)) added_ranges, removed_ranges = coalescePortRange(port, [_port for (_port, _protocol) in existing_port_ids]) if use_transaction is None: transaction = self.new_transaction() else: transaction = use_transaction if _obj.applied: for range in added_ranges: self._port(True, _policy, portStr(range, "-"), protocol, transaction) for range in removed_ranges: self._port(False, _policy, portStr(range, "-"), protocol, transaction) for range in added_ranges: port_id = self.__port_id(range, protocol) self.__register_port(_obj, port_id, timeout, sender) transaction.add_fail(self.__unregister_port, _obj, port_id) for range in removed_ranges: port_id = self.__port_id(range, protocol) transaction.add_post(self.__unregister_port, _obj, port_id) if use_transaction is None: transaction.execute(True) return _policy def __register_port(self, _obj, port_id, timeout, sender): _obj.ports.append(port_id) def remove_port(self, policy, port, protocol, use_transaction=None): _policy = self._fw.check_policy(policy) self._fw.check_panic() _obj = self._policies[_policy] existing_port_ids = list(filter(lambda x: x[1] == protocol, _obj.ports)) for port_id in existing_port_ids: if portInPortRange(port, port_id[0]): break else: _name = _obj.derived_from_zone if _obj.derived_from_zone else _policy raise FirewallError(errors.NOT_ENABLED, "'%s:%s' not in '%s'" % (port, protocol, _name)) added_ranges, removed_ranges = breakPortRange(port, [_port for (_port, _protocol) in existing_port_ids]) if use_transaction is None: transaction = self.new_transaction() else: transaction = use_transaction if _obj.applied: for range in added_ranges: self._port(True, _policy, portStr(range, "-"), protocol, transaction) for range in removed_ranges: self._port(False, _policy, portStr(range, "-"), protocol, transaction) for range in added_ranges: port_id = self.__port_id(range, protocol) self.__register_port(_obj, port_id, 0, None) transaction.add_fail(self.__unregister_port, _obj, port_id) for range in removed_ranges: port_id = self.__port_id(range, protocol) transaction.add_post(self.__unregister_port, _obj, port_id) if use_transaction is None: transaction.execute(True) return _policy def __unregister_port(self, _obj, port_id): if port_id in _obj.ports: _obj.ports.remove(port_id) def query_port(self, policy, port, protocol): for (_port, _protocol) in self.get_policy(policy).ports: if portInPortRange(port, _port) and protocol == _protocol: return True return False def list_ports(self, policy): return self.get_policy(policy).ports # PROTOCOLS def check_protocol(self, protocol): if not checkProtocol(protocol): raise FirewallError(errors.INVALID_PROTOCOL, protocol) def check_tcp_mss_clamp(self, tcp_mss_clamp_value): if not checkTcpMssClamp(tcp_mss_clamp_value): raise FirewallError(errors.INVALID_RULE, "tcp-mss-clamp value must be greater than or equal to 536, or the value 'pmtu'. Invalid value '%s'" % (tcp_mss_clamp_value)) def __protocol_id(self, protocol): self.check_protocol(protocol) return protocol def add_protocol(self, policy, protocol, timeout=0, sender=None, use_transaction=None): _policy = self._fw.check_policy(policy) self._fw.check_timeout(timeout) self._fw.check_panic() _obj = self._policies[_policy] protocol_id = self.__protocol_id(protocol) if protocol_id in _obj.protocols: _name = _obj.derived_from_zone if _obj.derived_from_zone else _policy raise FirewallError(errors.ALREADY_ENABLED, "'%s' already in '%s'" % (protocol, _name)) if use_transaction is None: transaction = self.new_transaction() else: transaction = use_transaction if _obj.applied: self._protocol(True, _policy, protocol, transaction) self.__register_protocol(_obj, protocol_id, timeout, sender) transaction.add_fail(self.__unregister_protocol, _obj, protocol_id) if use_transaction is None: transaction.execute(True) return _policy def __register_protocol(self, _obj, protocol_id, timeout, sender): _obj.protocols.append(protocol_id) def remove_protocol(self, policy, protocol, use_transaction=None): _policy = self._fw.check_policy(policy) self._fw.check_panic() _obj = self._policies[_policy] protocol_id = self.__protocol_id(protocol) if protocol_id not in _obj.protocols: _name = _obj.derived_from_zone if _obj.derived_from_zone else _policy raise FirewallError(errors.NOT_ENABLED, "'%s' not in '%s'" % (protocol, _name)) if use_transaction is None: transaction = self.new_transaction() else: transaction = use_transaction if _obj.applied: self._protocol(False, _policy, protocol, transaction) transaction.add_post(self.__unregister_protocol, _obj, protocol_id) if use_transaction is None: transaction.execute(True) return _policy def __unregister_protocol(self, _obj, protocol_id): if protocol_id in _obj.protocols: _obj.protocols.remove(protocol_id) def query_protocol(self, policy, protocol): return self.__protocol_id(protocol) in self.get_policy(policy).protocols def list_protocols(self, policy): return self.get_policy(policy).protocols # SOURCE PORTS def __source_port_id(self, port, protocol): self.check_port(port, protocol) return (portStr(port, "-"), protocol) def add_source_port(self, policy, port, protocol, timeout=0, sender=None, use_transaction=None): _policy = self._fw.check_policy(policy) self._fw.check_timeout(timeout) self._fw.check_panic() _obj = self._policies[_policy] existing_port_ids = list(filter(lambda x: x[1] == protocol, _obj.source_ports)) for port_id in existing_port_ids: if portInPortRange(port, port_id[0]): _name = _obj.derived_from_zone if _obj.derived_from_zone else _policy raise FirewallError(errors.ALREADY_ENABLED, "'%s:%s' already in '%s'" % (port, protocol, _name)) added_ranges, removed_ranges = coalescePortRange(port, [_port for (_port, _protocol) in existing_port_ids]) if use_transaction is None: transaction = self.new_transaction() else: transaction = use_transaction if _obj.applied: for range in added_ranges: self._source_port(True, _policy, portStr(range, "-"), protocol, transaction) for range in removed_ranges: self._source_port(False, _policy, portStr(range, "-"), protocol, transaction) for range in added_ranges: port_id = self.__source_port_id(range, protocol) self.__register_source_port(_obj, port_id, timeout, sender) transaction.add_fail(self.__unregister_source_port, _obj, port_id) for range in removed_ranges: port_id = self.__source_port_id(range, protocol) transaction.add_post(self.__unregister_source_port, _obj, port_id) if use_transaction is None: transaction.execute(True) return _policy def __register_source_port(self, _obj, port_id, timeout, sender): _obj.source_ports.append(port_id) def remove_source_port(self, policy, port, protocol, use_transaction=None): _policy = self._fw.check_policy(policy) self._fw.check_panic() _obj = self._policies[_policy] existing_port_ids = list(filter(lambda x: x[1] == protocol, _obj.source_ports)) for port_id in existing_port_ids: if portInPortRange(port, port_id[0]): break else: _name = _obj.derived_from_zone if _obj.derived_from_zone else _policy raise FirewallError(errors.NOT_ENABLED, "'%s:%s' not in '%s'" % (port, protocol, _name)) added_ranges, removed_ranges = breakPortRange(port, [_port for (_port, _protocol) in existing_port_ids]) if use_transaction is None: transaction = self.new_transaction() else: transaction = use_transaction if _obj.applied: for range in added_ranges: self._source_port(True, _policy, portStr(range, "-"), protocol, transaction) for range in removed_ranges: self._source_port(False, _policy, portStr(range, "-"), protocol, transaction) for range in added_ranges: port_id = self.__source_port_id(range, protocol) self.__register_source_port(_obj, port_id, 0, None) transaction.add_fail(self.__unregister_source_port, _obj, port_id) for range in removed_ranges: port_id = self.__source_port_id(range, protocol) transaction.add_post(self.__unregister_source_port, _obj, port_id) if use_transaction is None: transaction.execute(True) return _policy def __unregister_source_port(self, _obj, port_id): if port_id in _obj.source_ports: _obj.source_ports.remove(port_id) def query_source_port(self, policy, port, protocol): for (_port, _protocol) in self.get_policy(policy).source_ports: if portInPortRange(port, _port) and protocol == _protocol: return True return False def list_source_ports(self, policy): return self.get_policy(policy).source_ports # MASQUERADE def add_masquerade(self, policy, timeout=0, sender=None, use_transaction=None): _policy = self._fw.check_policy(policy) self._fw.check_timeout(timeout) self._fw.check_panic() _obj = self._policies[_policy] if _obj.masquerade: _name = _obj.derived_from_zone if _obj.derived_from_zone else _policy raise FirewallError(errors.ALREADY_ENABLED, "masquerade already enabled in '%s'" % _name) if use_transaction is None: transaction = self.new_transaction() else: transaction = use_transaction if _obj.applied: self._masquerade(True, _policy, transaction) self.__register_masquerade(_obj, timeout, sender) transaction.add_fail(self.__unregister_masquerade, _obj) if use_transaction is None: transaction.execute(True) return _policy def __register_masquerade(self, _obj, timeout, sender): _obj.masquerade = True def remove_masquerade(self, policy, use_transaction=None): _policy = self._fw.check_policy(policy) self._fw.check_panic() _obj = self._policies[_policy] if not _obj.masquerade: _name = _obj.derived_from_zone if _obj.derived_from_zone else _policy raise FirewallError(errors.NOT_ENABLED, "masquerade not enabled in '%s'" % _name) if use_transaction is None: transaction = self.new_transaction() else: transaction = use_transaction if _obj.applied: self._masquerade(False, _policy, transaction) transaction.add_post(self.__unregister_masquerade, _obj) if use_transaction is None: transaction.execute(True) return _policy def __unregister_masquerade(self, _obj): _obj.masquerade = False def query_masquerade(self, policy): return self.get_policy(policy).masquerade # PORT FORWARDING def check_forward_port(self, ipv, port, protocol, toport=None, toaddr=None): self._fw.check_port(port) self._fw.check_tcpudp(protocol) if toport: self._fw.check_port(toport) if toaddr: if not check_single_address(ipv, toaddr): raise FirewallError(errors.INVALID_ADDR, toaddr) if not toport and not toaddr: raise FirewallError( errors.INVALID_FORWARD, "port-forwarding is missing to-port AND to-addr") def __forward_port_id(self, port, protocol, toport=None, toaddr=None): if check_single_address("ipv6", toaddr): self.check_forward_port("ipv6", port, protocol, toport, toaddr) else: self.check_forward_port("ipv4", port, protocol, toport, toaddr) return (portStr(port, "-"), protocol, portStr(toport, "-"), str(toaddr)) def add_forward_port(self, policy, port, protocol, toport=None, toaddr=None, timeout=0, sender=None, use_transaction=None): _policy = self._fw.check_policy(policy) self._fw.check_timeout(timeout) self._fw.check_panic() _obj = self._policies[_policy] forward_id = self.__forward_port_id(port, protocol, toport, toaddr) if forward_id in _obj.forward_ports: _name = _obj.derived_from_zone if _obj.derived_from_zone else _policy raise FirewallError(errors.ALREADY_ENABLED, "'%s:%s:%s:%s' already in '%s'" % \ (port, protocol, toport, toaddr, _name)) if use_transaction is None: transaction = self.new_transaction() else: transaction = use_transaction if _obj.applied: self._forward_port(True, _policy, transaction, port, protocol, toport, toaddr) self.__register_forward_port(_obj, forward_id, timeout, sender) transaction.add_fail(self.__unregister_forward_port, _obj, forward_id) if use_transaction is None: transaction.execute(True) return _policy def __register_forward_port(self, _obj, forward_id, timeout, sender): _obj.forward_ports.append(forward_id) def remove_forward_port(self, policy, port, protocol, toport=None, toaddr=None, use_transaction=None): _policy = self._fw.check_policy(policy) self._fw.check_panic() _obj = self._policies[_policy] forward_id = self.__forward_port_id(port, protocol, toport, toaddr) if forward_id not in _obj.forward_ports: _name = _obj.derived_from_zone if _obj.derived_from_zone else _policy raise FirewallError(errors.NOT_ENABLED, "'%s:%s:%s:%s' not in '%s'" % \ (port, protocol, toport, toaddr, _name)) if use_transaction is None: transaction = self.new_transaction() else: transaction = use_transaction if _obj.applied: self._forward_port(False, _policy, transaction, port, protocol, toport, toaddr) transaction.add_post(self.__unregister_forward_port, _obj, forward_id) if use_transaction is None: transaction.execute(True) return _policy def __unregister_forward_port(self, _obj, forward_id): if forward_id in _obj.forward_ports: _obj.forward_ports.remove(forward_id) def query_forward_port(self, policy, port, protocol, toport=None, toaddr=None): forward_id = self.__forward_port_id(port, protocol, toport, toaddr) return forward_id in self.get_policy(policy).forward_ports def list_forward_ports(self, policy): return self.get_policy(policy).forward_ports # ICMP BLOCK def check_icmp_block(self, icmp): self._fw.check_icmptype(icmp) def __icmp_block_id(self, icmp): self.check_icmp_block(icmp) return icmp def add_icmp_block(self, policy, icmp, timeout=0, sender=None, use_transaction=None): _policy = self._fw.check_policy(policy) self._fw.check_timeout(timeout) self._fw.check_panic() _obj = self._policies[_policy] icmp_id = self.__icmp_block_id(icmp) if icmp_id in _obj.icmp_blocks: _name = _obj.derived_from_zone if _obj.derived_from_zone else _policy raise FirewallError(errors.ALREADY_ENABLED, "'%s' already in '%s'" % (icmp, _name)) if use_transaction is None: transaction = self.new_transaction() else: transaction = use_transaction if _obj.applied: self._icmp_block(True, _policy, icmp, transaction) self.__register_icmp_block(_obj, icmp_id, timeout, sender) transaction.add_fail(self.__unregister_icmp_block, _obj, icmp_id) if use_transaction is None: transaction.execute(True) return _policy def __register_icmp_block(self, _obj, icmp_id, timeout, sender): _obj.icmp_blocks.append(icmp_id) def remove_icmp_block(self, policy, icmp, use_transaction=None): _policy = self._fw.check_policy(policy) self._fw.check_panic() _obj = self._policies[_policy] icmp_id = self.__icmp_block_id(icmp) if icmp_id not in _obj.icmp_blocks: _name = _obj.derived_from_zone if _obj.derived_from_zone else _policy raise FirewallError(errors.NOT_ENABLED, "'%s' not in '%s'" % (icmp, _name)) if use_transaction is None: transaction = self.new_transaction() else: transaction = use_transaction if _obj.applied: self._icmp_block(False, _policy, icmp, transaction) transaction.add_post(self.__unregister_icmp_block, _obj, icmp_id) if use_transaction is None: transaction.execute(True) return _policy def __unregister_icmp_block(self, _obj, icmp_id): if icmp_id in _obj.icmp_blocks: _obj.icmp_blocks.remove(icmp_id) def query_icmp_block(self, policy, icmp): return self.__icmp_block_id(icmp) in self.get_policy(policy).icmp_blocks def list_icmp_blocks(self, policy): return self.get_policy(policy).icmp_blocks # ICMP BLOCK INVERSION def add_icmp_block_inversion(self, policy, sender=None, use_transaction=None): _policy = self._fw.check_policy(policy) self._fw.check_panic() _obj = self._policies[_policy] if _obj.icmp_block_inversion: _name = _obj.derived_from_zone if _obj.derived_from_zone else _policy raise FirewallError( errors.ALREADY_ENABLED, "icmp-block-inversion already enabled in '%s'" % _name) if use_transaction is None: transaction = self.new_transaction() else: transaction = use_transaction if _obj.applied: # undo icmp blocks for args in _obj.icmp_blocks: self._icmp_block(False, _policy, args, transaction) self._icmp_block_inversion(False, _policy, transaction) self.__register_icmp_block_inversion(_obj, sender) transaction.add_fail(self.__undo_icmp_block_inversion, _policy, _obj) # redo icmp blocks if _obj.applied: for args in _obj.icmp_blocks: self._icmp_block(True, _policy, args, transaction) self._icmp_block_inversion(True, _policy, transaction) if use_transaction is None: transaction.execute(True) return _policy def __register_icmp_block_inversion(self, _obj, sender): _obj.icmp_block_inversion = True def __undo_icmp_block_inversion(self, _policy, _obj): transaction = self.new_transaction() # undo icmp blocks if _obj.applied: for args in _obj.icmp_blocks: self._icmp_block(False, _policy, args, transaction) _obj.icmp_block_inversion = False # redo icmp blocks if _obj.applied: for args in _obj.icmp_blocks: self._icmp_block(True, _policy, args, transaction) transaction.execute(True) def remove_icmp_block_inversion(self, policy, use_transaction=None): _policy = self._fw.check_policy(policy) self._fw.check_panic() _obj = self._policies[_policy] if not _obj.icmp_block_inversion: _name = _obj.derived_from_zone if _obj.derived_from_zone else _policy raise FirewallError( errors.NOT_ENABLED, "icmp-block-inversion not enabled in '%s'" % _name) if use_transaction is None: transaction = self.new_transaction() else: transaction = use_transaction if _obj.applied: # undo icmp blocks for args in _obj.icmp_blocks: self._icmp_block(False, _policy, args, transaction) self._icmp_block_inversion(False, _policy, transaction) self.__unregister_icmp_block_inversion(_obj) transaction.add_fail(self.__register_icmp_block_inversion, _obj, None) # redo icmp blocks if _obj.applied: for args in _obj.icmp_blocks: self._icmp_block(True, _policy, args, transaction) self._icmp_block_inversion(True, _policy, transaction) if use_transaction is None: transaction.execute(True) return _policy def __unregister_icmp_block_inversion(self, _obj): _obj.icmp_block_inversion = False def query_icmp_block_inversion(self, policy): return self.get_policy(policy).icmp_block_inversion def gen_chain_rules(self, policy, create, table, chain, transaction): obj = self._fw.policy.get_policy(policy) if obj.derived_from_zone: # For policies derived from zones, use only the first policy in the # list to track chain creation. The chain names are converted to # zone-based names as such they're "global" for all zone derived # policies. tracking_policy = self._fw.zone._zone_policies[obj.derived_from_zone][0] else: tracking_policy = policy if create: if tracking_policy in self._chains and \ (table, chain) in self._chains[tracking_policy]: return else: if tracking_policy not in self._chains or \ (table, chain) not in self._chains[tracking_policy]: return for backend in self._fw.enabled_backends(): if backend.policies_supported and \ table in backend.get_available_tables(): rules = backend.build_policy_chain_rules(create, policy, table, chain) transaction.add_rules(backend, rules) self._register_chains(tracking_policy, create, [(table, chain)]) transaction.add_fail(self._register_chains, tracking_policy, not create, [(table, chain)]) def _register_chains(self, policy, create, tables): for (table, chain) in tables: if create: self._chains.setdefault(policy, []).append((table, chain)) else: self._chains[policy].remove((table, chain)) if len(self._chains[policy]) == 0: del self._chains[policy] # IPSETS def _ipset_family(self, name): if self._fw.ipset.get_type(name) == "hash:mac": return None return self._fw.ipset.get_family(name) def __ipset_type(self, name): return self._fw.ipset.get_type(name) def _ipset_match_flags(self, name, flag): return ",".join([flag] * self._fw.ipset.get_dimension(name)) def _check_ipset_applied(self, name): return self._fw.ipset.check_applied(name) def _check_ipset_type_for_source(self, name): _type = self.__ipset_type(name) if _type not in SOURCE_IPSET_TYPES: raise FirewallError( errors.INVALID_IPSET, "ipset '%s' with type '%s' not usable as source" % \ (name, _type)) def _rule_prepare(self, enable, policy, rule, transaction): ipvs = [] if rule.family: ipvs = [ rule.family ] elif rule.element and (isinstance(rule.element, Rich_IcmpBlock) or isinstance(rule.element, Rich_IcmpType)): ict = self._fw.config.get_icmptype(rule.element.name) if ict.destination: ipvs = [ipv for ipv in ["ipv4", "ipv6"] if ipv in ict.destination] source_ipv = self._rule_source_ipv(rule.source) if source_ipv: if rule.family: # rule family is defined by user, no way to change it if rule.family != source_ipv: raise FirewallError(errors.INVALID_RULE, "Source address family '%s' conflicts with rule family '%s'." % (source_ipv, rule.family)) else: # use the source family as rule family ipvs = [ source_ipv ] if not ipvs: ipvs = ["ipv4", "ipv6"] # clamp ipvs to those that are actually enabled. ipvs = [ipv for ipv in ipvs if self._fw.is_ipv_enabled(ipv)] # add an element to object to allow backends to know what ipvs this applies to rule.ipvs = ipvs for backend in set([self._fw.get_backend_by_ipv(x) for x in ipvs]): # SERVICE if type(rule.element) == Rich_Service: svc = self._fw.service.get_service(rule.element.name) destinations = [] if len(svc.destination) > 0: if rule.destination: # we can not use two destinations at the same time raise FirewallError(errors.INVALID_RULE, "Destination conflict with service.") for ipv in ipvs: if ipv in svc.destination and backend.is_ipv_supported(ipv): destinations.append(svc.destination[ipv]) else: # dummy for the following for loop destinations.append(None) for destination in destinations: if type(rule.action) == Rich_Accept: # only load modules for accept action helpers = self.get_helpers_for_service_modules(svc.modules, enable) helpers += self.get_helpers_for_service_helpers(svc.helpers) helpers = sorted(set(helpers), key=lambda x: x.name) modules = [ ] for helper in helpers: module = helper.module _module_short_name = get_nf_conntrack_short_name(module) nat_module = module.replace("conntrack", "nat") modules.append(nat_module) if helper.family != "" and not backend.is_ipv_supported(helper.family): # no support for family ipv, continue continue if len(helper.ports) < 1: modules.append(module) else: for (port,proto) in helper.ports: rules = backend.build_policy_helper_ports_rules( enable, policy, proto, port, destination, helper.name, _module_short_name) transaction.add_rules(backend, rules) transaction.add_modules(modules) # create rules for (port,proto) in svc.ports: rules = backend.build_policy_ports_rules( enable, policy, proto, port, destination, rule) transaction.add_rules(backend, rules) for proto in svc.protocols: rules = backend.build_policy_protocol_rules( enable, policy, proto, destination, rule) transaction.add_rules(backend, rules) # create rules for (port,proto) in svc.source_ports: rules = backend.build_policy_source_ports_rules( enable, policy, proto, port, destination, rule) transaction.add_rules(backend, rules) # PORT elif type(rule.element) == Rich_Port: port = rule.element.port protocol = rule.element.protocol self.check_port(port, protocol) rules = backend.build_policy_ports_rules( enable, policy, protocol, port, None, rule) transaction.add_rules(backend, rules) # PROTOCOL elif type(rule.element) == Rich_Protocol: protocol = rule.element.value self.check_protocol(protocol) rules = backend.build_policy_protocol_rules( enable, policy, protocol, None, rule) transaction.add_rules(backend, rules) # TCP/MSS CLAMP elif type(rule.element) == Rich_Tcp_Mss_Clamp: tcp_mss_clamp_value = rule.element.value self.check_tcp_mss_clamp(tcp_mss_clamp_value) rules = backend.build_policy_tcp_mss_clamp_rules( enable, policy, tcp_mss_clamp_value, None, rule) transaction.add_rules(backend, rules) # MASQUERADE elif type(rule.element) == Rich_Masquerade: if enable: for ipv in ipvs: if backend.is_ipv_supported(ipv): transaction.add_post(enable_ip_forwarding, ipv) rules = backend.build_policy_masquerade_rules(enable, policy, rule) transaction.add_rules(backend, rules) # FORWARD PORT elif type(rule.element) == Rich_ForwardPort: port = rule.element.port protocol = rule.element.protocol toport = rule.element.to_port toaddr = rule.element.to_address for ipv in ipvs: if backend.is_ipv_supported(ipv): self.check_forward_port(ipv, port, protocol, toport, toaddr) if toaddr and enable: transaction.add_post(enable_ip_forwarding, ipv) rules = backend.build_policy_forward_port_rules( enable, policy, port, protocol, toport, toaddr, rule) transaction.add_rules(backend, rules) # SOURCE PORT elif type(rule.element) == Rich_SourcePort: port = rule.element.port protocol = rule.element.protocol self.check_port(port, protocol) rules = backend.build_policy_source_ports_rules( enable, policy, protocol, port, None, rule) transaction.add_rules(backend, rules) # ICMP BLOCK and ICMP TYPE elif type(rule.element) == Rich_IcmpBlock or \ type(rule.element) == Rich_IcmpType: ict = self._fw.config.get_icmptype(rule.element.name) if rule.family and ict.destination and \ rule.family not in ict.destination: raise FirewallError(errors.INVALID_ICMPTYPE, "rich rule family '%s' conflicts with icmp type '%s'" % \ (rule.family, rule.element.name)) if type(rule.element) == Rich_IcmpBlock and \ rule.action and type(rule.action) == Rich_Accept: # icmp block might have reject or drop action, but not accept raise FirewallError(errors.INVALID_RULE, "IcmpBlock not usable with accept action") rules = backend.build_policy_icmp_block_rules(enable, policy, ict, rule) transaction.add_rules(backend, rules) elif rule.element is None: rules = backend.build_policy_rich_source_destination_rules( enable, policy, rule) transaction.add_rules(backend, rules) # EVERYTHING ELSE else: raise FirewallError(errors.INVALID_RULE, "Unknown element %s" % type(rule.element)) def _service(self, enable, policy, service, transaction, included_services=None): svc = self._fw.service.get_service(service) helpers = self.get_helpers_for_service_modules(svc.modules, enable) helpers += self.get_helpers_for_service_helpers(svc.helpers) helpers = sorted(set(helpers), key=lambda x: x.name) # First apply any services this service may include if included_services is None: included_services = [service] for include in svc.includes: if include in included_services: continue self.check_service(include) included_services.append(include) self._service(enable, policy, include, transaction, included_services=included_services) # build a list of (backend, destination). The destination may be ipv4, # ipv6 or None # backends_ipv = [] for ipv in ["ipv4", "ipv6"]: if not self._fw.is_ipv_enabled(ipv): continue backend = self._fw.get_backend_by_ipv(ipv) if len(svc.destination) > 0: if ipv in svc.destination: backends_ipv.append((backend, svc.destination[ipv])) else: if (backend, None) not in backends_ipv: backends_ipv.append((backend, None)) for (backend,destination) in backends_ipv: for helper in helpers: module = helper.module _module_short_name = get_nf_conntrack_short_name(module) nat_module = helper.module.replace("conntrack", "nat") transaction.add_module(nat_module) if helper.family != "" and not backend.is_ipv_supported(helper.family): # no support for family ipv, continue continue if len(helper.ports) < 1: transaction.add_module(module) else: for (port,proto) in helper.ports: rules = backend.build_policy_helper_ports_rules( enable, policy, proto, port, destination, helper.name, _module_short_name) transaction.add_rules(backend, rules) for (port,proto) in svc.ports: rules = backend.build_policy_ports_rules(enable, policy, proto, port, destination) transaction.add_rules(backend, rules) for protocol in svc.protocols: rules = backend.build_policy_protocol_rules( enable, policy, protocol, destination) transaction.add_rules(backend, rules) for (port,proto) in svc.source_ports: rules = backend.build_policy_source_ports_rules( enable, policy, proto, port, destination) transaction.add_rules(backend, rules) def _port(self, enable, policy, port, protocol, transaction): for backend in self._fw.enabled_backends(): if not backend.policies_supported: continue rules = backend.build_policy_ports_rules(enable, policy, protocol, port) transaction.add_rules(backend, rules) def _protocol(self, enable, policy, protocol, transaction): for backend in self._fw.enabled_backends(): if not backend.policies_supported: continue rules = backend.build_policy_protocol_rules(enable, policy, protocol) transaction.add_rules(backend, rules) def _source_port(self, enable, policy, port, protocol, transaction): for backend in self._fw.enabled_backends(): if not backend.policies_supported: continue rules = backend.build_policy_source_ports_rules(enable, policy, protocol, port) transaction.add_rules(backend, rules) def _masquerade(self, enable, policy, transaction): ipv = "ipv4" transaction.add_post(enable_ip_forwarding, ipv) backend = self._fw.get_backend_by_ipv(ipv) rules = backend.build_policy_masquerade_rules(enable, policy) transaction.add_rules(backend, rules) def _forward_port(self, enable, policy, transaction, port, protocol, toport=None, toaddr=None): if check_single_address("ipv6", toaddr): ipv = "ipv6" else: ipv = "ipv4" if toaddr and enable: transaction.add_post(enable_ip_forwarding, ipv) backend = self._fw.get_backend_by_ipv(ipv) rules = backend.build_policy_forward_port_rules( enable, policy, port, protocol, toport, toaddr) transaction.add_rules(backend, rules) def _icmp_block(self, enable, policy, icmp, transaction): ict = self._fw.config.get_icmptype(icmp) for backend in self._fw.enabled_backends(): if not backend.policies_supported: continue skip_backend = False if ict.destination: for ipv in ["ipv4", "ipv6"]: if ipv in ict.destination: if not backend.is_ipv_supported(ipv): skip_backend = True break if skip_backend: continue rules = backend.build_policy_icmp_block_rules(enable, policy, ict) transaction.add_rules(backend, rules) def _icmp_block_inversion(self, enable, policy, transaction): target = self._policies[policy].target # Do not add general icmp accept rules into a trusted, block or drop # policy. if target in [ "DROP", "%%REJECT%%", "REJECT" ]: return if not self.query_icmp_block_inversion(policy) and target == "ACCEPT": # ibi target and policy target are ACCEPT, no need to add an extra # rule return for backend in self._fw.enabled_backends(): if not backend.policies_supported: continue rules = backend.build_policy_icmp_block_inversion_rules(enable, policy) transaction.add_rules(backend, rules) def check_ingress_egress(self, policy, ingress_zones, egress_zones, ingress_interfaces, egress_interfaces, ingress_sources, egress_sources): for zone in ingress_zones: self.check_ingress_zone(zone) for zone in egress_zones: self.check_egress_zone(zone) if ("ANY" in ingress_zones or "HOST" in ingress_zones) and \ len(ingress_zones) > 1: raise FirewallError(errors.INVALID_ZONE, "'ingress-zones' may only contain one of: many regular zones, ANY, or HOST") if ("ANY" in egress_zones or "HOST" in egress_zones) and \ len(egress_zones) > 1: raise FirewallError(errors.INVALID_ZONE, "'egress-zones' may only contain one of: many regular zones, ANY, or HOST") if (egress_interfaces or egress_sources) and \ not ingress_interfaces and not ingress_sources and \ "HOST" not in ingress_zones and "ANY" not in ingress_zones: raise FirewallError(errors.INVALID_ZONE, "policy \"%s\" has no ingress" % (policy)) if (ingress_interfaces or ingress_sources) and \ not egress_interfaces and not egress_sources and \ "HOST" not in egress_zones and "ANY" not in egress_zones: raise FirewallError(errors.INVALID_ZONE, "policy \"%s\" has no egress" % (policy)) def check_ingress_egress_chain(self, policy, table, chain, ingress_zones, egress_zones, ingress_interfaces, egress_interfaces, ingress_sources, egress_sources): if chain == "PREROUTING": # raw,prerouting is used for conntrack helpers (services), so we # need to allow it if egress-zones contains an actual zone if table != "raw": if egress_interfaces: raise FirewallError(errors.INVALID_ZONE, "policy \"%s\" egress-zones may not include a zone with added interfaces." % (policy)) elif chain == "POSTROUTING": if "HOST" in ingress_zones: raise FirewallError(errors.INVALID_ZONE, "policy \"%s\" ingress-zones may not include HOST." % (policy)) if "HOST" in egress_zones: raise FirewallError(errors.INVALID_ZONE, "policy \"%s\" egress-zones may not include HOST." % (policy)) if ingress_interfaces: raise FirewallError(errors.INVALID_ZONE, "policy \"%s\" ingress-zones may not include a zone with added interfaces." % (policy)) elif chain == "FORWARD": if "HOST" in ingress_zones: raise FirewallError(errors.INVALID_ZONE, "policy \"%s\" ingress-zones may not include HOST." % (policy)) if "HOST" in egress_zones: raise FirewallError(errors.INVALID_ZONE, "policy \"%s\" egress-zones may not include HOST." % (policy)) elif chain == "INPUT": if "HOST" not in egress_zones: raise FirewallError(errors.INVALID_ZONE, "policy \"%s\" egress-zones must include only HOST." % (policy)) elif chain == "OUTPUT": if "HOST" not in ingress_zones: raise FirewallError(errors.INVALID_ZONE, "policy \"%s\" ingress-zones must include only HOST." % (policy)) def _ingress_egress_zones_transaction(self, enable, policy): transaction = FirewallTransaction(self._fw) self._ingress_egress_zones(enable, policy, transaction) transaction.execute(True) def _ingress_egress_zones(self, enable, policy, transaction): obj = self._policies[policy] ingress_zones = obj.ingress_zones egress_zones = obj.egress_zones ingress_interfaces = set() egress_interfaces = set() ingress_sources = set() egress_sources = set() for zone in ingress_zones: if zone in ["ANY", "HOST"]: continue ingress_interfaces |= set(self._fw.zone.list_interfaces(zone)) ingress_sources |= set(self._fw.zone.list_sources(zone)) for zone in egress_zones: if zone in ["ANY", "HOST"]: continue egress_interfaces |= set(self._fw.zone.list_interfaces(zone)) egress_sources |= set(self._fw.zone.list_sources(zone)) self.check_ingress_egress(policy, ingress_zones, egress_zones, ingress_interfaces, egress_interfaces, ingress_sources, egress_sources) for backend in self._fw.enabled_backends(): if not backend.policies_supported: continue for (table, chain) in self._get_table_chains_for_policy_dispatch(policy): self.check_ingress_egress_chain(policy, table, chain, ingress_zones, egress_zones, ingress_interfaces, egress_interfaces, ingress_sources, egress_sources) rules = backend.build_policy_ingress_egress_rules(enable, policy, table, chain, ingress_interfaces, egress_interfaces, ingress_sources, egress_sources) transaction.add_rules(backend, rules) def _get_table_chains_for_policy_dispatch(self, policy): """Create a list of (table, chain) needed for policy dispatch""" obj = self._policies[policy] if "ANY" in obj.ingress_zones and "HOST" in obj.egress_zones: # any --> HOST tc = [("filter", "INPUT"), ("nat", "PREROUTING"), ("mangle", "PREROUTING")] # iptables backend needs to put conntrack helper rules in raw # prerouting. if not self._fw.nftables_enabled: tc.append(("raw", "PREROUTING")) return tc elif "HOST" in obj.egress_zones: # zone --> HOST tc = [("filter", "INPUT")] # iptables backend needs to put conntrack helper rules in raw # prerouting. if not self._fw.nftables_enabled: tc.append(("raw", "PREROUTING")) return tc elif "HOST" in obj.ingress_zones: # HOST --> zone/any return [("filter", "OUTPUT"), ("nat", "OUTPUT")] elif "ANY" in obj.ingress_zones and "ANY" in obj.egress_zones: # any --> any tc = [("filter", "FORWARD"), ("nat", "PREROUTING"), ("nat", "POSTROUTING"), ("mangle", "PREROUTING")] # iptables backend needs to put conntrack helper rules in raw # prerouting. if not self._fw.nftables_enabled: tc.append(("raw", "PREROUTING")) return tc elif "ANY" in obj.egress_zones: # zone --> any tc = [("filter", "FORWARD"), ("nat", "PREROUTING"), ("mangle", "PREROUTING")] # iptables backend needs to put conntrack helper rules in raw # prerouting. if not self._fw.nftables_enabled: tc.append(("raw", "PREROUTING")) for zone in obj.ingress_zones: if self._fw.zone.get_zone(zone).interfaces: break else: tc.append(("nat", "POSTROUTING")) return tc elif "ANY" in obj.ingress_zones: # any --> zone tc = [("filter", "FORWARD"), ("nat", "POSTROUTING")] # iptables backend needs to put conntrack helper rules in raw # prerouting. if not self._fw.nftables_enabled: tc.append(("raw", "PREROUTING")) for zone in obj.egress_zones: if self._fw.zone.get_zone(zone).interfaces: break else: tc.append(("nat", "PREROUTING")) tc.append(("mangle", "PREROUTING")) return tc else: # zone -> zone tc = [("filter", "FORWARD")] # iptables backend needs to put conntrack helper rules in raw # prerouting. if not self._fw.nftables_enabled: tc.append(("raw", "PREROUTING")) for zone in obj.ingress_zones: if self._fw.zone.get_zone(zone).interfaces: break else: tc.append(("nat", "POSTROUTING")) for zone in obj.egress_zones: if self._fw.zone.get_zone(zone).interfaces: break else: tc.append(("nat", "PREROUTING")) tc.append(("mangle", "PREROUTING")) return tc def _get_table_chains_for_zone_dispatch(self, policy): """Create a list of (table, chain) needed for zone dispatch""" obj = self._policies[policy] if "HOST" in obj.egress_zones: # zone --> Host tc = [("filter", "INPUT")] # iptables backend needs to put conntrack helper rules in raw # prerouting. if not self._fw.nftables_enabled: tc.append(("raw", "PREROUTING")) return tc elif "ANY" in obj.egress_zones: # zone --> any return [("filter", "FORWARD"), ("nat", "PREROUTING"), ("mangle", "PREROUTING")] elif "ANY" in obj.ingress_zones: # any --> zone return [("nat", "POSTROUTING")] else: return FirewallError("Invalid policy: %s" % (policy)) def policy_base_chain_name(self, policy, table, policy_prefix, isSNAT=False): obj = self._fw.policy.get_policy(policy) if obj.derived_from_zone: suffix = obj.derived_from_zone else: suffix = policy_prefix + policy if "HOST" in obj.egress_zones: # zone/any --> Host if table == "filter": return "IN_" + suffix if table == "raw": # NOTE: nftables doesn't actually use this. Only iptables return "PRE_" + suffix if not obj.derived_from_zone: if table in ["mangle", "nat"]: return "PRE_" + suffix elif "HOST" in obj.ingress_zones: # HOST --> zone/any if not obj.derived_from_zone: if table in ["filter", "nat"]: return "OUT_" + suffix elif "ANY" in obj.egress_zones: # zone/any --> any if table == "filter": return "FWD_" + suffix elif table == "nat": if isSNAT: return "POST_" + suffix else: return "PRE_" + suffix elif table in ["mangle", "raw"]: return "PRE_" + suffix elif "ANY" in obj.ingress_zones: # any --> zone if table == "filter": return "FWD_" + suffix elif table == "nat": if isSNAT: return "POST_" + suffix else: return "PRE_" + suffix elif table in ["mangle", "raw"]: if not obj.derived_from_zone: return "PRE_" + suffix elif not obj.derived_from_zone: # zone --> zone if table == "filter": return "FWD_" + suffix elif table == "nat": if isSNAT: return "POST_" + suffix else: return "PRE_" + suffix elif table in ["mangle", "raw"]: return "PRE_" + suffix return FirewallError("Can't convert policy to chain name: %s, %s, %s" % (policy, table, isSNAT)) PK ���Z�_� � core/fw_transaction.pynu �[��� # -*- coding: utf-8 -*- # # Copyright (C) 2016 Red Hat, Inc. # # Authors: # Thomas Woerner <twoerner@redhat.com> # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see <http://www.gnu.org/licenses/>. # """Transaction classes for firewalld""" __all__ = [ "FirewallTransaction" ] import traceback from firewall.core.logger import log from firewall import errors from firewall.errors import FirewallError class FirewallTransaction(object): def __init__(self, fw): self.fw = fw self.rules = { } # [ ( backend.name, [ rule,.. ] ),.. ] self.pre_funcs = [ ] # [ (func, args),.. ] self.post_funcs = [ ] # [ (func, args),.. ] self.fail_funcs = [ ] # [ (func, args),.. ] self.modules = [ ] # [ module,.. ] def clear(self): self.rules.clear() del self.pre_funcs[:] del self.post_funcs[:] del self.fail_funcs[:] def add_rule(self, backend, rule): self.rules.setdefault(backend.name, [ ]).append(rule) def add_rules(self, backend, rules): for rule in rules: self.add_rule(backend, rule) def query_rule(self, backend, rule): return backend.name in self.rules and rule in self.rules[backend.name] def remove_rule(self, backend, rule): if backend.name in self.rules and rule in self.rules[backend.name]: self.rules[backend.name].remove(rule) def add_pre(self, func, *args): self.pre_funcs.append((func, args)) def add_post(self, func, *args): self.post_funcs.append((func, args)) def add_fail(self, func, *args): self.fail_funcs.append((func, args)) def add_module(self, module): if module not in self.modules: self.modules.append(module) def remove_module(self, module): if module in self.modules: self.modules.remove(module) def add_modules(self, modules): for module in modules: self.add_module(module) def remove_modules(self, modules): for module in modules: self.remove_module(module) def prepare(self, enable): log.debug4("%s.prepare(%s, %s)" % (type(self), enable, "...")) rules = { } if not enable: # reverse rule order for cleanup for backend_name in self.rules: for rule in reversed(self.rules[backend_name]): rules.setdefault(backend_name, [ ]).append( self.fw.get_backend_by_name(backend_name).reverse_rule(rule)) else: for backend_name in self.rules: rules.setdefault(backend_name, [ ]).extend(self.rules[backend_name]) return rules, self.modules def execute(self, enable): log.debug4("%s.execute(%s)" % (type(self), enable)) rules, modules = self.prepare(enable) # pre self.pre() # stage 1: apply rules error = False errorMsg = "" done = [ ] for backend_name in rules: try: self.fw.rules(backend_name, rules[backend_name]) except Exception as msg: error = True errorMsg = msg log.debug1(traceback.format_exc()) log.error(msg) else: done.append(backend_name) # stage 2: load modules if not error: module_return = self.fw.handle_modules(modules, enable) if module_return: # Debug log about issues loading modules, but don't error. The # modules may be builtin or CONFIG_MODULES=n, in which case # modprobe will fail. Or we may be running inside a container # that doesn't have sufficient privileges. Unfortunately there # is no way for us to know. (status, msg) = module_return if status: log.debug1(msg) # error case: revert rules if error: undo_rules = { } for backend_name in done: undo_rules[backend_name] = [ ] for rule in reversed(rules[backend_name]): undo_rules[backend_name].append( self.fw.get_backend_by_name(backend_name).reverse_rule(rule)) for backend_name in undo_rules: try: self.fw.rules(backend_name, undo_rules[backend_name]) except Exception as msg: log.debug1(traceback.format_exc()) log.error(msg) # call failure functions for (func, args) in self.fail_funcs: try: func(*args) except Exception as msg: log.debug1(traceback.format_exc()) log.error("Calling fail func %s(%s) failed: %s" % \ (func, args, msg)) raise FirewallError(errors.COMMAND_FAILED, errorMsg) # post self.post() def pre(self): log.debug4("%s.pre()" % type(self)) for (func, args) in self.pre_funcs: func(*args) def post(self): log.debug4("%s.post()" % type(self)) for (func, args) in self.post_funcs: func(*args) PK ���Z��1�� � core/fw_policies.pynu �[��� # -*- coding: utf-8 -*- # # Copyright (C) 2011-2016 Red Hat, Inc. # # Authors: # Thomas Woerner <twoerner@redhat.com> # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see <http://www.gnu.org/licenses/>. # __all__ = [ "FirewallPolicies" ] from firewall import config from firewall.core.logger import log from firewall.core.io.lockdown_whitelist import LockdownWhitelist from firewall import errors from firewall.errors import FirewallError class FirewallPolicies(object): def __init__(self): self._lockdown = False self.lockdown_whitelist = LockdownWhitelist(config.LOCKDOWN_WHITELIST) def __repr__(self): return '%s(%r, %r)' % (self.__class__, self._lockdown, self.lockdown_whitelist) def cleanup(self): self._lockdown = False self.lockdown_whitelist.cleanup() # lockdown def access_check(self, key, value): if key == "context": log.debug2('Doing access check for context "%s"' % value) if self.lockdown_whitelist.match_context(value): log.debug3('context matches.') return True elif key == "uid": log.debug2('Doing access check for uid %d' % value) if self.lockdown_whitelist.match_uid(value): log.debug3('uid matches.') return True elif key == "user": log.debug2('Doing access check for user "%s"' % value) if self.lockdown_whitelist.match_user(value): log.debug3('user matches.') return True elif key == "command": log.debug2('Doing access check for command "%s"' % value) if self.lockdown_whitelist.match_command(value): log.debug3('command matches.') return True return False def enable_lockdown(self): if self._lockdown: raise FirewallError(errors.ALREADY_ENABLED, "enable_lockdown()") self._lockdown = True def disable_lockdown(self): if not self._lockdown: raise FirewallError(errors.NOT_ENABLED, "disable_lockdown()") self._lockdown = False def query_lockdown(self): return self._lockdown PK ���Z.��,� ,� core/rich.pynu �[��� # -*- coding: utf-8 -*- # # Copyright (C) 2013-2016 Red Hat, Inc. # # Authors: # Thomas Woerner <twoerner@redhat.com> # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see <http://www.gnu.org/licenses/>. # __all__ = [ "Rich_Source", "Rich_Destination", "Rich_Service", "Rich_Port", "Rich_Protocol", "Rich_Masquerade", "Rich_IcmpBlock", "Rich_IcmpType", "Rich_SourcePort", "Rich_ForwardPort", "Rich_Log", "Rich_NFLog", "Rich_Accept", "Rich_Reject", "Rich_Drop", "Rich_Mark", "Rich_Audit", "Rich_Limit", "Rich_Rule", "Rich_Tcp_Mss_Clamp" ] from firewall import functions from firewall.core.ipset import check_ipset_name from firewall.core.base import REJECT_TYPES from firewall import errors from firewall.errors import FirewallError class Rich_Source(object): def __init__(self, addr, mac, ipset, invert=False): self.addr = addr if self.addr == "": self.addr = None self.mac = mac if self.mac == "" or self.mac is None: self.mac = None elif self.mac is not None: self.mac = self.mac.upper() self.ipset = ipset if self.ipset == "": self.ipset = None self.invert = invert if self.addr is None and self.mac is None and self.ipset is None: raise FirewallError(errors.INVALID_RULE, "no address, mac and ipset") def __str__(self): ret = 'source%s ' % (" NOT" if self.invert else "") if self.addr is not None: return ret + 'address="%s"' % self.addr elif self.mac is not None: return ret + 'mac="%s"' % self.mac elif self.ipset is not None: return ret + 'ipset="%s"' % self.ipset else: raise FirewallError(errors.INVALID_RULE, "no address, mac and ipset") class Rich_Destination(object): def __init__(self, addr, ipset, invert=False): self.addr = addr if self.addr == "": self.addr = None self.ipset = ipset if self.ipset == "": self.ipset = None self.invert = invert if self.addr is None and self.ipset is None: raise FirewallError(errors.INVALID_RULE, "no address and ipset") def __str__(self): ret = 'destination%s ' % (" NOT" if self.invert else "") if self.addr is not None: return ret + 'address="%s"' % self.addr elif self.ipset is not None: return ret + 'ipset="%s"' % self.ipset else: raise FirewallError(errors.INVALID_RULE, "no address and ipset") class Rich_Service(object): def __init__(self, name): self.name = name def __str__(self): return 'service name="%s"' % (self.name) class Rich_Port(object): def __init__(self, port, protocol): self.port = port self.protocol = protocol def __str__(self): return 'port port="%s" protocol="%s"' % (self.port, self.protocol) class Rich_SourcePort(Rich_Port): def __str__(self): return 'source-port port="%s" protocol="%s"' % (self.port, self.protocol) class Rich_Protocol(object): def __init__(self, value): self.value = value def __str__(self): return 'protocol value="%s"' % (self.value) class Rich_Masquerade(object): def __init__(self): pass def __str__(self): return 'masquerade' class Rich_IcmpBlock(object): def __init__(self, name): self.name = name def __str__(self): return 'icmp-block name="%s"' % (self.name) class Rich_IcmpType(object): def __init__(self, name): self.name = name def __str__(self): return 'icmp-type name="%s"' % (self.name) class Rich_Tcp_Mss_Clamp(object): def __init__(self, value): self.value = value def __str__(self): return 'tcp-mss-clamp value="%s"' % (self.value) class Rich_ForwardPort(object): def __init__(self, port, protocol, to_port, to_address): self.port = port self.protocol = protocol self.to_port = to_port self.to_address = to_address # replace None with "" in to_port and/or to_address if self.to_port is None: self.to_port = "" if self.to_address is None: self.to_address = "" def __str__(self): return 'forward-port port="%s" protocol="%s"%s%s' % \ (self.port, self.protocol, ' to-port="%s"' % self.to_port if self.to_port != "" else '', ' to-addr="%s"' % self.to_address if self.to_address != "" else '') class Rich_Log(object): def __init__(self, prefix=None, level=None, limit=None): #TODO check default level in iptables self.prefix = prefix self.level = level self.limit = limit def __str__(self): return 'log%s%s%s' % \ (' prefix="%s"' % (self.prefix) if self.prefix else "", ' level="%s"' % (self.level) if self.level else "", " %s" % self.limit if self.limit else "") def check(self): if self.prefix and len(self.prefix) > 127: raise FirewallError(errors.INVALID_LOG_PREFIX, "maximum accepted length of 'prefix' is 127.") if self.level and \ self.level not in [ "emerg", "alert", "crit", "error", "warning", "notice", "info", "debug" ]: raise FirewallError(errors.INVALID_LOG_LEVEL, self.level) if self.limit is not None: self.limit.check() class Rich_NFLog(object): def __init__(self, group=None, prefix=None, queue_size=None, limit=None): self.group = group self.prefix = prefix self.threshold = queue_size self.limit = limit def __str__(self): return 'nflog%s%s%s%s' % \ (' group="%s"' % (self.group) if self.group else "", ' prefix="%s"' % (self.prefix) if self.prefix else "", ' queue-size="%s"' % (self.threshold) if self.threshold else "", " %s" % self.limit if self.limit else "") def check(self): if self.group and not functions.checkUINT16(self.group): raise FirewallError(errors.INVALID_NFLOG_GROUP, "nflog 'group' must be an integer between 0 and 65535.") if self.prefix and len(self.prefix) > 127: raise FirewallError(errors.INVALID_LOG_PREFIX, "maximum accepted length of 'prefix' is 127.") if self.threshold and not functions.checkUINT16(self.threshold): raise FirewallError(errors.INVALID_NFLOG_QUEUE, "nflog 'queue-size' must be an integer between 0 and 65535.") if self.limit is not None: self.limit.check() class Rich_Audit(object): def __init__(self, limit=None): #TODO check default level in iptables self.limit = limit def __str__(self): return 'audit%s' % (" %s" % self.limit if self.limit else "") class Rich_Accept(object): def __init__(self, limit=None): self.limit = limit def __str__(self): return "accept%s" % (" %s" % self.limit if self.limit else "") class Rich_Reject(object): def __init__(self, _type=None, limit=None): self.type = _type self.limit = limit def __str__(self): return "reject%s%s" % (' type="%s"' % self.type if self.type else "", " %s" % self.limit if self.limit else "") def check(self, family): if self.type: if not family: raise FirewallError(errors.INVALID_RULE, "When using reject type you must specify also rule family.") if family in ['ipv4', 'ipv6'] and \ self.type not in REJECT_TYPES[family]: valid_types = ", ".join(REJECT_TYPES[family]) raise FirewallError(errors.INVALID_RULE, "Wrong reject type %s.\nUse one of: %s." % (self.type, valid_types)) class Rich_Drop(Rich_Accept): def __str__(self): return "drop%s" % (" %s" % self.limit if self.limit else "") class Rich_Mark(object): def __init__(self, _set, limit=None): self.set = _set self.limit = limit def __str__(self): return "mark set=%s%s" % (self.set, " %s" % self.limit if self.limit else "") def check(self): if self.set is not None: x = self.set else: raise FirewallError(errors.INVALID_MARK, "no value set") if "/" in x: splits = x.split("/") if len(splits) != 2: raise FirewallError(errors.INVALID_MARK, x) if not functions.checkUINT32(splits[0]) or \ not functions.checkUINT32(splits[1]): # value and mask are uint32 raise FirewallError(errors.INVALID_MARK, x) else: if not functions.checkUINT32(x): # value is uint32 raise FirewallError(errors.INVALID_MARK, x) class Rich_Limit(object): def __init__(self, value): self.value = value if "/" in self.value: splits = self.value.split("/") if len(splits) == 2 and \ splits[1] in [ "second", "minute", "hour", "day" ]: self.value = "%s/%s" % (splits[0], splits[1][:1]) def check(self): splits = None if "/" in self.value: splits = self.value.split("/") if not splits or len(splits) != 2: raise FirewallError(errors.INVALID_LIMIT, self.value) (rate, duration) = splits try: rate = int(rate) except: raise FirewallError(errors.INVALID_LIMIT, self.value) if rate < 1 or duration not in [ "s", "m", "h", "d" ]: raise FirewallError(errors.INVALID_LIMIT, self.value) mult = 1 if duration == "s": mult = 1 elif duration == "m": mult = 60 elif duration == "h": mult = 60*60 elif duration == "d": mult = 24*60*60 if 10000 * mult / rate == 0: raise FirewallError(errors.INVALID_LIMIT, "%s too fast" % self.value) if rate == 1 and duration == "d": # iptables (v1.4.21) doesn't accept 1/d raise FirewallError(errors.INVALID_LIMIT, "%s too slow" % self.value) def __str__(self): return 'limit value="%s"' % (self.value) def command(self): return '' class Rich_Rule(object): priority_min = -32768 priority_max = 32767 def __init__(self, family=None, rule_str=None, priority=0): if family is not None: self.family = str(family) else: self.family = None self.priority = priority self.source = None self.destination = None self.element = None self.log = None self.audit = None self.action = None if rule_str: self._import_from_string(rule_str) def _lexer(self, rule_str): """ Lexical analysis """ tokens = [] for r in functions.splitArgs(rule_str): if "=" in r: attr = r.split('=') if len(attr) != 2 or not attr[0] or not attr[1]: raise FirewallError(errors.INVALID_RULE, 'internal error in _lexer(): %s' % r) tokens.append({'attr_name':attr[0], 'attr_value':attr[1]}) else: tokens.append({'element':r}) tokens.append({'element':'EOL'}) return tokens def _import_from_string(self, rule_str): if not rule_str: raise FirewallError(errors.INVALID_RULE, 'empty rule') rule_str = functions.stripNonPrintableCharacters(rule_str) self.priority = 0 self.family = None self.source = None self.destination = None self.element = None self.log = None self.audit = None self.action = None tokens = self._lexer(rule_str) if tokens and tokens[0].get('element') == 'EOL': raise FirewallError(errors.INVALID_RULE, 'empty rule') attrs = {} # attributes of elements in_elements = [] # stack with elements we are in index = 0 # index into tokens while not (tokens[index].get('element') == 'EOL' and in_elements == ['rule']): element = tokens[index].get('element') attr_name = tokens[index].get('attr_name') attr_value = tokens[index].get('attr_value') #print ("in_elements: ", in_elements) #print ("index: %s, element: %s, attribute: %s=%s" % (index, element, attr_name, attr_value)) if attr_name: # attribute if attr_name not in ['priority', 'family', 'address', 'mac', 'ipset', 'invert', 'value', 'port', 'protocol', 'to-port', 'to-addr', 'name', 'group', 'prefix', 'level', 'queue-size', 'type', 'set']: raise FirewallError(errors.INVALID_RULE, "bad attribute '%s'" % attr_name) else: # element if element in ['rule', 'source', 'destination', 'protocol', 'service', 'port', 'icmp-block', 'icmp-type', 'masquerade', 'forward-port', 'source-port', 'log', 'nflog', 'audit', 'accept', 'drop', 'reject', 'mark', 'limit', 'not', 'NOT', 'EOL', 'tcp-mss-clamp']: if element == 'source' and self.source: raise FirewallError(errors.INVALID_RULE, "more than one 'source' element") elif element == 'destination' and self.destination: raise FirewallError(errors.INVALID_RULE, "more than one 'destination' element") elif element in ['protocol', 'service', 'port', 'icmp-block', 'icmp-type', 'masquerade', 'forward-port', 'source-port'] and self.element: raise FirewallError(errors.INVALID_RULE, "more than one element. There cannot be both '%s' and '%s' in one rule." % (element, self.element)) elif element in ['log', 'nflog'] and self.log: raise FirewallError(errors.INVALID_RULE, "more than one logging element") elif element == 'audit' and self.audit: raise FirewallError(errors.INVALID_RULE, "more than one 'audit' element") elif element in ['accept', 'drop', 'reject', 'mark'] and self.action: raise FirewallError(errors.INVALID_RULE, "more than one 'action' element. There cannot be both '%s' and '%s' in one rule." % (element, self.action)) else: raise FirewallError(errors.INVALID_RULE, "unknown element %s" % element) in_element = in_elements[len(in_elements)-1] if len(in_elements) > 0 else '' if in_element == '': if not element and attr_name: if attr_name == 'family': raise FirewallError(errors.INVALID_RULE, "'family' outside of rule. Use 'rule family=...'.") elif attr_name == 'priority': raise FirewallError(errors.INVALID_RULE, "'priority' outside of rule. Use 'rule priority=...'.") else: raise FirewallError(errors.INVALID_RULE, "'%s' outside of any element. Use 'rule <element> %s= ...'." % (attr_name, attr_name)) elif 'rule' not in element: raise FirewallError(errors.INVALID_RULE, "'%s' outside of rule. Use 'rule ... %s ...'." % (element, element)) else: in_elements.append('rule') # push into stack elif in_element == 'rule': if attr_name == 'family': if attr_value not in ['ipv4', 'ipv6']: raise FirewallError(errors.INVALID_RULE, "'family' attribute cannot have '%s' value. Use 'ipv4' or 'ipv6' instead." % attr_value) self.family = attr_value elif attr_name == 'priority': try: self.priority = int(attr_value) except ValueError: raise FirewallError(errors.INVALID_PRIORITY, "invalid 'priority' attribute value '%s'." % attr_value) elif attr_name: if attr_name == 'protocol': err_msg = "wrong 'protocol' usage. Use either 'rule protocol value=...' or 'rule [forward-]port protocol=...'." else: err_msg = "attribute '%s' outside of any element. Use 'rule <element> %s= ...'." % (attr_name, attr_name) raise FirewallError(errors.INVALID_RULE, err_msg) else: in_elements.append(element) # push into stack elif in_element == 'source': if attr_name in ['address', 'mac', 'ipset', 'invert']: attrs[attr_name] = attr_value elif element in ['not', 'NOT']: attrs['invert'] = True else: self.source = Rich_Source(attrs.get('address'), attrs.get('mac'), attrs.get('ipset'), attrs.get('invert', False)) in_elements.pop() # source attrs.clear() index = index -1 # return token to input elif in_element == 'destination': if attr_name in ['address', 'ipset', 'invert']: attrs[attr_name] = attr_value elif element in ['not', 'NOT']: attrs['invert'] = True else: self.destination = Rich_Destination(attrs.get('address'), attrs.get('ipset'), attrs.get('invert', False)) in_elements.pop() # destination attrs.clear() index = index -1 # return token to input elif in_element == 'protocol': if attr_name == 'value': self.element = Rich_Protocol(attr_value) in_elements.pop() # protocol else: raise FirewallError(errors.INVALID_RULE, "invalid 'protocol' element") elif in_element == 'tcp-mss-clamp': if attr_name == 'value': attrs[attr_name] = attr_value else: self.element = Rich_Tcp_Mss_Clamp(attrs.get('value')) in_elements.pop() attrs.clear() index = index -1 elif in_element == 'service': if attr_name == 'name': self.element = Rich_Service(attr_value) in_elements.pop() # service else: raise FirewallError(errors.INVALID_RULE, "invalid 'service' element") elif in_element == 'port': if attr_name in ['port', 'protocol']: attrs[attr_name] = attr_value else: self.element = Rich_Port(attrs.get('port'), attrs.get('protocol')) in_elements.pop() # port attrs.clear() index = index -1 # return token to input elif in_element == 'icmp-block': if attr_name == 'name': self.element = Rich_IcmpBlock(attr_value) in_elements.pop() # icmp-block else: raise FirewallError(errors.INVALID_RULE, "invalid 'icmp-block' element") elif in_element == 'icmp-type': if attr_name == 'name': self.element = Rich_IcmpType(attr_value) in_elements.pop() # icmp-type else: raise FirewallError(errors.INVALID_RULE, "invalid 'icmp-type' element") elif in_element == 'masquerade': self.element = Rich_Masquerade() in_elements.pop() attrs.clear() index = index -1 # return token to input elif in_element == 'forward-port': if attr_name in ['port', 'protocol', 'to-port', 'to-addr']: attrs[attr_name] = attr_value else: self.element = Rich_ForwardPort(attrs.get('port'), attrs.get('protocol'), attrs.get('to-port'), attrs.get('to-addr')) in_elements.pop() # forward-port attrs.clear() index = index -1 # return token to input elif in_element == 'source-port': if attr_name in ['port', 'protocol']: attrs[attr_name] = attr_value else: self.element = Rich_SourcePort(attrs.get('port'), attrs.get('protocol')) in_elements.pop() # source-port attrs.clear() index = index -1 # return token to input elif in_element == 'log': if attr_name in ['prefix', 'level']: attrs[attr_name] = attr_value elif element == 'limit': in_elements.append('limit') else: self.log = Rich_Log(attrs.get('prefix'), attrs.get('level'), attrs.get('limit')) in_elements.pop() # log attrs.clear() index = index -1 # return token to input elif in_element == 'nflog': if attr_name in ['group', 'prefix', 'queue-size']: attrs[attr_name] = attr_value elif element == 'limit': in_elements.append('limit') else: self.log = Rich_NFLog(attrs.get('group'), attrs.get('prefix'), attrs.get('queue-size'), attrs.get('limit')) in_elements.pop() # nflog attrs.clear() index = index -1 # return token to input elif in_element == 'audit': if element == 'limit': in_elements.append('limit') else: self.audit = Rich_Audit(attrs.get('limit')) in_elements.pop() # audit attrs.clear() index = index -1 # return token to input elif in_element == 'accept': if element == 'limit': in_elements.append('limit') else: self.action = Rich_Accept(attrs.get('limit')) in_elements.pop() # accept attrs.clear() index = index -1 # return token to input elif in_element == 'drop': if element == 'limit': in_elements.append('limit') else: self.action = Rich_Drop(attrs.get('limit')) in_elements.pop() # drop attrs.clear() index = index -1 # return token to input elif in_element == 'reject': if attr_name == 'type': attrs[attr_name] = attr_value elif element == 'limit': in_elements.append('limit') else: self.action = Rich_Reject(attrs.get('type'), attrs.get('limit')) in_elements.pop() # accept attrs.clear() index = index -1 # return token to input elif in_element == 'mark': if attr_name == 'set': attrs[attr_name] = attr_value elif element == 'limit': in_elements.append('limit') else: self.action = Rich_Mark(attrs.get('set'), attrs.get('limit')) in_elements.pop() # accept attrs.clear() index = index -1 # return token to input elif in_element == 'limit': if attr_name == 'value': attrs['limit'] = Rich_Limit(attr_value) in_elements.pop() # limit else: raise FirewallError(errors.INVALID_RULE, "invalid 'limit' element") index = index + 1 self.check() def check(self): if self.family is not None and self.family not in [ "ipv4", "ipv6" ]: raise FirewallError(errors.INVALID_FAMILY, self.family) if self.family is None: if (self.source is not None and self.source.addr is not None) or \ self.destination is not None: raise FirewallError(errors.MISSING_FAMILY) if type(self.element) == Rich_ForwardPort: raise FirewallError(errors.MISSING_FAMILY) if self.priority < self.priority_min or self.priority > self.priority_max: raise FirewallError(errors.INVALID_PRIORITY, "'priority' attribute must be between %d and %d." \ % (self.priority_min, self.priority_max)) if self.element is None and \ (self.log is None or (self.log is not None and self.priority == 0)): if self.action is None: raise FirewallError(errors.INVALID_RULE, "no element, no action") if self.source is None and self.destination is None and self.priority == 0: raise FirewallError(errors.INVALID_RULE, "no element, no source, no destination") if type(self.element) not in [ Rich_IcmpBlock, Rich_ForwardPort, Rich_Masquerade, Rich_Tcp_Mss_Clamp ]: if self.log is None and self.audit is None and \ self.action is None: raise FirewallError(errors.INVALID_RULE, "no action, no log, no audit") # source if self.source is not None: if self.source.addr is not None: if self.family is None: raise FirewallError(errors.INVALID_FAMILY) if self.source.mac is not None: raise FirewallError(errors.INVALID_RULE, "address and mac") if self.source.ipset is not None: raise FirewallError(errors.INVALID_RULE, "address and ipset") if not functions.check_address(self.family, self.source.addr): raise FirewallError(errors.INVALID_ADDR, str(self.source.addr)) elif self.source.mac is not None: if self.source.ipset is not None: raise FirewallError(errors.INVALID_RULE, "mac and ipset") if not functions.check_mac(self.source.mac): raise FirewallError(errors.INVALID_MAC, str(self.source.mac)) elif self.source.ipset is not None: if not check_ipset_name(self.source.ipset): raise FirewallError(errors.INVALID_IPSET, str(self.source.ipset)) else: raise FirewallError(errors.INVALID_RULE, "invalid source") # destination if self.destination is not None: if self.destination.addr is not None: if self.family is None: raise FirewallError(errors.INVALID_FAMILY) if self.destination.ipset is not None: raise FirewallError(errors.INVALID_DESTINATION, "address and ipset") if not functions.check_address(self.family, self.destination.addr): raise FirewallError(errors.INVALID_ADDR, str(self.destination.addr)) elif self.destination.ipset is not None: if not check_ipset_name(self.destination.ipset): raise FirewallError(errors.INVALID_IPSET, str(self.destination.ipset)) else: raise FirewallError(errors.INVALID_RULE, "invalid destination") # service if type(self.element) == Rich_Service: # service availability needs to be checked in Firewall, here is no # knowledge about this, therefore only simple check if self.element.name is None or len(self.element.name) < 1: raise FirewallError(errors.INVALID_SERVICE, str(self.element.name)) # port elif type(self.element) == Rich_Port: if not functions.check_port(self.element.port): raise FirewallError(errors.INVALID_PORT, self.element.port) if self.element.protocol not in [ "tcp", "udp", "sctp", "dccp" ]: raise FirewallError(errors.INVALID_PROTOCOL, self.element.protocol) # protocol elif type(self.element) == Rich_Protocol: if not functions.checkProtocol(self.element.value): raise FirewallError(errors.INVALID_PROTOCOL, self.element.value) # masquerade elif type(self.element) == Rich_Masquerade: if self.action is not None: raise FirewallError(errors.INVALID_RULE, "masquerade and action") if self.source is not None and self.source.mac is not None: raise FirewallError(errors.INVALID_RULE, "masquerade and mac source") # icmp-block elif type(self.element) == Rich_IcmpBlock: # icmp type availability needs to be checked in Firewall, here is no # knowledge about this, therefore only simple check if self.element.name is None or len(self.element.name) < 1: raise FirewallError(errors.INVALID_ICMPTYPE, str(self.element.name)) if self.action: raise FirewallError(errors.INVALID_RULE, "icmp-block and action") # icmp-type elif type(self.element) == Rich_IcmpType: # icmp type availability needs to be checked in Firewall, here is no # knowledge about this, therefore only simple check if self.element.name is None or len(self.element.name) < 1: raise FirewallError(errors.INVALID_ICMPTYPE, str(self.element.name)) # forward-port elif type(self.element) == Rich_ForwardPort: if not functions.check_port(self.element.port): raise FirewallError(errors.INVALID_PORT, self.element.port) if self.element.protocol not in [ "tcp", "udp", "sctp", "dccp" ]: raise FirewallError(errors.INVALID_PROTOCOL, self.element.protocol) if self.element.to_port == "" and self.element.to_address == "": raise FirewallError(errors.INVALID_PORT, self.element.to_port) if self.element.to_port != "" and \ not functions.check_port(self.element.to_port): raise FirewallError(errors.INVALID_PORT, self.element.to_port) if self.element.to_address != "" and \ not functions.check_single_address(self.family, self.element.to_address): raise FirewallError(errors.INVALID_ADDR, self.element.to_address) if self.family is None: raise FirewallError(errors.INVALID_FAMILY) if self.action is not None: raise FirewallError(errors.INVALID_RULE, "forward-port and action") # source-port elif type(self.element) == Rich_SourcePort: if not functions.check_port(self.element.port): raise FirewallError(errors.INVALID_PORT, self.element.port) if self.element.protocol not in [ "tcp", "udp", "sctp", "dccp" ]: raise FirewallError(errors.INVALID_PROTOCOL, self.element.protocol) # tcp-mss-clamp elif type(self.element) == Rich_Tcp_Mss_Clamp: if self.action is not None: raise FirewallError(errors.INVALID_RULE, "tcp-mss-clamp and %s are mutually exclusive" % self.action) if self.element.value: if not functions.checkTcpMssClamp(self.element.value): raise FirewallError(errors.INVALID_RULE, self.element.value) # other element and not empty? elif self.element is not None: raise FirewallError(errors.INVALID_RULE, "Unknown element %s" % type(self.element)) # log if self.log is not None: self.log.check() # audit if self.audit is not None: if type(self.action) not in [ Rich_Accept, Rich_Reject, Rich_Drop ]: raise FirewallError(errors.INVALID_AUDIT_TYPE, type(self.action)) if self.audit.limit is not None: self.audit.limit.check() # action if self.action is not None: if type(self.action) == Rich_Reject: self.action.check(self.family) elif type(self.action) == Rich_Mark: self.action.check() if self.action.limit is not None: self.action.limit.check() def __str__(self): ret = 'rule' if self.priority: ret += ' priority="%d"' % self.priority if self.family: ret += ' family="%s"' % self.family if self.source: ret += " %s" % self.source if self.destination: ret += " %s" % self.destination if self.element: ret += " %s" % self.element if self.log: ret += " %s" % self.log if self.audit: ret += " %s" % self.audit if self.action: ret += " %s" % self.action return ret #class Rich_RawRule(object): #class Rich_RuleSet(object): #class Rich_AddressList(object): PK ���Z�`-�"P "P core/io/ipset.pynu �[��� # -*- coding: utf-8 -*- # # Copyright (C) 2015-2016 Red Hat, Inc. # # Authors: # Thomas Woerner <twoerner@redhat.com> # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see <http://www.gnu.org/licenses/>. # """ipset io XML handler, reader, writer""" __all__ = [ "IPSet", "ipset_reader", "ipset_writer" ] import xml.sax as sax import os import io import shutil from firewall import config from firewall.functions import checkIP, checkIP6, checkIPnMask, \ checkIP6nMask, check_mac, check_port, checkInterface, \ checkProtocol from firewall.core.io.io_object import IO_Object, \ IO_Object_ContentHandler, IO_Object_XMLGenerator from firewall.core.ipset import IPSET_TYPES, IPSET_CREATE_OPTIONS from firewall.core.icmp import check_icmp_name, check_icmp_type, \ check_icmpv6_name, check_icmpv6_type from firewall.core.logger import log from firewall import errors from firewall.errors import FirewallError class IPSet(IO_Object): IMPORT_EXPORT_STRUCTURE = ( ( "version", "" ), # s ( "short", "" ), # s ( "description", "" ), # s ( "type", "" ), # s ( "options", { "": "", }, ), # a{ss} ( "entries", [ "" ], ), # as ) DBUS_SIGNATURE = '(ssssa{ss}as)' ADDITIONAL_ALNUM_CHARS = [ "_", "-", ":", "." ] PARSER_REQUIRED_ELEMENT_ATTRS = { "short": None, "description": None, "ipset": [ "type" ], "option": [ "name" ], "entry": None, } PARSER_OPTIONAL_ELEMENT_ATTRS = { "ipset": [ "version" ], "option": [ "value" ], } def __init__(self): super(IPSet, self).__init__() self.version = "" self.short = "" self.description = "" self.type = "" self.entries = [ ] self.options = { } self.applied = False def cleanup(self): self.version = "" self.short = "" self.description = "" self.type = "" del self.entries[:] self.options.clear() self.applied = False @staticmethod def check_entry(entry, options, ipset_type): family = "ipv4" if "family" in options: if options["family"] == "inet6": family = "ipv6" if not ipset_type.startswith("hash:"): raise FirewallError(errors.INVALID_IPSET, "ipset type '%s' not usable" % ipset_type) flags = ipset_type[5:].split(",") items = entry.split(",") if len(flags) != len(items) or len(flags) < 1: raise FirewallError( errors.INVALID_ENTRY, "entry '%s' does not match ipset type '%s'" % \ (entry, ipset_type)) for i in range(len(flags)): flag = flags[i] item = items[i] if flag == "ip": if "-" in item and family == "ipv4": # IP ranges only with plain IPs, no masks if i > 1: raise FirewallError( errors.INVALID_ENTRY, "invalid address '%s' in '%s'[%d]" % \ (item, entry, i)) splits = item.split("-") if len(splits) != 2: raise FirewallError( errors.INVALID_ENTRY, "invalid address range '%s' in '%s' for %s (%s)" % \ (item, entry, ipset_type, family)) for _split in splits: if (family == "ipv4" and not checkIP(_split)) or \ (family == "ipv6" and not checkIP6(_split)): raise FirewallError( errors.INVALID_ENTRY, "invalid address '%s' in '%s' for %s (%s)" % \ (_split, entry, ipset_type, family)) else: # IPs with mask only allowed in the first # position of the type if family == "ipv4": if item == "0.0.0.0": raise FirewallError( errors.INVALID_ENTRY, "invalid address '%s' in '%s' for %s (%s)" % \ (item, entry, ipset_type, family)) if i == 0: ip_check = checkIPnMask else: ip_check = checkIP else: ip_check = checkIP6 if not ip_check(item): raise FirewallError( errors.INVALID_ENTRY, "invalid address '%s' in '%s' for %s (%s)" % \ (item, entry, ipset_type, family)) elif flag == "net": if "-" in item: # IP ranges only with plain IPs, no masks splits = item.split("-") if len(splits) != 2: raise FirewallError( errors.INVALID_ENTRY, "invalid address range '%s' in '%s' for %s (%s)" % \ (item, entry, ipset_type, family)) # First part can only be a plain IP if (family == "ipv4" and not checkIP(splits[0])) or \ (family == "ipv6" and not checkIP6(splits[0])): raise FirewallError( errors.INVALID_ENTRY, "invalid address '%s' in '%s' for %s (%s)" % \ (splits[0], entry, ipset_type, family)) # Second part can also have a mask if (family == "ipv4" and not checkIPnMask(splits[1])) or \ (family == "ipv6" and not checkIP6nMask(splits[1])): raise FirewallError( errors.INVALID_ENTRY, "invalid address '%s' in '%s' for %s (%s)" % \ (splits[1], entry, ipset_type, family)) else: # IPs with mask allowed in all positions, but no /0 if item.endswith("/0"): if not (family == "ipv6" and i == 0 and ipset_type == "hash:net,iface"): raise FirewallError( errors.INVALID_ENTRY, "invalid address '%s' in '%s' for %s (%s)" % \ (item, entry, ipset_type, family)) if (family == "ipv4" and not checkIPnMask(item)) or \ (family == "ipv6" and not checkIP6nMask(item)): raise FirewallError( errors.INVALID_ENTRY, "invalid address '%s' in '%s' for %s (%s)" % \ (item, entry, ipset_type, family)) elif flag == "mac": # ipset does not allow to add 00:00:00:00:00:00 if not check_mac(item) or item == "00:00:00:00:00:00": raise FirewallError( errors.INVALID_ENTRY, "invalid mac address '%s' in '%s'" % (item, entry)) elif flag == "port": if ":" in item: splits = item.split(":") if len(splits) != 2: raise FirewallError( errors.INVALID_ENTRY, "invalid port '%s'" % (item)) if splits[0] == "icmp": if family != "ipv4": raise FirewallError( errors.INVALID_ENTRY, "invalid protocol for family '%s' in '%s'" % \ (family, entry)) if not check_icmp_name(splits[1]) and not \ check_icmp_type(splits[1]): raise FirewallError( errors.INVALID_ENTRY, "invalid icmp type '%s' in '%s'" % \ (splits[1], entry)) elif splits[0] in [ "icmpv6", "ipv6-icmp" ]: if family != "ipv6": raise FirewallError( errors.INVALID_ENTRY, "invalid protocol for family '%s' in '%s'" % \ (family, entry)) if not check_icmpv6_name(splits[1]) and not \ check_icmpv6_type(splits[1]): raise FirewallError( errors.INVALID_ENTRY, "invalid icmpv6 type '%s' in '%s'" % \ (splits[1], entry)) elif splits[0] not in [ "tcp", "sctp", "udp", "udplite" ] \ and not checkProtocol(splits[0]): raise FirewallError( errors.INVALID_ENTRY, "invalid protocol '%s' in '%s'" % (splits[0], entry)) elif not check_port(splits[1]): raise FirewallError( errors.INVALID_ENTRY, "invalid port '%s'in '%s'" % (splits[1], entry)) else: if not check_port(item): raise FirewallError( errors.INVALID_ENTRY, "invalid port '%s' in '%s'" % (item, entry)) elif flag == "mark": if item.startswith("0x"): try: int_val = int(item, 16) except ValueError: raise FirewallError( errors.INVALID_ENTRY, "invalid mark '%s' in '%s'" % (item, entry)) else: try: int_val = int(item) except ValueError: raise FirewallError( errors.INVALID_ENTRY, "invalid mark '%s' in '%s'" % (item, entry)) if int_val < 0 or int_val > 4294967295: raise FirewallError( errors.INVALID_ENTRY, "invalid mark '%s' in '%s'" % (item, entry)) elif flag == "iface": if not checkInterface(item) or len(item) > 15: raise FirewallError( errors.INVALID_ENTRY, "invalid interface '%s' in '%s'" % (item, entry)) else: raise FirewallError(errors.INVALID_IPSET, "ipset type '%s' not usable" % ipset_type) def _check_config(self, config, item, all_config, all_io_objects): if item == "type": if config not in IPSET_TYPES: raise FirewallError(errors.INVALID_TYPE, "'%s' is not valid ipset type" % config) if item == "options": for key in config.keys(): if key not in IPSET_CREATE_OPTIONS: raise FirewallError(errors.INVALID_IPSET, "ipset invalid option '%s'" % key) if key in [ "timeout", "hashsize", "maxelem" ]: try: int_value = int(config[key]) except ValueError: raise FirewallError( errors.INVALID_VALUE, "Option '%s': Value '%s' is not an integer" % \ (key, config[key])) if int_value < 0: raise FirewallError( errors.INVALID_VALUE, "Option '%s': Value '%s' is negative" % \ (key, config[key])) elif key == "family" and \ config[key] not in [ "inet", "inet6" ]: raise FirewallError(errors.INVALID_FAMILY, config[key]) def import_config(self, config, all_io_objects): if "timeout" in config[4] and config[4]["timeout"] != "0": if len(config[5]) != 0: raise FirewallError(errors.IPSET_WITH_TIMEOUT) for entry in config[5]: IPSet.check_entry(entry, config[4], config[3]) super(IPSet, self).import_config(config, all_io_objects) # PARSER class ipset_ContentHandler(IO_Object_ContentHandler): def startElement(self, name, attrs): IO_Object_ContentHandler.startElement(self, name, attrs) self.item.parser_check_element_attrs(name, attrs) if name == "ipset": if "type" in attrs: if attrs["type"] not in IPSET_TYPES: raise FirewallError(errors.INVALID_TYPE, "%s" % attrs["type"]) self.item.type = attrs["type"] if "version" in attrs: self.item.version = attrs["version"] elif name == "short": pass elif name == "description": pass elif name == "option": value = "" if "value" in attrs: value = attrs["value"] if attrs["name"] not in \ [ "family", "timeout", "hashsize", "maxelem" ]: raise FirewallError( errors.INVALID_OPTION, "Unknown option '%s'" % attrs["name"]) if self.item.type == "hash:mac" and attrs["name"] in [ "family" ]: raise FirewallError( errors.INVALID_OPTION, "Unsupported option '%s' for type '%s'" % \ (attrs["name"], self.item.type)) if attrs["name"] in [ "family", "timeout", "hashsize", "maxelem" ] \ and not value: raise FirewallError( errors.INVALID_OPTION, "Missing mandatory value of option '%s'" % attrs["name"]) if attrs["name"] in [ "timeout", "hashsize", "maxelem" ]: try: int_value = int(value) except ValueError: raise FirewallError( errors.INVALID_VALUE, "Option '%s': Value '%s' is not an integer" % \ (attrs["name"], value)) if int_value < 0: raise FirewallError( errors.INVALID_VALUE, "Option '%s': Value '%s' is negative" % \ (attrs["name"], value)) if attrs["name"] == "family" and value not in [ "inet", "inet6" ]: raise FirewallError(errors.INVALID_FAMILY, value) if attrs["name"] not in self.item.options: self.item.options[attrs["name"]] = value else: log.warning("Option %s already set, ignoring.", attrs["name"]) # nothing to do for entry and entries here def endElement(self, name): IO_Object_ContentHandler.endElement(self, name) if name == "entry": self.item.entries.append(self._element) def ipset_reader(filename, path): ipset = IPSet() if not filename.endswith(".xml"): raise FirewallError(errors.INVALID_NAME, "'%s' is missing .xml suffix" % filename) ipset.name = filename[:-4] ipset.check_name(ipset.name) ipset.filename = filename ipset.path = path ipset.builtin = False if path.startswith(config.ETC_FIREWALLD) else True ipset.default = ipset.builtin handler = ipset_ContentHandler(ipset) parser = sax.make_parser() parser.setContentHandler(handler) name = "%s/%s" % (path, filename) with open(name, "rb") as f: source = sax.InputSource(None) source.setByteStream(f) try: parser.parse(source) except sax.SAXParseException as msg: raise FirewallError(errors.INVALID_IPSET, "not a valid ipset file: %s" % \ msg.getException()) del handler del parser if "timeout" in ipset.options and ipset.options["timeout"] != "0" and \ len(ipset.entries) > 0: # no entries visible for ipsets with timeout log.warning("ipset '%s': timeout option is set, entries are ignored", ipset.name) del ipset.entries[:] i = 0 entries_set = set() while i < len(ipset.entries): if ipset.entries[i] in entries_set: log.warning("Entry %s already set, ignoring.", ipset.entries[i]) ipset.entries.pop(i) else: try: ipset.check_entry(ipset.entries[i], ipset.options, ipset.type) except FirewallError as e: log.warning("%s, ignoring.", e) ipset.entries.pop(i) else: entries_set.add(ipset.entries[i]) i += 1 del entries_set return ipset def ipset_writer(ipset, path=None): _path = path if path else ipset.path if ipset.filename: name = "%s/%s" % (_path, ipset.filename) else: name = "%s/%s.xml" % (_path, ipset.name) if os.path.exists(name): try: shutil.copy2(name, "%s.old" % name) except Exception as msg: log.error("Backup of file '%s' failed: %s", name, msg) dirpath = os.path.dirname(name) if dirpath.startswith(config.ETC_FIREWALLD) and not os.path.exists(dirpath): if not os.path.exists(config.ETC_FIREWALLD): os.mkdir(config.ETC_FIREWALLD, 0o750) os.mkdir(dirpath, 0o750) f = io.open(name, mode='wt', encoding='UTF-8') handler = IO_Object_XMLGenerator(f) handler.startDocument() # start ipset element attrs = { "type": ipset.type } if ipset.version and ipset.version != "": attrs["version"] = ipset.version handler.startElement("ipset", attrs) handler.ignorableWhitespace("\n") # short if ipset.short and ipset.short != "": handler.ignorableWhitespace(" ") handler.startElement("short", { }) handler.characters(ipset.short) handler.endElement("short") handler.ignorableWhitespace("\n") # description if ipset.description and ipset.description != "": handler.ignorableWhitespace(" ") handler.startElement("description", { }) handler.characters(ipset.description) handler.endElement("description") handler.ignorableWhitespace("\n") # options for key,value in ipset.options.items(): handler.ignorableWhitespace(" ") if value != "": handler.simpleElement("option", { "name": key, "value": value }) else: handler.simpleElement("option", { "name": key }) handler.ignorableWhitespace("\n") # entries for entry in ipset.entries: handler.ignorableWhitespace(" ") handler.startElement("entry", { }) handler.characters(entry) handler.endElement("entry") handler.ignorableWhitespace("\n") # end ipset element handler.endElement('ipset') handler.ignorableWhitespace("\n") handler.endDocument() f.close() del handler PK ���Z�ζ �. �. core/io/service.pynu �[��� # -*- coding: utf-8 -*- # # Copyright (C) 2011-2016 Red Hat, Inc. # # Authors: # Thomas Woerner <twoerner@redhat.com> # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see <http://www.gnu.org/licenses/>. # __all__ = [ "Service", "service_reader", "service_writer" ] import xml.sax as sax import os import io import shutil from firewall import config from firewall.core.io.io_object import IO_Object, \ IO_Object_ContentHandler, IO_Object_XMLGenerator, check_port, \ check_tcpudp, check_protocol, check_address from firewall.core.logger import log from firewall import errors from firewall.errors import FirewallError class Service(IO_Object): IMPORT_EXPORT_STRUCTURE = ( ( "version", "" ), ( "short", "" ), ( "description", "" ), ( "ports", [ ( "", "" ), ], ), ( "modules", [ "", ], ), ( "destination", { "": "", }, ), ( "protocols", [ "", ], ), ( "source_ports", [ ( "", "" ), ], ), ( "includes", [ "" ], ), ( "helpers", [ "", ], ), ) ADDITIONAL_ALNUM_CHARS = [ "_", "-" ] PARSER_REQUIRED_ELEMENT_ATTRS = { "short": None, "description": None, "service": None, } PARSER_OPTIONAL_ELEMENT_ATTRS = { "service": [ "name", "version" ], "port": [ "port", "protocol" ], "protocol": [ "value" ], "module": [ "name" ], "destination": [ "ipv4", "ipv6" ], "source-port": [ "port", "protocol" ], "include": [ "service" ], "helper": [ "name" ], } def __init__(self): super(Service, self).__init__() self.version = "" self.short = "" self.description = "" self.ports = [ ] self.protocols = [ ] self.modules = [ ] self.destination = { } self.source_ports = [ ] self.includes = [ ] self.helpers = [ ] def cleanup(self): self.version = "" self.short = "" self.description = "" del self.ports[:] del self.protocols[:] del self.modules[:] self.destination.clear() del self.source_ports[:] del self.includes[:] del self.helpers[:] def _check_config(self, config, item, all_config, all_io_objects): if item == "ports": for port in config: if port[0] != "": check_port(port[0]) check_tcpudp(port[1]) else: # only protocol check_protocol(port[1]) elif item == "protocols": for proto in config: check_protocol(proto) elif item == "source_ports": for port in config: check_port(port[0]) check_tcpudp(port[1]) elif item == "destination": for destination in config: if destination not in [ "ipv4", "ipv6" ]: raise FirewallError(errors.INVALID_DESTINATION, "'%s' not in {'ipv4'|'ipv6'}" % \ destination) check_address(destination, config[destination]) elif item == "modules": for module in config: if module.startswith("nf_conntrack_"): module = module.replace("nf_conntrack_", "") if "_" in module: module = module.replace("_", "-") if len(module) < 2: raise FirewallError(errors.INVALID_MODULE, module) # PARSER class service_ContentHandler(IO_Object_ContentHandler): def startElement(self, name, attrs): IO_Object_ContentHandler.startElement(self, name, attrs) self.item.parser_check_element_attrs(name, attrs) if name == "service": if "name" in attrs: log.warning("Ignoring deprecated attribute name='%s'", attrs["name"]) if "version" in attrs: self.item.version = attrs["version"] elif name == "short": pass elif name == "description": pass elif name == "port": if attrs["port"] != "": check_port(attrs["port"]) check_tcpudp(attrs["protocol"]) entry = (attrs["port"], attrs["protocol"]) if entry not in self.item.ports: self.item.ports.append(entry) else: log.warning("Port '%s/%s' already set, ignoring.", attrs["port"], attrs["protocol"]) else: check_protocol(attrs["protocol"]) if attrs["protocol"] not in self.item.protocols: self.item.protocols.append(attrs["protocol"]) else: log.warning("Protocol '%s' already set, ignoring.", attrs["protocol"]) elif name == "protocol": check_protocol(attrs["value"]) if attrs["value"] not in self.item.protocols: self.item.protocols.append(attrs["value"]) else: log.warning("Protocol '%s' already set, ignoring.", attrs["value"]) elif name == "source-port": check_port(attrs["port"]) check_tcpudp(attrs["protocol"]) entry = (attrs["port"], attrs["protocol"]) if entry not in self.item.source_ports: self.item.source_ports.append(entry) else: log.warning("SourcePort '%s/%s' already set, ignoring.", attrs["port"], attrs["protocol"]) elif name == "destination": for x in [ "ipv4", "ipv6" ]: if x in attrs: check_address(x, attrs[x]) if x in self.item.destination: log.warning("Destination address for '%s' already set, ignoring", x) else: self.item.destination[x] = attrs[x] elif name == "module": module = attrs["name"] if module.startswith("nf_conntrack_"): module = module.replace("nf_conntrack_", "") if "_" in module: module = module.replace("_", "-") if module not in self.item.modules: self.item.modules.append(module) else: log.warning("Module '%s' already set, ignoring.", module) elif name == "include": if attrs["service"] not in self.item.includes: self.item.includes.append(attrs["service"]) else: log.warning("Include '%s' already set, ignoring.", attrs["service"]) elif name == "helper": if attrs["name"] not in self.item.helpers: self.item.helpers.append(attrs["name"]) else: log.warning("Helper '%s' already set, ignoring.", attrs["name"]) def service_reader(filename, path): service = Service() if not filename.endswith(".xml"): raise FirewallError(errors.INVALID_NAME, "'%s' is missing .xml suffix" % filename) service.name = filename[:-4] service.check_name(service.name) service.filename = filename service.path = path service.builtin = False if path.startswith(config.ETC_FIREWALLD) else True service.default = service.builtin handler = service_ContentHandler(service) parser = sax.make_parser() parser.setContentHandler(handler) name = "%s/%s" % (path, filename) with open(name, "rb") as f: source = sax.InputSource(None) source.setByteStream(f) try: parser.parse(source) except sax.SAXParseException as msg: raise FirewallError(errors.INVALID_SERVICE, "not a valid service file: %s" % \ msg.getException()) del handler del parser return service def service_writer(service, path=None): _path = path if path else service.path if service.filename: name = "%s/%s" % (_path, service.filename) else: name = "%s/%s.xml" % (_path, service.name) if os.path.exists(name): try: shutil.copy2(name, "%s.old" % name) except Exception as msg: log.error("Backup of file '%s' failed: %s", name, msg) dirpath = os.path.dirname(name) if dirpath.startswith(config.ETC_FIREWALLD) and not os.path.exists(dirpath): if not os.path.exists(config.ETC_FIREWALLD): os.mkdir(config.ETC_FIREWALLD, 0o750) os.mkdir(dirpath, 0o750) f = io.open(name, mode='wt', encoding='UTF-8') handler = IO_Object_XMLGenerator(f) handler.startDocument() # start service element attrs = {} if service.version and service.version != "": attrs["version"] = service.version handler.startElement("service", attrs) handler.ignorableWhitespace("\n") # short if service.short and service.short != "": handler.ignorableWhitespace(" ") handler.startElement("short", { }) handler.characters(service.short) handler.endElement("short") handler.ignorableWhitespace("\n") # description if service.description and service.description != "": handler.ignorableWhitespace(" ") handler.startElement("description", { }) handler.characters(service.description) handler.endElement("description") handler.ignorableWhitespace("\n") # ports for port in service.ports: handler.ignorableWhitespace(" ") handler.simpleElement("port", { "port": port[0], "protocol": port[1] }) handler.ignorableWhitespace("\n") # protocols for protocol in service.protocols: handler.ignorableWhitespace(" ") handler.simpleElement("protocol", { "value": protocol }) handler.ignorableWhitespace("\n") # source ports for port in service.source_ports: handler.ignorableWhitespace(" ") handler.simpleElement("source-port", { "port": port[0], "protocol": port[1] }) handler.ignorableWhitespace("\n") # modules for module in service.modules: handler.ignorableWhitespace(" ") handler.simpleElement("module", { "name": module }) handler.ignorableWhitespace("\n") # destination if len(service.destination) > 0: handler.ignorableWhitespace(" ") handler.simpleElement("destination", service.destination) handler.ignorableWhitespace("\n") # includes for include in service.includes: handler.ignorableWhitespace(" ") handler.simpleElement("include", { "service": include }) handler.ignorableWhitespace("\n") # helpers for helper in service.helpers: handler.ignorableWhitespace(" ") handler.simpleElement("helper", { "name": helper }) handler.ignorableWhitespace("\n") # end service element handler.endElement('service') handler.ignorableWhitespace("\n") handler.endDocument() f.close() del handler PK ���Z�w{�{ { 2 core/io/__pycache__/firewalld_conf.cpython-310.pycnu �[��� o bhAb�5 � @ sT d dl Zd dlZd dlZd dlZd dlmZ d dlmZ g d�Z G dd� de �Z dS )� N)�config)�log) � DefaultZone� MinimalMark� CleanupOnExit�CleanupModulesOnExit�Lockdown� IPv6_rpfilter�IndividualCalls� LogDenied�AutomaticHelpers�FirewallBackend�FlushAllOnReload� RFC3964_IPv4�AllowZoneDriftingc @ sL e Zd Zdd� Zdd� Zdd� Zdd� Zd d � Zd d � Zd d� Z dd� Z dS )�firewalld_confc C s i | _ g | _|| _| �� d S �N)�_config�_deleted�filename�clear)�selfr � r �A/usr/lib/python3/dist-packages/firewall/core/io/firewalld_conf.py�__init__% s zfirewalld_conf.__init__c C s i | _ g | _d S r )r r �r r r r r + s zfirewalld_conf.clearc C s | j �� g | _d S r )r r r r r r r �cleanup/ s zfirewalld_conf.cleanupc C s | j �|�� �S r )r �get�strip)r �keyr r r r 3 s zfirewalld_conf.getc C s4 |� � }|� � | j|< || jv r| j�|� d S d S r )r r r �remove)r r �value�_keyr r r �set6 s �zfirewalld_conf.setc C s8 d}| j �� D ]\}}|r|d7 }|d||f 7 }q|S )N� � z%s=%s)r �items)r �sr r! r r r �__str__< s zfirewalld_conf.__str__c C sx | � � zt| jd�}W n� ty� } z�t�d| j|� | �dtj� | �dt tj �� | �dtj r4dnd� | �dtj r?dnd� | �d tj rJdnd� | �d tjrUdnd� | �d tjr`dnd� | �d tj� | �d tj� | �dtj� | �dtjr�dnd� | �dtjr�dnd� | �dtjr�d� � d� � d }~ww |D ]k}|s� nf|�� }t|�dk s�|d dv r�q�dd� |�d�D �}t|�dkr�t�d|�� � q�|d tvr�t�d|�� � q�|d dkr�t�d |�� � q�| j�|d �d u�rt�d |�� � q�|d | j|d < q�|� � | �d��s)t�d tj� | �dt tj�� | �d�}zt |� W n' t t f�y[ |d u�rPt� d |�rK|ndtj � | �dt tj �� Y nw | �d�}|�rk|�!� d v�r�|d u�r}t� d!|�rx|ndtj � | �dtj �r�dnd� | �d�}|�r�|�!� d v�r�|d u�r�t� d"|�r�|ndtj � | �dtj �r�dnd� | �d �}|�r�|�!� d#v�r�|d u�r�t� d$|�r�|ndtj � | �d tj �r�dnd� | �d �}|�r�|�!� d#v�r|d u�rt� d%|�r�|ndtj� | �d tj�r dnd� | �d �}|�r |�!� d#v�r=|d u�r1t� d&|�r,|ndtj� | �d tj�r:dnd� | �d �}|�rK|tj"v�ra|d u�rXt� d'|tj� | �d t tj�� | �d �}|�rq|�!� tj#v�r�|d u�r�t� d(|�r~|ndtj� | �d t tj�� | �d�}|�r�|�!� tj$v�r�|d u�r�t� d)|�r�|ndtj� | �dt tj�� | �d�}|�r�|�!� d#v�r�|d u�r�t� d*|�r�|ndtj� | �dt tj�� | �d�}|�r�|�!� d#v�r |d u�rt� d+|�r�|ndtj� | �dt tj�� | �d�}|�r|�!� d#v�r:|d u�r,t� d,|�r'|ndtj� | �dtj�r5dnd� d S d S )-N�rzFailed to load '%s': %sr r r �yes�nor r r r r r r r r r � r )�#�;c S s g | ]}|� � �qS r )r )�.0�xr r r � <listcomp>a s z'firewalld_conf.read.<locals>.<listcomp>�=� z Invalid option definition: '%s'zInvalid option: '%s'r$ zMissing value: '%s'z!Duplicate option definition: '%s'z0DefaultZone is not set, using default value '%s'z7MinimalMark '%s' is not valid, using default value '%d')r+ �falser* �truez7CleanupOnExit '%s' is not valid, using default value %sz>CleanupModulesOnExit '%s' is not valid, using default value %s)r* r5 r+ r4 z2Lockdown '%s' is not valid, using default value %sz7IPv6_rpfilter '%s' is not valid, using default value %sz9IndividualCalls '%s' is not valid, using default value %sz3LogDenied '%s' is invalid, using default value '%s'z:AutomaticHelpers '%s' is not valid, using default value %sz9FirewallBackend '%s' is not valid, using default value %sz:FlushAllOnReload '%s' is not valid, using default value %sz6RFC3964_IPv4 '%s' is not valid, using default value %sz;AllowZoneDrifting '%s' is not valid, using default value %s)%r �openr � Exceptionr �errorr# r � FALLBACK_ZONE�str�FALLBACK_MINIMAL_MARK�FALLBACK_CLEANUP_ON_EXIT� FALLBACK_CLEANUP_MODULES_ON_EXIT�FALLBACK_LOCKDOWN�FALLBACK_IPV6_RPFILTER�FALLBACK_INDIVIDUAL_CALLS�FALLBACK_LOG_DENIED�FALLBACK_AUTOMATIC_HELPERS�FALLBACK_FIREWALL_BACKEND� FALLBACK_FLUSH_ALL_ON_RELOAD�FALLBACK_RFC3964_IPV4� FALLBACK_ALLOW_ZONE_DRIFTINGr �len�split� valid_keysr r �close�int� ValueError� TypeError�warning�lower�LOG_DENIED_VALUES�AUTOMATIC_HELPERS_VALUES�FIREWALL_BACKEND_VALUES)r �f�msg�line�pairr! r r r �readE s( ��� � �� � � � � � � � � � � � �zfirewalld_conf.readc C sj t | j�dk r d S g }tj�tj�st�tjd� ztj ddtj� | j � tj� | j �dd�}W n t yD } zt�d| � � d }~ww d}d}z tj| j dd d �}W n& t yz } ztj�| j �rnt�d | j |f � � d }W Y d }~n�d }~ww |D ]�}|s� n�|�d �}t |�dk r�|s�|�d � d }q}|d dkr�d}|�|� |�d � q}|�d�}t |�dkr�d}|�|d � q}|d �� } |d �� } | |v�r| | jv r�| j| | kr�d}|�d| | j| f � d }n| | jv r�d }n d}|�|d � |�| � q}d }q}t | j�dk�r>| j�� D ](\} } | |v �r �q| dv �r'�q|�s1|�d � d }|�d| | f � d }�q|�rE|�� |�� |�sTt�|j� d S tj�| j ��r�z t� | j d| j � W n t �y� } zt�|j� t d| j |f ��d }~ww z t� |j| j � W n t �y� } zt�|j� t d| j |f ��d }~ww t� | j d� d S )Nr, i� �wtz%s.F)�mode�prefix�dir�deletez!Failed to open temporary file: %s�rtzUTF-8)rY �encodingzFailed to open '%s': %sr% Tr r- r2 r3 z%s=%s )r r r z%s.oldzBackup of '%s' failed: %szFailed to create '%s': %si� ) rG r �os�path�existsr � ETC_FIREWALLD�mkdir�tempfile�NamedTemporaryFile�basenamer �dirnamer7 r r8 �ior6 r �writerH r �appendr& rJ r �name�shutil�copy2�IOError�move�chmod) r �done� temp_filerT �modified�emptyrS rU �pr r! r r r ri � s� ����� � � �� ��zfirewalld_conf.writeN) �__name__� __module__� __qualname__r r r r r# r( rW ri r r r r r $ s r ) �os.pathr_ rh rd rl �firewallr �firewall.core.loggerr rI �objectr r r r r �<module> s PK ���Z���m� � , core/io/__pycache__/icmptype.cpython-310.pycnu �[��� o bhAb� � @ s� g d �Z ddlmZ ddlZddlZddlZddlmZ ddlm Z m Z m Z ddl m Z ddlmZ ddlmZ G dd � d e �ZG d d � d e �Zd d � Zddd�ZdS ))�IcmpType�icmptype_reader�icmptype_writer� N)�config)� IO_Object�IO_Object_ContentHandler�IO_Object_XMLGenerator)�log)�errors)� FirewallErrorc sh e Zd ZdddddgffZdZddgZd d d d �Zd d gd dgd�Z� fdd�Zdd� Z dd� Z � Z S )r )�version� )�shortr )� descriptionr � destinationr z(sssas)�_�-N)r r �icmptype�namer �ipv4�ipv6)r r c s* t t| ��� d| _d| _d| _g | _d S �Nr )�superr �__init__r r r r ��self�� __class__� �;/usr/lib/python3/dist-packages/firewall/core/io/icmptype.pyr 7 s zIcmpType.__init__c C s" d| _ d| _d| _| jd d �= d S r )r r r r r r r r �cleanup> s zIcmpType.cleanupc C s2 |dkr|D ]}|dvrt tjd| ��qd S d S )Nr �r r z '%s' not from {'ipv4'|'ipv6'})r r �INVALID_DESTINATION)r r �item� all_config�all_io_objectsr r r r � _check_configD s ����zIcmpType._check_config) �__name__� __module__� __qualname__�IMPORT_EXPORT_STRUCTURE�DBUS_SIGNATURE�ADDITIONAL_ALNUM_CHARS� PARSER_REQUIRED_ELEMENT_ATTRS� PARSER_OPTIONAL_ELEMENT_ATTRSr r r& � __classcell__r r r r r $ s$ ��� r c @ s e Zd Zdd� ZdS )�icmptype_ContentHandlerc C s� t �| ||� | j�||� |dkr-d|v r t�d|d � d|v r+|d | j_d S d S |dkr3d S |dkr9d S |dkrWdD ]}||v rV|| �� d v rV| jj� t |�� q?d S d S ) Nr r z'Ignoring deprecated attribute name='%s'r r r r r! )�yes�true) r � startElementr# �parser_check_element_attrsr �warningr �lowerr �append�str)r r �attrs�xr r r r3 O s, ����z$icmptype_ContentHandler.startElementN)r' r( r) r3 r r r r r0 N s r0 c C s t � }| �d�sttjd| ��| d d� |_|�|j� | |_||_|� t j �r+dnd|_ |j |_ t|�}t�� }|�|� d|| f }t|d��4}t�d �}|�|� z|�|� W n tjys } z ttjd|�� ��d }~ww W d � ~~|S 1 s�w Y ~~|S ) Nz.xmlz%s is missing .xml suffix���FT�%s/%s�rbz not a valid icmptype file: %s)r �endswithr r � INVALID_NAMEr � check_name�filename�path� startswithr � ETC_FIREWALLD�builtin�defaultr0 �sax� make_parser�setContentHandler�open� InputSource� setByteStream�parse�SAXParseException�INVALID_ICMPTYPE� getException) rA rB r �handler�parserr �f�source�msgr r r r c sJ � ����� � � r c C s |r|n| j }| jrd|| jf }nd|| jf }tj �|�rCz t�|d| � W n tyB } z t� d||� W Y d }~nd }~ww tj � |�}|� t j �ritj �|�sitj �t j �sct�t j d� t�|d� tj|ddd�}t|�}|�� i }| jr�| jd kr�| j|d < |�d |� |�d � | jr�| jd kr�|�d � |�di � |�| j� |�d� |�d � | jr�| jd kr�|�d � |�di � |�| j� |�d� |�d � | jr�|�d � i }| jD ]} d|| < q�|�d|� |�d � |�d � |�d � |� � |� � ~d S )Nr< z %s/%s.xmlz%s.oldz Backup of file '%s' failed: %si� �wtzUTF-8)�mode�encodingr r r � z r r r1 r ) rB rA r �os�exists�shutil�copy2� Exceptionr �error�dirnamerC r rD �mkdir�iorJ r � startDocumentr r3 �ignorableWhitespacer � characters� endElementr r � simpleElement� endDocument�close) r rB �_pathr rU �dirpathrS rQ r9 r: r r r r s` �� r )N)�__all__�xml.saxrG rZ rb r\ �firewallr �firewall.core.io.io_objectr r r �firewall.core.loggerr r �firewall.errorsr r r0 r r r r r r �<module> s * PK ���Zx�8W� � ) core/io/__pycache__/ifcfg.cpython-310.pycnu �[��� o bhAb� � @ sJ d Z dgZddlZddlZddlZddlZddlmZ G dd� de �Z dS )zifcfg file parser�ifcfg� N)�logc @ sL e Zd Zdd� Zdd� Zdd� Zdd� Zd d � Zd d � Zd d� Z dd� Z dS )r c C s i | _ g | _|| _| �� d S �N)�_config�_deleted�filename�clear)�selfr � r �8/usr/lib/python3/dist-packages/firewall/core/io/ifcfg.py�__init__" s zifcfg.__init__c C s i | _ g | _d S r )r r �r r r r r ( s z ifcfg.clearc C s | j �� d S r )r r r r r r �cleanup, s z ifcfg.cleanupc C s | j �|�� �S r )r �get�strip)r �keyr r r r / s z ifcfg.getc C s4 |� � }|� � | j|< || jv r| j�|� d S d S r )r r r �remove)r r �value�_keyr r r �set2 s �z ifcfg.setc C s8 d}| j �� D ]\}}|r|d7 }|d||f 7 }q|S )N� � z%s=%s)r �items)r �sr r r r r �__str__8 s z ifcfg.__str__c C s2 | � � zt| jd�}W n ty! } z t�d| j|� � d }~ww |D ]n}|s* ni|�� }t|�dk s:|d dv r;q$dd� |�dd�D �}t|�d krMq$t|d �d krm|d � d �rm|d � d �rm|d dd � |d< |d d krtq$| j � |d �d ur�t� d | j|�� � q$|d | j |d < q$|�� d S )N�rzFailed to load '%s': %s� r )�#�;c S s g | ]}|� � �qS r )r )�.0�xr r r � <listcomp>P s z ifcfg.read.<locals>.<listcomp>�=� �"���r z%%s: Duplicate option definition: '%s')r �openr � Exceptionr �errorr �len�split� startswith�endswithr r �warning�close)r �f�msg�line�pairr r r �readA s< �� � � z ifcfg.readc C sd t | j�dk r d S g }ztjddtj�| j� tj�| j�dd�}W n t y6 } zt � d| � � d }~ww d}d}z t j | jddd �}W n& t yl } ztj�| j�r`t � d | j|f � � d }W Y d }~n�d }~ww |D ]�}|su n�|�d �}t |�dk r�|s�|�d � d }qo|d dkr�d}|�|� |�d � qo|�dd�}t |�dkr�d}|�|d � qo|d �� } |d �� } t | �dkr�| �d�r�| �d�r�| dd� } | |v�r| | jv r�| j| | kr�d}|�d| | j| f � d }n| | jv r�d }n d}|�|d � |�| � qod }qot | j�d k�r;| j�� D ] \} } | |v �r)�q |�s.d }|�d| | f � d }�q |�rB|�� |�� |�sQt�|j� d S tj�| j��r�z t�| jd| j � W n t �y� } zt�|j� t d| j|f ��d }~ww z t� |j| j� W n t �y� } zt�|j� t d| j|f ��d }~ww t� | jd� d S )Nr �wtz%s.F)�mode�prefix�dir�deletez!Failed to open temporary file: %s�rtzUTF-8)r5 �encodingzFailed to open '%s': %sr Tr r r" r# r$ r% z%s=%s z%s.bakzBackup of '%s' failed: %szFailed to create '%s': %si� ) r) r �tempfile�NamedTemporaryFile�os�path�basenamer �dirnamer' r r( �ior& �existsr �writer* r+ r, r �appendr r. r �name�shutil�copy2�IOError�move�chmod) r �done� temp_filer0 �modified�emptyr/ r1 �pr r r r r rC ^ s� ����� � �� � �� ��z ifcfg.writeN) �__name__� __module__� __qualname__r r r r r r r3 rC r r r r r ! s ) �__doc__�__all__�os.pathr= rA r; rF �firewall.core.loggerr �objectr r r r r �<module> s PK ���ZS���� � , core/io/__pycache__/__init__.cpython-310.pycnu �[��� o bhAb< � @ sr d dl Z de jv r5d dlmZ eed�s dd� Zeede� d dlmZ eed�s7d d � Z eede � dS dS dS ) � N�_xmlplus)�AttributesImpl� __contains__c C s |t | d�v S )N�_attrs)�getattr)�self�name� r �;/usr/lib/python3/dist-packages/firewall/core/io/__init__.py� __AttributesImpl__contains__ s r )� XMLGenerator�_writec C s t | d��|� d S )N�_out)r �write)r �textr r r �__XMLGenerator_write$ s r ) �xml�__file__�xml.sax.xmlreaderr �hasattrr �setattr�xml.sax.saxutilsr r r r r r �<module> s � PK ���Z@��& �& - core/io/__pycache__/io_object.cpython-310.pycnu �[��� o bhAb�- � @ s� d Z g d�ZddlmZ ddlm mZ ddlZddlmZ ddl m Z ddl m Z ddl m Z G dd � d e�ZG d d � d e�ZG d d � d e�ZG dd� de�ZG dd� dejj�ZG dd� dej�Zdd� Zdd� Zdd� Zdd� Z dS ) z5Generic io_object handler, io specific check methods.)� IO_Object�IO_Object_ContentHandler�IO_Object_XMLGenerator� check_port� check_tcpudp�check_protocol� check_address� N)� OrderedDict)� functions)�errors)� FirewallErrorc @ s� e Zd ZdZdZdZg Zi Zi Zdd� Z dd� Z dd � Z d d � Z d d � Z dd� Zi fdd�Zdd� Zdd� Zdd� Zdd� ZdS )r z; Abstract IO_Object as base for icmptype, service and zone � z()c C s" d| _ d| _d| _d| _d| _d S )N� F)�filename�path�name�default�builtin��selfr r �</usr/lib/python3/dist-packages/firewall/core/io/io_object.py�__init__- s zIO_Object.__init__c C s2 g }| j D ]}|�t�t| |d ��� qt|�S )Nr )�IMPORT_EXPORT_STRUCTURE�append�copy�deepcopy�getattr�tuple)r �ret�xr r r � export_config4 s zIO_Object.export_configc C sT i }t dd� | jD ��}|D ]}t| |�s tt| |�t�r't�t| |��||< q|S )Nc S � g | ] }|d |d f�qS �r � r ��.0r r r r � <listcomp>< � z0IO_Object.export_config_dict.<locals>.<listcomp>)�dictr r � isinstance�boolr r )r �conf� type_formats�keyr r r �export_config_dict: s �z IO_Object.export_config_dictc C s� | � ||� t| j�D ]=\}\}}t|| t�r=g }t� }|| D ]}||vr1|�|� |�|� q!~t| |t � |�� q t| |t � || �� q d S �N) � check_config� enumerater r) �list�setr �add�setattrr r ) r r+ �all_io_objects�i�element�dummy�_conf�_setr r r r � import_configB s ��zIO_Object.import_configc C s| | � ||� |D ]3}t| |�sttjd�|���t|| t�r0t| |tt � t � || ���� qt| |t � || �� qd S )Nz-Internal error. '{}' is not a valid attribute) �check_config_dict�hasattrr r � UNKNOWN_ERROR�formatr) r2 r5 r �fromkeysr r )r r+ r6 r- r r r �import_config_dictR s "�z IO_Object.import_config_dictc C st t |t�sttjd|td�t|�f ��t|�dk r ttjd��|D ]}|�� s7|| j vr7ttjd||f ��q"d S )N�'%s' not of type %s, but %sr r# zname can't be emptyz'%s' is not allowed in '%s') r) �strr r � INVALID_TYPE�type�len� INVALID_NAME�isalnum�ADDITIONAL_ALNUM_CHARS)r r �charr r r � check_name^ s �� ���zIO_Object.check_namec C sh t |�t | j�krttjdt |�t | j�f ��i }t| j�D ] \}\}}|| ||< q | �||� d S )Nz structure size mismatch %d != %d)rG r r r rE r1 r= )r r+ r6 � conf_dictr7 r �yr r r r0 k s ��zIO_Object.check_configc C sp t dd� | jD ��}|D ])}|dd� | jD �vr!ttjd�|���| �|| || � | �|| |||� q d S )Nc S r! r" r r$ r r r r& w r' z/IO_Object.check_config_dict.<locals>.<listcomp>c S s g | ]\}}|�qS r r )r% r rN r r r r& y s zoption '{}' is not valid)r( r r r �INVALID_OPTIONr@ �_check_config_structure� _check_config)r r+ r6 r, r- r r r r= v s �zIO_Object.check_config_dictc C s d S r/ r )r �dummy1�dummy2�dummy3�dummy4r r r rQ ~ s zIO_Object._check_configc C sX t |t|��sttjd|t|�t|�f ��t |t�r8t|�dkr)ttjd| ��|D ] }| �||d � q+d S t |t�rdt|�t|�krQttjd|t|�f ��t |�D ] \}}| �|| |� qUd S t |t �r�t|� � �d \}}|� � D ]2\}}t |t|��s�ttjd|t|�t|�f ��t |t|��s�ttjd|t|�t|�f ��qwd S d S )NrC r# zlen('%s') != 1r zlen('%s') != %d) r) rF r r rE r2 rG rP r r1 r( �items) r r+ � structurer r7 �value�skey�svaluer- r r r rP � sT �� �� ��� ������z!IO_Object._check_config_structurec C s� |� � }d}|| jv r/d}| j| d ur/| j| D ]}||v r%|�|� qttjd||f ��|| jv rGd}| j| D ] }||v rF|�|� q;|sQttjd| ��|D ] }ttjd||f ��d S )NFTzMissing attribute %s for %szUnexpected element %sz%s: Unexpected attribute %s)�getNames� PARSER_REQUIRED_ELEMENT_ATTRS�remover r � PARSE_ERROR� PARSER_OPTIONAL_ELEMENT_ATTRS)r r �attrs�_attrs�foundr r r r �parser_check_element_attrs� s6 � �� ��z$IO_Object.parser_check_element_attrsN)�__name__� __module__� __qualname__�__doc__r �DBUS_SIGNATURErJ r\ r_ r r r. r< rB rL r0 r= rQ rP rc r r r r r $ s$ !r c �$ e Zd Z� fdd�Zdd� Z� ZS )�UnexpectedElementErrorc s t t| ��� || _d S r/ )�superrj r r �r r �� __class__r r r � s z UnexpectedElementError.__init__c C s d| j S )NzUnexpected element '%s')r r r r r �__str__� � z UnexpectedElementError.__str__�rd re rf r ro � __classcell__r r rm r rj � s rj c ri )�MissingAttributeErrorc � t t| ��� || _|| _d S r/ )rk rs r r � attribute�r r ru rm r r r � � z MissingAttributeError.__init__c C � d| j | jf S )Nz$Element '%s': missing '%s' attribute�r ru r r r r ro � � �z MissingAttributeError.__str__rq r r rm r rs � � rs c ri )�UnexpectedAttributeErrorc rt r/ )rk r| r r ru rv rm r r r � rw z!UnexpectedAttributeError.__init__c C rx )Nz'Element '%s': unexpected attribute '%s'ry r r r r ro � rz z UnexpectedAttributeError.__str__rq r r rm r r| � r{ r| c @ s4 e Zd Zdd� Zdd� Zdd� Zdd� Zd d � Zd S ) r c C s || _ d| _d S �Nr )�item�_element)r r~ r r r r � s z!IO_Object_ContentHandler.__init__c C � d| _ d S r} �r r r r r � startDocument� rp z&IO_Object_ContentHandler.startDocumentc C r� r} r� )r r r` r r r � startElement� rp z%IO_Object_ContentHandler.startElementc C s0 |dkr | j | j_d S |dkr| j | j_d S d S )N�short� description)r r~ r� r� rl r r r � endElement� s �z#IO_Object_ContentHandler.endElementc C s | j |�dd�7 _ d S )N� � )r �replace)r �contentr r r � characters� s z#IO_Object_ContentHandler.charactersN)rd re rf r r� r� r� r� r r r r r � s r c @ s e Zd Zdd� Zdd� ZdS )r c C sN t jj�| � |j| _|j| _i g| _| jd | _ g | _ d| _ d| _ d| _ d S )N���zutf-8F)�sax�handler�ContentHandlerr �write�_write�flush�_flush� _ns_contexts�_current_context�_undeclared_ns_maps� _encoding�_pending_start_element�_short_empty_elements)r �outr r r r � s z IO_Object_XMLGenerator.__init__c C sF | � d| � |�� D ]\}}| � d|t�|�f � q | � d� dS )z* slightly modified startElement() �<z %s=%sz/>N)r� rV �saxutils� quoteattr)r r r` rX r r r � simpleElement� s z$IO_Object_XMLGenerator.simpleElementN)rd re rf r r� r r r r r � s r c C s� t �| �}|dkrttjd| ��|dkr ttjd| ��|d u r)ttjd| ��t|�dkr?|d |d krAttjd| ��d S d S ) N���z port number in '%s' is too bigr� z'%s' is invalid port rangez port range '%s' is ambiguous� r r# )r � getPortRanger r � INVALID_PORTrG )�port� port_ranger r r r s$ ��� ��r c C s | dvr t tjd| ��d S )N)�tcp�udp�sctp�dccpz)'%s' not from {'tcp'|'udp'|'sctp'|'dccp'})r r �INVALID_PROTOCOL��protocolr r r r s ���r c C s t �| �s ttj| ��d S r/ )r � checkProtocolr r r� r� r r r r s �r c C s$ t �| |�sttjd|| f ��d S )Nz '%s' is not valid %s address)r r r r � INVALID_ADDR)�ipv�addrr r r r s ��r ) rg �__all__�xml.saxr� �xml.sax.saxutilsr� r � collectionsr �firewallr r �firewall.errorsr �objectr � Exceptionrj rs r| r� r� r � XMLGeneratorr r r r r r r r r �<module> s( PK ���Z� �r r + core/io/__pycache__/service.cpython-310.pycnu �[��� o bhAb�. � @ s� g d �Z ddlmZ ddlZddlZddlZddlmZ ddlm Z m Z m Z m Z m Z mZmZ ddlmZ ddlmZ ddlmZ G dd � d e �ZG d d � d e �Zd d � Zddd�ZdS ))�Service�service_reader�service_writer� N)�config)� IO_Object�IO_Object_ContentHandler�IO_Object_XMLGenerator� check_port� check_tcpudp�check_protocol� check_address)�log)�errors)� FirewallErrorc s� e Zd Zdddddgfddgfdddifd dgfd dgfd dgfd dgff Zd dgZdddd�Zddgddgdgdgddgddgdgdgd�Z� fdd�Zd d � Zd d � Z � Z S ) r )�version� )�shortr )� descriptionr �ports)r r �modulesr � destination� protocols� source_ports�includes�helpers�_�-N)r r �service�namer �port�protocol�value�ipv4�ipv6r )r r r �moduler � source-port�include�helperc sN t t| ��� d| _d| _d| _g | _g | _g | _i | _ g | _ g | _ g | _ d S �Nr ) �superr �__init__r r r r r r r r r r ��self�� __class__� �:/usr/lib/python3/dist-packages/firewall/core/io/service.pyr* C s zService.__init__c C sh d| _ d| _d| _| jd d �= | jd d �= | jd d �= | j�� | jd d �= | j d d �= | j d d �= d S r( ) r r r r r r r �clearr r r r+ r/ r/ r0 �cleanupP s zService.cleanupc C s, |dkr$|D ]}|d dkrt |d � t|d � qt|d � qd S |dkr3|D ]}t|� q*d S |dkrJ|D ]}t |d � t|d � q9d S |dkrh|D ]}|dvr^ttjd | ��t||| � qPd S |d kr�|D ]%}|�d �r�|�d d�}d |v r�|�d d �}t |�dk r�ttj |��qnd S d S )Nr r r � r r r �r" r# z'%s' not in {'ipv4'|'ipv6'}r � nf_conntrack_r r � ) r r r r r �INVALID_DESTINATIONr � startswith�replace�len�INVALID_MODULE) r, r �item� all_config�all_io_objectsr �protor r$ r/ r/ r0 � _check_config\ sJ � � ���� ��zService._check_config) �__name__� __module__� __qualname__�IMPORT_EXPORT_STRUCTURE�ADDITIONAL_ALNUM_CHARS� PARSER_REQUIRED_ELEMENT_ATTRS� PARSER_OPTIONAL_ELEMENT_ATTRSr* r2 r@ � __classcell__r/ r/ r- r0 r % s: � �� r c @ s e Zd Zdd� ZdS )�service_ContentHandlerc C s< t �| ||� | j�||� |dkr,d|v r t�d|d � d|v r*|d | j_d S d S |dkr2d S |dkr8d S |dkr�|d dkrrt|d � t|d � |d |d f}|| jj vre| jj � |� d S t�d |d |d � d S t |d � |d | jj vr�| jj � |d � d S t�d |d � d S |d kr�t |d � |d | jj vr�| jj � |d � d S t�d |d � d S |d kr�t|d � t|d � |d |d f}|| jj vr�| jj � |� d S t�d|d |d � d S |dk�r dD ]$}||v �rt||| � || jjv �rt�d|� q�|| | jj|< q�d S |dk�rV|d }|�d��r>|�dd�}d|v �r>|�dd�}|| jjv�rN| jj� |� d S t�d|� d S |dk�ry|d | jjv�ro| jj� |d � d S t�d|d � d S |dk�r�|d | jjv�r�| jj� |d � d S t�d|d � d S d S )Nr r z'Ignoring deprecated attribute name='%s'r r r r r r z#Port '%s/%s' already set, ignoring.z$Protocol '%s' already set, ignoring.r! r% z)SourcePort '%s/%s' already set, ignoring.r r4 z2Destination address for '%s' already set, ignoringr$ r5 r r z"Module '%s' already set, ignoring.r& z#Include '%s' already set, ignoring.r' z"Helper '%s' already set, ignoring.)r � startElementr< �parser_check_element_attrsr �warningr r r r �appendr r r r r r8 r9 r r r )r, r �attrs�entry�xr$ r/ r/ r0 rJ � s� �� � � � � ��� � � ��z#service_ContentHandler.startElementN)rA rB rC rJ r/ r/ r/ r0 rI � s rI c C s t � }| �d�sttjd| ��| d d� |_|�|j� | |_||_|� t j �r+dnd|_ |j |_ t|�}t�� }|�|� d|| f }t|d��4}t�d �}|�|� z|�|� W n tjys } z ttjd|�� ��d }~ww W d � ~~|S 1 s�w Y ~~|S ) Nz.xmlz'%s' is missing .xml suffix���FT�%s/%s�rbz not a valid service file: %s)r �endswithr r � INVALID_NAMEr � check_name�filename�pathr8 r � ETC_FIREWALLD�builtin�defaultrI �sax� make_parser�setContentHandler�open� InputSource� setByteStream�parse�SAXParseException�INVALID_SERVICE� getException) rW rX r �handler�parserr �f�source�msgr/ r/ r0 r � sJ � ����� � � r c C sJ |r|n| j }| jrd|| jf }nd|| jf }tj �|�rCz t�|d| � W n tyB } z t� d||� W Y d }~nd }~ww tj � |�}|� t j �ritj �|�sitj �t j �sct�t j d� t�|d� tj|ddd�}t|�}|�� i }| jr�| jd kr�| j|d < |�d |� |�d � | jr�| jd kr�|�d � |�di � |�| j� |�d� |�d � | jr�| jd kr�|�d � |�di � |�| j� |�d� |�d � | jD ]} |�d � |�d| d | d d�� |�d � q�| j D ]} |�d � |�dd| i� |�d � q�| j D ]} |�d � |�d| d | d d�� |�d � �q| j D ]} |�d � |�dd| i� |�d � �q/t | j �dk�r^|�d � |�d| j � |�d � | j!D ]} |�d � |�dd | i� |�d � �qa| j"D ]} |�d � |�dd| i� |�d � �qz|�d � |�d � |�#� |�$� ~d S ) NrR z %s/%s.xmlz%s.oldz Backup of file '%s' failed: %si� �wtzUTF-8)�mode�encodingr r r � z r r r r r3 )r r r r! r% r$ r r r& r' )%rX rW r �os�exists�shutil�copy2� Exceptionr �error�dirnamer8 r rY �mkdir�ior_ r � startDocumentr rJ �ignorableWhitespacer � characters� endElementr r � simpleElementr r r r: r r r � endDocument�close)r rX �_pathr rj �dirpathrh rf rN r r r$ r& r' r/ r/ r0 r � s� �� � r )N)�__all__�xml.saxr\ ro rw rq �firewallr �firewall.core.io.io_objectr r r r r r r �firewall.core.loggerr r �firewall.errorsr r rI r r r/ r/ r/ r0 �<module> s $ ]Q PK ���Z���� � * core/io/__pycache__/helper.cpython-310.pycnu �[��� o bhAb> � @ s� g d �Z ddlmZ ddlZddlZddlZddlmZ ddlm Z m Z m Z m Z m Z ddlmZ ddlmZ ddlmZ G dd � d e �ZG d d � d e �Zd d � Zddd�ZdS ))�Helper� helper_reader� helper_writer� N)�config)� IO_Object�IO_Object_ContentHandler�IO_Object_XMLGenerator� check_port� check_tcpudp)�log)�errors)� FirewallErrorc sv e Zd ZdddddddgffZdZd d gZd d d gd �Zg d�ddgd�Z� fdd�Zdd� Z dd� Z dd� Z � Z S )r )�version� )�shortr )� descriptionr )�familyr )�moduler �ports)r r z (sssssa(ss))�-�.Nr )r r �helper)�namer r �port�protocol)r r c s6 t t| ��� d| _d| _d| _d| _d| _g | _d S �Nr ) �superr �__init__r r r r r r ��self�� __class__� �9/usr/lib/python3/dist-packages/firewall/core/io/helper.pyr : s zHelper.__init__c C s. d| _ d| _d| _d| _d| _| jd d �= d S r )r r r r r r r r" r" r# �cleanupC s zHelper.cleanupc C s( ddg}||vrt tjd||f ��d S )N�ipv4�ipv6z'%s' not in '%s')r r � INVALID_IPV)r �ipv�ipvsr" r" r# � check_ipvK s ��zHelper.check_ipvc C s| |dkr|D ]}t |d � t|d � qd S |dkr:|�d�s(ttjd| ��t|�dd��dk r<ttjd| ��d S d S ) Nr r � r � nf_conntrack_�('%s' does not start with 'nf_conntrack_'r �Module name '%s' too short)r r � startswithr r �INVALID_MODULE�len�replace)r r �item� all_config�all_io_objectsr r" r" r# � _check_configQ s" � ���zHelper._check_config) �__name__� __module__� __qualname__�IMPORT_EXPORT_STRUCTURE�DBUS_SIGNATURE�ADDITIONAL_ALNUM_CHARS� PARSER_REQUIRED_ELEMENT_ATTRS� PARSER_OPTIONAL_ELEMENT_ATTRSr r$ r* r6 � __classcell__r" r" r r# r % s* ��� r c @ s e Zd Zdd� ZdS )�helper_ContentHandlerc C sJ t �| ||� | j�||� |dkrcd|v r |d | j_d|v r.| j�|d � |d | j_d|v ra|d �d�sCtt j d|d ��t |d � dd��dk rYtt j d |d ��|d | j_ d S d S |d krid S |d krod S |d kr�t|d � t|d � |d |d f}|| jjvr�| jj�|� d S t�d|d |d � d S d S )Nr r r r r, r- r r+ r. r r r r z#Port '%s/%s' already set, ignoring.)r � startElementr3 �parser_check_element_attrsr r* r r/ r r r0 r1 r2 r r r r �appendr �warning)r r �attrs�entryr" r" r# rA b sJ �� �� ��z"helper_ContentHandler.startElementN)r7 r8 r9 rA r" r" r" r# r@ a s r@ c C s t � }| �d�sttjd| ��| d d� |_|�|j� | |_||_|� t j �r+dnd|_ |j |_ t|�}t�� }|�|� d|| f }t|d��4}t�d �}|�|� z|�|� W n tjys } z ttjd|�� ��d }~ww W d � ~~|S 1 s�w Y ~~|S ) Nz.xmlz'%s' is missing .xml suffix���FT�%s/%s�rbznot a valid helper file: %s)r �endswithr r � INVALID_NAMEr � check_name�filename�pathr/ r � ETC_FIREWALLD�builtin�defaultr@ �sax� make_parser�setContentHandler�open� InputSource� setByteStream�parse�SAXParseException�INVALID_HELPER� getException) rM rN r �handler�parserr �f�source�msgr" r" r# r � sJ � ����� � � r c C s: |r|n| j }| jrd|| jf }nd|| jf }tj �|�rCz t�|d| � W n tyB } z t� d||� W Y d }~nd }~ww tj � |�}|� t j �ritj �|�sitj �t j �sct�t j d� t�|d� tj|ddd�}t|�}|�� i }| j|d < | jr�| jd kr�| j|d < | jr�| jd kr�| j|d < |�d |� |�d� | jr�| jd kr�|�d� |�di � |�| j� |�d� |�d� | jr�| jd kr�|�d� |�di � |�| j� |�d� |�d� | j D ]} |�d� |� d| d | d d�� |�d� q�|�d � |�d� |� � |� � ~d S )NrH z %s/%s.xmlz%s.oldz Backup of file '%s' failed: %si� �wtzUTF-8)�mode�encodingr r r r r � z r r r r r+ )r r ) rN rM r �os�exists�shutil�copy2� Exceptionr �error�dirnamer/ r rO �mkdir�iorU r � startDocumentr r r rA �ignorableWhitespacer � characters� endElementr r � simpleElement� endDocument�close) r rN �_pathr r` �dirpathr^ r\ rE r r" r" r# r � s` �� r )N)�__all__�xml.saxrR re rm rg �firewallr �firewall.core.io.io_objectr r r r r �firewall.core.loggerr r �firewall.errorsr r r@ r r r" r" r" r# �<module> s <# PK ���Z���<J( J( ) core/io/__pycache__/ipset.cpython-310.pycnu �[��� o bhAb"P � @ s� d Z g d�ZddlmZ ddlZddlZddlZddlmZ ddl m Z m Z m Z m Z mZmZmZmZ ddlmZmZmZ ddlmZmZ ddlmZmZm Z m Z dd l m Z dd lm Z dd l!m"Z" G d d � d e�Z#G dd� de�Z$dd� Z%ddd�Z&dS )z$ipset io XML handler, reader, writer)�IPSet� ipset_reader� ipset_writer� N)�config)�checkIP�checkIP6� checkIPnMask� checkIP6nMask� check_mac� check_port�checkInterface� checkProtocol)� IO_Object�IO_Object_ContentHandler�IO_Object_XMLGenerator)� IPSET_TYPES�IPSET_CREATE_OPTIONS)�check_icmp_name�check_icmp_type�check_icmpv6_name�check_icmpv6_type)�log)�errors)� FirewallErrorc s� e Zd ZdddddddifddgffZdZg d �Zd d d gd gd d �Zdgdgd�Z� fdd�Zdd� Z e dd� �Z dd� Z � fdd�Z � ZS )r )�version� )�shortr )� descriptionr )�typer �optionsr �entriesz (ssssa{ss}as))�_�-�:�.Nr �name)r r �ipset�option�entryr �value)r& r' c s< t t| ��� d| _d| _d| _d| _g | _i | _d| _ d S �Nr F) �superr �__init__r r r r r r �applied��self�� __class__� �8/usr/lib/python3/dist-packages/firewall/core/io/ipset.pyr, C s zIPSet.__init__c C s8 d| _ d| _d| _d| _| jd d �= | j�� d| _d S r* )r r r r r r �clearr- r. r2 r2 r3 �cleanupM s z IPSet.cleanupc C s� d}d|v r|d dkrd}|� d�sttjd| ��|dd � �d�}| �d�}t|�t|�ks7t|�d k rAttjd | |f ��tt|��D �]�}|| }|| }|d kr�d |v r�|dkr�|d krmttjd || |f ��|�d �} t| �dkr�ttjd|| ||f ��| D ] } |dkr�t| �r�|dkr�t | �s�ttjd| | ||f ��q�qG|dkr�|dkr�ttjd|| ||f ��|dkr�t } nt} nt } | |�s�ttjd|| ||f ��qG|dk�r�d |v �rE|�d �} t| �dkr�ttjd|| ||f ��|dk�rt| d ��r|dk�r t | d ��s ttjd| d | ||f ��|dk�r*t | d ��r6|dk�rDt | d ��sDttjd| d | ||f ��qG|� d��rf|dk�rZ|dk�rZ|dk�sfttjd|| ||f ��|dk�rpt |��rz|dk�r�t |��s�ttjd|| ||f ��qG|dk�r�t |��r�|dk�r�ttjd|| f ��qG|dk�r_d|v �rO|�d�} t| �dk�r�ttjd| ��| d d k�r�|dk�r�ttjd || f ��t| d ��s�t| d ��s�ttjd | d | f ��qG| d d v �r!|dk�rttjd || f ��t| d ��s t| d ��s ttjd | d | f ��qG| d d!v�r;t| d ��s;ttjd"| d | f ��t| d ��sNttjd#| d | f ��qGt|��s^ttjd$|| f ��qG|d%k�r�|� d&��r�zt|d'�} W n+ t�y� ttjd(|| f ��w zt|�} W n t�y� ttjd(|| f ��w | dk �s�| d)k�r�ttjd(|| f ��qG|d*k�r�t|��r�t|�d+k�r�ttjd,|| f ��qGttjd| ��d S )-N�ipv4�family�inet6�ipv6zhash:zipset type '%s' not usable� �,� z)entry '%s' does not match ipset type '%s'�ipr" z invalid address '%s' in '%s'[%d]� z.invalid address range '%s' in '%s' for %s (%s)z(invalid address '%s' in '%s' for %s (%s)z0.0.0.0r �netz/0zhash:net,iface�macz00:00:00:00:00:00z invalid mac address '%s' in '%s'�portr# zinvalid port '%s'�icmpz(invalid protocol for family '%s' in '%s'z invalid icmp type '%s' in '%s')�icmpv6z ipv6-icmpz invalid icmpv6 type '%s' in '%s')�tcp�sctp�udp�udplitez invalid protocol '%s' in '%s'zinvalid port '%s'in '%s'zinvalid port '%s' in '%s'�mark�0x� zinvalid mark '%s' in '%s'l �� �iface� z invalid interface '%s' in '%s')� startswithr r � INVALID_IPSET�split�len� INVALID_ENTRY�ranger r r r �endswithr r r r r r r �int� ValueErrorr ) r( r � ipset_typer7 �flags�items�i�flag�item�splits�_split�ip_check�int_valr2 r2 r3 � check_entryV s� � ���� �� ���� �� ��� ������� �� ��� �� � �� � ��� �� � ��� ����� �� �� �� �� ��� ��zIPSet.check_entryc C s� |dkr|t vrttjd| ��|dkrj|�� D ]S}|tvr&ttjd| ��|dv rWzt|| �}W n tyE ttj d||| f ��w |dk rVttj d||| f ��q|d kri|| d vrittj || ��qd S d S ) Nr z '%s' is not valid ipset typer zipset invalid option '%s'��timeout�hashsize�maxelem�)Option '%s': Value '%s' is not an integerr �#Option '%s': Value '%s' is negativer7 ��inetr8 ) r r r � INVALID_TYPE�keysr rN rT rU � INVALID_VALUE�INVALID_FAMILY)r/ r r[ � all_config�all_io_objects�key� int_valuer2 r2 r3 � _check_config sH � � ��� ��� ��zIPSet._check_configc sp d|d v r|d d dkrt |d �dkrttj��|d D ] }t�||d |d � q tt| ��||� d S )Nrb � �0r: r � )rP r r �IPSET_WITH_TIMEOUTr r` r+ � import_config)r/ r rn r( r0 r2 r3 rv ' s zIPSet.import_config)�__name__� __module__� __qualname__�IMPORT_EXPORT_STRUCTURE�DBUS_SIGNATURE�ADDITIONAL_ALNUM_CHARS� PARSER_REQUIRED_ELEMENT_ATTRS� PARSER_OPTIONAL_ELEMENT_ATTRSr, r5 � staticmethodr` rq rv � __classcell__r2 r2 r0 r3 r , s4 ��� 6r c @ s e Zd Zdd� Zdd� ZdS )�ipset_ContentHandlerc C s� t �| ||� | j�||� |dkr:d|v r,|d tvr&ttjd|d ��|d | j_d|v r8|d | j_ d S d S |dkr@d S |dkrFd S |dkr�d}d |v rT|d }|d d vrdttj d |d ��| jjd kr~|d dv r~ttj d|d | jjf ��|d d v r�|s�ttj d|d ��|d dv r�zt |�}W n t y� ttj d|d |f ��w |dk r�ttj d|d |f ��|d dkr�|dvr�ttj|��|d | jjvr�|| jj|d < d S t�d|d � d S d S )Nr& r z%sr r r r' r r) r% )r7 rb rc rd zUnknown option '%s'zhash:mac)r7 z%Unsupported option '%s' for type '%s'z&Missing mandatory value of option '%s'ra re r rf r7 rg z Option %s already set, ignoring.)r � startElementr[ �parser_check_element_attrsr r r ri r r �INVALID_OPTIONrT rU rk rl r r �warning)r/ r% �attrsr) rp r2 r2 r3 r� 2 s~ �� ��� � � ��� �� �z!ipset_ContentHandler.startElementc C s, t �| |� |dkr| jj�| j� d S d S )Nr( )r � endElementr[ r �append�_element)r/ r% r2 r2 r3 r� i s �z ipset_ContentHandler.endElementN)rw rx ry r� r� r2 r2 r2 r3 r� 1 s 7r� c C s t � }| �d�sttjd| ��| d d� |_|�|j� | |_||_|� t j �r+dnd|_ |j |_ t|�}t�� }|�|� d|| f }t|d��1}t�d �}|�|� z|�|� W n tjys } z ttjd|�� ��d }~ww W d � n1 s~w Y ~~d |jv r�|jd d kr�t|j�d kr�t � d |j� |jd d �= d } t � } | t|j�k �r |j| | v r�t � d |j| � |j� | � n9z|� |j| |j|j!� W n ty� } zt � d| � |j� | � W Y d } ~ nd } ~ ww | �"|j| � | d7 } | t|j�k s�~ |S )Nz.xmlz'%s' is missing .xml suffix���FT�%s/%s�rbznot a valid ipset file: %srb rs r z6ipset '%s': timeout option is set, entries are ignoredz Entry %s already set, ignoring.z %s, ignoring.r< )#r rS r r � INVALID_NAMEr% � check_name�filename�pathrM r � ETC_FIREWALLD�builtin�defaultr� �sax� make_parser�setContentHandler�open� InputSource� setByteStream�parse�SAXParseExceptionrN � getExceptionr rP r r r� �set�popr` r �add) r� r� r& �handler�parserr% �f�source�msgrY � entries_set�er2 r2 r3 r n sp � ����� � � ��� r c C sx |r|n| j }| jrd|| jf }nd|| jf }tj �|�rCz t�|d| � W n tyB } z t� d||� W Y d }~nd }~ww tj � |�}|� t j �ritj �|�sitj �t j �sct�t j d� t�|d� tj|ddd�}t|�}|�� d | ji}| jr�| jd kr�| j|d < |�d |� |�d � | jr�| jd kr�|�d� |�di � |�| j� |�d� |�d � | jr�| jd kr�|�d� |�di � |�| j� |�d� |�d � | j� � D ]$\} } |�d� | d kr�|� d| | d�� n|� dd| i� |�d � q�| j D ] } |�d� |�di � |�| � |�d� |�d � �q |�d � |�d � |� � |� � ~d S )Nr� z %s/%s.xmlz%s.oldz Backup of file '%s' failed: %si� �wtzUTF-8)�mode�encodingr r r r& � z r r r' )r% r) r% r( )!r� r� r% �os�exists�shutil�copy2� Exceptionr �error�dirnamerM r r� �mkdir�ior� r � startDocumentr r r� �ignorableWhitespacer � charactersr� r r rX � simpleElementr � endDocument�close) r& r� �_pathr% r� �dirpathr� r� r� ro r) r( r2 r2 r3 r � sj �� r )N)'�__doc__�__all__�xml.saxr� r� r� r� �firewallr �firewall.functionsr r r r r r r r �firewall.core.io.io_objectr r r �firewall.core.ipsetr r �firewall.core.icmpr r r r �firewall.core.loggerr r �firewall.errorsr r r� r r r2 r2 r2 r3 �<module> s( ( =3PK ���Z�$8��] �] * core/io/__pycache__/policy.cpython-310.pycnu �[��� o bhAb�� � @ s g d �Z ddlmZ ddlZddlZddlZddlmZ ddlm Z m Z m Z m Z m Z mZmZmZ ddlmZmZmZ ddlmZmZmZmZmZmZ ddl m Z ddl m Z dd lm Z dd l!m"Z" d d � Z#d d� Z$dd� Z%dd� Z&G dd� de�Z'G dd� de�Z(d dd�Z)d dd�Z*dS ) )�Policy� policy_reader� policy_writer� N)�config)�checkIP�checkIP6� checkUINT16�coalescePortRange�max_policy_name_len�portInPortRange�portStr�uniqify)�DEFAULT_POLICY_TARGET�POLICY_TARGETS�DEFAULT_POLICY_PRIORITY)� IO_Object�IO_Object_ContentHandler�IO_Object_XMLGenerator� check_port� check_tcpudp�check_protocol)�rich)�log)�errors)� FirewallErrorc s� |dkr dS |dkr dS |dkrO| j r2| j jr't�dt| j �� d| _dS t�� d �| j _dS � d | jj vrE| jj � � d � dS t�d� d � dS |dk�r| j rw| j jrit�dt| j �� d| _dS t� � d � d �| j _dS t � d � t � d � t� d d �� d f}tt� fd d �| jj��}|D ].}t|d |d �r�t| jt�r�| jjn| jj}t�ttjd|d � d |f �� dS q�t|d dd� |D ��\}}|D ]} t| d �� d f} | jj�| � q�|D ]} t| d �� d f} | jj� | � q�dS |d k�rQ| j �r-| j j�r"t�dt| j �� d| _dS t� � d �| j _dS t � d � � d | jj v�rG| jj � � d � dS t�d� d � dS |dk�r�| j �r�| j j�rmt�dt| j �� d| _dS d} d� v �rx� d } t� | �| j _dS t�d� d � dS |dk�r�| j �r�| j j�r�t�dt| j �� d| _dS t� � d �| j _dS � d | jj!v�r�| jj!� � d � dS t�d� d � dS |dk�r| j �r�| j j�r�t�dt| j �� d| _dS t�"� d �| j _dS t�d� d � dS |dk�r7| j �r%| j j�r t�dt| j �� d| _dS t�#� | j _dS | jj$�r1t�d� dS d| j_$dS |d k�r�d } d � v �rG� d } d } d � v �rR� d } | j �ry| j j�rit�dt| j �� d| _dS t�%� d � d | | �| j _dS t � d � t � d � | �r�t | � | �r�t&| ��s�t'| ��s�ttj(d | ��t� d d �� d t| d �t| �f} | | jj)v�r�| jj)� | � dS t�d!� d � d | �r�d"| nd | �r�d#| nd � dS |d$k�r�| j �r | j j�r�t�dt| j �� d| _dS t�*� d � d �| j _dS t � d � t � d � t� d d �� d f}tt� fd%d �| jj+��}|D ]1}t|d |d ��r`t| jt��rG| jjn| jj}t�ttjd|d � d |f �� dS �q0t|d d&d� |D ��\}}|D ]} t| d �� d f} | jj+�| � �qr|D ]} t| d �� d f} | jj+� | � �q�dS |d'k�r�| j �s�t�d(� d| _dS | j j,�r�t�d)t| j �� dS d*}d }d+� v �rΈ d+ }d }d,� v �rو d, }d-� v �r� d- �-� d.v �r�d}t�.|||�| j _,dS |d/v �r]| j �st�d0� d| _dS | j j/�rt�d1� d| _dS |d2k�r"t�0� | j _/n4|d3k�r:d }d4� v �r2� d4 }t�1|�| j _/n |d5k�rFt�2� | j _/n|d6k�rV� d7 }t�3|�| j _/| j j/| _4dS |d8k�r�| j �smt�d9� dS | j j�ryt�d:� dS d }d;� v �r�� d; }|d<v�r�t�d=� d| _dS d }d>� v �r�� d> }|�r�t5|�d?k�r�t�d@� d| _dS t�6||�| j _| j j| _4dS |dAk�r@| j �s�t�d9� dS | j j�r�t�d:� dS d }dB� v �r�� dB }t7|��s�t�dC� d| _dS d }d>� v �r� d> }|�r t5|�d?k�rt�dD� d| _dS d }dE� v �r0� dE }t7|��s0t�dF� d| _dS t�8|||�| j _| j j| _4dS |dGk�rp| j �sPt�dH� dS | j j9�rct�dIt| j �� d| _dS t�:� | j _9| j j9| _4dS |dJk�r�d }d }dK� v �r�� dK }|dLv�r�t�dM� dK � d| _dS dN� v �r�t;� dN �}tj<||dO�| _ dS |dPk�r�| j4�s�t�dQ� d| _dS | j4j=�r�t�dRt| j �� d| _dS � d }t�>|�| j4_=dS d*S )SN�short� description�servicez;Invalid rule: More than one element in rule '%s', ignoring.T�namez#Service '%s' already set, ignoring.�port�protocol�-c � | d � d kS �N� r � ��x��attrsr% �9/usr/lib/python3/dist-packages/firewall/core/io/policy.py�<lambda>E � z%common_startElement.<locals>.<lambda>r z'%s:%s' already in '%s'c S � g | ]\}}|�qS r% r% ��.0�_port� _protocolr% r% r* � <listcomp>O � z'common_startElement.<locals>.<listcomp>�valuez$Protocol '%s' already set, ignoring.� tcp-mss-clamp�pmtuz0Invalid rule: tcp-mss-clamp '%s' outside of rule� icmp-blockz&icmp-block '%s' already set, ignoring.� icmp-typez-Invalid rule: icmp-block '%s' outside of rule� masqueradez!Masquerade already set, ignoring.� forward-port� �to-port�to-addrz#to-addr '%s' is not a valid addressz-Forward port %s/%s%s%s already set, ignoring.z >%sz @%s� source-portc r" r# r% r& r( r% r* r+ � r, c S r- r% r% r. r% r% r* r2 � r3 � destinationz)Invalid rule: Destination outside of rulez?Invalid rule: More than one destination in rule '%s', ignoring.F�address�ipset�invert��yes�true)�accept�reject�drop�markz$Invalid rule: Action outside of rulez"Invalid rule: More than one actionrF rG �typerH rI �setr z!Invalid rule: Log outside of rulez Invalid rule: More than one log�level)�emerg�alert�crit�error�warning�notice�info�debugz Invalid rule: Invalid log level�prefix� z Invalid rule: Invalid log prefix�nflog�groupz'Invalid rule: Invalid nflog group valuez"Invalid rule: Invalid nflog prefix� queue-sizez&Invalid rule: Invalid nflog queue-size�auditz#Invalid rule: Audit outside of rulez9Invalid rule: More than one audit in rule '%s', ignoring.�rule�family)�ipv4�ipv6z&Invalid rule: Rule family "%s" invalid�priority)r\ r_ �limitz4Invalid rule: Limit outside of action, log and auditz9Invalid rule: More than one limit in rule '%s', ignoring.)?�_rule�elementr rQ �str� _rule_errorr � Rich_Service�item�services�append� Rich_Portr r r �list�filter�portsr � isinstancer �derived_from_zoner r r �ALREADY_ENABLEDr �remove� Rich_Protocolr � protocols�Rich_Tcp_Mss_Clamp�Rich_IcmpBlock� icmp_blocks� Rich_IcmpType�Rich_Masquerader9 �Rich_ForwardPortr r � INVALID_ADDR� forward_ports�Rich_SourcePort� source_portsr? �lower�Rich_Destination�action� Rich_Accept� Rich_Reject� Rich_Drop� Rich_Mark� _limit_ok�len�Rich_Logr � Rich_NFLogrZ � Rich_Audit�int� Rich_Ruler` � Rich_Limit)�objr r) � new_port_id�existing_port_ids�port_id�_name� added_ranges�removed_ranges�_range�entry�_value�to_port�to_addrrB r@ rA �_type�_setrL rU rX � thresholdr\ r_ r4 r% r( r* �common_startElement! sL W � �� U � ��� I � ��� G � � �� � � . � �� $ � � � � � � � � ��� � � � � � ��� � � � � x ��� v � � �� i � � � _ � � \ �� Z � � � � ��� 9 �� � 7 � � � � � �� � � � �| � c � J � + � � � � � ��r� c C s� |dkrX| j sPz| j�� W n ty* } zt�d|t| j�� W Y d }~n*d }~ww t| j�| jjvrG| jj � | j� | jj� t| j�� n t�dt| j�� d | _d| _ d S |dv rad | _ d S d S )Nr[ z%s: %sz Rule '%s' already set, ignoring.F)rF rG rH rI r rZ ) rd ra �check� Exceptionr rQ rc rf � rules_str�rulesrh r� )r� r �er% r% r* �common_endElementz s& ��� �r� c C s2 t | t�rdnd}|dkr,d|v r,|d }|D ]}||vr)ttjd�|| j|���qd S |dkrC|D ]}t|d � t|d � q2d S |dkrR|D ]} t | � qId S |d kr�d |v r�|d } |D ]%} | | vr�ttj d �|| j| ��} | |� d i �v r�t � d �| �� q`| �q`d S |dkr�|D ]J} t| d � t| d � | d s�| d s�ttjd�|| j| ���| d r�t| d � | d r�t| d �s�t| d �s�ttjd�|| j| d ���q�d S |dkr�|D ]}t|d � t|d � q�d S |dv �r�|D ]�}tj|d�}|j�r�d |v �r�t |jtj��st |jtj��r�|d } |jj| v�rIttj d �|| j|jj��} |jj|� d i �v �rGt � d �| �� q�| �|j�r�|d |jj }|j�r�|j|jv�r�ttj d�|| j|j|jj��} |� d i �� |jj�}|�r�|j�r�|j|jv �r�t � d �| �� q�| �q�d S d S )Nr �Zonerg z){} '{}': '{}' not among existing servicesrl r r$ rr ru � icmptypesz+{} '{}': '{}' not among existing ICMP types�icmptypes_unsupportedz{} (unsupported)rz � � z-{} '{}': '{}' is missing to-port AND to-addr z,{} '{}': to-addr '{}' is not a valid addressr| )r� � rich_rules��rule_strz<{} '{}': rich rule family '{}' conflicts with icmp type '{}')rm r r r �INVALID_SERVICE�formatr r r r �INVALID_ICMPTYPE�getr �debug1�INVALID_FORWARDr r ry r r� rb rt rv r\ r? )r� r rf � all_config�all_io_objects�obj_type�existing_servicesr r �proto�existing_icmptypes�icmptype�ex�fwd_portr[ �obj_rich�ict�ict_unsupportedr% r% r* �common_check_config� s� ���� � ����� �� ���� � � � ������r� c C s� | j r#| j dkr#|�d� |�di � |�| j � |�d� |�d� | jrF| jdkrF|�d� |�di � |�| j� |�d� |�d� t| j�D ]}|�d� |�dd|i� |�d� qKt| j �D ]}|�d� |�d|d |d d �� |�d� qet| j �D ]}|�d� |�d d |i� |�d� q�t| j �D ]}|�d� |�dd|i� |�d� q�| j r�|�d� |�di � |�d� t| j �D ];}|�d� |d |d d �}|d r�|d dkr�|d |d< |d r�|d dkr�|d |d< |�d|� |�d� q�t| j�D ]}|�d� |�d|d |d d �� |�d� �q | jD �]'}i }|j�r8|j|d< |jd k�rEt|j�|d< |�d� |�d|� |�d� |j�r�i }|jj�rf|jj|d< |jj�rq|jj|d< |jj�r||jj|d< |jj�r�d |d < |�d � |�d |� |�d� |j�r�i }|jj�r�|jj|d< |jj�r�|jj|d< |jj�r�d |d < |�d � |�d |� |�d� |j�r�d} i }t|j�tj k�r�d} |jj |d< n�t|j�tj k�r�d} |jj |d< |jj |d < n�t|j�tj!k�rd } |jj"|d < n�t|j�tj#k�r d!} |jj"|d < n�t|j�tj$k�r,d} nyt|j�tj%k�r>d} |jj |d< ngt|j�tj&k�rPd"} |jj |d< nUt|j�tj'k�r�d} |jj |d< |jj |d < |jj(dk�rt|jj(|d< |jj)dk�r�|jj)|d< n#t|j�tj*k�r�d} |jj |d< |jj |d < n t+t,j-d#t|j� ��|�d � |�| |� |�d� |j.�rtt|j.�tj/k�ri }|j.j0�r�|j.j0|d$< |j.j1�r�|j.j1|d%< |j.j2�r|�d � |�d&|� |�d'� |�d(d |j.j2j"i� |�d)� |�d&� n |�d � |�d&|� |�d� n^i }|j.j3�r#|j.j3|d*< |j.j0�r.|j.j0|d$< |j.j4�r9|j.j4|d+< |j.j2�rd|�d � |�d,|� |�d'� |�d(d |j.j2j"i� |�d)� |�d,� n |�d � |�d,|� |�d� |j5�r�i }|j5j2�r�|�d � |�d-i � |�d'� |�d(d |j5j2j"i� |�d)� |�d-� n |�d � |�d-|� |�d� |j6�rBd} i }t|j6�tj7k�r�d.} n>t|j6�tj8k�r�d/} |j6j�r�|j6j|d0< n't|j6�tj9k�r�d1} nt|j6�tj:k�r�d2} |j6j;|d3< n t.�<d4t|j6�� |j6j2�r2|�d � |�| |� |�d'� |�d(d |j6j2j"i� |�d)� |�| � n |�d � |�| |� |�d� |�d� |�d� |�d� �q*d S )5Nr; � r � r r r r r r$ )r r r r4 r7 r9 r� r< r� r= r: r> r\ r_ r[ r@ �macrA �TruerB z �sourcer? r5 r8 z"Unknown element '%s' in obj_writerrU rL r z r` z rX rY rW rZ rF rG rJ rH rI rK zUnknown action '%s')=r �ignorableWhitespace� startElement� characters� endElementr r rg � simpleElementrl rr ru r9 rz r| r� r\ r_ rc r� �addrr� rA rB r? rb rJ r re r ri r r rq r4 rs rw rt rv rx r� � to_addressr{ r r �INVALID_OBJECTr r� rU rL r` rX r� rZ r r� r� r� r� rK rQ ) r� �handlerr r r �icmp�forwardr) r[ rb r r% r% r* � common_writer� s� � � � � � � � � ��r� c s� e Zd ZdZdZeZdgZdddddd gfd d gfd d gfd ddgfdd gfdd gfdd gfddd gfdd gffZg d�Z i dd�dd�ddg�d d g�d d d g�d d g�d!d g�d"d�d#d d g�d$d�d%d�d&d�d d'g�d(d d g�d)d�d*d�d+d�dddd,gd'gd gd gd-��Z d.d/gd0d1gd2d/gg d3�g d4�d5d6gg d7�d8gd'gd9� Z � fd:d;�Z d<d=� Z � fd>d?�Z� fd@dA�ZdBdC� Z� fdDdE�Z� ZS )Fr i ���i� r )�versionr; )r r; )r r; )�targetr; rg r; rl )r; r; ru )r9 Frz )r; r; r; r; r� rr r| )r_ r � ingress_zones� egress_zones)�_r! �/r Nr �policyr� r r r r r7 r8 r9 r: r[ r� r? r4 r> r rW rZ rK )rF rG rH rI r` � ingress-zone� egress-zoner� r_ r< r= r\ )r@ r� rB r\ rA )r@ rB rA rU rL )rX rU rY rJ ) r� r: r[ r� r? r rW rG r5 c s� t t| ��� d| _d| _d| _t| _g | _g | _ g | _ g | _ d| _ d| _ g | _g | _g | _g | _d| _| j| _d | _g | _g | _d S �Nr; F)�superr �__init__r� r r r r� rg rl rr ru �icmp_block_inversionr9 rz r| r� r� �applied�priority_defaultr_ rn r� r� ��self�� __class__r% r* r� s( zPolicy.__init__c C s� d| _ d| _d| _t| _| jd d �= | jd d �= | jd d �= | jd d �= d| _ d| _ | j d d �= | j d d �= | j d d �= | jd d �= d| _| j| _| jd d �= | jd d �= d S r� )r� r r r r� rg rl rr ru r� r9 rz r| r� r� r� r� r_ r� r� r� r% r% r* �cleanup" s$ zPolicy.cleanupc s |dkr| j S ttt| �|�S )Nr� )r� �getattrr� r �r� r r� r% r* � __getattr__6 s zPolicy.__getattr__c sD |dkrdd� |D �| _ dd� | j D �| _d S tt| ��||� d S )Nr� c S s g | ]}t j|d ��qS )r� )r r� �r/ �sr% r% r* r2 > s z&Policy.__setattr__.<locals>.<listcomp>c S s g | ]}t |��qS r% )rc r� r% r% r* r2 @ r3 )r� r� r� r � __setattr__)r� r r4 r� r% r* r� < s zPolicy.__setattr__c C s� t | ||||� | j|d v rttjd�| j���|dkr.|tvr,ttjd�| j|���d S |dkrT|| jv sA|| j ksA|| j k rRttj d�| j|| j | j | j���d S |dv r�dd gt |d � � � }|D ]a}||vrwttjd �| j|���|d vr�tdd g�t|�@ s�|d v r�t|�t|g� r�ttjd �| j|���|d kr�|d kr�d|v r�d |d v s�|dkr�d |v r�d |d v r�ttjd�| j���qfd S |dk�r1|�r1d|v r�d |d v r�ttjd�| j���d |v �r-d |d v r�ttjd�| j���|d D ]/}|dk�rq�||d v�rttjd�| j|���|d | j�r,ttjd�| j|���q�d S d S |dk�rk|D �]/}tj|d�}|j�r�t|jtj��r�d|v �rcd |d v �rcttjd�| j���d |v �r�d |d v �ryttjd�| j���|d D ]/}|dk�r��q}||d v�r�ttjd�| j|���|d | j�r�ttjd�| j|����q}�q8|j�r"t|jtj��r"d|v �r d |d v �r�|jj�r�ttjd�| j����q8|d �r |jj�s�ttjd�| j���d|d v�r |d D ](}||d v�r ttjd�| j|���|d | j�r ttjd�| j|����q��q8|j�rgt|jtj��rgd|v �rg|d D ]/}|d v �r@�q7||d v�rRttjd�| j|���|d | j�rettjd�| j|����q7�q8d S |dk�r�|D ]j} d|v �r�d |d v �r�| d �r�ttjd�| j����qr|d �r�| d �s�ttjd�| j���d|d v�r�|d D ](}||d v�r�ttjd�| j|���|d | j�r�ttjd�| j|����q��qrd S d S ) N�zonesz0Policy '{}': Can't have the same name as a zone.r� z#Policy '{}': '{}' is invalid targetr_ z^Policy '{}': {} is invalid priority. Must be in range [{}, {}]. The following are reserved: {})r� r� �ANY�HOSTz*Policy '{}': '{}' not among existing zones)r� r� zKPolicy '{}': '{}' may only contain one of: many regular zones, ANY, or HOSTr� r� zSPolicy '{}': 'HOST' can only appear in either ingress or egress zones, but not bothr9 z;Policy '{}': 'masquerade' is invalid for egress zone 'HOST'z<Policy '{}': 'masquerade' is invalid for ingress zone 'HOST'z&Policy '{}': Zone '{}' does not exist.z\Policy '{}': 'masquerade' cannot be used because ingress zone '{}' has assigned interfaces. r� r� zNPolicy '{}': A 'forward-port' with 'to-addr' is invalid for egress zone 'HOST'zPPolicy '{}': 'forward-port' requires 'to-addr' if egress zone is 'ANY' or a zonez[Policy '{}': 'forward-port' cannot be used because egress zone '{}' has assigned interfaceszZPolicy '{}': 'mark' action cannot be used because egress zone '{}' has assigned interfacesrz r� )r� r r r � NAME_CONFLICTr� r �INVALID_TARGET�priority_reserved� priority_max� priority_min�INVALID_PRIORITYrj �keys� INVALID_ZONErK � interfacesr r� rb rm rw rx r� r� r r� ) r� r rf r� r� �existing_zones�zoner[ r� r� r% r% r* � _check_configD s< � ����� �� ������ �� �� �� �� �� ��� �� �� ��� . ��� �� ���zPolicy._check_configc s� t t| ��|� |�d�rttjd�|���|�d�r$ttjd�|���|� d�dkr4ttjd�|���d|v rB|d |� d�� }n|}t |�t � krYttjd�|t |�t � ���d S )Nr� z&Policy '{}': name can't start with '/'z$Policy '{}': name can't end with '/'r$ z'Policy '{}': name has more than one '/'z)Policy '{}': name has {} chars, max is {}) r� r � check_name� startswithr r � INVALID_NAMEr� �endswith�count�findr� r )r� r � checked_namer� r% r* r� � s0 � �����zPolicy.check_name)�__name__� __module__� __qualname__r� r� r r� r� �IMPORT_EXPORT_STRUCTURE�ADDITIONAL_ALNUM_CHARS� PARSER_REQUIRED_ELEMENT_ATTRS� PARSER_OPTIONAL_ELEMENT_ATTRSr� r� r� r� r� r� � __classcell__r% r% r� r* r � s� ��������� � � � � ������� vr c @ s$ e Zd Zdd� Zdd� Zdd� ZdS )�policy_ContentHandlerc C s" t �| |� d | _d| _d | _d S )NF)r r� ra rd r� )r� rf r% r% r* r� � s z policy_ContentHandler.__init__c C s� t �| ||� | jr d S | j�||� t| ||�rd S |dkrSd|v r)|d | j_d|v r5t|d �| j_d|v rO|d }|t vrGt t j |��|rQ|| j_ d S d S d S |dkrt|d | jjvrj| jj�|d � d S t�d|d � d S |dkr�|d | jjvr�| jj�|d � d S t�d |d � d S |d kr�| js�t�d � d | _d S | jjr�t�d t| j�� d | _d S d}d|v r�|d �� dv r�d }d } }}d|v r�|d }d|v r�|d }d|v r�|d }tj||||d�| j_d S t�d|� d S )Nr� r� r_ r� r� r z(Ingress zone '%s' already set, ignoring.r� z'Egress zone '%s' already set, ignoring.r� z$Invalid rule: Source outside of ruleTz:Invalid rule: More than one source in rule '%s', ignoring.FrB rC r@ r� rA )rB zUnknown XML element '%s')r r� rd rf �parser_check_element_attrsr� r� r� r_ r r r r� r� r� rh r rQ r� ra r� rc r} r � Rich_Source)r� r r) r� rB r� r� rA r% r% r* r� � sn � � � z"policy_ContentHandler.startElementc C s t �| |� t| |� d S �N)r r� r� r� r% r% r* r� s z policy_ContentHandler.endElementN)r� r� r r� r� r� r% r% r% r* r � s @r Fc C s t � }| �d�sttjd| ��| d d� |_|s |�|j� | |_||_|� t j �r-dnd|_ |j |_ t|�}t�� }|�|� d|| f }t|d��4}t�d �}|�|� z|�|� W n tjyu } z ttjd| �� ��d } ~ ww W d � ~~|S 1 s�w Y ~~|S ) Nz.xmlz'%s' is missing .xml suffix���FT�%s/%s�rbznot a valid policy file: %s)r r� r r r� r r� �filename�pathr� r � ETC_FIREWALLD�builtin�defaultr �sax� make_parser�setContentHandler�open� InputSource� setByteStream�parse�SAXParseException�INVALID_POLICY� getException) r r � no_check_namer� r� �parserr �fr� �msgr% r% r* r sL � ����� � � r c C s� |r|n| j }| jrd|| jf }nd|| jf }tj �|�rCz t�|d| � W n tyB } z t� d||� W Y d }~nd }~ww tj � |�}|� t j �ritj �|�sitj �t j �sct�t j d� t�|d� tj|ddd�}t|�}|�� i }| jr�| jd kr�| j|d < | j| jkr�t| j�|d < | j|d < |�d |� |�d� t| |� t| j �D ]} |�d� |� dd| i� |�d� q�t| j �D ]} |�d� |� dd| i� |�d� q�|� d � |�d� |� � |�!� ~d S )Nr z %s/%s.xmlz%s.oldz Backup of file '%s' failed: %si� �wtzUTF-8)�mode�encodingr; r� r_ r� r� r� r� r� r r� )"r r r �os�exists�shutil�copy2r� r rP �dirnamer� r r �mkdir�ior r � startDocumentr� r_ r� rc r� r� r� r� r r� r� r� r� � endDocument�close) r� r �_pathr r �dirpathr r� r) r� r% r% r* r ; sR �� r )Fr )+�__all__�xml.saxr r# r) r% �firewallr �firewall.functionsr r r r r r r r �firewall.core.baser r r �firewall.core.io.io_objectr r r r r r � firewall.corer �firewall.core.loggerr r �firewall.errorsr r� r� r� r� r r r r r% r% r% r* �<module> s4 ( [L v L PK ���Z�*X�, �, * core/io/__pycache__/direct.cpython-310.pycnu �[��� o bhAb�< � @ s� d dl mZ d dlZd dlZd dlZd dlmZ d dlmZ d dl m Z m Z d dl m Z mZmZ d dlmZ d dlmZ d dlmZ d d lmZ d d lmZ G d d � d e�ZG d d� de �ZdS )� N)�config)�LastUpdatedOrderedDict)� splitArgs�joinArgs)� IO_Object�IO_Object_ContentHandler�IO_Object_XMLGenerator)�log)� ipXtables)�ebtables)�errors)� FirewallErrorc @ s$ e Zd Zdd� Zdd� Zdd� ZdS )�direct_ContentHandlerc C s t �| |� d| _d S )NF)r �__init__�direct)�self�item� r �9/usr/lib/python3/dist-packages/firewall/core/io/direct.pyr ( s z direct_ContentHandler.__init__c C s` t �| ||� | j�||� |dkr | jrttjd��d| _d S |dkrD| js.t� d� d S |d }|d }|d }| j� |||� d S |dkr�| jsRt� d � d S |d }|d vrbttj d | ��|d }|d }zt |d �}W n t y� t� d |d � Y d S w ||||g| _d S |dkr�| js�t� d� d S |d }|g| _d S t� d| � d S )Nr zMore than one direct tag.T�chainz$Parse Error: chain outside of direct�ipv�table�rulez#Parse Error: rule outside of direct��ipv4�ipv6�ebz"'%s' not from {'ipv4'|'ipv6'|'eb'}�priorityz'Parse Error: %s is not a valid priority� passthroughz&Parse Error: command outside of directzUnknown XML element %s)r � startElementr �parser_check_element_attrsr r r � PARSE_ERRORr �error� add_chain� INVALID_IPV�int� ValueError�_rule� _passthrough)r �name�attrsr r r r r r r r , sX � � �� z"direct_ContentHandler.startElementc C s� t �| |� |dkr(| jr | j�t| j�� | jj| j� nt� d� d | _d S |dkrJ| jr@| j �t| j�� | jj | j � nt� d� d | _ d S d S )Nr z2Error: rule does not have any arguments, ignoring.r z9Error: passthrough does not have any arguments, ignoring.) r � endElement�_elementr' �appendr r �add_ruler r" r( �add_passthrough)r r) r r r r+ \ s �z direct_ContentHandler.endElementN)�__name__� __module__� __qualname__r r r+ r r r r r ' s 0r c s6 e Zd ZdZddgfddddddgfgfdddgfgffZdZd g d �g d �d gd �Zi Z� fdd�Zdd� Z dd� Z dd� Z dd� Z dd� Z dd� Zd d � Zd d � Zd d!� Zd"d#� Zd$d%� Zd&d'� Zd(d)� Zd*d+� Zd,d-� Zd.d/� Zd0d1� Zd2d3� Zd4d5� Zd6d7� Z d8d9� Z d:d;� Z d<d=� Z d>d?� Z d@dA� Z!� Z"S )B�Directz Direct class �chains)� r5 r5 �rulesr5 r � passthroughsz(a(sss)a(sssias)a(sas))N�r r r �r r r r r )r r r r c s0 t t| ��� || _t� | _t� | _t� | _d S �N)�superr3 r �filenamer r4 r6 r7 )r r< �� __class__r r r � s zDirect.__init__c C s d S r: r )r �confr �all_conf�all_io_objectsr r r � _check_config� s zDirect._check_configc C s� g }g }| j D ]}| j | D ]}|�tt|�t|g� �� qq|�|� g }| jD ]"}| j| D ]}|�t|d |d |d |d t|d �f�� q1q*|�|� g }| jD ]}| j| D ] }|�t|t|�f�� q^qW|�|� t|�S )Nr � � )r4 r- �tuple�listr6 r7 )r �ret�x�keyr r r r r � export_config� s, � �� � zDirect.export_configc C s� | � � | �|� t| j�D ]6\}\}}|dkr$|| D ]}| j|� q |dkr4|| D ]}| j|� q,|dkrD|| D ]}| j|� q<qd S )Nr4 r6 r7 )�cleanup� check_config� enumerate�IMPORT_EXPORT_STRUCTUREr# r. r/ )r r? rA �i�element�dummyrH r r r � import_config� s ��zDirect.import_configc C s" | j �� | j�� | j�� d S r: )r4 �clearr6 r7 �r r r r rK � s zDirect.cleanupc C s� t d� | jD ]}t d|d |d d�| j| �f � qt d� | jD ]&}t d|d |d |d f � | j| D ]\}}t d |d �|�f � q:q$t d � | jD ]}t d | � | j| D ] }t d d �|� � q_qRd S )Nr4 z (%s, %s): %sr rC �,r6 z (%s, %s, %s):rD z (%d, ('%s'))z','r7 z %s:z ('%s'))�printr4 �joinr6 r7 )r rI r �argsr r r �output� s$ � � ��z Direct.outputc C s( g d�}||vrt tjd||f ��d S )Nr �'%s' not in '%s')r r r$ )r r �ipvsr r r � _check_ipv� s ��zDirect._check_ipvc C sF | � |� |dv rtj�� ntj�� }||vr!ttjd||f ��d S )N)r r rZ )r\ r �BUILT_IN_CHAINS�keysr r r � INVALID_TABLE)r r r �tablesr r r �_check_ipv_table� s � ��zDirect._check_ipv_tablec C sf | � ||� ||f}|| jvrg | j|< || j| vr%| j| �|� d S t�d|||f d � d S )Nz(Chain '%s' for table '%s' with ipv '%s' �already in list, ignoring)ra r4 r- r �warning�r r r r rI r r r r# � s � �zDirect.add_chainc C sp | � ||� ||f}|| jv r/|| j| v r/| j| �|� t| j| �dkr-| j|= d S d S td|||f ��)Nr z4Chain '%s' with table '%s' with ipv '%s' not in list)ra r4 �remove�lenr& rd r r r � remove_chain� s ���zDirect.remove_chainc C s, | � ||� ||f}|| jv o|| j| v S r: )ra r4 rd r r r � query_chain� s zDirect.query_chainc C s8 | � ||� ||f}|| jv r| j| S td||f ��)Nz&No chains for table '%s' with ipv '%s')ra r4 r& )r r r rI r r r � get_chains� s �zDirect.get_chainsc C � | j S r: )r4 rT r r r �get_all_chains� � zDirect.get_all_chainsc C s� | � ||� |||f}|| jvrt� | j|< |t|�f}|| j| vr,|| j| |< d S t�dd�|�||f d||f d � d S )N�(Rule '%s' for table '%s' and chain '%s' �',z with ipv '%s' and priority %d rb )ra r6 r rE r rc rW �r r r r r rX rI �valuer r r r. s � � �zDirect.add_rulec C s� | � ||� |||f}|t|�f}|| jv r4|| j| v r4| j| |= t| j| �dkr2| j|= d S d S tdd�|�||f d||f ��)Nr rm rn z)with ipv '%s' and priority %d not in list)ra rE r6 rf r& rW ro r r r � remove_rule s �� �zDirect.remove_rulec C sf | � ||� |||f}|| jv r/| j| �� D ]}| j| |= qt| j| �dkr1| j|= d S d S d S )Nr )ra r6 r^ rf )r r r r rI rp r r r � remove_rules s �zDirect.remove_rulesc C s: | � ||� |||f}|t|�f}|| jv o || j| v S r: )ra rE r6 ro r r r � query_rule' s zDirect.query_rulec C sB | � ||� |||f}|| jv r| j| S td||f d| ��)Nz'No rules for table '%s' and chain '%s' z with ipv '%s')ra r6 r& rd r r r � get_rules- s ��zDirect.get_rulesc C rj r: )r6 rT r r r � get_all_rules6 rl zDirect.get_all_rulesc C s` | � |� || jvrg | j|< || j| vr | j| �|� d S t�dd�|�|f d � d S )N� Passthrough '%s' for ipv '%s'rn rb )r\ r7 r- r rc rW �r r rX r r r r/ ; s � �zDirect.add_passthroughc C sn | � |� || jv r*|| j| v r*| j| �|� t| j| �dkr(| j|= d S d S tdd�|�|f d ��)Nr rv rn z not in list)r\ r7 re rf r& rW rw r r r �remove_passthroughE s � ��zDirect.remove_passthroughc C s" | � |� || jv o|| j| v S r: )r\ r7 rw r r r �query_passthroughO s zDirect.query_passthroughc C s* | � |� || jv r| j| S td| ��)Nz No passthroughs for ipv '%s')r\ r7 r& )r r r r r �get_passthroughsS s zDirect.get_passthroughsc C rj r: )r7 rT r r r �get_all_passthroughsZ rl zDirect.get_all_passthroughsc C s� | � � | j�d�sttjd| j ��t| �}t�� }|� |� t | jd��2}t� d �}|� |� z|� |� W n tjyO } z ttjd|�� ��d }~ww W d � d S 1 s[w Y d S )Nz.xmlz'%s' is missing .xml suffix�rbzNot a valid file: %s)rK r< �endswithr r � INVALID_NAMEr �sax� make_parser�setContentHandler�open� InputSource� setByteStream�parse�SAXParseException� INVALID_TYPE� getException)r �handler�parser�f�source�msgr r r �read_ s. � �����"�z Direct.readc C s t j�| j�r)z t�| jd| j � W n ty( } z td| j|f ��d }~ww t j�tj �s7t � tj d� t j | jddd�}t |�}|�� |�di � |�d� | jD ]"}|\}}| j| D ]}|�d � |�d |||d �� |�d� qaqV| jD ]?}|\}}}| j| D ]2\}} t| �d k r�q�|�d � |�d |||d| d�� |�tj�t| ��� |�d � |�d� q�q|| jD ]3}| j| D ]+} t| �d k r�q�|�d � |�dd|i� |�tj�t| ��� |�d� |�d� q�q�|�d� |�d� |�� |� � ~d S )Nz%s.oldzBackup of '%s' failed: %si� �wtzUTF-8)�mode�encodingr � z r r8 rC r z%dr9 r r ) �os�path�existsr< �shutil�copy2� Exception�IOErrorr � ETC_FIREWALLD�mkdir�ior� r � startDocumentr �ignorableWhitespacer4 � simpleElementr6 rf r �saxutils�escaper r+ r7 � endDocument�close) r r� r� r� rI r r r r rX r r r �writeq sh �� � � � � � z Direct.write)#r0 r1 r2 �__doc__rN �DBUS_SIGNATURE� PARSER_REQUIRED_ELEMENT_ATTRS� PARSER_OPTIONAL_ELEMENT_ATTRSr rB rJ rR rK rY r\ ra r# rg rh ri rk r. rq rr rs rt ru r/ rx ry rz r{ r� r� � __classcell__r r r= r r3 q sN �� r3 )�xml.saxr r� r� r� �firewallr �firewall.fw_typesr �firewall.functionsr r �firewall.core.io.io_objectr r r �firewall.core.loggerr � firewall.corer r r �firewall.errorsr r r3 r r r r �<module> s JPK ���ZֲNv� � - core/io/__pycache__/functions.cpython-310.pycnu �[��� o bhAb� � @ s� d dl Z d dlmZ d dlmZ d dlmZ d dlmZ d dl m Z d dl m Z d dl mZ d d lmZ d d lmZ d d lmZ d d lmZ d d lmZ dd� ZdS )� N)�config)� FirewallError)�FirewallConfig)� zone_reader)�service_reader)� ipset_reader)�icmptype_reader)� helper_reader)� policy_reader)�Direct)�LockdownWhitelist)�firewalld_confc C s� t | �}t|jtjtjgd�t|jtjtj gd�t |j tj tj gd�t|jtjtjgd�t|jtjtjgd�t|jtjtjgd�d�}|�� D ]2}|| d D ])}tj � |�sXqOt t� |��D ]}|� d�rw|| d ||�}|| d |� q_qOqG|�!� tj �"tj#�r�zt$tj#�}|�%� |�&|�'� � W n, t(y� } z t(|j)dtj#|j*f ��d }~w t+y� } z t+dtj#|f ��d }~ww tj �"tj,��r zt-tj,�}|�%� |�&|�'� � W n- t(y� } z t(|j)dtj,|j*f ��d }~w t+�y } z t+dtj,|f ��d }~ww tj �"tj.��rOz t/tj.�}|�%� W d S t(�y9 } z t(|j)dtj.|j*f ��d }~w t+�yN } z t+dtj.|f ��d }~ww d S )N)�reader�add�dirs)�ipset�helper�icmptype�service�zone�policyr z.xmlr r z'%s': %s)0r r � add_ipsetr �FIREWALLD_IPSETS�ETC_FIREWALLD_IPSETSr � add_helper�FIREWALLD_HELPERS�ETC_FIREWALLD_HELPERSr � add_icmptype�FIREWALLD_ICMPTYPES�ETC_FIREWALLD_ICMPTYPESr � add_service�FIREWALLD_SERVICES�ETC_FIREWALLD_SERVICESr �add_zone�FIREWALLD_ZONES�ETC_FIREWALLD_ZONESr �add_policy_object�FIREWALLD_POLICIES�ETC_FIREWALLD_POLICIES�keys�os�path�isdir�sorted�listdir�endswith�full_check_config�isfile�FIREWALLD_DIRECTr �read� check_config� export_configr �code�msg� Exception�LOCKDOWN_WHITELISTr �FIREWALLD_CONFr ) �fw� fw_config�readersr �_dir�file�obj�errorr7 � rB �</usr/lib/python3/dist-packages/firewall/core/io/functions.py�check_on_disk_config& s� � � � � � �� ��� ��� ��� ����rD )r* �firewallr �firewall.errorsr �firewall.core.fw_configr �firewall.core.io.zoner �firewall.core.io.servicer �firewall.core.io.ipsetr �firewall.core.io.icmptyper �firewall.core.io.helperr �firewall.core.io.policyr �firewall.core.io.directr �#firewall.core.io.lockdown_whitelistr � firewall.core.io.firewalld_confr rD rB rB rB rC �<module> s PK ���Z��"�� � 6 core/io/__pycache__/lockdown_whitelist.cpython-310.pycnu �[��� o bhAb�/ � @ s� d dl mZ d dlZd dlZd dlZd dlmZ d dlmZm Z m Z d dl m Z d dl mZmZmZmZmZ d dlmZ d dlmZ G dd � d e �ZG d d � d e�ZdS ) � N)�config)� IO_Object�IO_Object_ContentHandler�IO_Object_XMLGenerator)�log)�uniqify� checkUser�checkUid� checkCommand� checkContext)�errors)� FirewallErrorc @ s e Zd Zdd� Zdd� ZdS )�!lockdown_whitelist_ContentHandlerc C s t �| |� d| _d S )NF)r �__init__� whitelist)�self�item� r �E/usr/lib/python3/dist-packages/firewall/core/io/lockdown_whitelist.pyr % s z*lockdown_whitelist_ContentHandler.__init__c C sX t �| ||� | j�||� |dkr | jrttjd��d| _d S |dkr:| js.t� d� d S |d }| j� |� d S |dkr�| jsHt� d� d S d |v rpzt |d �}W n t yg t� d |d � Y d S w | j� |� d S d|v r~| j�|d � d S d S |d kr�| js�t� d � d S d |vr�t� d� d S | j�|d � d S t� d| � d S )Nr zMore than one whitelist.T�commandz)Parse Error: command outside of whitelist�name�userz&Parse Error: user outside of whitelist�idz"Parse Error: %s is not a valid uid�selinuxz)Parse Error: selinux outside of whitelist�contextzParse Error: no contextzUnknown XML element %s)r � startElementr �parser_check_element_attrsr r r � PARSE_ERRORr �error� add_command�int� ValueError�add_uid�add_user� add_context)r r �attrsr �uidr r r r ) sR � ��� z.lockdown_whitelist_ContentHandler.startElementN)�__name__� __module__� __qualname__r r r r r r r $ s r c s, e Zd ZdZddgfddgfddgfddgffZdZd gZd d gd d gd �Zddd giZ� fdd�Z dd� Z dd� Z dd� Z dd� Z dd� Zd d � Zd d � Zd d!� Zd"d#� Zd$d%� Zd&d'� Zd(d)� Zd*d+� Zd,d-� Zd.d/� Zd0d1� Zd2d3� Zd4d5� Zd6d7� Z d8d9� Z d:d;� Z d<d=� Z d>d?� Z d@dA� Z!� Z"S )B�LockdownWhitelistz LockdownWhitelist class �commands� �contexts�users�uidsr z (asasasai)�_Nr r )r r r r r r c s6 t t| ��� || _d | _g | _g | _g | _g | _d S �N) �superr* r �filename�parserr+ r- r. r/ )r r3 �� __class__r r r n s zLockdownWhitelist.__init__c C s� |dv r|D ]}| � ||d d� ||� qd S |dkr't|�s%ttj|��d S |dkr7t|�s5ttj|��d S |dkrGt|�sEttj|��d S |dkrUt |�sWttj |��d S d S )N�r+ r- r. r/ ���r r r r& ) � _check_configr r r �INVALID_COMMANDr �INVALID_CONTEXTr � INVALID_USERr � INVALID_UID)r r r � all_config�all_io_objects�xr r r r9 y s* � � � � �z LockdownWhitelist._check_configc C s4 | j d d �= | jd d �= | jd d �= | jd d �= d S r1 r7 �r r r r �cleanup� s zLockdownWhitelist.cleanupc C �> t |�s ttj|��|| jvr| j�|� d S ttjd| ��)Nz!Command "%s" already in whitelist)r r r r: r+ �append�ALREADY_ENABLED�r r r r r r � � �z LockdownWhitelist.add_commandc C �* || j v r | j �|� d S ttjd| ��)Nz Command "%s" not in whitelist.)r+ �remover r � NOT_ENABLEDrF r r r �remove_command� � �z LockdownWhitelist.remove_commandc C � || j v S r1 �r+ rF r r r � has_command� � z LockdownWhitelist.has_commandc C sB | j D ]}|�d�r|�|d d� �r dS q||kr dS qdS )N�*r8 TF)r+ �endswith� startswith)r r �_commandr r r � match_command� s ��z LockdownWhitelist.match_commandc C � | j S r1 rN rA r r r � get_commands� � z LockdownWhitelist.get_commandsc C sB t |�s ttjt|���|| jvr| j�|� d S ttjd| ��)Nz Uid "%s" already in whitelist)r r r r= �strr/ rD rE �r r& r r r r" � s �zLockdownWhitelist.add_uidc C rH )NzUid "%s" not in whitelist.)r/ rI r r rJ rZ r r r � remove_uid� rL z LockdownWhitelist.remove_uidc C rM r1 �r/ rZ r r r �has_uid� rP zLockdownWhitelist.has_uidc C rM r1 r\ rZ r r r � match_uid� rP zLockdownWhitelist.match_uidc C rV r1 r\ rA r r r �get_uids� rX zLockdownWhitelist.get_uidsc C rC )Nz User "%s" already in whitelist)r r r r< r. rD rE �r r r r r r# � rG zLockdownWhitelist.add_userc C rH )NzUser "%s" not in whitelist.)r. rI r r rJ r` r r r � remove_user� rL z LockdownWhitelist.remove_userc C rM r1 �r. r` r r r �has_user� rP zLockdownWhitelist.has_userc C rM r1 rb r` r r r � match_user� rP z LockdownWhitelist.match_userc C rV r1 rb rA r r r � get_users� rX zLockdownWhitelist.get_usersc C rC )Nz!Context "%s" already in whitelist)r r r r; r- rD rE �r r r r r r$ rG z LockdownWhitelist.add_contextc C rH )Nz Context "%s" not in whitelist.)r- rI r r rJ rf r r r �remove_context$ rL z LockdownWhitelist.remove_contextc C rM r1 �r- rf r r r � has_context+ rP z LockdownWhitelist.has_contextc C rM r1 rh rf r r r � match_context. rP z LockdownWhitelist.match_contextc C rV r1 rh rA r r r � get_contexts1 rX z LockdownWhitelist.get_contextsc C s� | � � | j�d�sttjd| j ��t| �}t�� }|� |� z |� | j� W ~~d S tj yB } z ttj d|� � ��d }~ww )Nz.xmlz'%s' is missing .xml suffixzNot a valid file: %s)rB r3 rR r r � INVALID_NAMEr �sax� make_parser�setContentHandler�parse�SAXParseException� INVALID_TYPE� getException)r �handlerr4 �msgr r r �read6 s( � �����zLockdownWhitelist.readc C s� t j�| j�r)z t�| jd| j � W n ty( } z td| j|f ��d }~ww t j�tj �s7t � tj d� t j | jddd�}t |�}|�� |�di � |�d� t| j�D ]}|�d � |�d d |i� |�d� qXt| j�D ]}|�d � |�d d t|�i� |�d� qrt| j�D ]}|�d � |�d d |i� |�d� q�t| j�D ]}|�d � |�dd|i� |�d� q�|�d� |�d� |�� |�� ~d S )Nz%s.oldzBackup of '%s' failed: %si� �wtzUTF-8)�mode�encodingr � z r r r r r r )�os�path�existsr3 �shutil�copy2� Exception�IOErrorr � ETC_FIREWALLD�mkdir�io�openr � startDocumentr �ignorableWhitespacer r+ � simpleElementr/ rY r. r- � endElement� endDocument�close)r ru �frt r r& r r r r r �writeG sF �� zLockdownWhitelist.write)#r' r( r) �__doc__�IMPORT_EXPORT_STRUCTURE�DBUS_SIGNATURE�ADDITIONAL_ALNUM_CHARS� PARSER_REQUIRED_ELEMENT_ATTRS� PARSER_OPTIONAL_ELEMENT_ATTRSr r9 rB r rK rO rU rW r" r[ r] r^ r_ r# ra rc rd re r$ rg ri rj rk rv r� � __classcell__r r r5 r r* W sR ��� 1 r* )�xml.saxrm r{ r� r~ �firewallr �firewall.core.io.io_objectr r r �firewall.core.loggerr �firewall.functionsr r r r r r �firewall.errorsr r r* r r r r �<module> s 3PK ���Z��- - ( core/io/__pycache__/zone.cpython-310.pycnu �[��� o bhAbJ � @ s� g d �Z ddlmZ ddlZddlZddlZddlmZ ddlm Z m Z m Z m Z m Z mZ ddlmZmZ ddlmZmZmZ ddlmZmZmZmZ ddlm Z dd l m Z dd lm Z dd l m!Z! G d d � d e�Z"G dd� de�Z#ddd�Z$ddd�Z%dS ))�Zone� zone_reader� zone_writer� N)�config)� checkIPnMask� checkIP6nMask�checkInterface�uniqify�max_zone_name_len� check_mac)�DEFAULT_ZONE_TARGET� ZONE_TARGETS)� IO_Object�IO_Object_ContentHandler�IO_Object_XMLGenerator)�common_startElement�common_endElement�common_check_config� common_writer)�rich)�log)�errors)� FirewallErrorc s� e Zd ZdZdddddddgfd d gfd dgfd d dgfddgfddgfddgfddgfdd gfddfZg d�Zi dd�dd�dd�dd g�d d d g�d d g�d d g�d!d�d"d d g�d#d g�d$d�d%d�d&d�d d'g�d(d d g�d)d�d*d�ddddd+gd'gdd,��Zg d-�d.gd/d0gd1d2gg d3�g d4�d5d6gg d7�d8gd'gd9� Zed:d;� �Z � fd<d=�Z d>d?� Z � fd@dA�Z � fdBdC�Z dDdE� Z� fdFdG�ZdHdI� Z� ZS )Jr z Zone class )�version� )�shortr )� descriptionr )�UNUSEDF)�targetr �servicesr �ports)r r � icmp_blocks)� masqueradeF� forward_ports)r r r r � interfaces�sources� rules_str� protocols� source_ports)�icmp_block_inversionF)�forwardT)�_�-�/r Nr �zone�service�name�port�protocolz icmp-blockz icmp-typer* � forward-port� interface�rule�source� destination�valuez source-portr �nflog�set)�audit�accept�reject�drop�mark�limit�icmp-block-inversion)r0 � immutabler r �enabledzto-portzto-addr�family�priority)�address�mac�invertrD �ipset)rF rH rI �prefix�level)�grouprJ z queue-size�type) r. r" r3 r5 r6 r7 r r9 r= z tcp-mss-clampc C s4 t tj�D ]\}\}}|| kr| S qttjd��)Nz index_of())� enumerater �IMPORT_EXPORT_STRUCTUREr r � UNKNOWN_ERROR)�element�i�el�dummy� rU �7/usr/lib/python3/dist-packages/firewall/core/io/zone.py�index_off s � z Zone.index_ofc s� t t| ��� d| _d| _d| _d| _t| _g | _ g | _ g | _ g | _ d| _ d| _g | _g | _g | _g | _g | _g | _d| _d| _d| _d S �Nr FT)�superr �__init__r r r r r r r r r' r! r* r" r# r( r$ r% �rulesr& r) �combined�applied��self�� __class__rU rV rZ m s* z Zone.__init__c C s� d| _ d| _d| _d| _t| _| jd d �= | jd d �= | jd d �= | j d d �= d| _ d| _ | j d d �= | j d d �= | jd d �= | jd d �= | jd d �= | jd d �= d| _d| _d| _d S rX )r r r r r r r r r' r! r* r" r# r( r$ r% r[ r& r) r\ r] r^ rU rU rV �cleanup� s( z Zone.cleanupc sP |dkr dd� |D �| _ tt| ��|dd� | j D �� d S tt| ��||� d S )Nr& c S s g | ]}t j|d ��qS ))�rule_str)r � Rich_Rule��.0�srU rU rV � <listcomp>� s z$Zone.__setattr__.<locals>.<listcomp>c S s g | ]}t |��qS rU )�strre rU rU rV rh � s )r[ rY r � __setattr__)r_ r0 r8 r` rU rV rj � s "zZone.__setattr__c s t t| ��� }|d= |S )Nr )rY r �export_config_dict)r_ �confr` rU rV rk � s zZone.export_config_dictc C sj t | ||||� | j|d v rttjd�| j���|dkr.|tvr,ttjd�| j|���d S |dkrj|D ]3}t|�sEttj d�| j|���|d D ] }|| jkrQqI||d | j v rfttj d�| j||���qIq4d S |d kr�|D ]B}t |�s�t |�s�t |�s�|�d �s�ttjd �| j|���|d D ] }|| jkr�q�||d | jv r�ttjd �| j||���q�qpd S d S ) N�policiesz0Zone '{}': Can't have the same name as a policy.r z Zone '{}': invalid target '{}'r$ z!Zone '{}': invalid interface '{}'�zonesz4Zone '{}': interface '{}' already bound to zone '{}'r% �ipset:z Zone '{}': invalid source '{}'z1Zone '{}': source '{}' already bound to zone '{}')r r0 r r � NAME_CONFLICT�formatr �INVALID_TARGETr �INVALID_INTERFACEr$ r r r � startswith� INVALID_ADDRr% )r_ r �item� all_config�all_io_objectsr4 r. r6 rU rU rV � _check_config� sd �� � ����� �� � �����zZone._check_configc s� t t| ��|� |�d�rttjd�|���|�d�r$ttjd�|���|� d�dkr4ttjd�|���d|v rB|d |� d�� }n|}t |�t � krYttjd�|t |�t � ���d S )Nr- z$Zone '{}': name can't start with '/'z"Zone '{}': name can't end with '/'� z%Zone '{}': name has more than one '/'z'Zone '{}': name has {} chars, max is {}) rY r � check_namert r r � INVALID_NAMErq �endswith�count�find�lenr )r_ r0 � checked_namer` rU rV r{ � s0 � �����zZone.check_namec C s� d| _ d | _d| _d| _d| _|jD ] }|| jvr | j�|� q|jD ] }|| jvr0| j�|� q#|jD ] }|| jvrA| j�|� q4|j D ] }|| j vrR| j �|� qE|j D ] }|| j vrc| j �|� qV|j D ] }|| j vrt| j �|� qg|j r{d| _ |j r�d| _ |jD ] }|| jvr�| j�|� q�|jD ] }|| jvr�| j�|� q�|jD ]} | j�| � | j�t| �� q�|jr�d| _d S d S )NTr )r\ �filenamer r r r$ �appendr% r r r' r! r* r" r# r( r[ r& ri r) ) r_ r. r4 r6 r/ r1 �proto�icmpr* r5 rU rU rV �combine� s^ � � � � � � � � �z Zone.combine)�__name__� __module__� __qualname__�__doc__rO �ADDITIONAL_ALNUM_CHARS� PARSER_REQUIRED_ELEMENT_ATTRS� PARSER_OPTIONAL_ELEMENT_ATTRS� staticmethodrW rZ rb rj rk ry r{ r� � __classcell__rU rU r` rV r ( s� ��������� � � � � ������� %r c @ s$ e Zd Zdd� Zdd� Zdd� ZdS )�zone_ContentHandlerc C s" t �| |� d | _d| _d | _d S )NF)r rZ �_rule� _rule_error� _limit_ok)r_ rv rU rU rV rZ s z zone_ContentHandler.__init__c C s� t �| ||� | jr d S | j�||� t| ||�rd S |dkrgd|v r+t�d|d � d|v r5|d | j_d|v rAt�d|d � d|v ra|d }|t vrSt t j |��|dkrc|t kre|| j_d S d S d S d S |d kr|| jjrvt�d � d S d | j_d S |d kr�| jr�t�d � d | _d S d|vr�t�d� d | _d S |d | jjvr�| jj�|d � d S t�d|d � d S |dk�r�| j�r| jjr�t�dt| j�� d | _d S d}d|v r�|d �� dv r�d }d } }}d|v r�|d }d|v r�|d }d|v �r|d }tj||||d�| j_d S d|v�r d|v�r t�d� d S d|v �r1d|v �r1t�d� d S d|v �r>t�d |d � d|v �rJt�d � d S d|v �rlt|d ��slt|d ��slt|d ��slt t j|d ��d|v �r�d |d }|| jj v�r�| jj �|� nt�d |d � d|v �r�|d }|| jj v�r�| jj �|� d S t�d |d � d S d S |d k�r�| jj �r�t�d!� d S d | j_ d S t�d"|� d S )#Nr. r0 z'Ignoring deprecated attribute name='%s'r rB z,Ignoring deprecated attribute immutable='%s'r r r* z Forward already set, ignoring.Tr4 z$Invalid rule: interface use in rule.z Invalid interface: Name missing.z%Interface '%s' already set, ignoring.r6 z:Invalid rule: More than one source in rule '%s', ignoring.FrH )�yes�truerF rG rI )rH z$Invalid source: No address no ipset.z"Invalid source: Address and ipset.rD z)Ignoring deprecated attribute family='%s'z+Invalid source: Invertion not allowed here.zipset:%sz"Source '%s' already set, ignoring.rA z+Icmp-Block-Inversion already set, ignoring.zUnknown XML element '%s') r � startElementr� rv �parser_check_element_attrsr r �warningr r r r rr r r r* r� r$ r� r6 ri �lowerr � Rich_Sourcer r r ru r% r) ) r_ r0 �attrsr rH �addrrG rI �entryrU rU rV r� s� � � � � � � � � � � �� z zone_ContentHandler.startElementc C s t �| |� t| |� d S �N)r � endElementr )r_ r0 rU rU rV r� � s z zone_ContentHandler.endElementN)r� r� r� rZ r� r� rU rU rU rV r� s pr� Fc C s t � }| �d�sttjd| ��| d d� |_|s |�|j� | |_||_|� t j �r-dnd|_ |j |_ d|_t|�}t�� }|�|� d|| f }t|d��4}t�d �}|�|� z|�|� W n tjyx } z ttjd| �� ��d } ~ ww W d � ~~|S 1 s�w Y ~~|S ) Nz.xmlz'%s' is missing .xml suffix���FT�%s/%s�rbznot a valid zone file: %s)r r} r r r| r0 r{ r� �pathrt r � ETC_FIREWALLD�builtin�defaultr* r� �sax� make_parser�setContentHandler�open� InputSource� setByteStream�parse�SAXParseException� INVALID_ZONE� getException) r� r� � no_check_namer. �handler�parserr0 �fr6 �msgrU rU rV r � sN � ����� � � r c C sF |r|n| j }| jrd|| jf }nd|| jf }tj �|�rCz t�|d| � W n tyB } z t� d||� W Y d }~nd }~ww tj � |�}|� t j �ritj �|�sitj �t j �sct�t j d� t�|d� tj|ddd�}t|�}|�� i }| jr�| jd kr�| j|d < | jtkr�| j|d < |�d |� |�d � t| |� t| j�D ]} |�d� |�dd| i� |�d � q�t| j �D ]%} |�d� d| v r�|�dd| dd � i� n|�dd| i� |�d � q�| j r�|�d� |�di � |�d � | j �r|�d� |�di � |�d � |� d � |�d � |� � |�!� ~d S )Nr� z %s/%s.xmlz%s.oldz Backup of file '%s' failed: %si� �wtzUTF-8)�mode�encodingr r r r. � z r4 r0 ro r6 rI � rF rA r* )"r� r� r0 �os�exists�shutil�copy2� Exceptionr �error�dirnamert r r� �mkdir�ior� r � startDocumentr r r r� �ignorableWhitespacer r r$ � simpleElementr% r) r* r� � endDocument�close) r. r� �_pathr0 r� �dirpathr� r� r� r4 r6 rU rU rV r � sd �� r )Fr� )&�__all__�xml.saxr� r� r� r� �firewallr �firewall.functionsr r r r r r �firewall.core.baser r �firewall.core.io.io_objectr r r �firewall.core.io.policyr r r r � firewall.corer �firewall.core.loggerr r �firewall.errorsr r r� r r rU rU rU rV �<module> s& f |!PK ���Z8�W�� � core/io/functions.pynu �[��� # -*- coding: utf-8 -*- # # Copyright (C) 2018 Red Hat, Inc. # # Authors: # Eric Garver <egarver@redhat.com> # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see <http://www.gnu.org/licenses/>. # import os from firewall import config from firewall.errors import FirewallError from firewall.core.fw_config import FirewallConfig from firewall.core.io.zone import zone_reader from firewall.core.io.service import service_reader from firewall.core.io.ipset import ipset_reader from firewall.core.io.icmptype import icmptype_reader from firewall.core.io.helper import helper_reader from firewall.core.io.policy import policy_reader from firewall.core.io.direct import Direct from firewall.core.io.lockdown_whitelist import LockdownWhitelist from firewall.core.io.firewalld_conf import firewalld_conf def check_on_disk_config(fw): fw_config = FirewallConfig(fw) readers = { "ipset": {"reader": ipset_reader, "add": fw_config.add_ipset, "dirs": [config.FIREWALLD_IPSETS, config.ETC_FIREWALLD_IPSETS], }, "helper": {"reader": helper_reader, "add": fw_config.add_helper, "dirs": [config.FIREWALLD_HELPERS, config.ETC_FIREWALLD_HELPERS], }, "icmptype": {"reader": icmptype_reader, "add": fw_config.add_icmptype, "dirs": [config.FIREWALLD_ICMPTYPES, config.ETC_FIREWALLD_ICMPTYPES], }, "service": {"reader": service_reader, "add": fw_config.add_service, "dirs": [config.FIREWALLD_SERVICES, config.ETC_FIREWALLD_SERVICES], }, "zone": {"reader": zone_reader, "add": fw_config.add_zone, "dirs": [config.FIREWALLD_ZONES, config.ETC_FIREWALLD_ZONES], }, "policy": {"reader": policy_reader, "add": fw_config.add_policy_object, "dirs": [config.FIREWALLD_POLICIES, config.ETC_FIREWALLD_POLICIES], }, } for reader in readers.keys(): for _dir in readers[reader]["dirs"]: if not os.path.isdir(_dir): continue for file in sorted(os.listdir(_dir)): if file.endswith(".xml"): obj = readers[reader]["reader"](file, _dir) readers[reader]["add"](obj) fw_config.full_check_config() if os.path.isfile(config.FIREWALLD_DIRECT): try: obj = Direct(config.FIREWALLD_DIRECT) obj.read() obj.check_config(obj.export_config()) except FirewallError as error: raise FirewallError(error.code, "'%s': %s" % (config.FIREWALLD_DIRECT, error.msg)) except Exception as msg: raise Exception("'%s': %s" % (config.FIREWALLD_DIRECT, msg)) if os.path.isfile(config.LOCKDOWN_WHITELIST): try: obj = LockdownWhitelist(config.LOCKDOWN_WHITELIST) obj.read() obj.check_config(obj.export_config()) except FirewallError as error: raise FirewallError(error.code, "'%s': %s" % (config.LOCKDOWN_WHITELIST, error.msg)) except Exception as msg: raise Exception("'%s': %s" % (config.LOCKDOWN_WHITELIST, msg)) if os.path.isfile(config.FIREWALLD_CONF): try: obj = firewalld_conf(config.FIREWALLD_CONF) obj.read() except FirewallError as error: raise FirewallError(error.code, "'%s': %s" % (config.FIREWALLD_CONF, error.msg)) except Exception as msg: raise Exception("'%s': %s" % (config.FIREWALLD_CONF, msg)) PK ���Z�:2��5 �5 core/io/firewalld_conf.pynu �[��� # -*- coding: utf-8 -*- # # Copyright (C) 2011-2012 Red Hat, Inc. # # Authors: # Thomas Woerner <twoerner@redhat.com> # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see <http://www.gnu.org/licenses/>. # import os.path import io import tempfile import shutil from firewall import config from firewall.core.logger import log valid_keys = [ "DefaultZone", "MinimalMark", "CleanupOnExit", "CleanupModulesOnExit", "Lockdown", "IPv6_rpfilter", "IndividualCalls", "LogDenied", "AutomaticHelpers", "FirewallBackend", "FlushAllOnReload", "RFC3964_IPv4", "AllowZoneDrifting" ] class firewalld_conf(object): def __init__(self, filename): self._config = { } self._deleted = [ ] self.filename = filename self.clear() def clear(self): self._config = { } self._deleted = [ ] def cleanup(self): self._config.clear() self._deleted = [ ] def get(self, key): return self._config.get(key.strip()) def set(self, key, value): _key = key.strip() self._config[_key] = value.strip() if _key in self._deleted: self._deleted.remove(_key) def __str__(self): s = "" for (key,value) in self._config.items(): if s: s += '\n' s += '%s=%s' % (key, value) return s # load self.filename def read(self): self.clear() try: f = open(self.filename, "r") except Exception as msg: log.error("Failed to load '%s': %s", self.filename, msg) self.set("DefaultZone", config.FALLBACK_ZONE) self.set("MinimalMark", str(config.FALLBACK_MINIMAL_MARK)) self.set("CleanupOnExit", "yes" if config.FALLBACK_CLEANUP_ON_EXIT else "no") self.set("CleanupModulesOnExit", "yes" if config.FALLBACK_CLEANUP_MODULES_ON_EXIT else "no") self.set("Lockdown", "yes" if config.FALLBACK_LOCKDOWN else "no") self.set("IPv6_rpfilter","yes" if config.FALLBACK_IPV6_RPFILTER else "no") self.set("IndividualCalls", "yes" if config.FALLBACK_INDIVIDUAL_CALLS else "no") self.set("LogDenied", config.FALLBACK_LOG_DENIED) self.set("AutomaticHelpers", config.FALLBACK_AUTOMATIC_HELPERS) self.set("FirewallBackend", config.FALLBACK_FIREWALL_BACKEND) self.set("FlushAllOnReload", "yes" if config.FALLBACK_FLUSH_ALL_ON_RELOAD else "no") self.set("RFC3964_IPv4", "yes" if config.FALLBACK_RFC3964_IPV4 else "no") self.set("AllowZoneDrifting", "yes" if config.FALLBACK_ALLOW_ZONE_DRIFTING else "no") raise for line in f: if not line: break line = line.strip() if len(line) < 1 or line[0] in ['#', ';']: continue # get key/value pair pair = [ x.strip() for x in line.split("=") ] if len(pair) != 2: log.error("Invalid option definition: '%s'", line.strip()) continue elif pair[0] not in valid_keys: log.error("Invalid option: '%s'", line.strip()) continue elif pair[1] == '': log.error("Missing value: '%s'", line.strip()) continue elif self._config.get(pair[0]) is not None: log.error("Duplicate option definition: '%s'", line.strip()) continue self._config[pair[0]] = pair[1] f.close() # check default zone if not self.get("DefaultZone"): log.error("DefaultZone is not set, using default value '%s'", config.FALLBACK_ZONE) self.set("DefaultZone", str(config.FALLBACK_ZONE)) # check minimal mark value = self.get("MinimalMark") try: int(value) except (ValueError, TypeError): if value is not None: log.warning("MinimalMark '%s' is not valid, using default " "value '%d'", value if value else '', config.FALLBACK_MINIMAL_MARK) self.set("MinimalMark", str(config.FALLBACK_MINIMAL_MARK)) # check cleanup on exit value = self.get("CleanupOnExit") if not value or value.lower() not in [ "no", "false", "yes", "true" ]: if value is not None: log.warning("CleanupOnExit '%s' is not valid, using default " "value %s", value if value else '', config.FALLBACK_CLEANUP_ON_EXIT) self.set("CleanupOnExit", "yes" if config.FALLBACK_CLEANUP_ON_EXIT else "no") # check module cleanup on exit value = self.get("CleanupModulesOnExit") if not value or value.lower() not in [ "no", "false", "yes", "true" ]: if value is not None: log.warning("CleanupModulesOnExit '%s' is not valid, using default " "value %s", value if value else '', config.FALLBACK_CLEANUP_MODULES_ON_EXIT) self.set("CleanupModulesOnExit", "yes" if config.FALLBACK_CLEANUP_MODULES_ON_EXIT else "no") # check lockdown value = self.get("Lockdown") if not value or value.lower() not in [ "yes", "true", "no", "false" ]: if value is not None: log.warning("Lockdown '%s' is not valid, using default " "value %s", value if value else '', config.FALLBACK_LOCKDOWN) self.set("Lockdown", "yes" if config.FALLBACK_LOCKDOWN else "no") # check ipv6_rpfilter value = self.get("IPv6_rpfilter") if not value or value.lower() not in [ "yes", "true", "no", "false" ]: if value is not None: log.warning("IPv6_rpfilter '%s' is not valid, using default " "value %s", value if value else '', config.FALLBACK_IPV6_RPFILTER) self.set("IPv6_rpfilter","yes" if config.FALLBACK_IPV6_RPFILTER else "no") # check individual calls value = self.get("IndividualCalls") if not value or value.lower() not in [ "yes", "true", "no", "false" ]: if value is not None: log.warning("IndividualCalls '%s' is not valid, using default " "value %s", value if value else '', config.FALLBACK_INDIVIDUAL_CALLS) self.set("IndividualCalls", "yes" if config.FALLBACK_INDIVIDUAL_CALLS else "no") # check log denied value = self.get("LogDenied") if not value or value not in config.LOG_DENIED_VALUES: if value is not None: log.warning("LogDenied '%s' is invalid, using default value '%s'", value, config.FALLBACK_LOG_DENIED) self.set("LogDenied", str(config.FALLBACK_LOG_DENIED)) # check automatic helpers value = self.get("AutomaticHelpers") if not value or value.lower() not in config.AUTOMATIC_HELPERS_VALUES: if value is not None: log.warning("AutomaticHelpers '%s' is not valid, using default " "value %s", value if value else '', config.FALLBACK_AUTOMATIC_HELPERS) self.set("AutomaticHelpers", str(config.FALLBACK_AUTOMATIC_HELPERS)) value = self.get("FirewallBackend") if not value or value.lower() not in config.FIREWALL_BACKEND_VALUES: if value is not None: log.warning("FirewallBackend '%s' is not valid, using default " "value %s", value if value else '', config.FALLBACK_FIREWALL_BACKEND) self.set("FirewallBackend", str(config.FALLBACK_FIREWALL_BACKEND)) value = self.get("FlushAllOnReload") if not value or value.lower() not in [ "yes", "true", "no", "false" ]: if value is not None: log.warning("FlushAllOnReload '%s' is not valid, using default " "value %s", value if value else '', config.FALLBACK_FLUSH_ALL_ON_RELOAD) self.set("FlushAllOnReload", str(config.FALLBACK_FLUSH_ALL_ON_RELOAD)) value = self.get("RFC3964_IPv4") if not value or value.lower() not in [ "yes", "true", "no", "false" ]: if value is not None: log.warning("RFC3964_IPv4 '%s' is not valid, using default " "value %s", value if value else '', config.FALLBACK_RFC3964_IPV4) self.set("RFC3964_IPv4", str(config.FALLBACK_RFC3964_IPV4)) value = self.get("AllowZoneDrifting") if not value or value.lower() not in [ "yes", "true", "no", "false" ]: if value is not None: log.warning("AllowZoneDrifting '%s' is not valid, using default " "value %s", value if value else '', config.FALLBACK_ALLOW_ZONE_DRIFTING) self.set("AllowZoneDrifting", "yes" if config.FALLBACK_ALLOW_ZONE_DRIFTING else "no") # save to self.filename if there are key/value changes def write(self): if len(self._config) < 1: # no changes: nothing to do return # handled keys done = [ ] if not os.path.exists(config.ETC_FIREWALLD): os.mkdir(config.ETC_FIREWALLD, 0o750) try: temp_file = tempfile.NamedTemporaryFile(mode='wt', prefix="%s." % os.path.basename(self.filename), dir=os.path.dirname(self.filename), delete=False) except Exception as msg: log.error("Failed to open temporary file: %s" % msg) raise modified = False empty = False try: f= io.open(self.filename, mode='rt', encoding='UTF-8') except Exception as msg: if os.path.exists(self.filename): log.error("Failed to open '%s': %s" % (self.filename, msg)) raise else: f = None else: for line in f: if not line: break # remove newline line = line.strip("\n") if len(line) < 1: if not empty: temp_file.write(u"\n") empty = True elif line[0] == '#': empty = False temp_file.write(line) temp_file.write(u"\n") else: p = line.split("=") if len(p) != 2: empty = False temp_file.write(line+u"\n") continue key = p[0].strip() value = p[1].strip() # check for modified key/value pairs if key not in done: if (key in self._config and \ self._config[key] != value): empty = False temp_file.write(u'%s=%s\n' % (key, self._config[key])) modified = True elif key in self._deleted: modified = True else: empty = False temp_file.write(line+u"\n") done.append(key) else: modified = True # write remaining key/value pairs if len(self._config) > 0: for (key,value) in self._config.items(): if key in done: continue if key in ["MinimalMark", "AutomaticHelpers", "AllowZoneDrifting"]: # omit deprecated from new config continue if not empty: temp_file.write(u"\n") empty = True temp_file.write(u'%s=%s\n' % (key, value)) modified = True if f: f.close() temp_file.close() if not modified: # not modified: remove tempfile os.remove(temp_file.name) return # make backup if os.path.exists(self.filename): try: shutil.copy2(self.filename, "%s.old" % self.filename) except Exception as msg: os.remove(temp_file.name) raise IOError("Backup of '%s' failed: %s" % (self.filename, msg)) # copy tempfile try: shutil.move(temp_file.name, self.filename) except Exception as msg: os.remove(temp_file.name) raise IOError("Failed to create '%s': %s" % (self.filename, msg)) else: os.chmod(self.filename, 0o600) PK ���Z��p�J J core/io/zone.pynu �[��� # -*- coding: utf-8 -*- # # Copyright (C) 2011-2016 Red Hat, Inc. # # Authors: # Thomas Woerner <twoerner@redhat.com> # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see <http://www.gnu.org/licenses/>. # __all__ = [ "Zone", "zone_reader", "zone_writer" ] import xml.sax as sax import os import io import shutil from firewall import config from firewall.functions import checkIPnMask, checkIP6nMask, checkInterface, uniqify, max_zone_name_len, check_mac from firewall.core.base import DEFAULT_ZONE_TARGET, ZONE_TARGETS from firewall.core.io.io_object import IO_Object, \ IO_Object_ContentHandler, IO_Object_XMLGenerator from firewall.core.io.policy import common_startElement, common_endElement, common_check_config, common_writer from firewall.core import rich from firewall.core.logger import log from firewall import errors from firewall.errors import FirewallError class Zone(IO_Object): """ Zone class """ IMPORT_EXPORT_STRUCTURE = ( ( "version", "" ), # s ( "short", "" ), # s ( "description", "" ), # s ( "UNUSED", False ), # b ( "target", "" ), # s ( "services", [ "", ], ), # as ( "ports", [ ( "", "" ), ], ), # a(ss) ( "icmp_blocks", [ "", ], ), # as ( "masquerade", False ), # b ( "forward_ports", [ ( "", "", "", "" ), ], ), # a(ssss) ( "interfaces", [ "" ] ), # as ( "sources", [ "" ] ), # as ( "rules_str", [ "" ] ), # as ( "protocols", [ "", ], ), # as ( "source_ports", [ ( "", "" ), ], ), # a(ss) ( "icmp_block_inversion", False ), # b ( "forward", True ), # b ) ADDITIONAL_ALNUM_CHARS = [ "_", "-", "/" ] PARSER_REQUIRED_ELEMENT_ATTRS = { "short": None, "description": None, "zone": None, "service": [ "name" ], "port": [ "port", "protocol" ], "icmp-block": [ "name" ], "icmp-type": [ "name" ], "forward": None, "forward-port": [ "port", "protocol" ], "interface": [ "name" ], "rule": None, "source": None, "destination": None, "protocol": [ "value" ], "source-port": [ "port", "protocol" ], "log": None, "nflog": None, "audit": None, "accept": None, "reject": None, "drop": None, "mark": [ "set" ], "limit": [ "value" ], "icmp-block-inversion": None, } PARSER_OPTIONAL_ELEMENT_ATTRS = { "zone": [ "name", "immutable", "target", "version" ], "masquerade": [ "enabled" ], "forward-port": [ "to-port", "to-addr" ], "rule": [ "family", "priority" ], "source": [ "address", "mac", "invert", "family", "ipset" ], "destination": [ "address", "invert", "ipset" ], "log": [ "prefix", "level" ], "nflog": [ "group", "prefix", "queue-size" ], "reject": [ "type" ], "tcp-mss-clamp": [ "value" ], } @staticmethod def index_of(element): for i, (el, dummy) in enumerate(Zone.IMPORT_EXPORT_STRUCTURE): if el == element: return i raise FirewallError(errors.UNKNOWN_ERROR, "index_of()") def __init__(self): super(Zone, self).__init__() self.version = "" self.short = "" self.description = "" self.UNUSED = False self.target = DEFAULT_ZONE_TARGET self.services = [ ] self.ports = [ ] self.protocols = [ ] self.icmp_blocks = [ ] self.forward = True self.masquerade = False self.forward_ports = [ ] self.source_ports = [ ] self.interfaces = [ ] self.sources = [ ] self.rules = [ ] self.rules_str = [ ] self.icmp_block_inversion = False self.combined = False self.applied = False def cleanup(self): self.version = "" self.short = "" self.description = "" self.UNUSED = False self.target = DEFAULT_ZONE_TARGET del self.services[:] del self.ports[:] del self.protocols[:] del self.icmp_blocks[:] self.forward = True self.masquerade = False del self.forward_ports[:] del self.source_ports[:] del self.interfaces[:] del self.sources[:] del self.rules[:] del self.rules_str[:] self.icmp_block_inversion = False self.combined = False self.applied = False def __setattr__(self, name, value): if name == "rules_str": self.rules = [rich.Rich_Rule(rule_str=s) for s in value] # must convert back to string to get the canonical string. super(Zone, self).__setattr__(name, [str(s) for s in self.rules]) else: super(Zone, self).__setattr__(name, value) def export_config_dict(self): conf = super(Zone, self).export_config_dict() del conf["UNUSED"] return conf def _check_config(self, config, item, all_config, all_io_objects): common_check_config(self, config, item, all_config, all_io_objects) if self.name in all_io_objects["policies"]: raise FirewallError(errors.NAME_CONFLICT, "Zone '{}': Can't have the same name as a policy.".format(self.name)) if item == "target": if config not in ZONE_TARGETS: raise FirewallError(errors.INVALID_TARGET, "Zone '{}': invalid target '{}'".format( self.name, config)) elif item == "interfaces": for interface in config: if not checkInterface(interface): raise FirewallError(errors.INVALID_INTERFACE, "Zone '{}': invalid interface '{}'".format( self.name, interface)) for zone in all_io_objects["zones"]: if zone == self.name: continue if interface in all_io_objects["zones"][zone].interfaces: raise FirewallError(errors.INVALID_INTERFACE, "Zone '{}': interface '{}' already bound to zone '{}'".format( self.name, interface, zone)) elif item == "sources": for source in config: if not checkIPnMask(source) and not checkIP6nMask(source) and \ not check_mac(source) and not source.startswith("ipset:"): raise FirewallError(errors.INVALID_ADDR, "Zone '{}': invalid source '{}'".format( self.name, source)) for zone in all_io_objects["zones"]: if zone == self.name: continue if source in all_io_objects["zones"][zone].sources: raise FirewallError(errors.INVALID_ADDR, "Zone '{}': source '{}' already bound to zone '{}'".format( self.name, source, zone)) def check_name(self, name): super(Zone, self).check_name(name) if name.startswith('/'): raise FirewallError(errors.INVALID_NAME, "Zone '{}': name can't start with '/'".format(name)) elif name.endswith('/'): raise FirewallError(errors.INVALID_NAME, "Zone '{}': name can't end with '/'".format(name)) elif name.count('/') > 1: raise FirewallError(errors.INVALID_NAME, "Zone '{}': name has more than one '/'".format(name)) else: if "/" in name: checked_name = name[:name.find('/')] else: checked_name = name if len(checked_name) > max_zone_name_len(): raise FirewallError(errors.INVALID_NAME, "Zone '{}': name has {} chars, max is {}".format( name, len(checked_name), max_zone_name_len())) def combine(self, zone): self.combined = True self.filename = None self.version = "" self.short = "" self.description = "" for interface in zone.interfaces: if interface not in self.interfaces: self.interfaces.append(interface) for source in zone.sources: if source not in self.sources: self.sources.append(source) for service in zone.services: if service not in self.services: self.services.append(service) for port in zone.ports: if port not in self.ports: self.ports.append(port) for proto in zone.protocols: if proto not in self.protocols: self.protocols.append(proto) for icmp in zone.icmp_blocks: if icmp not in self.icmp_blocks: self.icmp_blocks.append(icmp) if zone.forward: self.forward = True if zone.masquerade: self.masquerade = True for forward in zone.forward_ports: if forward not in self.forward_ports: self.forward_ports.append(forward) for port in zone.source_ports: if port not in self.source_ports: self.source_ports.append(port) for rule in zone.rules: self.rules.append(rule) self.rules_str.append(str(rule)) if zone.icmp_block_inversion: self.icmp_block_inversion = True # PARSER class zone_ContentHandler(IO_Object_ContentHandler): def __init__(self, item): IO_Object_ContentHandler.__init__(self, item) self._rule = None self._rule_error = False self._limit_ok = None def startElement(self, name, attrs): IO_Object_ContentHandler.startElement(self, name, attrs) if self._rule_error: return self.item.parser_check_element_attrs(name, attrs) if common_startElement(self, name, attrs): return elif name == "zone": if "name" in attrs: log.warning("Ignoring deprecated attribute name='%s'", attrs["name"]) if "version" in attrs: self.item.version = attrs["version"] if "immutable" in attrs: log.warning("Ignoring deprecated attribute immutable='%s'", attrs["immutable"]) if "target" in attrs: target = attrs["target"] if target not in ZONE_TARGETS: raise FirewallError(errors.INVALID_TARGET, target) if target != "" and target != DEFAULT_ZONE_TARGET: self.item.target = target elif name == "forward": if self.item.forward: log.warning("Forward already set, ignoring.") else: self.item.forward = True elif name == "interface": if self._rule: log.warning('Invalid rule: interface use in rule.') self._rule_error = True return # zone bound to interface if "name" not in attrs: log.warning('Invalid interface: Name missing.') self._rule_error = True return if attrs["name"] not in self.item.interfaces: self.item.interfaces.append(attrs["name"]) else: log.warning("Interface '%s' already set, ignoring.", attrs["name"]) elif name == "source": if self._rule: if self._rule.source: log.warning("Invalid rule: More than one source in rule '%s', ignoring.", str(self._rule)) self._rule_error = True return invert = False if "invert" in attrs and \ attrs["invert"].lower() in [ "yes", "true" ]: invert = True addr = mac = ipset = None if "address" in attrs: addr = attrs["address"] if "mac" in attrs: mac = attrs["mac"] if "ipset" in attrs: ipset = attrs["ipset"] self._rule.source = rich.Rich_Source(addr, mac, ipset, invert=invert) return # zone bound to source if "address" not in attrs and "ipset" not in attrs: log.warning('Invalid source: No address no ipset.') return if "address" in attrs and "ipset" in attrs: log.warning('Invalid source: Address and ipset.') return if "family" in attrs: log.warning("Ignoring deprecated attribute family='%s'", attrs["family"]) if "invert" in attrs: log.warning('Invalid source: Invertion not allowed here.') return if "address" in attrs: if not checkIPnMask(attrs["address"]) and \ not checkIP6nMask(attrs["address"]) and \ not check_mac(attrs["address"]): raise FirewallError(errors.INVALID_ADDR, attrs["address"]) if "ipset" in attrs: entry = "ipset:%s" % attrs["ipset"] if entry not in self.item.sources: self.item.sources.append(entry) else: log.warning("Source '%s' already set, ignoring.", attrs["address"]) if "address" in attrs: entry = attrs["address"] if entry not in self.item.sources: self.item.sources.append(entry) else: log.warning("Source '%s' already set, ignoring.", attrs["address"]) elif name == "icmp-block-inversion": if self.item.icmp_block_inversion: log.warning("Icmp-Block-Inversion already set, ignoring.") else: self.item.icmp_block_inversion = True else: log.warning("Unknown XML element '%s'", name) return def endElement(self, name): IO_Object_ContentHandler.endElement(self, name) common_endElement(self, name) def zone_reader(filename, path, no_check_name=False): zone = Zone() if not filename.endswith(".xml"): raise FirewallError(errors.INVALID_NAME, "'%s' is missing .xml suffix" % filename) zone.name = filename[:-4] if not no_check_name: zone.check_name(zone.name) zone.filename = filename zone.path = path zone.builtin = False if path.startswith(config.ETC_FIREWALLD) else True zone.default = zone.builtin # new Zone() objects default this to True, but if reading on disk # configuration we have to assume False, because the absence of # <forward> element indicates False. Presence indicates True. zone.forward = False handler = zone_ContentHandler(zone) parser = sax.make_parser() parser.setContentHandler(handler) name = "%s/%s" % (path, filename) with open(name, "rb") as f: source = sax.InputSource(None) source.setByteStream(f) try: parser.parse(source) except sax.SAXParseException as msg: raise FirewallError(errors.INVALID_ZONE, "not a valid zone file: %s" % \ msg.getException()) del handler del parser return zone def zone_writer(zone, path=None): _path = path if path else zone.path if zone.filename: name = "%s/%s" % (_path, zone.filename) else: name = "%s/%s.xml" % (_path, zone.name) if os.path.exists(name): try: shutil.copy2(name, "%s.old" % name) except Exception as msg: log.error("Backup of file '%s' failed: %s", name, msg) dirpath = os.path.dirname(name) if dirpath.startswith(config.ETC_FIREWALLD) and not os.path.exists(dirpath): if not os.path.exists(config.ETC_FIREWALLD): os.mkdir(config.ETC_FIREWALLD, 0o750) os.mkdir(dirpath, 0o750) f = io.open(name, mode='wt', encoding='UTF-8') handler = IO_Object_XMLGenerator(f) handler.startDocument() # start zone element attrs = {} if zone.version and zone.version != "": attrs["version"] = zone.version if zone.target != DEFAULT_ZONE_TARGET: attrs["target"] = zone.target handler.startElement("zone", attrs) handler.ignorableWhitespace("\n") common_writer(zone, handler) # interfaces for interface in uniqify(zone.interfaces): handler.ignorableWhitespace(" ") handler.simpleElement("interface", { "name": interface }) handler.ignorableWhitespace("\n") # source for source in uniqify(zone.sources): handler.ignorableWhitespace(" ") if "ipset:" in source: handler.simpleElement("source", { "ipset": source[6:] }) else: handler.simpleElement("source", { "address": source }) handler.ignorableWhitespace("\n") # icmp-block-inversion if zone.icmp_block_inversion: handler.ignorableWhitespace(" ") handler.simpleElement("icmp-block-inversion", { }) handler.ignorableWhitespace("\n") # forward if zone.forward: handler.ignorableWhitespace(" ") handler.simpleElement("forward", { }) handler.ignorableWhitespace("\n") # end zone element handler.endElement("zone") handler.ignorableWhitespace("\n") handler.endDocument() f.close() del handler PK ���Z,E?|�< �< core/io/direct.pynu �[��� # -*- coding: utf-8 -*- # # Copyright (C) 2011-2016 Red Hat, Inc. # # Authors: # Thomas Woerner <twoerner@redhat.com> # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see <http://www.gnu.org/licenses/>. # import xml.sax as sax import os import io import shutil from firewall import config from firewall.fw_types import LastUpdatedOrderedDict from firewall.functions import splitArgs, joinArgs from firewall.core.io.io_object import IO_Object, IO_Object_ContentHandler, \ IO_Object_XMLGenerator from firewall.core.logger import log from firewall.core import ipXtables from firewall.core import ebtables from firewall import errors from firewall.errors import FirewallError class direct_ContentHandler(IO_Object_ContentHandler): def __init__(self, item): IO_Object_ContentHandler.__init__(self, item) self.direct = False def startElement(self, name, attrs): IO_Object_ContentHandler.startElement(self, name, attrs) self.item.parser_check_element_attrs(name, attrs) if name == "direct": if self.direct: raise FirewallError(errors.PARSE_ERROR, "More than one direct tag.") self.direct = True elif name == "chain": if not self.direct: log.error("Parse Error: chain outside of direct") return ipv = attrs["ipv"] table = attrs["table"] chain = attrs["chain"] self.item.add_chain(ipv, table, chain) elif name == "rule": if not self.direct: log.error("Parse Error: rule outside of direct") return ipv = attrs["ipv"] if ipv not in [ "ipv4", "ipv6", "eb" ]: raise FirewallError(errors.INVALID_IPV, "'%s' not from {'ipv4'|'ipv6'|'eb'}" % ipv) table = attrs["table"] chain = attrs["chain"] try: priority = int(attrs["priority"]) except ValueError: log.error("Parse Error: %s is not a valid priority" % attrs["priority"]) return self._rule = [ ipv, table, chain, priority ] elif name == "passthrough": if not self.direct: log.error("Parse Error: command outside of direct") return ipv = attrs["ipv"] self._passthrough = [ ipv ] else: log.error('Unknown XML element %s' % name) return def endElement(self, name): IO_Object_ContentHandler.endElement(self, name) if name == "rule": if self._element: # add arguments self._rule.append(splitArgs(self._element)) self.item.add_rule(*self._rule) else: log.error("Error: rule does not have any arguments, ignoring.") self._rule = None elif name == "passthrough": if self._element: # add arguments self._passthrough.append(splitArgs(self._element)) self.item.add_passthrough(*self._passthrough) else: log.error("Error: passthrough does not have any arguments, " + "ignoring.") self._passthrough = None class Direct(IO_Object): """ Direct class """ IMPORT_EXPORT_STRUCTURE = ( # chain: [ ipv, table, [ chain ] ] ( "chains", [ ( "", "", "" ), ], ), # a(sss) # rule: [ ipv, table, chain, [ priority, [ arg ] ] ] ( "rules", [ ( "", "", "", 0, [ "" ] ), ], ), # a(sssias) # passthrough: [ ipv, [ [ arg ] ] ] ( "passthroughs", [ ( "", [ "" ]), ], ), # a(sas) ) DBUS_SIGNATURE = '(a(sss)a(sssias)a(sas))' PARSER_REQUIRED_ELEMENT_ATTRS = { "direct": None, "chain": [ "ipv", "table", "chain" ], "rule": [ "ipv", "table", "chain", "priority" ], "passthrough": [ "ipv" ] } PARSER_OPTIONAL_ELEMENT_ATTRS = { } def __init__(self, filename): super(Direct, self).__init__() self.filename = filename self.chains = LastUpdatedOrderedDict() self.rules = LastUpdatedOrderedDict() self.passthroughs = LastUpdatedOrderedDict() def _check_config(self, conf, item, all_conf, all_io_objects): pass # check arg lists def export_config(self): ret = [ ] x = [ ] for key in self.chains: for chain in self.chains[key]: x.append(tuple(list(key) + list([chain]))) ret.append(x) x = [ ] for key in self.rules: for rule in self.rules[key]: x.append(tuple((key[0], key[1], key[2], rule[0], list(rule[1])))) ret.append(x) x = [ ] for key in self.passthroughs: for rule in self.passthroughs[key]: x.append(tuple((key, list(rule)))) ret.append(x) return tuple(ret) def import_config(self, conf, all_io_objects): self.cleanup() self.check_config(conf) for i,(element,dummy) in enumerate(self.IMPORT_EXPORT_STRUCTURE): if element == "chains": for x in conf[i]: self.add_chain(*x) if element == "rules": for x in conf[i]: self.add_rule(*x) if element == "passthroughs": for x in conf[i]: self.add_passthrough(*x) def cleanup(self): self.chains.clear() self.rules.clear() self.passthroughs.clear() def output(self): print("chains") for key in self.chains: print(" (%s, %s): %s" % (key[0], key[1], ",".join(self.chains[key]))) print("rules") for key in self.rules: print(" (%s, %s, %s):" % (key[0], key[1], key[2])) for (priority,args) in self.rules[key]: print(" (%d, ('%s'))" % (priority, "','".join(args))) print("passthroughs") for key in self.passthroughs: print(" %s:" % (key)) for args in self.passthroughs[key]: print(" ('%s')" % ("','".join(args))) def _check_ipv(self, ipv): ipvs = ['ipv4', 'ipv6', 'eb'] if ipv not in ipvs: raise FirewallError(errors.INVALID_IPV, "'%s' not in '%s'" % (ipv, ipvs)) def _check_ipv_table(self, ipv, table): self._check_ipv(ipv) tables = ipXtables.BUILT_IN_CHAINS.keys() if ipv in ['ipv4', 'ipv6'] \ else ebtables.BUILT_IN_CHAINS.keys() if table not in tables: raise FirewallError(errors.INVALID_TABLE, "'%s' not in '%s'" % (table, tables)) # chains def add_chain(self, ipv, table, chain): self._check_ipv_table(ipv, table) key = (ipv, table) if key not in self.chains: self.chains[key] = [ ] if chain not in self.chains[key]: self.chains[key].append(chain) else: log.warning("Chain '%s' for table '%s' with ipv '%s' " % \ (chain, table, ipv) + "already in list, ignoring") def remove_chain(self, ipv, table, chain): self._check_ipv_table(ipv, table) key = (ipv, table) if key in self.chains and chain in self.chains[key]: self.chains[key].remove(chain) if len(self.chains[key]) == 0: del self.chains[key] else: raise ValueError( \ "Chain '%s' with table '%s' with ipv '%s' not in list" % \ (chain, table, ipv)) def query_chain(self, ipv, table, chain): self._check_ipv_table(ipv, table) key = (ipv, table) return (key in self.chains and chain in self.chains[key]) def get_chains(self, ipv, table): self._check_ipv_table(ipv, table) key = (ipv, table) if key in self.chains: return self.chains[key] else: raise ValueError("No chains for table '%s' with ipv '%s'" % \ (table, ipv)) def get_all_chains(self): return self.chains # rules def add_rule(self, ipv, table, chain, priority, args): self._check_ipv_table(ipv, table) key = (ipv, table, chain) if key not in self.rules: self.rules[key] = LastUpdatedOrderedDict() value = (priority, tuple(args)) if value not in self.rules[key]: self.rules[key][value] = priority else: log.warning("Rule '%s' for table '%s' and chain '%s' " % \ ("',".join(args), table, chain) + "with ipv '%s' and priority %d " % (ipv, priority) + "already in list, ignoring") def remove_rule(self, ipv, table, chain, priority, args): self._check_ipv_table(ipv, table) key = (ipv, table, chain) value = (priority, tuple(args)) if key in self.rules and value in self.rules[key]: del self.rules[key][value] if len(self.rules[key]) == 0: del self.rules[key] else: raise ValueError("Rule '%s' for table '%s' and chain '%s' " % \ ("',".join(args), table, chain) + \ "with ipv '%s' and priority %d not in list" % (ipv, priority)) def remove_rules(self, ipv, table, chain): self._check_ipv_table(ipv, table) key = (ipv, table, chain) if key in self.rules: for value in self.rules[key].keys(): del self.rules[key][value] if len(self.rules[key]) == 0: del self.rules[key] def query_rule(self, ipv, table, chain, priority, args): self._check_ipv_table(ipv, table) key = (ipv, table, chain) value = (priority, tuple(args)) return (key in self.rules and value in self.rules[key]) def get_rules(self, ipv, table, chain): self._check_ipv_table(ipv, table) key = (ipv, table, chain) if key in self.rules: return self.rules[key] else: raise ValueError("No rules for table '%s' and chain '%s' " %\ (table, chain) + "with ipv '%s'" % (ipv)) def get_all_rules(self): return self.rules # # passthrough # def add_passthrough(self, ipv, args): self._check_ipv(ipv) if ipv not in self.passthroughs: self.passthroughs[ipv] = [ ] if args not in self.passthroughs[ipv]: self.passthroughs[ipv].append(args) else: log.warning("Passthrough '%s' for ipv '%s'" % \ ("',".join(args), ipv) + "already in list, ignoring") def remove_passthrough(self, ipv, args): self._check_ipv(ipv) if ipv in self.passthroughs and args in self.passthroughs[ipv]: self.passthroughs[ipv].remove(args) if len(self.passthroughs[ipv]) == 0: del self.passthroughs[ipv] else: raise ValueError("Passthrough '%s' for ipv '%s'" % \ ("',".join(args), ipv) + "not in list") def query_passthrough(self, ipv, args): self._check_ipv(ipv) return ipv in self.passthroughs and args in self.passthroughs[ipv] def get_passthroughs(self, ipv): self._check_ipv(ipv) if ipv in self.passthroughs: return self.passthroughs[ipv] else: raise ValueError("No passthroughs for ipv '%s'" % (ipv)) def get_all_passthroughs(self): return self.passthroughs # read def read(self): self.cleanup() if not self.filename.endswith(".xml"): raise FirewallError(errors.INVALID_NAME, "'%s' is missing .xml suffix" % self.filename) handler = direct_ContentHandler(self) parser = sax.make_parser() parser.setContentHandler(handler) with open(self.filename, "rb") as f: source = sax.InputSource(None) source.setByteStream(f) try: parser.parse(source) except sax.SAXParseException as msg: raise FirewallError(errors.INVALID_TYPE, "Not a valid file: %s" % \ msg.getException()) def write(self): if os.path.exists(self.filename): try: shutil.copy2(self.filename, "%s.old" % self.filename) except Exception as msg: raise IOError("Backup of '%s' failed: %s" % (self.filename, msg)) if not os.path.exists(config.ETC_FIREWALLD): os.mkdir(config.ETC_FIREWALLD, 0o750) f = io.open(self.filename, mode='wt', encoding='UTF-8') handler = IO_Object_XMLGenerator(f) handler.startDocument() # start whitelist element handler.startElement("direct", { }) handler.ignorableWhitespace("\n") # chains for key in self.chains: (ipv, table) = key for chain in self.chains[key]: handler.ignorableWhitespace(" ") handler.simpleElement("chain", { "ipv": ipv, "table": table, "chain": chain }) handler.ignorableWhitespace("\n") # rules for key in self.rules: (ipv, table, chain) = key for (priority, args) in self.rules[key]: if len(args) < 1: continue handler.ignorableWhitespace(" ") handler.startElement("rule", { "ipv": ipv, "table": table, "chain": chain, "priority": "%d" % priority }) handler.ignorableWhitespace(sax.saxutils.escape(joinArgs(args))) handler.endElement("rule") handler.ignorableWhitespace("\n") # passthroughs for ipv in self.passthroughs: for args in self.passthroughs[ipv]: if len(args) < 1: continue handler.ignorableWhitespace(" ") handler.startElement("passthrough", { "ipv": ipv }) handler.ignorableWhitespace(sax.saxutils.escape(joinArgs(args))) handler.endElement("passthrough") handler.ignorableWhitespace("\n") # end zone element handler.endElement("direct") handler.ignorableWhitespace("\n") handler.endDocument() f.close() del handler PK ���Z <�᭾ �� core/io/policy.pynu �[��� # -*- coding: utf-8 -*- # # SPDX-License-Identifier: GPL-2.0-or-later __all__ = [ "Policy", "policy_reader", "policy_writer" ] import xml.sax as sax import os import io import shutil from firewall import config from firewall.functions import ( checkIP, checkIP6, checkUINT16, coalescePortRange, max_policy_name_len, portInPortRange, portStr, uniqify, ) from firewall.core.base import DEFAULT_POLICY_TARGET, POLICY_TARGETS, DEFAULT_POLICY_PRIORITY from firewall.core.io.io_object import IO_Object, \ IO_Object_ContentHandler, IO_Object_XMLGenerator, check_port, \ check_tcpudp, check_protocol from firewall.core import rich from firewall.core.logger import log from firewall import errors from firewall.errors import FirewallError def common_startElement(obj, name, attrs): if name == "short": pass elif name == "description": pass elif name == "service": if obj._rule: if obj._rule.element: log.warning("Invalid rule: More than one element in rule '%s', ignoring.", str(obj._rule)) obj._rule_error = True return True obj._rule.element = rich.Rich_Service(attrs["name"]) return True if attrs["name"] not in obj.item.services: obj.item.services.append(attrs["name"]) else: log.warning("Service '%s' already set, ignoring.", attrs["name"]) elif name == "port": if obj._rule: if obj._rule.element: log.warning("Invalid rule: More than one element in rule '%s', ignoring.", str(obj._rule)) obj._rule_error = True return True obj._rule.element = rich.Rich_Port(attrs["port"], attrs["protocol"]) return True check_port(attrs["port"]) check_tcpudp(attrs["protocol"]) # coalesce and warn about overlapping ranges new_port_id = (portStr(attrs["port"], "-"), attrs["protocol"]) existing_port_ids = list(filter(lambda x: x[1] == attrs["protocol"], obj.item.ports)) for port_id in existing_port_ids: if portInPortRange(new_port_id[0], port_id[0]): # the range is wholly contained already, so just warn _name = obj.item.derived_from_zone if isinstance(obj.item, Policy) else obj.item.name log.warning(FirewallError(errors.ALREADY_ENABLED, "'%s:%s' already in '%s'" % (new_port_id[0], attrs["protocol"], _name))) break # for else: # the range can be coalesced into the existing set added_ranges, removed_ranges = coalescePortRange(new_port_id[0], [_port for (_port, _protocol) in existing_port_ids]) for _range in removed_ranges: entry = (portStr(_range, "-"), attrs["protocol"]) obj.item.ports.remove(entry) for _range in added_ranges: entry = (portStr(_range, "-"), attrs["protocol"]) obj.item.ports.append(entry) elif name == "protocol": if obj._rule: if obj._rule.element: log.warning("Invalid rule: More than one element in rule '%s', ignoring.", str(obj._rule)) obj._rule_error = True return True obj._rule.element = rich.Rich_Protocol(attrs["value"]) else: check_protocol(attrs["value"]) if attrs["value"] not in obj.item.protocols: obj.item.protocols.append(attrs["value"]) else: log.warning("Protocol '%s' already set, ignoring.", attrs["value"]) elif name == "tcp-mss-clamp": if obj._rule: if obj._rule.element: log.warning("Invalid rule: More than one element in rule '%s', ignoring.", str(obj._rule)) obj._rule_error = True return True _value="pmtu" if "value" in attrs: _value = attrs["value"] obj._rule.element = rich.Rich_Tcp_Mss_Clamp(_value) else: log.warning("Invalid rule: tcp-mss-clamp '%s' outside of rule", attrs["value"]) elif name == "icmp-block": if obj._rule: if obj._rule.element: log.warning("Invalid rule: More than one element in rule '%s', ignoring.", str(obj._rule)) obj._rule_error = True return True obj._rule.element = rich.Rich_IcmpBlock(attrs["name"]) return True if attrs["name"] not in obj.item.icmp_blocks: obj.item.icmp_blocks.append(attrs["name"]) else: log.warning("icmp-block '%s' already set, ignoring.", attrs["name"]) elif name == "icmp-type": if obj._rule: if obj._rule.element: log.warning("Invalid rule: More than one element in rule '%s', ignoring.", str(obj._rule)) obj._rule_error = True return True obj._rule.element = rich.Rich_IcmpType(attrs["name"]) return True else: log.warning("Invalid rule: icmp-block '%s' outside of rule", attrs["name"]) elif name == "masquerade": if obj._rule: if obj._rule.element: log.warning("Invalid rule: More than one element in rule '%s', ignoring.", str(obj._rule)) obj._rule_error = True return True obj._rule.element = rich.Rich_Masquerade() else: if obj.item.masquerade: log.warning("Masquerade already set, ignoring.") else: obj.item.masquerade = True elif name == "forward-port": to_port = "" if "to-port" in attrs: to_port = attrs["to-port"] to_addr = "" if "to-addr" in attrs: to_addr = attrs["to-addr"] if obj._rule: if obj._rule.element: log.warning("Invalid rule: More than one element in rule '%s', ignoring.", str(obj._rule)) obj._rule_error = True return True obj._rule.element = rich.Rich_ForwardPort(attrs["port"], attrs["protocol"], to_port, to_addr) return True check_port(attrs["port"]) check_tcpudp(attrs["protocol"]) if to_port: check_port(to_port) if to_addr: if not checkIP(to_addr) and not checkIP6(to_addr): raise FirewallError(errors.INVALID_ADDR, "to-addr '%s' is not a valid address" \ % to_addr) entry = (portStr(attrs["port"], "-"), attrs["protocol"], portStr(to_port, "-"), str(to_addr)) if entry not in obj.item.forward_ports: obj.item.forward_ports.append(entry) else: log.warning("Forward port %s/%s%s%s already set, ignoring.", attrs["port"], attrs["protocol"], " >%s" % to_port if to_port else "", " @%s" % to_addr if to_addr else "") elif name == "source-port": if obj._rule: if obj._rule.element: log.warning("Invalid rule: More than one element in rule '%s', ignoring.", str(obj._rule)) obj._rule_error = True return True obj._rule.element = rich.Rich_SourcePort(attrs["port"], attrs["protocol"]) return True check_port(attrs["port"]) check_tcpudp(attrs["protocol"]) # coalesce and warn about overlapping ranges new_port_id = (portStr(attrs["port"], "-"), attrs["protocol"]) existing_port_ids = list(filter(lambda x: x[1] == attrs["protocol"], obj.item.source_ports)) for port_id in existing_port_ids: if portInPortRange(new_port_id[0], port_id[0]): # the range is wholly contained already, so just warn _name = obj.item.derived_from_zone if isinstance(obj.item, Policy) else obj.item.name log.warning(FirewallError(errors.ALREADY_ENABLED, "'%s:%s' already in '%s'" % (new_port_id[0], attrs["protocol"], _name))) break # for else: # the range can be coalesced into the existing set added_ranges, removed_ranges = coalescePortRange(new_port_id[0], [_port for (_port, _protocol) in existing_port_ids]) for _range in removed_ranges: entry = (portStr(_range, "-"), attrs["protocol"]) obj.item.source_ports.remove(entry) for _range in added_ranges: entry = (portStr(_range, "-"), attrs["protocol"]) obj.item.source_ports.append(entry) elif name == "destination": if not obj._rule: log.warning('Invalid rule: Destination outside of rule') obj._rule_error = True return True if obj._rule.destination: log.warning("Invalid rule: More than one destination in rule '%s', ignoring.", str(obj._rule)) return True invert = False address = None if "address" in attrs: address = attrs["address"] ipset = None if "ipset" in attrs: ipset = attrs["ipset"] if "invert" in attrs and \ attrs["invert"].lower() in [ "yes", "true" ]: invert = True obj._rule.destination = rich.Rich_Destination(address, ipset, invert) elif name in [ "accept", "reject", "drop", "mark" ]: if not obj._rule: log.warning('Invalid rule: Action outside of rule') obj._rule_error = True return True if obj._rule.action: log.warning('Invalid rule: More than one action') obj._rule_error = True return True if name == "accept": obj._rule.action = rich.Rich_Accept() elif name == "reject": _type = None if "type" in attrs: _type = attrs["type"] obj._rule.action = rich.Rich_Reject(_type) elif name == "drop": obj._rule.action = rich.Rich_Drop() elif name == "mark": _set = attrs["set"] obj._rule.action = rich.Rich_Mark(_set) obj._limit_ok = obj._rule.action elif name == "log": if not obj._rule: log.warning('Invalid rule: Log outside of rule') return True if obj._rule.log: log.warning('Invalid rule: More than one log') return True level = None if "level" in attrs: level = attrs["level"] if level not in [ "emerg", "alert", "crit", "error", "warning", "notice", "info", "debug" ]: log.warning('Invalid rule: Invalid log level') obj._rule_error = True return True prefix = None if "prefix" in attrs: prefix = attrs["prefix"] if not prefix or len(prefix) > 127: log.warning('Invalid rule: Invalid log prefix') obj._rule_error = True return True obj._rule.log = rich.Rich_Log(prefix, level) obj._limit_ok = obj._rule.log elif name == "nflog": if not obj._rule: log.warning('Invalid rule: Log outside of rule') return True if obj._rule.log: log.warning('Invalid rule: More than one log') return True group = None if "group" in attrs: group = attrs["group"] if not checkUINT16(group): log.warning('Invalid rule: Invalid nflog group value') obj._rule_error = True return True prefix = None if "prefix" in attrs: prefix = attrs["prefix"] if not prefix or len(prefix) > 127: log.warning('Invalid rule: Invalid nflog prefix') obj._rule_error = True return True threshold = None if "queue-size" in attrs: threshold = attrs["queue-size"] if not checkUINT16(threshold): log.warning('Invalid rule: Invalid nflog queue-size') obj._rule_error = True return True obj._rule.log = rich.Rich_NFLog(group, prefix, threshold) obj._limit_ok = obj._rule.log elif name == "audit": if not obj._rule: log.warning('Invalid rule: Audit outside of rule') return True if obj._rule.audit: log.warning("Invalid rule: More than one audit in rule '%s', ignoring.", str(obj._rule)) obj._rule_error = True return True obj._rule.audit = rich.Rich_Audit() obj._limit_ok = obj._rule.audit elif name == "rule": family = None priority = 0 if "family" in attrs: family = attrs["family"] if family not in [ "ipv4", "ipv6" ]: log.warning('Invalid rule: Rule family "%s" invalid', attrs["family"]) obj._rule_error = True return True if "priority" in attrs: priority = int(attrs["priority"]) obj._rule = rich.Rich_Rule(family=family, priority=priority) elif name == "limit": if not obj._limit_ok: log.warning('Invalid rule: Limit outside of action, log and audit') obj._rule_error = True return True if obj._limit_ok.limit: log.warning("Invalid rule: More than one limit in rule '%s', ignoring.", str(obj._rule)) obj._rule_error = True return True value = attrs["value"] obj._limit_ok.limit = rich.Rich_Limit(value) else: return False return True def common_endElement(obj, name): if name == "rule": if not obj._rule_error: try: obj._rule.check() except Exception as e: log.warning("%s: %s", e, str(obj._rule)) else: if str(obj._rule) not in obj.item.rules_str: obj.item.rules.append(obj._rule) obj.item.rules_str.append(str(obj._rule)) else: log.warning("Rule '%s' already set, ignoring.", str(obj._rule)) obj._rule = None obj._rule_error = False elif name in [ "accept", "reject", "drop", "mark", "log", "audit" ]: obj._limit_ok = None def common_check_config(obj, config, item, all_config, all_io_objects): obj_type = "Policy" if isinstance(obj, Policy) else "Zone" if item == "services" and "services" in all_io_objects: existing_services = all_io_objects["services"] for service in config: if service not in existing_services: raise FirewallError(errors.INVALID_SERVICE, "{} '{}': '{}' not among existing services".format( obj_type, obj.name, service)) elif item == "ports": for port in config: check_port(port[0]) check_tcpudp(port[1]) elif item == "protocols": for proto in config: check_protocol(proto) elif item == "icmp_blocks" and "icmptypes" in all_io_objects: existing_icmptypes = all_io_objects["icmptypes"] for icmptype in config: if icmptype not in existing_icmptypes: ex = FirewallError(errors.INVALID_ICMPTYPE, "{} '{}': '{}' not among existing ICMP types".format( obj_type, obj.name, icmptype)) if icmptype in all_io_objects.get("icmptypes_unsupported", {}): log.debug1("{} (unsupported)".format(ex)) else: raise ex elif item == "forward_ports": for fwd_port in config: check_port(fwd_port[0]) check_tcpudp(fwd_port[1]) if not fwd_port[2] and not fwd_port[3]: raise FirewallError(errors.INVALID_FORWARD, "{} '{}': '{}' is missing to-port AND to-addr ".format( obj_type, obj.name, fwd_port)) if fwd_port[2]: check_port(fwd_port[2]) if fwd_port[3]: if not checkIP(fwd_port[3]) and not checkIP6(fwd_port[3]): raise FirewallError(errors.INVALID_ADDR, "{} '{}': to-addr '{}' is not a valid address".format( obj_type, obj.name, fwd_port[3])) elif item == "source_ports": for port in config: check_port(port[0]) check_tcpudp(port[1]) elif item in ["rules_str", "rich_rules"]: for rule in config: obj_rich = rich.Rich_Rule(rule_str=rule) if obj_rich.element and "icmptypes" in all_io_objects and \ (isinstance(obj_rich.element, rich.Rich_IcmpBlock) or isinstance(obj_rich.element, rich.Rich_IcmpType)): existing_icmptypes = all_io_objects["icmptypes"] if obj_rich.element.name not in existing_icmptypes: ex = FirewallError(errors.INVALID_ICMPTYPE, "{} '{}': '{}' not among existing ICMP types".format( obj_type, obj.name, obj_rich.element.name)) if obj_rich.element.name in all_io_objects.get("icmptypes_unsupported", {}): log.debug1("{} (unsupported)".format(ex)) else: raise ex elif obj_rich.family: ict = all_io_objects["icmptypes"][obj_rich.element.name] if ict.destination and obj_rich.family not in ict.destination: ex = FirewallError(errors.INVALID_ICMPTYPE, "{} '{}': rich rule family '{}' conflicts with icmp type '{}'".format( obj_type, obj.name, obj_rich.family, obj_rich.element.name)) ict_unsupported = all_io_objects.get("icmptypes_unsupported", {}).get(obj_rich.element.name) if ict_unsupported and ict_unsupported.destination and \ obj_rich.family in ict_unsupported.destination: log.debug1("{} (unsupported)".format(ex)) else: raise ex def common_writer(obj, handler): # short if obj.short and obj.short != "": handler.ignorableWhitespace(" ") handler.startElement("short", { }) handler.characters(obj.short) handler.endElement("short") handler.ignorableWhitespace("\n") # description if obj.description and obj.description != "": handler.ignorableWhitespace(" ") handler.startElement("description", { }) handler.characters(obj.description) handler.endElement("description") handler.ignorableWhitespace("\n") # services for service in uniqify(obj.services): handler.ignorableWhitespace(" ") handler.simpleElement("service", { "name": service }) handler.ignorableWhitespace("\n") # ports for port in uniqify(obj.ports): handler.ignorableWhitespace(" ") handler.simpleElement("port", { "port": port[0], "protocol": port[1] }) handler.ignorableWhitespace("\n") # protocols for protocol in uniqify(obj.protocols): handler.ignorableWhitespace(" ") handler.simpleElement("protocol", { "value": protocol }) handler.ignorableWhitespace("\n") # icmp-blocks for icmp in uniqify(obj.icmp_blocks): handler.ignorableWhitespace(" ") handler.simpleElement("icmp-block", { "name": icmp }) handler.ignorableWhitespace("\n") # masquerade if obj.masquerade: handler.ignorableWhitespace(" ") handler.simpleElement("masquerade", { }) handler.ignorableWhitespace("\n") # forward-ports for forward in uniqify(obj.forward_ports): handler.ignorableWhitespace(" ") attrs = { "port": forward[0], "protocol": forward[1] } if forward[2] and forward[2] != "" : attrs["to-port"] = forward[2] if forward[3] and forward[3] != "" : attrs["to-addr"] = forward[3] handler.simpleElement("forward-port", attrs) handler.ignorableWhitespace("\n") # source-ports for port in uniqify(obj.source_ports): handler.ignorableWhitespace(" ") handler.simpleElement("source-port", { "port": port[0], "protocol": port[1] }) handler.ignorableWhitespace("\n") # rules for rule in obj.rules: attrs = { } if rule.family: attrs["family"] = rule.family if rule.priority != 0: attrs["priority"] = str(rule.priority) handler.ignorableWhitespace(" ") handler.startElement("rule", attrs) handler.ignorableWhitespace("\n") # source if rule.source: attrs = { } if rule.source.addr: attrs["address"] = rule.source.addr if rule.source.mac: attrs["mac"] = rule.source.mac if rule.source.ipset: attrs["ipset"] = rule.source.ipset if rule.source.invert: attrs["invert"] = "True" handler.ignorableWhitespace(" ") handler.simpleElement("source", attrs) handler.ignorableWhitespace("\n") # destination if rule.destination: attrs = { } if rule.destination.addr: attrs["address"] = rule.destination.addr if rule.destination.ipset: attrs["ipset"] = rule.destination.ipset if rule.destination.invert: attrs["invert"] = "True" handler.ignorableWhitespace(" ") handler.simpleElement("destination", attrs) handler.ignorableWhitespace("\n") # element if rule.element: element = "" attrs = { } if type(rule.element) == rich.Rich_Service: element = "service" attrs["name"] = rule.element.name elif type(rule.element) == rich.Rich_Port: element = "port" attrs["port"] = rule.element.port attrs["protocol"] = rule.element.protocol elif type(rule.element) == rich.Rich_Protocol: element = "protocol" attrs["value"] = rule.element.value elif type(rule.element) == rich.Rich_Tcp_Mss_Clamp: element = "tcp-mss-clamp" attrs["value"] = rule.element.value elif type(rule.element) == rich.Rich_Masquerade: element = "masquerade" elif type(rule.element) == rich.Rich_IcmpBlock: element = "icmp-block" attrs["name"] = rule.element.name elif type(rule.element) == rich.Rich_IcmpType: element = "icmp-type" attrs["name"] = rule.element.name elif type(rule.element) == rich.Rich_ForwardPort: element = "forward-port" attrs["port"] = rule.element.port attrs["protocol"] = rule.element.protocol if rule.element.to_port != "": attrs["to-port"] = rule.element.to_port if rule.element.to_address != "": attrs["to-addr"] = rule.element.to_address elif type(rule.element) == rich.Rich_SourcePort: element = "source-port" attrs["port"] = rule.element.port attrs["protocol"] = rule.element.protocol else: raise FirewallError( errors.INVALID_OBJECT, "Unknown element '%s' in obj_writer" % type(rule.element)) handler.ignorableWhitespace(" ") handler.simpleElement(element, attrs) handler.ignorableWhitespace("\n") # rule.element # log if rule.log: if type(rule.log) == rich.Rich_Log: attrs = { } if rule.log.prefix: attrs["prefix"] = rule.log.prefix if rule.log.level: attrs["level"] = rule.log.level if rule.log.limit: handler.ignorableWhitespace(" ") handler.startElement("log", attrs) handler.ignorableWhitespace("\n ") handler.simpleElement("limit", { "value": rule.log.limit.value }) handler.ignorableWhitespace("\n ") handler.endElement("log") else: handler.ignorableWhitespace(" ") handler.simpleElement("log", attrs) handler.ignorableWhitespace("\n") else: attrs = { } if rule.log.group: attrs["group"] = rule.log.group if rule.log.prefix: attrs["prefix"] = rule.log.prefix if rule.log.threshold: attrs["queue-size"] = rule.log.threshold if rule.log.limit: handler.ignorableWhitespace(" ") handler.startElement("nflog", attrs) handler.ignorableWhitespace("\n ") handler.simpleElement("limit", { "value": rule.log.limit.value }) handler.ignorableWhitespace("\n ") handler.endElement("nflog") else: handler.ignorableWhitespace(" ") handler.simpleElement("nflog", attrs) handler.ignorableWhitespace("\n") # audit if rule.audit: attrs = {} if rule.audit.limit: handler.ignorableWhitespace(" ") handler.startElement("audit", { }) handler.ignorableWhitespace("\n ") handler.simpleElement("limit", { "value": rule.audit.limit.value }) handler.ignorableWhitespace("\n ") handler.endElement("audit") else: handler.ignorableWhitespace(" ") handler.simpleElement("audit", attrs) handler.ignorableWhitespace("\n") # action if rule.action: action = "" attrs = { } if type(rule.action) == rich.Rich_Accept: action = "accept" elif type(rule.action) == rich.Rich_Reject: action = "reject" if rule.action.type: attrs["type"] = rule.action.type elif type(rule.action) == rich.Rich_Drop: action = "drop" elif type(rule.action) == rich.Rich_Mark: action = "mark" attrs["set"] = rule.action.set else: log.warning("Unknown action '%s'", type(rule.action)) if rule.action.limit: handler.ignorableWhitespace(" ") handler.startElement(action, attrs) handler.ignorableWhitespace("\n ") handler.simpleElement("limit", { "value": rule.action.limit.value }) handler.ignorableWhitespace("\n ") handler.endElement(action) else: handler.ignorableWhitespace(" ") handler.simpleElement(action, attrs) handler.ignorableWhitespace("\n") handler.ignorableWhitespace(" ") handler.endElement("rule") handler.ignorableWhitespace("\n") class Policy(IO_Object): priority_min = -32768 priority_max = 32767 priority_default = DEFAULT_POLICY_PRIORITY priority_reserved = [0] IMPORT_EXPORT_STRUCTURE = ( ( "version", "" ), # s ( "short", "" ), # s ( "description", "" ), # s ( "target", "" ), # s ( "services", [ "", ], ), # as ( "ports", [ ( "", "" ), ], ), # a(ss) ( "icmp_blocks", [ "", ], ), # as ( "masquerade", False ), # b ( "forward_ports", [ ( "", "", "", "" ), ], ), # a(ssss) ( "rich_rules", [ "" ] ), # as ( "protocols", [ "", ], ), # as ( "source_ports", [ ( "", "" ), ], ), # a(ss) ( "priority", 0 ), # i ( "ingress_zones", [ "" ] ), # as ( "egress_zones", [ "" ] ), # as ) ADDITIONAL_ALNUM_CHARS = [ "_", "-", "/" ] PARSER_REQUIRED_ELEMENT_ATTRS = { "short": None, "description": None, "policy": ["target"], "service": [ "name" ], "port": [ "port", "protocol" ], "icmp-block": [ "name" ], "icmp-type": [ "name" ], "masquerade": None, "forward-port": [ "port", "protocol" ], "rule": None, "source": None, "destination": None, "protocol": [ "value" ], "source-port": [ "port", "protocol" ], "log": None, "nflog": None, "audit": None, "accept": None, "reject": None, "drop": None, "mark": [ "set" ], "limit": [ "value" ], "ingress-zone": [ "name" ], "egress-zone": [ "name" ], } PARSER_OPTIONAL_ELEMENT_ATTRS = { "policy": [ "version", "priority" ], "forward-port": [ "to-port", "to-addr" ], "rule": [ "family", "priority" ], "source": [ "address", "mac", "invert", "family", "ipset" ], "destination": [ "address", "invert", "ipset" ], "log": [ "prefix", "level" ], "nflog": [ "group", "prefix", "queue-size" ], "reject": [ "type" ], "tcp-mss-clamp": [ "value" ], } def __init__(self): super(Policy, self).__init__() self.version = "" self.short = "" self.description = "" self.target = DEFAULT_POLICY_TARGET self.services = [ ] self.ports = [ ] self.protocols = [ ] self.icmp_blocks = [ ] self.icmp_block_inversion = False # for zones, not written to policy config self.masquerade = False self.forward_ports = [ ] self.source_ports = [ ] self.rules = [ ] self.rules_str = [ ] self.applied = False self.priority = self.priority_default self.derived_from_zone = None self.ingress_zones = [] self.egress_zones = [] def cleanup(self): self.version = "" self.short = "" self.description = "" self.target = DEFAULT_POLICY_TARGET del self.services[:] del self.ports[:] del self.protocols[:] del self.icmp_blocks[:] self.icmp_block_inversion = False self.masquerade = False del self.forward_ports[:] del self.source_ports[:] del self.rules[:] del self.rules_str[:] self.applied = False self.priority = self.priority_default del self.ingress_zones[:] del self.egress_zones[:] def __getattr__(self, name): if name == "rich_rules": return self.rules_str else: return getattr(super(Policy, self), name) def __setattr__(self, name, value): if name == "rich_rules": self.rules = [rich.Rich_Rule(rule_str=s) for s in value] # must convert back to string to get the canonical string. self.rules_str = [str(s) for s in self.rules] else: super(Policy, self).__setattr__(name, value) def _check_config(self, config, item, all_config, all_io_objects): common_check_config(self, config, item, all_config, all_io_objects) if self.name in all_io_objects["zones"]: raise FirewallError(errors.NAME_CONFLICT, "Policy '{}': Can't have the same name as a zone.".format(self.name)) if item == "target": if config not in POLICY_TARGETS: raise FirewallError(errors.INVALID_TARGET, "Policy '{}': '{}' is invalid target".format(self.name, config)) elif item == "priority": if config in self.priority_reserved or \ config > self.priority_max or \ config < self.priority_min: raise FirewallError(errors.INVALID_PRIORITY, "Policy '{}': {} is invalid priority. Must be in range [{}, {}]. The following are reserved: {}".format( self.name, config, self.priority_min, self.priority_max, self.priority_reserved)) elif item in ["ingress_zones", "egress_zones"]: existing_zones = ["ANY", "HOST"] + list(all_io_objects["zones"].keys()) for zone in config: if zone not in existing_zones: raise FirewallError(errors.INVALID_ZONE, "Policy '{}': '{}' not among existing zones".format( self.name, zone)) if ((zone not in ["ANY", "HOST"] and (set(["ANY", "HOST"]) & set(config))) or \ (zone in ["ANY", "HOST"] and (set(config) - set([zone])))): raise FirewallError(errors.INVALID_ZONE, "Policy '{}': '{}' may only contain one of: many regular zones, ANY, or HOST".format( self.name, item)) if zone == "HOST" and \ ((item == "ingress_zones" and "egress_zones" in all_config and "HOST" in all_config["egress_zones"]) or \ (item == "egress_zones" and "ingress_zones" in all_config and "HOST" in all_config["ingress_zones"])): raise FirewallError(errors.INVALID_ZONE, "Policy '{}': 'HOST' can only appear in either ingress or egress zones, but not both".format( self.name)) elif item == "masquerade" and config: if "egress_zones" in all_config and "HOST" in all_config["egress_zones"]: raise FirewallError(errors.INVALID_ZONE, "Policy '{}': 'masquerade' is invalid for egress zone 'HOST'".format( self.name)) elif "ingress_zones" in all_config: if "HOST" in all_config["ingress_zones"]: raise FirewallError(errors.INVALID_ZONE, "Policy '{}': 'masquerade' is invalid for ingress zone 'HOST'".format( self.name)) for zone in all_config["ingress_zones"]: if zone == "ANY": continue if zone not in all_io_objects["zones"]: raise FirewallError(errors.INVALID_ZONE, "Policy '{}': Zone '{}' does not exist.".format(self.name, zone)) if all_io_objects["zones"][zone].interfaces: raise FirewallError(errors.INVALID_ZONE, "Policy '{}': 'masquerade' cannot be used because ingress zone '{}' has assigned interfaces. ".format(self.name, zone)) elif item == "rich_rules": for rule in config: obj = rich.Rich_Rule(rule_str=rule) if obj.element and isinstance(obj.element, rich.Rich_Masquerade): if "egress_zones" in all_config and "HOST" in all_config["egress_zones"]: raise FirewallError(errors.INVALID_ZONE, "Policy '{}': 'masquerade' is invalid for egress zone 'HOST'".format( self.name)) elif "ingress_zones" in all_config: if "HOST" in all_config["ingress_zones"]: raise FirewallError(errors.INVALID_ZONE, "Policy '{}': 'masquerade' is invalid for ingress zone 'HOST'".format( self.name)) for zone in all_config["ingress_zones"]: if zone == "ANY": continue if zone not in all_io_objects["zones"]: raise FirewallError(errors.INVALID_ZONE, "Policy '{}': Zone '{}' does not exist.".format(self.name, zone)) if all_io_objects["zones"][zone].interfaces: raise FirewallError(errors.INVALID_ZONE, "Policy '{}': 'masquerade' cannot be used because ingress zone '{}' has assigned interfaces. ".format(self.name, zone)) elif obj.element and isinstance(obj.element, rich.Rich_ForwardPort): if "egress_zones" in all_config: if "HOST" in all_config["egress_zones"]: if obj.element.to_address: raise FirewallError(errors.INVALID_FORWARD, "Policy '{}': A 'forward-port' with 'to-addr' is invalid for egress zone 'HOST'".format( self.name)) elif all_config["egress_zones"]: if not obj.element.to_address: raise FirewallError(errors.INVALID_FORWARD, "Policy '{}': 'forward-port' requires 'to-addr' if egress zone is 'ANY' or a zone".format( self.name)) if "ANY" not in all_config["egress_zones"]: for zone in all_config["egress_zones"]: if zone not in all_io_objects["zones"]: raise FirewallError(errors.INVALID_ZONE, "Policy '{}': Zone '{}' does not exist.".format(self.name, zone)) if all_io_objects["zones"][zone].interfaces: raise FirewallError(errors.INVALID_ZONE, "Policy '{}': 'forward-port' cannot be used because egress zone '{}' has assigned interfaces".format(self.name, zone)) elif obj.action and isinstance(obj.action, rich.Rich_Mark): if "egress_zones" in all_config: for zone in all_config["egress_zones"]: if zone in ["ANY", "HOST"]: continue if zone not in all_io_objects["zones"]: raise FirewallError(errors.INVALID_ZONE, "Policy '{}': Zone '{}' does not exist.".format(self.name, zone)) if all_io_objects["zones"][zone].interfaces: raise FirewallError(errors.INVALID_ZONE, "Policy '{}': 'mark' action cannot be used because egress zone '{}' has assigned interfaces".format(self.name, zone)) elif item == "forward_ports": for fwd_port in config: if "egress_zones" in all_config: if "HOST" in all_config["egress_zones"]: if fwd_port[3]: raise FirewallError(errors.INVALID_FORWARD, "Policy '{}': A 'forward-port' with 'to-addr' is invalid for egress zone 'HOST'".format( self.name)) elif all_config["egress_zones"]: if not fwd_port[3]: raise FirewallError(errors.INVALID_FORWARD, "Policy '{}': 'forward-port' requires 'to-addr' if egress zone is 'ANY' or a zone".format( self.name)) if "ANY" not in all_config["egress_zones"]: for zone in all_config["egress_zones"]: if zone not in all_io_objects["zones"]: raise FirewallError(errors.INVALID_ZONE, "Policy '{}': Zone '{}' does not exist.".format(self.name, zone)) if all_io_objects["zones"][zone].interfaces: raise FirewallError(errors.INVALID_ZONE, "Policy '{}': 'forward-port' cannot be used because egress zone '{}' has assigned interfaces".format(self.name, zone)) def check_name(self, name): super(Policy, self).check_name(name) if name.startswith('/'): raise FirewallError(errors.INVALID_NAME, "Policy '{}': name can't start with '/'".format(name)) elif name.endswith('/'): raise FirewallError(errors.INVALID_NAME, "Policy '{}': name can't end with '/'".format(name)) elif name.count('/') > 1: raise FirewallError(errors.INVALID_NAME, "Policy '{}': name has more than one '/'".format(name)) else: if "/" in name: checked_name = name[:name.find('/')] else: checked_name = name if len(checked_name) > max_policy_name_len(): raise FirewallError(errors.INVALID_NAME, "Policy '{}': name has {} chars, max is {}".format( name, len(checked_name), max_policy_name_len())) # PARSER class policy_ContentHandler(IO_Object_ContentHandler): def __init__(self, item): IO_Object_ContentHandler.__init__(self, item) self._rule = None self._rule_error = False self._limit_ok = None def startElement(self, name, attrs): IO_Object_ContentHandler.startElement(self, name, attrs) if self._rule_error: return self.item.parser_check_element_attrs(name, attrs) if common_startElement(self, name, attrs): return elif name == "policy": if "version" in attrs: self.item.version = attrs["version"] if "priority" in attrs: self.item.priority = int(attrs["priority"]) if "target" in attrs: target = attrs["target"] if target not in POLICY_TARGETS: raise FirewallError(errors.INVALID_TARGET, target) if target: self.item.target = target elif name == "ingress-zone": if attrs["name"] not in self.item.ingress_zones: self.item.ingress_zones.append(attrs["name"]) else: log.warning("Ingress zone '%s' already set, ignoring.", attrs["name"]) elif name == "egress-zone": if attrs["name"] not in self.item.egress_zones: self.item.egress_zones.append(attrs["name"]) else: log.warning("Egress zone '%s' already set, ignoring.", attrs["name"]) elif name == "source": if not self._rule: log.warning('Invalid rule: Source outside of rule') self._rule_error = True return if self._rule.source: log.warning("Invalid rule: More than one source in rule '%s', ignoring.", str(self._rule)) self._rule_error = True return invert = False if "invert" in attrs and \ attrs["invert"].lower() in [ "yes", "true" ]: invert = True addr = mac = ipset = None if "address" in attrs: addr = attrs["address"] if "mac" in attrs: mac = attrs["mac"] if "ipset" in attrs: ipset = attrs["ipset"] self._rule.source = rich.Rich_Source(addr, mac, ipset, invert=invert) return else: log.warning("Unknown XML element '%s'", name) return def endElement(self, name): IO_Object_ContentHandler.endElement(self, name) common_endElement(self, name) def policy_reader(filename, path, no_check_name=False): policy = Policy() if not filename.endswith(".xml"): raise FirewallError(errors.INVALID_NAME, "'%s' is missing .xml suffix" % filename) policy.name = filename[:-4] if not no_check_name: policy.check_name(policy.name) policy.filename = filename policy.path = path policy.builtin = False if path.startswith(config.ETC_FIREWALLD) else True policy.default = policy.builtin handler = policy_ContentHandler(policy) parser = sax.make_parser() parser.setContentHandler(handler) name = "%s/%s" % (path, filename) with open(name, "rb") as f: source = sax.InputSource(None) source.setByteStream(f) try: parser.parse(source) except sax.SAXParseException as msg: raise FirewallError(errors.INVALID_POLICY, "not a valid policy file: %s" % \ msg.getException()) del handler del parser return policy def policy_writer(policy, path=None): _path = path if path else policy.path if policy.filename: name = "%s/%s" % (_path, policy.filename) else: name = "%s/%s.xml" % (_path, policy.name) if os.path.exists(name): try: shutil.copy2(name, "%s.old" % name) except Exception as msg: log.error("Backup of file '%s' failed: %s", name, msg) dirpath = os.path.dirname(name) if dirpath.startswith(config.ETC_FIREWALLD) and not os.path.exists(dirpath): if not os.path.exists(config.ETC_FIREWALLD): os.mkdir(config.ETC_FIREWALLD, 0o750) os.mkdir(dirpath, 0o750) f = io.open(name, mode='wt', encoding='UTF-8') handler = IO_Object_XMLGenerator(f) handler.startDocument() # start policy element attrs = {} if policy.version and policy.version != "": attrs["version"] = policy.version if policy.priority != policy.priority_default: attrs["priority"] = str(policy.priority) attrs["target"] = policy.target handler.startElement("policy", attrs) handler.ignorableWhitespace("\n") common_writer(policy, handler) # ingress-zones for zone in uniqify(policy.ingress_zones): handler.ignorableWhitespace(" ") handler.simpleElement("ingress-zone", { "name": zone }) handler.ignorableWhitespace("\n") # egress-zones for zone in uniqify(policy.egress_zones): handler.ignorableWhitespace(" ") handler.simpleElement("egress-zone", { "name": zone }) handler.ignorableWhitespace("\n") # end policy element handler.endElement("policy") handler.ignorableWhitespace("\n") handler.endDocument() f.close() del handler PK ���ZT���- �- core/io/io_object.pynu �[��� # -*- coding: utf-8 -*- # # Copyright (C) 2011-2016 Red Hat, Inc. # # Authors: # Thomas Woerner <twoerner@redhat.com> # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see <http://www.gnu.org/licenses/>. # """Generic io_object handler, io specific check methods.""" __all__ = [ "IO_Object", "IO_Object_ContentHandler", "IO_Object_XMLGenerator", "check_port", "check_tcpudp", "check_protocol", "check_address" ] import xml.sax as sax import xml.sax.saxutils as saxutils import copy from collections import OrderedDict from firewall import functions from firewall import errors from firewall.errors import FirewallError class IO_Object(object): """ Abstract IO_Object as base for icmptype, service and zone """ IMPORT_EXPORT_STRUCTURE = ( ) DBUS_SIGNATURE = '()' ADDITIONAL_ALNUM_CHARS = [ ] # additional to alnum PARSER_REQUIRED_ELEMENT_ATTRS = { } PARSER_OPTIONAL_ELEMENT_ATTRS = { } def __init__(self): self.filename = "" self.path = "" self.name = "" self.default = False self.builtin = False def export_config(self): ret = [ ] for x in self.IMPORT_EXPORT_STRUCTURE: ret.append(copy.deepcopy(getattr(self, x[0]))) return tuple(ret) def export_config_dict(self): conf = {} type_formats = dict([(x[0], x[1]) for x in self.IMPORT_EXPORT_STRUCTURE]) for key in type_formats: if getattr(self, key) or isinstance(getattr(self, key), bool): conf[key] = copy.deepcopy(getattr(self, key)) return conf def import_config(self, conf, all_io_objects): self.check_config(conf, all_io_objects) for i,(element,dummy) in enumerate(self.IMPORT_EXPORT_STRUCTURE): if isinstance(conf[i], list): # remove duplicates without changing the order _conf = [ ] _set = set() for x in conf[i]: if x not in _set: _conf.append(x) _set.add(x) del _set setattr(self, element, copy.deepcopy(_conf)) else: setattr(self, element, copy.deepcopy(conf[i])) def import_config_dict(self, conf, all_io_objects): self.check_config_dict(conf, all_io_objects) for key in conf: if not hasattr(self, key): raise FirewallError(errors.UNKNOWN_ERROR, "Internal error. '{}' is not a valid attribute".format(key)) if isinstance(conf[key], list): # maintain list order while removing duplicates setattr(self, key, list(OrderedDict.fromkeys(copy.deepcopy(conf[key])))) else: setattr(self, key, copy.deepcopy(conf[key])) def check_name(self, name): if not isinstance(name, str): raise FirewallError(errors.INVALID_TYPE, "'%s' not of type %s, but %s" % (name, type(""), type(name))) if len(name) < 1: raise FirewallError(errors.INVALID_NAME, "name can't be empty") for char in name: if not char.isalnum() and char not in self.ADDITIONAL_ALNUM_CHARS: raise FirewallError( errors.INVALID_NAME, "'%s' is not allowed in '%s'" % ((char, name))) def check_config(self, conf, all_io_objects={}): if len(conf) != len(self.IMPORT_EXPORT_STRUCTURE): raise FirewallError( errors.INVALID_TYPE, "structure size mismatch %d != %d" % \ (len(conf), len(self.IMPORT_EXPORT_STRUCTURE))) conf_dict = {} for i,(x,y) in enumerate(self.IMPORT_EXPORT_STRUCTURE): conf_dict[x] = conf[i] self.check_config_dict(conf_dict, all_io_objects) def check_config_dict(self, conf, all_io_objects): type_formats = dict([(x[0], x[1]) for x in self.IMPORT_EXPORT_STRUCTURE]) for key in conf: if key not in [x for (x,y) in self.IMPORT_EXPORT_STRUCTURE]: raise FirewallError(errors.INVALID_OPTION, "option '{}' is not valid".format(key)) self._check_config_structure(conf[key], type_formats[key]) self._check_config(conf[key], key, conf, all_io_objects) def _check_config(self, dummy1, dummy2, dummy3, dummy4): # to be overloaded by sub classes return def _check_config_structure(self, conf, structure): if not isinstance(conf, type(structure)): raise FirewallError(errors.INVALID_TYPE, "'%s' not of type %s, but %s" % \ (conf, type(structure), type(conf))) if isinstance(structure, list): # same type elements, else struct if len(structure) != 1: raise FirewallError(errors.INVALID_TYPE, "len('%s') != 1" % structure) for x in conf: self._check_config_structure(x, structure[0]) elif isinstance(structure, tuple): if len(structure) != len(conf): raise FirewallError(errors.INVALID_TYPE, "len('%s') != %d" % (conf, len(structure))) for i,value in enumerate(structure): self._check_config_structure(conf[i], value) elif isinstance(structure, dict): # only one key value pair in structure (skey, svalue) = list(structure.items())[0] for (key, value) in conf.items(): if not isinstance(key, type(skey)): raise FirewallError(errors.INVALID_TYPE, "'%s' not of type %s, but %s" % (\ key, type(skey), type(key))) if not isinstance(value, type(svalue)): raise FirewallError(errors.INVALID_TYPE, "'%s' not of type %s, but %s" % (\ value, type(svalue), type(value))) # check required elements and attributes and also optional attributes def parser_check_element_attrs(self, name, attrs): _attrs = attrs.getNames() found = False if name in self.PARSER_REQUIRED_ELEMENT_ATTRS: found = True if self.PARSER_REQUIRED_ELEMENT_ATTRS[name] is not None: for x in self.PARSER_REQUIRED_ELEMENT_ATTRS[name]: if x in _attrs: _attrs.remove(x) else: raise FirewallError( errors.PARSE_ERROR, "Missing attribute %s for %s" % (x, name)) if name in self.PARSER_OPTIONAL_ELEMENT_ATTRS: found = True for x in self.PARSER_OPTIONAL_ELEMENT_ATTRS[name]: if x in _attrs: _attrs.remove(x) if not found: raise FirewallError(errors.PARSE_ERROR, "Unexpected element %s" % name) # raise attributes[0] for x in _attrs: raise FirewallError(errors.PARSE_ERROR, "%s: Unexpected attribute %s" % (name, x)) # PARSER class UnexpectedElementError(Exception): def __init__(self, name): super(UnexpectedElementError, self).__init__() self.name = name def __str__(self): return "Unexpected element '%s'" % (self.name) class MissingAttributeError(Exception): def __init__(self, name, attribute): super(MissingAttributeError, self).__init__() self.name = name self.attribute = attribute def __str__(self): return "Element '%s': missing '%s' attribute" % \ (self.name, self.attribute) class UnexpectedAttributeError(Exception): def __init__(self, name, attribute): super(UnexpectedAttributeError, self).__init__() self.name = name self.attribute = attribute def __str__(self): return "Element '%s': unexpected attribute '%s'" % \ (self.name, self.attribute) class IO_Object_ContentHandler(sax.handler.ContentHandler): def __init__(self, item): self.item = item self._element = "" def startDocument(self): self._element = "" def startElement(self, name, attrs): self._element = "" def endElement(self, name): if name == "short": self.item.short = self._element elif name == "description": self.item.description = self._element def characters(self, content): self._element += content.replace('\n', ' ') class IO_Object_XMLGenerator(saxutils.XMLGenerator): def __init__(self, out): # fix memory leak in saxutils.XMLGenerator.__init__: # out = _gettextwriter(out, encoding) # creates unbound object results in garbage in gc # # saxutils.XMLGenerator.__init__(self, out, "utf-8") # replaced by modified saxutils.XMLGenerator.__init__ code: sax.handler.ContentHandler.__init__(self) self._write = out.write self._flush = out.flush self._ns_contexts = [{}] # contains uri -> prefix dicts self._current_context = self._ns_contexts[-1] self._undeclared_ns_maps = [] self._encoding = "utf-8" self._pending_start_element = False self._short_empty_elements = False def simpleElement(self, name, attrs): """ slightly modified startElement() """ self._write('<' + name) for (name, value) in attrs.items(): self._write(' %s=%s' % (name, saxutils.quoteattr(value))) self._write('/>') def check_port(port): port_range = functions.getPortRange(port) if port_range == -2: raise FirewallError(errors.INVALID_PORT, "port number in '%s' is too big" % port) elif port_range == -1: raise FirewallError(errors.INVALID_PORT, "'%s' is invalid port range" % port) elif port_range is None: raise FirewallError(errors.INVALID_PORT, "port range '%s' is ambiguous" % port) elif len(port_range) == 2 and port_range[0] >= port_range[1]: raise FirewallError(errors.INVALID_PORT, "'%s' is invalid port range" % port) def check_tcpudp(protocol): if protocol not in [ "tcp", "udp", "sctp", "dccp" ]: raise FirewallError(errors.INVALID_PROTOCOL, "'%s' not from {'tcp'|'udp'|'sctp'|'dccp'}" % \ protocol) def check_protocol(protocol): if not functions.checkProtocol(protocol): raise FirewallError(errors.INVALID_PROTOCOL, protocol) def check_address(ipv, addr): if not functions.check_address(ipv, addr): raise FirewallError(errors.INVALID_ADDR, "'%s' is not valid %s address" % (addr, ipv)) PK ���ZP�h֕ � core/io/icmptype.pynu �[��� # -*- coding: utf-8 -*- # # Copyright (C) 2011-2016 Red Hat, Inc. # # Authors: # Thomas Woerner <twoerner@redhat.com> # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see <http://www.gnu.org/licenses/>. # __all__ = [ "IcmpType", "icmptype_reader", "icmptype_writer" ] import xml.sax as sax import os import io import shutil from firewall import config from firewall.core.io.io_object import IO_Object, \ IO_Object_ContentHandler, IO_Object_XMLGenerator from firewall.core.logger import log from firewall import errors from firewall.errors import FirewallError class IcmpType(IO_Object): IMPORT_EXPORT_STRUCTURE = ( ( "version", "" ), # s ( "short", "" ), # s ( "description", "" ), # s ( "destination", [ "", ], ), # as ) DBUS_SIGNATURE = '(sssas)' ADDITIONAL_ALNUM_CHARS = [ "_", "-" ] PARSER_REQUIRED_ELEMENT_ATTRS = { "short": None, "description": None, "icmptype": None, } PARSER_OPTIONAL_ELEMENT_ATTRS = { "icmptype": [ "name", "version" ], "destination": [ "ipv4", "ipv6" ], } def __init__(self): super(IcmpType, self).__init__() self.version = "" self.short = "" self.description = "" self.destination = [ ] def cleanup(self): self.version = "" self.short = "" self.description = "" del self.destination[:] def _check_config(self, config, item, all_config, all_io_objects): if item == "destination": for destination in config: if destination not in [ "ipv4", "ipv6" ]: raise FirewallError(errors.INVALID_DESTINATION, "'%s' not from {'ipv4'|'ipv6'}" % \ destination) # PARSER class icmptype_ContentHandler(IO_Object_ContentHandler): def startElement(self, name, attrs): IO_Object_ContentHandler.startElement(self, name, attrs) self.item.parser_check_element_attrs(name, attrs) if name == "icmptype": if "name" in attrs: log.warning("Ignoring deprecated attribute name='%s'" % attrs["name"]) if "version" in attrs: self.item.version = attrs["version"] elif name == "short": pass elif name == "description": pass elif name == "destination": for x in [ "ipv4", "ipv6" ]: if x in attrs and \ attrs[x].lower() in [ "yes", "true" ]: self.item.destination.append(str(x)) def icmptype_reader(filename, path): icmptype = IcmpType() if not filename.endswith(".xml"): raise FirewallError(errors.INVALID_NAME, "%s is missing .xml suffix" % filename) icmptype.name = filename[:-4] icmptype.check_name(icmptype.name) icmptype.filename = filename icmptype.path = path icmptype.builtin = False if path.startswith(config.ETC_FIREWALLD) else True icmptype.default = icmptype.builtin handler = icmptype_ContentHandler(icmptype) parser = sax.make_parser() parser.setContentHandler(handler) name = "%s/%s" % (path, filename) with open(name, "rb") as f: source = sax.InputSource(None) source.setByteStream(f) try: parser.parse(source) except sax.SAXParseException as msg: raise FirewallError(errors.INVALID_ICMPTYPE, "not a valid icmptype file: %s" % \ msg.getException()) del handler del parser return icmptype def icmptype_writer(icmptype, path=None): _path = path if path else icmptype.path if icmptype.filename: name = "%s/%s" % (_path, icmptype.filename) else: name = "%s/%s.xml" % (_path, icmptype.name) if os.path.exists(name): try: shutil.copy2(name, "%s.old" % name) except Exception as msg: log.error("Backup of file '%s' failed: %s", name, msg) dirpath = os.path.dirname(name) if dirpath.startswith(config.ETC_FIREWALLD) and not os.path.exists(dirpath): if not os.path.exists(config.ETC_FIREWALLD): os.mkdir(config.ETC_FIREWALLD, 0o750) os.mkdir(dirpath, 0o750) f = io.open(name, mode='wt', encoding='UTF-8') handler = IO_Object_XMLGenerator(f) handler.startDocument() # start icmptype element attrs = {} if icmptype.version and icmptype.version != "": attrs["version"] = icmptype.version handler.startElement("icmptype", attrs) handler.ignorableWhitespace("\n") # short if icmptype.short and icmptype.short != "": handler.ignorableWhitespace(" ") handler.startElement("short", { }) handler.characters(icmptype.short) handler.endElement("short") handler.ignorableWhitespace("\n") # description if icmptype.description and icmptype.description != "": handler.ignorableWhitespace(" ") handler.startElement("description", { }) handler.characters(icmptype.description) handler.endElement("description") handler.ignorableWhitespace("\n") # destination if icmptype.destination: handler.ignorableWhitespace(" ") attrs = { } for x in icmptype.destination: attrs[x] = "yes" handler.simpleElement("destination", attrs) handler.ignorableWhitespace("\n") # end icmptype element handler.endElement('icmptype') handler.ignorableWhitespace("\n") handler.endDocument() f.close() del handler PK ���Z�eΪ� � core/io/ifcfg.pynu �[��� # -*- coding: utf-8 -*- # # Copyright (C) 2011-2016 Red Hat, Inc. # # Authors: # Thomas Woerner <twoerner@redhat.com> # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see <http://www.gnu.org/licenses/>. # """ifcfg file parser""" __all__ = [ "ifcfg" ] import os.path import io import tempfile import shutil from firewall.core.logger import log class ifcfg(object): def __init__(self, filename): self._config = { } self._deleted = [ ] self.filename = filename self.clear() def clear(self): self._config = { } self._deleted = [ ] def cleanup(self): self._config.clear() def get(self, key): return self._config.get(key.strip()) def set(self, key, value): _key = key.strip() self._config[_key] = value.strip() if _key in self._deleted: self._deleted.remove(_key) def __str__(self): s = "" for (key, value) in self._config.items(): if s: s += '\n' s += '%s=%s' % (key, value) return s # load self.filename def read(self): self.clear() try: f = open(self.filename, "r") except Exception as msg: log.error("Failed to load '%s': %s", self.filename, msg) raise for line in f: if not line: break line = line.strip() if len(line) < 1 or line[0] in ['#', ';']: continue # get key/value pair pair = [ x.strip() for x in line.split("=", 1) ] if len(pair) != 2: continue if len(pair[1]) >= 2 and \ pair[1].startswith('"') and pair[1].endswith('"'): pair[1] = pair[1][1:-1] if pair[1] == '': continue elif self._config.get(pair[0]) is not None: log.warning("%s: Duplicate option definition: '%s'", self.filename, line.strip()) continue self._config[pair[0]] = pair[1] f.close() def write(self): if len(self._config) < 1: # no changes: nothing to do return # handled keys done = [ ] try: temp_file = tempfile.NamedTemporaryFile( mode='wt', prefix="%s." % os.path.basename(self.filename), dir=os.path.dirname(self.filename), delete=False) except Exception as msg: log.error("Failed to open temporary file: %s" % msg) raise modified = False empty = False try: f = io.open(self.filename, mode='rt', encoding='UTF-8') except Exception as msg: if os.path.exists(self.filename): log.error("Failed to open '%s': %s" % (self.filename, msg)) raise else: f = None else: for line in f: if not line: break # remove newline line = line.strip("\n") if len(line) < 1: if not empty: temp_file.write(u"\n") empty = True elif line[0] == '#': empty = False temp_file.write(line) temp_file.write(u"\n") else: p = line.split("=", 1) if len(p) != 2: empty = False temp_file.write(line+u"\n") continue key = p[0].strip() value = p[1].strip() if len(value) >= 2 and \ value.startswith('"') and value.endswith('"'): value = value[1:-1] # check for modified key/value pairs if key not in done: if key in self._config and self._config[key] != value: empty = False temp_file.write(u'%s=%s\n' % (key, self._config[key])) modified = True elif key in self._deleted: modified = True else: empty = False temp_file.write(line+u"\n") done.append(key) else: modified = True # write remaining key/value pairs if len(self._config) > 0: for (key, value) in self._config.items(): if key in done: continue if not empty: empty = True temp_file.write(u'%s=%s\n' % (key, value)) modified = True if f: f.close() temp_file.close() if not modified: # not modified: remove tempfile os.remove(temp_file.name) return # make backup if os.path.exists(self.filename): try: shutil.copy2(self.filename, "%s.bak" % self.filename) except Exception as msg: os.remove(temp_file.name) raise IOError("Backup of '%s' failed: %s" % (self.filename, msg)) # copy tempfile try: shutil.move(temp_file.name, self.filename) except Exception as msg: os.remove(temp_file.name) raise IOError("Failed to create '%s': %s" % (self.filename, msg)) else: os.chmod(self.filename, 0o600) PK ���Z��@�> > core/io/helper.pynu �[��� # -*- coding: utf-8 -*- # # Copyright (C) 2011-2016 Red Hat, Inc. # # Authors: # Thomas Woerner <twoerner@redhat.com> # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see <http://www.gnu.org/licenses/>. # __all__ = [ "Helper", "helper_reader", "helper_writer" ] import xml.sax as sax import os import io import shutil from firewall import config from firewall.core.io.io_object import IO_Object, \ IO_Object_ContentHandler, IO_Object_XMLGenerator, check_port, \ check_tcpudp from firewall.core.logger import log from firewall import errors from firewall.errors import FirewallError class Helper(IO_Object): IMPORT_EXPORT_STRUCTURE = ( ( "version", "" ), # s ( "short", "" ), # s ( "description", "" ), # s ( "family", "", ), # s ( "module", "", ), # s ( "ports", [ ( "", "" ), ], ), # a(ss) ) DBUS_SIGNATURE = '(sssssa(ss))' ADDITIONAL_ALNUM_CHARS = [ "-", "." ] PARSER_REQUIRED_ELEMENT_ATTRS = { "short": None, "description": None, "helper": [ "module" ], } PARSER_OPTIONAL_ELEMENT_ATTRS = { "helper": [ "name", "version", "family" ], "port": [ "port", "protocol" ], } def __init__(self): super(Helper, self).__init__() self.version = "" self.short = "" self.description = "" self.module = "" self.family = "" self.ports = [ ] def cleanup(self): self.version = "" self.short = "" self.description = "" self.module = "" self.family = "" del self.ports[:] def check_ipv(self, ipv): ipvs = [ 'ipv4', 'ipv6' ] if ipv not in ipvs: raise FirewallError(errors.INVALID_IPV, "'%s' not in '%s'" % (ipv, ipvs)) def _check_config(self, config, item, all_config, all_io_objects): if item == "ports": for port in config: check_port(port[0]) check_tcpudp(port[1]) elif item == "module": if not config.startswith("nf_conntrack_"): raise FirewallError( errors.INVALID_MODULE, "'%s' does not start with 'nf_conntrack_'" % config) if len(config.replace("nf_conntrack_", "")) < 1: raise FirewallError(errors.INVALID_MODULE, "Module name '%s' too short" % config) # PARSER class helper_ContentHandler(IO_Object_ContentHandler): def startElement(self, name, attrs): IO_Object_ContentHandler.startElement(self, name, attrs) self.item.parser_check_element_attrs(name, attrs) if name == "helper": if "version" in attrs: self.item.version = attrs["version"] if "family" in attrs: self.item.check_ipv(attrs["family"]) self.item.family = attrs["family"] if "module" in attrs: if not attrs["module"].startswith("nf_conntrack_"): raise FirewallError( errors.INVALID_MODULE, "'%s' does not start with 'nf_conntrack_'" % \ attrs["module"]) if len(attrs["module"].replace("nf_conntrack_", "")) < 1: raise FirewallError( errors.INVALID_MODULE, "Module name '%s' too short" % attrs["module"]) self.item.module = attrs["module"] elif name == "short": pass elif name == "description": pass elif name == "port": check_port(attrs["port"]) check_tcpudp(attrs["protocol"]) entry = (attrs["port"], attrs["protocol"]) if entry not in self.item.ports: self.item.ports.append(entry) else: log.warning("Port '%s/%s' already set, ignoring.", attrs["port"], attrs["protocol"]) def helper_reader(filename, path): helper = Helper() if not filename.endswith(".xml"): raise FirewallError(errors.INVALID_NAME, "'%s' is missing .xml suffix" % filename) helper.name = filename[:-4] helper.check_name(helper.name) helper.filename = filename helper.path = path helper.builtin = False if path.startswith(config.ETC_FIREWALLD) else True helper.default = helper.builtin handler = helper_ContentHandler(helper) parser = sax.make_parser() parser.setContentHandler(handler) name = "%s/%s" % (path, filename) with open(name, "rb") as f: source = sax.InputSource(None) source.setByteStream(f) try: parser.parse(source) except sax.SAXParseException as msg: raise FirewallError(errors.INVALID_HELPER, "not a valid helper file: %s" % \ msg.getException()) del handler del parser return helper def helper_writer(helper, path=None): _path = path if path else helper.path if helper.filename: name = "%s/%s" % (_path, helper.filename) else: name = "%s/%s.xml" % (_path, helper.name) if os.path.exists(name): try: shutil.copy2(name, "%s.old" % name) except Exception as msg: log.error("Backup of file '%s' failed: %s", name, msg) dirpath = os.path.dirname(name) if dirpath.startswith(config.ETC_FIREWALLD) and not os.path.exists(dirpath): if not os.path.exists(config.ETC_FIREWALLD): os.mkdir(config.ETC_FIREWALLD, 0o750) os.mkdir(dirpath, 0o750) f = io.open(name, mode='wt', encoding='UTF-8') handler = IO_Object_XMLGenerator(f) handler.startDocument() # start helper element attrs = {} attrs["module"] = helper.module if helper.version and helper.version != "": attrs["version"] = helper.version if helper.family and helper.family != "": attrs["family"] = helper.family handler.startElement("helper", attrs) handler.ignorableWhitespace("\n") # short if helper.short and helper.short != "": handler.ignorableWhitespace(" ") handler.startElement("short", { }) handler.characters(helper.short) handler.endElement("short") handler.ignorableWhitespace("\n") # description if helper.description and helper.description != "": handler.ignorableWhitespace(" ") handler.startElement("description", { }) handler.characters(helper.description) handler.endElement("description") handler.ignorableWhitespace("\n") # ports for port in helper.ports: handler.ignorableWhitespace(" ") handler.simpleElement("port", { "port": port[0], "protocol": port[1] }) handler.ignorableWhitespace("\n") # end helper element handler.endElement('helper') handler.ignorableWhitespace("\n") handler.endDocument() f.close() del handler PK ���Z� $��/ �/ core/io/lockdown_whitelist.pynu �[��� # -*- coding: utf-8 -*- # # Copyright (C) 2011-2016 Red Hat, Inc. # # Authors: # Thomas Woerner <twoerner@redhat.com> # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see <http://www.gnu.org/licenses/>. # import xml.sax as sax import os import io import shutil from firewall import config from firewall.core.io.io_object import IO_Object, \ IO_Object_ContentHandler, IO_Object_XMLGenerator from firewall.core.logger import log from firewall.functions import uniqify, checkUser, checkUid, checkCommand, \ checkContext from firewall import errors from firewall.errors import FirewallError class lockdown_whitelist_ContentHandler(IO_Object_ContentHandler): def __init__(self, item): IO_Object_ContentHandler.__init__(self, item) self.whitelist = False def startElement(self, name, attrs): IO_Object_ContentHandler.startElement(self, name, attrs) self.item.parser_check_element_attrs(name, attrs) if name == "whitelist": if self.whitelist: raise FirewallError(errors.PARSE_ERROR, "More than one whitelist.") self.whitelist = True elif name == "command": if not self.whitelist: log.error("Parse Error: command outside of whitelist") return command = attrs["name"] self.item.add_command(command) elif name == "user": if not self.whitelist: log.error("Parse Error: user outside of whitelist") return if "id" in attrs: try: uid = int(attrs["id"]) except ValueError: log.error("Parse Error: %s is not a valid uid" % attrs["id"]) return self.item.add_uid(uid) elif "name" in attrs: self.item.add_user(attrs["name"]) elif name == "selinux": if not self.whitelist: log.error("Parse Error: selinux outside of whitelist") return if "context" not in attrs: log.error("Parse Error: no context") return self.item.add_context(attrs["context"]) else: log.error('Unknown XML element %s' % name) return class LockdownWhitelist(IO_Object): """ LockdownWhitelist class """ IMPORT_EXPORT_STRUCTURE = ( ( "commands", [ "" ] ), # as ( "contexts", [ "" ] ), # as ( "users", [ "" ] ), # as ( "uids", [ 0 ] ) # ai ) DBUS_SIGNATURE = '(asasasai)' ADDITIONAL_ALNUM_CHARS = [ "_" ] PARSER_REQUIRED_ELEMENT_ATTRS = { "whitelist": None, "command": [ "name" ], "user": None, # "group": None, "selinux": [ "context" ], } PARSER_OPTIONAL_ELEMENT_ATTRS = { "user": [ "id", "name" ], # "group": [ "id", "name" ], } def __init__(self, filename): super(LockdownWhitelist, self).__init__() self.filename = filename self.parser = None self.commands = [ ] self.contexts = [ ] self.users = [ ] self.uids = [ ] # self.gids = [ ] # self.groups = [ ] def _check_config(self, config, item, all_config, all_io_objects): if item in [ "commands", "contexts", "users", "uids" ]: for x in config: self._check_config(x, item[:-1], all_config, all_io_objects) elif item == "command": if not checkCommand(config): raise FirewallError(errors.INVALID_COMMAND, config) elif item == "context": if not checkContext(config): raise FirewallError(errors.INVALID_CONTEXT, config) elif item == "user": if not checkUser(config): raise FirewallError(errors.INVALID_USER, config) elif item == "uid": if not checkUid(config): raise FirewallError(errors.INVALID_UID, config) def cleanup(self): del self.commands[:] del self.contexts[:] del self.users[:] del self.uids[:] # del self.gids[:] # del self.groups[:] # commands def add_command(self, command): if not checkCommand(command): raise FirewallError(errors.INVALID_COMMAND, command) if command not in self.commands: self.commands.append(command) else: raise FirewallError(errors.ALREADY_ENABLED, 'Command "%s" already in whitelist' % command) def remove_command(self, command): if command in self.commands: self.commands.remove(command) else: raise FirewallError(errors.NOT_ENABLED, 'Command "%s" not in whitelist.' % command) def has_command(self, command): return (command in self.commands) def match_command(self, command): for _command in self.commands: if _command.endswith("*"): if command.startswith(_command[:-1]): return True else: if _command == command: return True return False def get_commands(self): return self.commands # user ids def add_uid(self, uid): if not checkUid(uid): raise FirewallError(errors.INVALID_UID, str(uid)) if uid not in self.uids: self.uids.append(uid) else: raise FirewallError(errors.ALREADY_ENABLED, 'Uid "%s" already in whitelist' % uid) def remove_uid(self, uid): if uid in self.uids: self.uids.remove(uid) else: raise FirewallError(errors.NOT_ENABLED, 'Uid "%s" not in whitelist.' % uid) def has_uid(self, uid): return (uid in self.uids) def match_uid(self, uid): return (uid in self.uids) def get_uids(self): return self.uids # users def add_user(self, user): if not checkUser(user): raise FirewallError(errors.INVALID_USER, user) if user not in self.users: self.users.append(user) else: raise FirewallError(errors.ALREADY_ENABLED, 'User "%s" already in whitelist' % user) def remove_user(self, user): if user in self.users: self.users.remove(user) else: raise FirewallError(errors.NOT_ENABLED, 'User "%s" not in whitelist.' % user) def has_user(self, user): return (user in self.users) def match_user(self, user): return (user in self.users) def get_users(self): return self.users # # group ids # # def add_gid(self, gid): # if gid not in self.gids: # self.gids.append(gid) # # def remove_gid(self, gid): # if gid in self.gids: # self.gids.remove(gid) # else: # raise FirewallError(errors.NOT_ENABLED, # 'Gid "%s" not in whitelist.' % gid) # # def has_gid(self, gid): # return (gid in self.gids) # # def match_gid(self, gid): # return (gid in self.gids) # # def get_gids(self): # return self.gids # # groups # # def add_group(self, group): # if group not in self.groups: # self.groups.append(group) # # def remove_group(self, group): # if group in self.groups: # self.groups.remove(group) # else: # raise FirewallError(errors.NOT_ENABLED, # 'Group "%s" not in whitelist.' % group) # # def has_group(self, group): # return (group in self.groups) # # def match_group(self, group): # return (group in self.groups) # # def get_groups(self): # return self.groups # selinux contexts def add_context(self, context): if not checkContext(context): raise FirewallError(errors.INVALID_CONTEXT, context) if context not in self.contexts: self.contexts.append(context) else: raise FirewallError(errors.ALREADY_ENABLED, 'Context "%s" already in whitelist' % context) def remove_context(self, context): if context in self.contexts: self.contexts.remove(context) else: raise FirewallError(errors.NOT_ENABLED, 'Context "%s" not in whitelist.' % context) def has_context(self, context): return (context in self.contexts) def match_context(self, context): return (context in self.contexts) def get_contexts(self): return self.contexts # read and write def read(self): self.cleanup() if not self.filename.endswith(".xml"): raise FirewallError(errors.INVALID_NAME, "'%s' is missing .xml suffix" % self.filename) handler = lockdown_whitelist_ContentHandler(self) parser = sax.make_parser() parser.setContentHandler(handler) try: parser.parse(self.filename) except sax.SAXParseException as msg: raise FirewallError(errors.INVALID_TYPE, "Not a valid file: %s" % \ msg.getException()) del handler del parser def write(self): if os.path.exists(self.filename): try: shutil.copy2(self.filename, "%s.old" % self.filename) except Exception as msg: raise IOError("Backup of '%s' failed: %s" % (self.filename, msg)) if not os.path.exists(config.ETC_FIREWALLD): os.mkdir(config.ETC_FIREWALLD, 0o750) f = io.open(self.filename, mode='wt', encoding='UTF-8') handler = IO_Object_XMLGenerator(f) handler.startDocument() # start whitelist element handler.startElement("whitelist", { }) handler.ignorableWhitespace("\n") # commands for command in uniqify(self.commands): handler.ignorableWhitespace(" ") handler.simpleElement("command", { "name": command }) handler.ignorableWhitespace("\n") for uid in uniqify(self.uids): handler.ignorableWhitespace(" ") handler.simpleElement("user", { "id": str(uid) }) handler.ignorableWhitespace("\n") for user in uniqify(self.users): handler.ignorableWhitespace(" ") handler.simpleElement("user", { "name": user }) handler.ignorableWhitespace("\n") # for gid in uniqify(self.gids): # handler.ignorableWhitespace(" ") # handler.simpleElement("user", { "id": str(gid) }) # handler.ignorableWhitespace("\n") # for group in uniqify(self.groups): # handler.ignorableWhitespace(" ") # handler.simpleElement("group", { "name": group }) # handler.ignorableWhitespace("\n") for context in uniqify(self.contexts): handler.ignorableWhitespace(" ") handler.simpleElement("selinux", { "context": context }) handler.ignorableWhitespace("\n") # end whitelist element handler.endElement("whitelist") handler.ignorableWhitespace("\n") handler.endDocument() f.close() del handler PK ���Z,�:< < core/io/__init__.pynu �[��� # -*- coding: utf-8 -*- # # Copyright (C) 2012 Red Hat, Inc. # # Authors: # Thomas Woerner <twoerner@redhat.com> # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see <http://www.gnu.org/licenses/>. # # fix xmlplus to be compatible with the python xml sax parser and python 3 # by adding __contains__ to xml.sax.xmlreader.AttributesImpl import xml if "_xmlplus" in xml.__file__: from xml.sax.xmlreader import AttributesImpl if not hasattr(AttributesImpl, "__contains__"): # this is missing: def __AttributesImpl__contains__(self, name): return name in getattr(self, "_attrs") # add it using the name __contains__ setattr(AttributesImpl, "__contains__", __AttributesImpl__contains__) from xml.sax.saxutils import XMLGenerator if not hasattr(XMLGenerator, "_write"): # this is missing: def __XMLGenerator_write(self, text): getattr(self, "_out").write(text) # add it using the name _write setattr(XMLGenerator, "_write", __XMLGenerator_write) PK ���Z�Gܞ�t �t core/nftables.pynu �[��� # -*- coding: utf-8 -*- # # Copyright (C) 2018 Red Hat, Inc. # # Authors: # Eric Garver <e@erig.me> # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see <http://www.gnu.org/licenses/>. # import copy import json import ipaddress from firewall.core.logger import log from firewall.functions import check_mac, getPortRange, normalizeIP6, \ check_single_address, check_address from firewall.errors import FirewallError, UNKNOWN_ERROR, INVALID_RULE, \ INVALID_ICMPTYPE, INVALID_TYPE, INVALID_ENTRY, \ INVALID_PORT from firewall.core.rich import Rich_Accept, Rich_Reject, Rich_Drop, Rich_Mark, \ Rich_Masquerade, Rich_ForwardPort, Rich_IcmpBlock, \ Rich_Tcp_Mss_Clamp, Rich_NFLog from firewall.core.base import DEFAULT_ZONE_TARGET from nftables.nftables import Nftables TABLE_NAME = "firewalld" TABLE_NAME_POLICY = TABLE_NAME + "_" + "policy_drop" POLICY_CHAIN_PREFIX = "policy_" # Map iptables (table, chain) to hooks and priorities. # These are well defined by NF_IP_PRI_* defines in netfilter. # # This is analogous to ipXtables.BUILT_IN_CHAINS, but we omit the chains that # are only used for direct rules. # # Note: All hooks use their standard position + NFT_HOOK_OFFSET. This means # iptables will have DROP precedence. It also means that even if iptables # ACCEPTs a packet it may still be dropped later by firewalld's rules. # NFT_HOOK_OFFSET = 10 IPTABLES_TO_NFT_HOOK = { #"security": { # "INPUT": ("input", 50 + NFT_HOOK_OFFSET), # "OUTPUT": ("output", 50 + NFT_HOOK_OFFSET), # "FORWARD": ("forward", 50 + NFT_HOOK_OFFSET), #}, "raw": { # "PREROUTING": ("prerouting", -300 + NFT_HOOK_OFFSET), # "OUTPUT": ("output", -300 + NFT_HOOK_OFFSET), }, "mangle": { "PREROUTING": ("prerouting", -150 + NFT_HOOK_OFFSET), # "POSTROUTING": ("postrouting", -150 + NFT_HOOK_OFFSET), # "INPUT": ("input", -150 + NFT_HOOK_OFFSET), # "OUTPUT": ("output", -150 + NFT_HOOK_OFFSET), # "FORWARD": ("forward", -150 + NFT_HOOK_OFFSET), }, "nat": { "PREROUTING": ("prerouting", -100 + NFT_HOOK_OFFSET), "POSTROUTING": ("postrouting", 100 + NFT_HOOK_OFFSET), # "INPUT": ("input", 100 + NFT_HOOK_OFFSET), "OUTPUT": ("output", -100 + NFT_HOOK_OFFSET), }, "filter": { "PREROUTING": ("prerouting", 0 + NFT_HOOK_OFFSET), "INPUT": ("input", 0 + NFT_HOOK_OFFSET), "FORWARD": ("forward", 0 + NFT_HOOK_OFFSET), "OUTPUT": ("output", 0 + NFT_HOOK_OFFSET), }, } def _icmp_types_fragments(protocol, type, code=None): fragments = [{"match": {"left": {"payload": {"protocol": protocol, "field": "type"}}, "op": "==", "right": type}}] if code is not None: fragments.append({"match": {"left": {"payload": {"protocol": protocol, "field": "code"}}, "op": "==", "right": code}}) return fragments # Most ICMP types are provided by nft, but for the codes we have to use numeric # values. # ICMP_TYPES_FRAGMENTS = { "ipv4": { "communication-prohibited": _icmp_types_fragments("icmp", "destination-unreachable", 13), "destination-unreachable": _icmp_types_fragments("icmp", "destination-unreachable"), "echo-reply": _icmp_types_fragments("icmp", "echo-reply"), "echo-request": _icmp_types_fragments("icmp", "echo-request"), "fragmentation-needed": _icmp_types_fragments("icmp", "destination-unreachable", 4), "host-precedence-violation": _icmp_types_fragments("icmp", "destination-unreachable", 14), "host-prohibited": _icmp_types_fragments("icmp", "destination-unreachable", 10), "host-redirect": _icmp_types_fragments("icmp", "redirect", 1), "host-unknown": _icmp_types_fragments("icmp", "destination-unreachable", 7), "host-unreachable": _icmp_types_fragments("icmp", "destination-unreachable", 1), "ip-header-bad": _icmp_types_fragments("icmp", "parameter-problem", 1), "network-prohibited": _icmp_types_fragments("icmp", "destination-unreachable", 8), "network-redirect": _icmp_types_fragments("icmp", "redirect", 0), "network-unknown": _icmp_types_fragments("icmp", "destination-unreachable", 6), "network-unreachable": _icmp_types_fragments("icmp", "destination-unreachable", 0), "parameter-problem": _icmp_types_fragments("icmp", "parameter-problem"), "port-unreachable": _icmp_types_fragments("icmp", "destination-unreachable", 3), "precedence-cutoff": _icmp_types_fragments("icmp", "destination-unreachable", 15), "protocol-unreachable": _icmp_types_fragments("icmp", "destination-unreachable", 2), "redirect": _icmp_types_fragments("icmp", "redirect"), "required-option-missing": _icmp_types_fragments("icmp", "parameter-problem", 1), "router-advertisement": _icmp_types_fragments("icmp", "router-advertisement"), "router-solicitation": _icmp_types_fragments("icmp", "router-solicitation"), "source-quench": _icmp_types_fragments("icmp", "source-quench"), "source-route-failed": _icmp_types_fragments("icmp", "destination-unreachable", 5), "time-exceeded": _icmp_types_fragments("icmp", "time-exceeded"), "timestamp-reply": _icmp_types_fragments("icmp", "timestamp-reply"), "timestamp-request": _icmp_types_fragments("icmp", "timestamp-request"), "tos-host-redirect": _icmp_types_fragments("icmp", "redirect", 3), "tos-host-unreachable": _icmp_types_fragments("icmp", "destination-unreachable", 12), "tos-network-redirect": _icmp_types_fragments("icmp", "redirect", 2), "tos-network-unreachable": _icmp_types_fragments("icmp", "destination-unreachable", 11), "ttl-zero-during-reassembly": _icmp_types_fragments("icmp", "time-exceeded", 1), "ttl-zero-during-transit": _icmp_types_fragments("icmp", "time-exceeded", 0), }, "ipv6": { "address-unreachable": _icmp_types_fragments("icmpv6", "destination-unreachable", 3), "bad-header": _icmp_types_fragments("icmpv6", "parameter-problem", 0), "beyond-scope": _icmp_types_fragments("icmpv6", "destination-unreachable", 2), "communication-prohibited": _icmp_types_fragments("icmpv6", "destination-unreachable", 1), "destination-unreachable": _icmp_types_fragments("icmpv6", "destination-unreachable"), "echo-reply": _icmp_types_fragments("icmpv6", "echo-reply"), "echo-request": _icmp_types_fragments("icmpv6", "echo-request"), "failed-policy": _icmp_types_fragments("icmpv6", "destination-unreachable", 5), "neighbour-advertisement": _icmp_types_fragments("icmpv6", "nd-neighbor-advert"), "neighbour-solicitation": _icmp_types_fragments("icmpv6", "nd-neighbor-solicit"), "no-route": _icmp_types_fragments("icmpv6", "destination-unreachable", 0), "packet-too-big": _icmp_types_fragments("icmpv6", "packet-too-big"), "parameter-problem": _icmp_types_fragments("icmpv6", "parameter-problem"), "port-unreachable": _icmp_types_fragments("icmpv6", "destination-unreachable", 4), "redirect": _icmp_types_fragments("icmpv6", "nd-redirect"), "reject-route": _icmp_types_fragments("icmpv6", "destination-unreachable", 6), "router-advertisement": _icmp_types_fragments("icmpv6", "nd-router-advert"), "router-solicitation": _icmp_types_fragments("icmpv6", "nd-router-solicit"), "time-exceeded": _icmp_types_fragments("icmpv6", "time-exceeded"), "ttl-zero-during-reassembly": _icmp_types_fragments("icmpv6", "time-exceeded", 1), "ttl-zero-during-transit": _icmp_types_fragments("icmpv6", "time-exceeded", 0), "unknown-header-type": _icmp_types_fragments("icmpv6", "parameter-problem", 1), "unknown-option": _icmp_types_fragments("icmpv6", "parameter-problem", 2), } } class nftables(object): name = "nftables" policies_supported = True def __init__(self, fw): self._fw = fw self.restore_command_exists = True self.available_tables = [] self.rule_to_handle = {} self.rule_ref_count = {} self.rich_rule_priority_counts = {} self.policy_priority_counts = {} self.zone_source_index_cache = {} self.created_tables = {"inet": []} self.nftables = Nftables() self.nftables.set_echo_output(True) self.nftables.set_handle_output(True) def _run_replace_zone_source(self, rule, zone_source_index_cache): for verb in ["add", "insert", "delete"]: if verb in rule: break if "%%ZONE_SOURCE%%" in rule[verb]["rule"]: zone_source = (rule[verb]["rule"]["%%ZONE_SOURCE%%"]["zone"], rule[verb]["rule"]["%%ZONE_SOURCE%%"]["address"]) del rule[verb]["rule"]["%%ZONE_SOURCE%%"] elif "%%ZONE_INTERFACE%%" in rule[verb]["rule"]: zone_source = None del rule[verb]["rule"]["%%ZONE_INTERFACE%%"] else: return family = rule[verb]["rule"]["family"] if zone_source and verb == "delete": if family in zone_source_index_cache and \ zone_source in zone_source_index_cache[family]: zone_source_index_cache[family].remove(zone_source) elif verb != "delete": if family not in zone_source_index_cache: zone_source_index_cache[family] = [] if zone_source: # order source based dispatch by zone name if zone_source not in zone_source_index_cache[family]: zone_source_index_cache[family].append(zone_source) zone_source_index_cache[family].sort(key=lambda x: x[0]) index = zone_source_index_cache[family].index(zone_source) else: index = len(zone_source_index_cache[family]) _verb_snippet = rule[verb] del rule[verb] if index == 0: rule["insert"] = _verb_snippet else: index -= 1 # point to the rule before insertion point rule["add"] = _verb_snippet rule["add"]["rule"]["index"] = index def reverse_rule(self, dict): if "insert" in dict: return {"delete": copy.deepcopy(dict["insert"])} elif "add" in dict: return {"delete": copy.deepcopy(dict["add"])} else: raise FirewallError(UNKNOWN_ERROR, "Failed to reverse rule") def _set_rule_replace_priority(self, rule, priority_counts, token): for verb in ["add", "insert", "delete"]: if verb in rule: break if token in rule[verb]["rule"]: priority = rule[verb]["rule"][token] del rule[verb]["rule"][token] if type(priority) != int: raise FirewallError(INVALID_RULE, "priority must be followed by a number") chain = (rule[verb]["rule"]["family"], rule[verb]["rule"]["chain"]) # family, chain # Add the rule to the priority counts. We don't need to store the # rule, just bump the ref count for the priority value. if verb == "delete": if chain not in priority_counts or \ priority not in priority_counts[chain] or \ priority_counts[chain][priority] <= 0: raise FirewallError(UNKNOWN_ERROR, "nonexistent or underflow of priority count") priority_counts[chain][priority] -= 1 else: if chain not in priority_counts: priority_counts[chain] = {} if priority not in priority_counts[chain]: priority_counts[chain][priority] = 0 # calculate index of new rule index = 0 for p in sorted(priority_counts[chain].keys()): if p == priority and verb == "insert": break index += priority_counts[chain][p] if p == priority and verb == "add": break priority_counts[chain][priority] += 1 _verb_snippet = rule[verb] del rule[verb] if index == 0: rule["insert"] = _verb_snippet else: index -= 1 # point to the rule before insertion point rule["add"] = _verb_snippet rule["add"]["rule"]["index"] = index def _get_rule_key(self, rule): for verb in ["add", "insert", "delete"]: if verb in rule and "rule" in rule[verb]: rule_key = copy.deepcopy(rule[verb]["rule"]) for non_key in ["index", "handle", "position"]: if non_key in rule_key: del rule_key[non_key] # str(rule_key) is insufficient because dictionary order is # not stable.. so abuse the JSON library rule_key = json.dumps(rule_key, sort_keys=True) return rule_key # Not a rule (it's a table, chain, etc) return None def set_rules(self, rules, log_denied): _valid_verbs = ["add", "insert", "delete", "flush", "replace"] _valid_add_verbs = ["add", "insert", "replace"] _deduplicated_rules = [] _executed_rules = [] rich_rule_priority_counts = copy.deepcopy(self.rich_rule_priority_counts) policy_priority_counts = copy.deepcopy(self.policy_priority_counts) zone_source_index_cache = copy.deepcopy(self.zone_source_index_cache) rule_ref_count = self.rule_ref_count.copy() for rule in rules: if type(rule) != dict: raise FirewallError(UNKNOWN_ERROR, "rule must be a dictionary, rule: %s" % (rule)) for verb in _valid_verbs: if verb in rule: break if verb not in rule: raise FirewallError(INVALID_RULE, "no valid verb found, rule: %s" % (rule)) rule_key = self._get_rule_key(rule) # rule deduplication if rule_key in rule_ref_count: log.debug2("%s: prev rule ref cnt %d, %s", self.__class__, rule_ref_count[rule_key], rule_key) if verb != "delete": rule_ref_count[rule_key] += 1 continue elif rule_ref_count[rule_key] > 1: rule_ref_count[rule_key] -= 1 continue elif rule_ref_count[rule_key] == 1: rule_ref_count[rule_key] -= 1 else: raise FirewallError(UNKNOWN_ERROR, "rule ref count bug: rule_key '%s', cnt %d" % (rule_key, rule_ref_count[rule_key])) elif rule_key and verb != "delete": rule_ref_count[rule_key] = 1 _deduplicated_rules.append(rule) _rule = copy.deepcopy(rule) if rule_key: # filter empty rule expressions. Rich rules add quite a bit of # them, but it makes the rest of the code simpler. libnftables # does not tolerate them. _rule[verb]["rule"]["expr"] = list(filter(None, _rule[verb]["rule"]["expr"])) self._set_rule_replace_priority(_rule, rich_rule_priority_counts, "%%RICH_RULE_PRIORITY%%") self._set_rule_replace_priority(_rule, policy_priority_counts, "%%POLICY_PRIORITY%%") self._run_replace_zone_source(_rule, zone_source_index_cache) # delete using rule handle if verb == "delete": _rule = {"delete": {"rule": {"family": _rule["delete"]["rule"]["family"], "table": _rule["delete"]["rule"]["table"], "chain": _rule["delete"]["rule"]["chain"], "handle": self.rule_to_handle[rule_key]}}} _executed_rules.append(_rule) json_blob = {"nftables": [{"metainfo": {"json_schema_version": 1}}] + _executed_rules} if log.getDebugLogLevel() >= 3: # guarded with if statement because json.dumps() is expensive. log.debug3("%s: calling python-nftables with JSON blob: %s", self.__class__, json.dumps(json_blob)) rc, output, error = self.nftables.json_cmd(json_blob) if rc != 0: raise ValueError("'%s' failed: %s\nJSON blob:\n%s" % ("python-nftables", error, json.dumps(json_blob))) self.rich_rule_priority_counts = rich_rule_priority_counts self.policy_priority_counts = policy_priority_counts self.zone_source_index_cache = zone_source_index_cache self.rule_ref_count = rule_ref_count index = 0 for rule in _deduplicated_rules: index += 1 # +1 due to metainfo rule_key = self._get_rule_key(rule) if not rule_key: continue if "delete" in rule: del self.rule_to_handle[rule_key] del self.rule_ref_count[rule_key] continue for verb in _valid_add_verbs: if verb in output["nftables"][index]: break if verb not in output["nftables"][index]: continue self.rule_to_handle[rule_key] = output["nftables"][index][verb]["rule"]["handle"] def set_rule(self, rule, log_denied): self.set_rules([rule], log_denied) return "" def get_available_tables(self, table=None): # Tables always exist in nftables return [table] if table else IPTABLES_TO_NFT_HOOK.keys() def build_flush_rules(self): # Policy is stashed in a separate table that we're _not_ going to # flush. As such, we retain the policy rule handles and ref counts. saved_rule_to_handle = {} saved_rule_ref_count = {} for rule in self._build_set_policy_rules_ct_rules(True): policy_key = self._get_rule_key(rule) if policy_key in self.rule_to_handle: saved_rule_to_handle[policy_key] = self.rule_to_handle[policy_key] saved_rule_ref_count[policy_key] = self.rule_ref_count[policy_key] self.rule_to_handle = saved_rule_to_handle self.rule_ref_count = saved_rule_ref_count self.rich_rule_priority_counts = {} self.policy_priority_counts = {} self.zone_source_index_cache = {} rules = [] if TABLE_NAME in self.created_tables["inet"]: rules.append({"delete": {"table": {"family": "inet", "name": TABLE_NAME}}}) self.created_tables["inet"].remove(TABLE_NAME) return rules def _build_set_policy_rules_ct_rules(self, enable): add_del = { True: "add", False: "delete" }[enable] rules = [] for hook in ["input", "forward", "output"]: rules.append({add_del: {"rule": {"family": "inet", "table": TABLE_NAME_POLICY, "chain": "%s_%s" % ("filter", hook), "expr": [{"match": {"left": {"ct": {"key": "state"}}, "op": "in", "right": {"set": ["established", "related"]}}}, {"accept": None}]}}}) return rules def build_set_policy_rules(self, policy): # Policy is not exposed to the user. It's only to make sure we DROP # packets while reloading and for panic mode. As such, using hooks with # a higher priority than our base chains is sufficient. rules = [] if policy == "PANIC": rules.append({"add": {"table": {"family": "inet", "name": TABLE_NAME_POLICY}}}) self.created_tables["inet"].append(TABLE_NAME_POLICY) # Use "raw" priority for panic mode. This occurs before # conntrack, mangle, nat, etc for hook in ["prerouting", "output"]: rules.append({"add": {"chain": {"family": "inet", "table": TABLE_NAME_POLICY, "name": "%s_%s" % ("raw", hook), "type": "filter", "hook": hook, "prio": -300 + NFT_HOOK_OFFSET - 1, "policy": "drop"}}}) if policy == "DROP": rules.append({"add": {"table": {"family": "inet", "name": TABLE_NAME_POLICY}}}) self.created_tables["inet"].append(TABLE_NAME_POLICY) # To drop everything except existing connections we use # "filter" because it occurs _after_ conntrack. for hook in ["input", "forward", "output"]: rules.append({"add": {"chain": {"family": "inet", "table": TABLE_NAME_POLICY, "name": "%s_%s" % ("filter", hook), "type": "filter", "hook": hook, "prio": 0 + NFT_HOOK_OFFSET - 1, "policy": "drop"}}}) rules += self._build_set_policy_rules_ct_rules(True) elif policy == "ACCEPT": for rule in self._build_set_policy_rules_ct_rules(False): policy_key = self._get_rule_key(rule) if policy_key in self.rule_to_handle: rules.append(rule) if TABLE_NAME_POLICY in self.created_tables["inet"]: rules.append({"delete": {"table": {"family": "inet", "name": TABLE_NAME_POLICY}}}) self.created_tables["inet"].remove(TABLE_NAME_POLICY) else: FirewallError(UNKNOWN_ERROR, "not implemented") return rules def supported_icmp_types(self, ipv=None): # nftables supports any icmp_type via arbitrary type/code matching. # We just need a translation for it in ICMP_TYPES_FRAGMENTS. supported = set() for _ipv in [ipv] if ipv else ICMP_TYPES_FRAGMENTS.keys(): supported.update(ICMP_TYPES_FRAGMENTS[_ipv].keys()) return list(supported) def build_default_tables(self): default_tables = [] default_tables.append({"add": {"table": {"family": "inet", "name": TABLE_NAME}}}) self.created_tables["inet"].append(TABLE_NAME) return default_tables def build_default_rules(self, log_denied="off"): default_rules = [] for chain in IPTABLES_TO_NFT_HOOK["mangle"].keys(): default_rules.append({"add": {"chain": {"family": "inet", "table": TABLE_NAME, "name": "mangle_%s" % chain, "type": "filter", "hook": "%s" % IPTABLES_TO_NFT_HOOK["mangle"][chain][0], "prio": IPTABLES_TO_NFT_HOOK["mangle"][chain][1]}}}) for dispatch_suffix in ["POLICIES_pre", "ZONES", "POLICIES_post"]: default_rules.append({"add": {"chain": {"family": "inet", "table": TABLE_NAME, "name": "mangle_%s_%s" % (chain, dispatch_suffix)}}}) for dispatch_suffix in ["ZONES"]: default_rules.append({"add": {"rule": {"family": "inet", "table": TABLE_NAME, "chain": "mangle_%s" % chain, "expr": [{"jump": {"target": "mangle_%s_%s" % (chain, dispatch_suffix)}}]}}}) for chain in IPTABLES_TO_NFT_HOOK["nat"].keys(): default_rules.append({"add": {"chain": {"family": "inet", "table": TABLE_NAME, "name": "nat_%s" % chain, "type": "nat", "hook": "%s" % IPTABLES_TO_NFT_HOOK["nat"][chain][0], "prio": IPTABLES_TO_NFT_HOOK["nat"][chain][1]}}}) if chain in ["OUTPUT"]: # nat, output does not have zone dispatch for dispatch_suffix in ["POLICIES_pre", "POLICIES_post"]: default_rules.append({"add": {"chain": {"family": "inet", "table": TABLE_NAME, "name": "nat_%s_%s" % (chain, dispatch_suffix)}}}) default_rules.append({"add": {"rule": {"family": "inet", "table": TABLE_NAME, "chain": "nat_%s" % chain, "expr": [{"jump": {"target": "nat_%s_%s" % (chain, dispatch_suffix)}}]}}}) else: for dispatch_suffix in ["POLICIES_pre", "ZONES", "POLICIES_post"]: default_rules.append({"add": {"chain": {"family": "inet", "table": TABLE_NAME, "name": "nat_%s_%s" % (chain, dispatch_suffix)}}}) for dispatch_suffix in ["ZONES"]: default_rules.append({"add": {"rule": {"family": "inet", "table": TABLE_NAME, "chain": "nat_%s" % chain, "expr": [{"jump": {"target": "nat_%s_%s" % (chain, dispatch_suffix)}}]}}}) for chain in IPTABLES_TO_NFT_HOOK["filter"].keys(): default_rules.append({"add": {"chain": {"family": "inet", "table": TABLE_NAME, "name": "filter_%s" % chain, "type": "filter", "hook": "%s" % IPTABLES_TO_NFT_HOOK["filter"][chain][0], "prio": IPTABLES_TO_NFT_HOOK["filter"][chain][1]}}}) # filter, INPUT default_rules.append({"add": {"rule": {"family": "inet", "table": TABLE_NAME, "chain": "filter_%s" % "INPUT", "expr": [{"match": {"left": {"ct": {"key": "state"}}, "op": "in", "right": {"set": ["established", "related"]}}}, {"accept": None}]}}}) default_rules.append({"add": {"rule": {"family": "inet", "table": TABLE_NAME, "chain": "filter_%s" % "INPUT", "expr": [{"match": {"left": {"ct": {"key": "status"}}, "op": "in", "right": "dnat"}}, {"accept": None}]}}}) default_rules.append({"add": {"rule": {"family": "inet", "table": TABLE_NAME, "chain": "filter_%s" % "INPUT", "expr": [{"match": {"left": {"meta": {"key": "iifname"}}, "op": "==", "right": "lo"}}, {"accept": None}]}}}) for dispatch_suffix in ["POLICIES_pre", "ZONES", "POLICIES_post"]: default_rules.append({"add": {"chain": {"family": "inet", "table": TABLE_NAME, "name": "filter_%s_%s" % ("INPUT", dispatch_suffix)}}}) for dispatch_suffix in ["ZONES"]: default_rules.append({"add": {"rule": {"family": "inet", "table": TABLE_NAME, "chain": "filter_%s" % "INPUT", "expr": [{"jump": {"target": "filter_%s_%s" % ("INPUT", dispatch_suffix)}}]}}}) if log_denied != "off": default_rules.append({"add": {"rule": {"family": "inet", "table": TABLE_NAME, "chain": "filter_%s" % "INPUT", "expr": [{"match": {"left": {"ct": {"key": "state"}}, "op": "in", "right": {"set": ["invalid"]}}}, self._pkttype_match_fragment(log_denied), {"log": {"prefix": "STATE_INVALID_DROP: "}}]}}}) default_rules.append({"add": {"rule": {"family": "inet", "table": TABLE_NAME, "chain": "filter_%s" % "INPUT", "expr": [{"match": {"left": {"ct": {"key": "state"}}, "op": "in", "right": {"set": ["invalid"]}}}, {"drop": None}]}}}) if log_denied != "off": default_rules.append({"add": {"rule": {"family": "inet", "table": TABLE_NAME, "chain": "filter_%s" % "INPUT", "expr": [self._pkttype_match_fragment(log_denied), {"log": {"prefix": "FINAL_REJECT: "}}]}}}) default_rules.append({"add": {"rule": {"family": "inet", "table": TABLE_NAME, "chain": "filter_%s" % "INPUT", "expr": [{"reject": {"type": "icmpx", "expr": "admin-prohibited"}}]}}}) # filter, FORWARD default_rules.append({"add": {"rule": {"family": "inet", "table": TABLE_NAME, "chain": "filter_%s" % "FORWARD", "expr": [{"match": {"left": {"ct": {"key": "state"}}, "op": "in", "right": {"set": ["established", "related"]}}}, {"accept": None}]}}}) default_rules.append({"add": {"rule": {"family": "inet", "table": TABLE_NAME, "chain": "filter_%s" % "FORWARD", "expr": [{"match": {"left": {"ct": {"key": "status"}}, "op": "in", "right": "dnat"}}, {"accept": None}]}}}) default_rules.append({"add": {"rule": {"family": "inet", "table": TABLE_NAME, "chain": "filter_%s" % "FORWARD", "expr": [{"match": {"left": {"meta": {"key": "iifname"}}, "op": "==", "right": "lo"}}, {"accept": None}]}}}) for dispatch_suffix in ["POLICIES_pre"]: default_rules.append({"add": {"chain": {"family": "inet", "table": TABLE_NAME, "name": "filter_%s_%s" % ("FORWARD", dispatch_suffix)}}}) for dispatch_suffix in ["ZONES"]: default_rules.append({"add": {"chain": {"family": "inet", "table": TABLE_NAME, "name": "filter_%s_%s" % ("FORWARD", dispatch_suffix)}}}) default_rules.append({"add": {"rule": {"family": "inet", "table": TABLE_NAME, "chain": "filter_%s" % "FORWARD", "expr": [{"jump": {"target": "filter_%s_%s" % ("FORWARD", dispatch_suffix)}}]}}}) for dispatch_suffix in ["POLICIES_post"]: default_rules.append({"add": {"chain": {"family": "inet", "table": TABLE_NAME, "name": "filter_%s_%s" % ("FORWARD", dispatch_suffix)}}}) if log_denied != "off": default_rules.append({"add": {"rule": {"family": "inet", "table": TABLE_NAME, "chain": "filter_%s" % "FORWARD", "expr": [{"match": {"left": {"ct": {"key": "state"}}, "op": "in", "right": {"set": ["invalid"]}}}, self._pkttype_match_fragment(log_denied), {"log": {"prefix": "STATE_INVALID_DROP: "}}]}}}) default_rules.append({"add": {"rule": {"family": "inet", "table": TABLE_NAME, "chain": "filter_%s" % "FORWARD", "expr": [{"match": {"left": {"ct": {"key": "state"}}, "op": "in", "right": {"set": ["invalid"]}}}, {"drop": None}]}}}) if log_denied != "off": default_rules.append({"add": {"rule": {"family": "inet", "table": TABLE_NAME, "chain": "filter_%s" % "FORWARD", "expr": [self._pkttype_match_fragment(log_denied), {"log": {"prefix": "FINAL_REJECT: "}}]}}}) default_rules.append({"add": {"rule": {"family": "inet", "table": TABLE_NAME, "chain": "filter_%s" % "FORWARD", "expr": [{"reject": {"type": "icmpx", "expr": "admin-prohibited"}}]}}}) # filter, OUTPUT default_rules.append({"add": {"rule": {"family": "inet", "table": TABLE_NAME, "chain": "filter_%s" % "OUTPUT", "expr": [{"match": {"left": {"ct": {"key": "state"}}, "op": "in", "right": {"set": ["established", "related"]}}}, {"accept": None}]}}}) default_rules.append({"add": {"rule": {"family": "inet", "table": TABLE_NAME, "chain": "filter_OUTPUT", "expr": [{"match": {"left": {"meta": {"key": "oifname"}}, "op": "==", "right": "lo"}}, {"accept": None}]}}}) for dispatch_suffix in ["POLICIES_pre"]: default_rules.append({"add": {"chain": {"family": "inet", "table": TABLE_NAME, "name": "filter_%s_%s" % ("OUTPUT", dispatch_suffix)}}}) default_rules.append({"add": {"rule": {"family": "inet", "table": TABLE_NAME, "chain": "filter_%s" % "OUTPUT", "expr": [{"jump": {"target": "filter_%s_%s" % ("OUTPUT", dispatch_suffix)}}]}}}) for dispatch_suffix in ["POLICIES_post"]: default_rules.append({"add": {"chain": {"family": "inet", "table": TABLE_NAME, "name": "filter_%s_%s" % ("OUTPUT", dispatch_suffix)}}}) default_rules.append({"add": {"rule": {"family": "inet", "table": TABLE_NAME, "chain": "filter_%s" % "OUTPUT", "expr": [{"jump": {"target": "filter_%s_%s" % ("OUTPUT", dispatch_suffix)}}]}}}) return default_rules def get_zone_table_chains(self, table): if table == "filter": return ["INPUT", "FORWARD"] if table == "mangle": return ["PREROUTING"] if table == "nat": return ["PREROUTING", "POSTROUTING"] return [] def build_policy_ingress_egress_rules(self, enable, policy, table, chain, ingress_interfaces, egress_interfaces, ingress_sources, egress_sources): p_obj = self._fw.policy.get_policy(policy) chain_suffix = "pre" if p_obj.priority < 0 else "post" isSNAT = True if (table == "nat" and chain == "POSTROUTING") else False _policy = self._fw.policy.policy_base_chain_name(policy, table, POLICY_CHAIN_PREFIX, isSNAT) ingress_fragments = [] egress_fragments = [] if ingress_interfaces: ingress_fragments.append({"match": {"left": {"meta": {"key": "iifname"}}, "op": "==", "right": {"set": list(ingress_interfaces)}}}) if egress_interfaces: egress_fragments.append({"match": {"left": {"meta": {"key": "oifname"}}, "op": "==", "right": {"set": list(egress_interfaces)}}}) if ingress_sources: for src in ingress_sources: ingress_fragments.append(self._rule_addr_fragment("saddr", src)) if egress_sources: for dst in egress_sources: egress_fragments.append(self._rule_addr_fragment("daddr", dst)) def _generate_policy_dispatch_rule(ingress_fragment, egress_fragment): expr_fragments = [] if ingress_fragment: expr_fragments.append(ingress_fragment) if egress_fragment: expr_fragments.append(egress_fragment) expr_fragments.append({"jump": {"target": "%s_%s" % (table, _policy)}}) rule = {"family": "inet", "table": TABLE_NAME, "chain": "%s_%s_POLICIES_%s" % (table, chain, chain_suffix), "expr": expr_fragments} rule.update(self._policy_priority_fragment(p_obj)) if enable: return {"add": {"rule": rule}} else: return {"delete": {"rule": rule}} rules = [] if ingress_fragments: # zone --> [zone, ANY, HOST] for ingress_fragment in ingress_fragments: if egress_fragments: # zone --> zone for egress_fragment in egress_fragments: rules.append(_generate_policy_dispatch_rule(ingress_fragment, egress_fragment)) else: # zone --> [ANY, HOST] rules.append(_generate_policy_dispatch_rule(ingress_fragment, None)) else: # [ANY, HOST] --> [zone, ANY, HOST] if egress_fragments: # [ANY, HOST] --> zone for egress_fragment in egress_fragments: rules.append(_generate_policy_dispatch_rule(None, egress_fragment)) else: # [ANY, HOST] --> [ANY, HOST] rules.append(_generate_policy_dispatch_rule(None, None)) return rules def build_zone_source_interface_rules(self, enable, zone, policy, interface, table, chain, append=False): isSNAT = True if (table == "nat" and chain == "POSTROUTING") else False _policy = self._fw.policy.policy_base_chain_name(policy, table, POLICY_CHAIN_PREFIX, isSNAT=isSNAT) opt = { "PREROUTING": "iifname", "POSTROUTING": "oifname", "INPUT": "iifname", "FORWARD": "iifname", "OUTPUT": "oifname", }[chain] if interface[len(interface)-1] == "+": interface = interface[:len(interface)-1] + "*" action = "goto" if interface == "*": expr_fragments = [{action: {"target": "%s_%s" % (table, _policy)}}] else: expr_fragments = [{"match": {"left": {"meta": {"key": opt}}, "op": "==", "right": interface}}, {action: {"target": "%s_%s" % (table, _policy)}}] if enable and not append: verb = "insert" rule = {"family": "inet", "table": TABLE_NAME, "chain": "%s_%s_ZONES" % (table, chain), "expr": expr_fragments} rule.update(self._zone_interface_fragment()) elif enable: verb = "add" rule = {"family": "inet", "table": TABLE_NAME, "chain": "%s_%s_ZONES" % (table, chain), "expr": expr_fragments} else: verb = "delete" rule = {"family": "inet", "table": TABLE_NAME, "chain": "%s_%s_ZONES" % (table, chain), "expr": expr_fragments} if not append: rule.update(self._zone_interface_fragment()) return [{verb: {"rule": rule}}] def build_zone_source_address_rules(self, enable, zone, policy, address, table, chain): isSNAT = True if (table == "nat" and chain == "POSTROUTING") else False _policy = self._fw.policy.policy_base_chain_name(policy, table, POLICY_CHAIN_PREFIX, isSNAT=isSNAT) add_del = { True: "insert", False: "delete" }[enable] opt = { "PREROUTING": "saddr", "POSTROUTING": "daddr", "INPUT": "saddr", "FORWARD": "saddr", "OUTPUT": "daddr", }[chain] action = "goto" rule = {"family": "inet", "table": TABLE_NAME, "chain": "%s_%s_ZONES" % (table, chain), "expr": [self._rule_addr_fragment(opt, address), {action: {"target": "%s_%s" % (table, _policy)}}]} rule.update(self._zone_source_fragment(zone, address)) return [{add_del: {"rule": rule}}] def build_policy_chain_rules(self, enable, policy, table, chain): add_del = { True: "add", False: "delete" }[enable] isSNAT = True if (table == "nat" and chain == "POSTROUTING") else False _policy = self._fw.policy.policy_base_chain_name(policy, table, POLICY_CHAIN_PREFIX, isSNAT=isSNAT) p_obj = self._fw.policy.get_policy(policy) rules = [] rules.append({add_del: {"chain": {"family": "inet", "table": TABLE_NAME, "name": "%s_%s" % (table, _policy)}}}) for chain_suffix in ["pre", "log", "deny", "allow", "post"]: rules.append({add_del: {"chain": {"family": "inet", "table": TABLE_NAME, "name": "%s_%s_%s" % (table, _policy, chain_suffix)}}}) # policy dispatch if p_obj.derived_from_zone: rules.append({"add": {"rule": {"family": "inet", "table": TABLE_NAME, "chain": "%s_%s" % (table, _policy), "expr": [{"jump": {"target": "%s_%s_%s" % (table, chain, "POLICIES_pre")}}]}}}) for chain_suffix in ["pre", "log", "deny", "allow", "post"]: rules.append({add_del: {"rule": {"family": "inet", "table": TABLE_NAME, "chain": "%s_%s" % (table, _policy), "expr": [{"jump": {"target": "%s_%s_%s" % (table, _policy, chain_suffix)}}]}}}) # since zones are always terminal we need to jump to the policy # dispatch just before the catch-all accept/drop if p_obj.derived_from_zone: rules.append({"add": {"rule": {"family": "inet", "table": TABLE_NAME, "chain": "%s_%s" % (table, _policy), "expr": [{"jump": {"target": "%s_%s_%s" % (table, chain, "POLICIES_post")}}]}}}) target = self._fw.policy._policies[policy].target if self._fw.get_log_denied() != "off": if table == "filter": if target in [DEFAULT_ZONE_TARGET, "REJECT", "%%REJECT%%", "DROP"]: log_suffix = target if target in [DEFAULT_ZONE_TARGET, "%%REJECT%%"]: log_suffix = "REJECT" rules.append({add_del: {"rule": {"family": "inet", "table": TABLE_NAME, "chain": "%s_%s" % (table, _policy), "expr": [self._pkttype_match_fragment(self._fw.get_log_denied()), {"log": {"prefix": "\"filter_%s_%s: \"" % (_policy, log_suffix)}}]}}}) if table == "filter" and \ target in [DEFAULT_ZONE_TARGET, "ACCEPT", "REJECT", "%%REJECT%%", "DROP"]: if target in [DEFAULT_ZONE_TARGET, "%%REJECT%%", "REJECT"]: target_fragment = self._reject_fragment() else: target_fragment = {target.lower(): None} rules.append({add_del: {"rule": {"family": "inet", "table": TABLE_NAME, "chain": "%s_%s" % (table, _policy), "expr": [target_fragment]}}}) if not enable: rules.reverse() return rules def _pkttype_match_fragment(self, pkttype): if pkttype == "all": return {} elif pkttype in ["unicast", "broadcast", "multicast"]: return {"match": {"left": {"meta": {"key": "pkttype"}}, "op": "==", "right": pkttype}} raise FirewallError(INVALID_RULE, "Invalid pkttype \"%s\"", pkttype) def _reject_types_fragment(self, reject_type): frags = { # REJECT_TYPES : <nft reject rule fragment> "icmp-host-prohibited" : {"reject": {"type": "icmp", "expr": "host-prohibited"}}, "host-prohib" : {"reject": {"type": "icmp", "expr": "host-prohibited"}}, "icmp-net-prohibited" : {"reject": {"type": "icmp", "expr": "net-prohibited"}}, "net-prohib" : {"reject": {"type": "icmp", "expr": "net-prohibited"}}, "icmp-admin-prohibited" : {"reject": {"type": "icmp", "expr": "admin-prohibited"}}, "admin-prohib" : {"reject": {"type": "icmp", "expr": "admin-prohibited"}}, "icmp6-adm-prohibited" : {"reject": {"type": "icmpv6", "expr": "admin-prohibited"}}, "adm-prohibited" : {"reject": {"type": "icmpv6", "expr": "admin-prohibited"}}, "icmp-net-unreachable" : {"reject": {"type": "icmp", "expr": "net-unreachable"}}, "net-unreach" : {"reject": {"type": "icmp", "expr": "net-unreachable"}}, "icmp-host-unreachable" : {"reject": {"type": "icmp", "expr": "host-unreachable"}}, "host-unreach" : {"reject": {"type": "icmp", "expr": "host-unreachable"}}, "icmp-port-unreachable" : {"reject": {"type": "icmp", "expr": "port-unreachable"}}, "icmp6-port-unreachable" : {"reject": {"type": "icmpv6", "expr": "port-unreachable"}}, "port-unreach" : {"reject": {"type": "icmpx", "expr": "port-unreachable"}}, "icmp-proto-unreachable" : {"reject": {"type": "icmp", "expr": "prot-unreachable"}}, "proto-unreach" : {"reject": {"type": "icmp", "expr": "prot-unreachable"}}, "icmp6-addr-unreachable" : {"reject": {"type": "icmpv6", "expr": "addr-unreachable"}}, "addr-unreach" : {"reject": {"type": "icmpv6", "expr": "addr-unreachable"}}, "icmp6-no-route" : {"reject": {"type": "icmpv6", "expr": "no-route"}}, "no-route" : {"reject": {"type": "icmpv6", "expr": "no-route"}}, "tcp-reset" : {"reject": {"type": "tcp reset"}}, "tcp-rst" : {"reject": {"type": "tcp reset"}}, } return frags[reject_type] def _reject_fragment(self): return {"reject": {"type": "icmpx", "expr": "admin-prohibited"}} def _icmp_match_fragment(self): return {"match": {"left": {"meta": {"key": "l4proto"}}, "op": "==", "right": {"set": ["icmp", "icmpv6"]}}} def _rich_rule_limit_fragment(self, limit): if not limit: return {} rich_to_nft = { "s" : "second", "m" : "minute", "h" : "hour", "d" : "day", } try: i = limit.value.index("/") except ValueError: raise FirewallError(INVALID_RULE, "Expected '/' in limit") return {"limit": {"rate": int(limit.value[0:i]), "per": rich_to_nft[limit.value[i+1]]}} def _rich_rule_chain_suffix(self, rich_rule): if type(rich_rule.element) in [Rich_Masquerade, Rich_ForwardPort, Rich_IcmpBlock, Rich_Tcp_Mss_Clamp]: # These are special and don't have an explicit action pass elif rich_rule.action: if type(rich_rule.action) not in [Rich_Accept, Rich_Reject, Rich_Drop, Rich_Mark]: raise FirewallError(INVALID_RULE, "Unknown action %s" % type(rich_rule.action)) else: raise FirewallError(INVALID_RULE, "No rule action specified.") if rich_rule.priority == 0: if type(rich_rule.element) in [Rich_Masquerade, Rich_ForwardPort, Rich_Tcp_Mss_Clamp] or \ type(rich_rule.action) in [Rich_Accept, Rich_Mark]: return "allow" elif type(rich_rule.element) in [Rich_IcmpBlock] or \ type(rich_rule.action) in [Rich_Reject, Rich_Drop]: return "deny" elif rich_rule.priority < 0: return "pre" else: return "post" def _rich_rule_chain_suffix_from_log(self, rich_rule): if not rich_rule.log and not rich_rule.audit: raise FirewallError(INVALID_RULE, "Not log or audit") if rich_rule.priority == 0: return "log" elif rich_rule.priority < 0: return "pre" else: return "post" def _zone_interface_fragment(self): return {"%%ZONE_INTERFACE%%": None} def _zone_source_fragment(self, zone, address): if check_single_address("ipv6", address): address = normalizeIP6(address) elif check_address("ipv6", address): addr_split = address.split("/") address = normalizeIP6(addr_split[0]) + "/" + addr_split[1] return {"%%ZONE_SOURCE%%": {"zone": zone, "address": address}} def _policy_priority_fragment(self, policy): return {"%%POLICY_PRIORITY%%": policy.priority} def _rich_rule_priority_fragment(self, rich_rule): if not rich_rule or rich_rule.priority == 0: return {} return {"%%RICH_RULE_PRIORITY%%": rich_rule.priority} def _rich_rule_log(self, policy, rich_rule, enable, table, expr_fragments): if not rich_rule.log: return {} _policy = self._fw.policy.policy_base_chain_name(policy, table, POLICY_CHAIN_PREFIX) add_del = { True: "add", False: "delete" }[enable] chain_suffix = self._rich_rule_chain_suffix_from_log(rich_rule) log_options = {} if type(rich_rule.log) == Rich_NFLog: log_options["group"] = int(rich_rule.log.group) if rich_rule.log.group else 0 if rich_rule.log.threshold: log_options["queue-threshold"] = int(rich_rule.log.threshold) else: if rich_rule.log.level: level = "warn" if "warning" == rich_rule.log.level else rich_rule.log.level log_options["level"] = "%s" % level if rich_rule.log.prefix: log_options["prefix"] = "%s" % rich_rule.log.prefix rule = {"family": "inet", "table": TABLE_NAME, "chain": "%s_%s_%s" % (table, _policy, chain_suffix), "expr": expr_fragments + [{"log": log_options}, self._rich_rule_limit_fragment(rich_rule.log.limit)]} rule.update(self._rich_rule_priority_fragment(rich_rule)) return {add_del: {"rule": rule}} def _rich_rule_audit(self, policy, rich_rule, enable, table, expr_fragments): if not rich_rule.audit: return {} _policy = self._fw.policy.policy_base_chain_name(policy, table, POLICY_CHAIN_PREFIX) add_del = { True: "add", False: "delete" }[enable] chain_suffix = self._rich_rule_chain_suffix_from_log(rich_rule) rule = {"family": "inet", "table": TABLE_NAME, "chain": "%s_%s_%s" % (table, _policy, chain_suffix), "expr": expr_fragments + [{"log": {"level": "audit"}}, self._rich_rule_limit_fragment(rich_rule.audit.limit)]} rule.update(self._rich_rule_priority_fragment(rich_rule)) return {add_del: {"rule": rule}} def _rich_rule_action(self, policy, rich_rule, enable, table, expr_fragments): if not rich_rule.action: return {} _policy = self._fw.policy.policy_base_chain_name(policy, table, POLICY_CHAIN_PREFIX) add_del = { True: "add", False: "delete" }[enable] chain_suffix = self._rich_rule_chain_suffix(rich_rule) chain = "%s_%s_%s" % (table, _policy, chain_suffix) if type(rich_rule.action) == Rich_Accept: rule_action = {"accept": None} elif type(rich_rule.action) == Rich_Reject: if rich_rule.action.type: rule_action = self._reject_types_fragment(rich_rule.action.type) else: rule_action = {"reject": None} elif type(rich_rule.action) == Rich_Drop: rule_action = {"drop": None} elif type(rich_rule.action) == Rich_Mark: table = "mangle" _policy = self._fw.policy.policy_base_chain_name(policy, table, POLICY_CHAIN_PREFIX) chain = "%s_%s_%s" % (table, _policy, chain_suffix) value = rich_rule.action.set.split("/") if len(value) > 1: rule_action = {"mangle": {"key": {"meta": {"key": "mark"}}, "value": {"^": [{"&": [{"meta": {"key": "mark"}}, value[1]]}, value[0]]}}} else: rule_action = {"mangle": {"key": {"meta": {"key": "mark"}}, "value": value[0]}} else: raise FirewallError(INVALID_RULE, "Unknown action %s" % type(rich_rule.action)) rule = {"family": "inet", "table": TABLE_NAME, "chain": chain, "expr": expr_fragments + [self._rich_rule_limit_fragment(rich_rule.action.limit), rule_action]} rule.update(self._rich_rule_priority_fragment(rich_rule)) return {add_del: {"rule": rule}} def _rule_addr_fragment(self, addr_field, address, invert=False): if address.startswith("ipset:"): return self._set_match_fragment(address[len("ipset:"):], True if "daddr" == addr_field else False, invert) else: if check_mac(address): family = "ether" elif check_single_address("ipv4", address): family = "ip" elif check_address("ipv4", address): family = "ip" normalized_address = ipaddress.IPv4Network(address, strict=False) address = {"prefix": {"addr": normalized_address.network_address.compressed, "len": normalized_address.prefixlen}} elif check_single_address("ipv6", address): family = "ip6" address = normalizeIP6(address) else: family = "ip6" addr_len = address.split("/") address = {"prefix": {"addr": normalizeIP6(addr_len[0]), "len": int(addr_len[1])}} return {"match": {"left": {"payload": {"protocol": family, "field": addr_field}}, "op": "!=" if invert else "==", "right": address}} def _rich_rule_family_fragment(self, rich_family): if not rich_family: return {} if rich_family not in ["ipv4", "ipv6"]: raise FirewallError(INVALID_RULE, "Invalid family" % rich_family) return {"match": {"left": {"meta": {"key": "nfproto"}}, "op": "==", "right": rich_family}} def _rich_rule_destination_fragment(self, rich_dest): if not rich_dest: return {} if rich_dest.addr: address = rich_dest.addr elif rich_dest.ipset: address = "ipset:" + rich_dest.ipset return self._rule_addr_fragment("daddr", address, invert=rich_dest.invert) def _rich_rule_source_fragment(self, rich_source): if not rich_source: return {} if rich_source.addr: address = rich_source.addr elif hasattr(rich_source, "mac") and rich_source.mac: address = rich_source.mac elif hasattr(rich_source, "ipset") and rich_source.ipset: address = "ipset:" + rich_source.ipset return self._rule_addr_fragment("saddr", address, invert=rich_source.invert) def _port_fragment(self, port): range = getPortRange(port) if isinstance(range, int) and range < 0: raise FirewallError(INVALID_PORT) elif len(range) == 1: return range[0] else: return {"range": [range[0], range[1]]} def build_policy_ports_rules(self, enable, policy, proto, port, destination=None, rich_rule=None): add_del = { True: "add", False: "delete" }[enable] table = "filter" _policy = self._fw.policy.policy_base_chain_name(policy, table, POLICY_CHAIN_PREFIX) expr_fragments = [] if rich_rule: expr_fragments.append(self._rich_rule_family_fragment(rich_rule.family)) if destination: expr_fragments.append(self._rule_addr_fragment("daddr", destination)) if rich_rule: expr_fragments.append(self._rich_rule_destination_fragment(rich_rule.destination)) expr_fragments.append(self._rich_rule_source_fragment(rich_rule.source)) expr_fragments.append({"match": {"left": {"payload": {"protocol": proto, "field": "dport"}}, "op": "==", "right": self._port_fragment(port)}}) if not rich_rule or type(rich_rule.action) != Rich_Mark: expr_fragments.append({"match": {"left": {"ct": {"key": "state"}}, "op": "in", "right": {"set": ["new", "untracked"]}}}) rules = [] if rich_rule: rules.append(self._rich_rule_log(policy, rich_rule, enable, table, expr_fragments)) rules.append(self._rich_rule_audit(policy, rich_rule, enable, table, expr_fragments)) rules.append(self._rich_rule_action(policy, rich_rule, enable, table, expr_fragments)) else: rules.append({add_del: {"rule": {"family": "inet", "table": TABLE_NAME, "chain": "%s_%s_allow" % (table, _policy), "expr": expr_fragments + [{"accept": None}]}}}) return rules def build_policy_protocol_rules(self, enable, policy, protocol, destination=None, rich_rule=None): add_del = { True: "add", False: "delete" }[enable] table = "filter" _policy = self._fw.policy.policy_base_chain_name(policy, table, POLICY_CHAIN_PREFIX) expr_fragments = [] if rich_rule: expr_fragments.append(self._rich_rule_family_fragment(rich_rule.family)) if destination: expr_fragments.append(self._rule_addr_fragment("daddr", destination)) if rich_rule: expr_fragments.append(self._rich_rule_destination_fragment(rich_rule.destination)) expr_fragments.append(self._rich_rule_source_fragment(rich_rule.source)) expr_fragments.append({"match": {"left": {"meta": {"key": "l4proto"}}, "op": "==", "right": protocol}}) if not rich_rule or type(rich_rule.action) != Rich_Mark: expr_fragments.append({"match": {"left": {"ct": {"key": "state"}}, "op": "in", "right": {"set": ["new", "untracked"]}}}) rules = [] if rich_rule: rules.append(self._rich_rule_log(policy, rich_rule, enable, table, expr_fragments)) rules.append(self._rich_rule_audit(policy, rich_rule, enable, table, expr_fragments)) rules.append(self._rich_rule_action(policy, rich_rule, enable, table, expr_fragments)) else: rules.append({add_del: {"rule": {"family": "inet", "table": TABLE_NAME, "chain": "%s_%s_allow" % (table, _policy), "expr": expr_fragments + [{"accept": None}]}}}) return rules def build_policy_tcp_mss_clamp_rules(self, enable, policy, tcp_mss_clamp_value, destination=None, rich_rule=None): table = "filter" _policy = self._fw.policy.policy_base_chain_name(policy, table, POLICY_CHAIN_PREFIX) add_del = { True: "add", False: "delete" }[enable] expr_fragments = [] if rich_rule: expr_fragments.append(self._rich_rule_destination_fragment(rich_rule.destination)) expr_fragments.append(self._rich_rule_source_fragment(rich_rule.source)) chain_suffix = self._rich_rule_chain_suffix(rich_rule) expr_fragments.append({"match": {"op": "in", "left": {"payload": {"protocol": "tcp","field": "flags"}}, "right": "syn"}}) if tcp_mss_clamp_value == "pmtu" or tcp_mss_clamp_value is None: expr_fragments.append({"mangle": {"key": {"tcp option": {"name": "maxseg","field": "size"}}, "value": {"rt": {"key": "mtu" }}}}) else: expr_fragments.append({"mangle": {"key": {"tcp option": {"name": "maxseg","field": "size"}}, "value": tcp_mss_clamp_value}}) rules = [] rules.append({add_del: {"rule": {"family": "inet", "table": TABLE_NAME, "chain": "filter_%s_%s" % (_policy, chain_suffix), "expr": expr_fragments}}}) return rules def build_policy_source_ports_rules(self, enable, policy, proto, port, destination=None, rich_rule=None): add_del = { True: "add", False: "delete" }[enable] table = "filter" _policy = self._fw.policy.policy_base_chain_name(policy, table, POLICY_CHAIN_PREFIX) expr_fragments = [] if rich_rule: expr_fragments.append(self._rich_rule_family_fragment(rich_rule.family)) if destination: expr_fragments.append(self._rule_addr_fragment("daddr", destination)) if rich_rule: expr_fragments.append(self._rich_rule_destination_fragment(rich_rule.destination)) expr_fragments.append(self._rich_rule_source_fragment(rich_rule.source)) expr_fragments.append({"match": {"left": {"payload": {"protocol": proto, "field": "sport"}}, "op": "==", "right": self._port_fragment(port)}}) if not rich_rule or type(rich_rule.action) != Rich_Mark: expr_fragments.append({"match": {"left": {"ct": {"key": "state"}}, "op": "in", "right": {"set": ["new", "untracked"]}}}) rules = [] if rich_rule: rules.append(self._rich_rule_log(policy, rich_rule, enable, table, expr_fragments)) rules.append(self._rich_rule_audit(policy, rich_rule, enable, table, expr_fragments)) rules.append(self._rich_rule_action(policy, rich_rule, enable, table, expr_fragments)) else: rules.append({add_del: {"rule": {"family": "inet", "table": TABLE_NAME, "chain": "%s_%s_allow" % (table, _policy), "expr": expr_fragments + [{"accept": None}]}}}) return rules def build_policy_helper_ports_rules(self, enable, policy, proto, port, destination, helper_name, module_short_name): table = "filter" _policy = self._fw.policy.policy_base_chain_name(policy, table, POLICY_CHAIN_PREFIX) add_del = { True: "add", False: "delete" }[enable] rules = [] if enable: rules.append({"add": {"ct helper": {"family": "inet", "table": TABLE_NAME, "name": "helper-%s-%s" % (helper_name, proto), "type": module_short_name, "protocol": proto}}}) expr_fragments = [] if destination: expr_fragments.append(self._rule_addr_fragment("daddr", destination)) expr_fragments.append({"match": {"left": {"payload": {"protocol": proto, "field": "dport"}}, "op": "==", "right": self._port_fragment(port)}}) expr_fragments.append({"ct helper": "helper-%s-%s" % (helper_name, proto)}) rules.append({add_del: {"rule": {"family": "inet", "table": TABLE_NAME, "chain": "filter_%s_allow" % (_policy), "expr": expr_fragments}}}) return rules def build_zone_forward_rules(self, enable, zone, policy, table, interface=None, source=None): add_del = { True: "add", False: "delete" }[enable] _policy = self._fw.policy.policy_base_chain_name(policy, table, POLICY_CHAIN_PREFIX) rules = [] if interface: if interface[len(interface)-1] == "+": interface = interface[:len(interface)-1] + "*" expr = [{"match": {"left": {"meta": {"key": "oifname"}}, "op": "==", "right": interface}}, {"accept": None}] else: # source expr = [self._rule_addr_fragment("daddr", source), {"accept": None}] rule = {"family": "inet", "table": TABLE_NAME, "chain": "filter_%s_allow" % (_policy), "expr": expr} rules.append({add_del: {"rule": rule}}) return rules def build_policy_masquerade_rules(self, enable, policy, rich_rule=None): add_del = { True: "add", False: "delete" }[enable] rules = [] expr_fragments = [] if rich_rule: expr_fragments.append(self._rich_rule_family_fragment(rich_rule.family)) expr_fragments.append(self._rich_rule_destination_fragment(rich_rule.destination)) expr_fragments.append(self._rich_rule_source_fragment(rich_rule.source)) chain_suffix = self._rich_rule_chain_suffix(rich_rule) else: expr_fragments.append({"match": {"left": {"meta": {"key": "nfproto"}}, "op": "==", "right": "ipv4"}}) chain_suffix = "allow" table = "nat" _policy = self._fw.policy.policy_base_chain_name(policy, table, POLICY_CHAIN_PREFIX, isSNAT=True) rule = {"family": "inet", "table": TABLE_NAME, "chain": "nat_%s_%s" % (_policy, chain_suffix), "expr": expr_fragments + [{"match": {"left": {"meta": {"key": "oifname"}}, "op": "!=", "right": "lo"}}, {"masquerade": None}]} rule.update(self._rich_rule_priority_fragment(rich_rule)) rules.append({add_del: {"rule": rule}}) return rules def build_policy_forward_port_rules(self, enable, policy, port, protocol, toport, toaddr, rich_rule=None): table = "nat" _policy = self._fw.policy.policy_base_chain_name(policy, table, POLICY_CHAIN_PREFIX) add_del = { True: "add", False: "delete" }[enable] expr_fragments = [] if rich_rule: expr_fragments.append(self._rich_rule_family_fragment(rich_rule.family)) expr_fragments.append(self._rich_rule_destination_fragment(rich_rule.destination)) expr_fragments.append(self._rich_rule_source_fragment(rich_rule.source)) chain_suffix = self._rich_rule_chain_suffix(rich_rule) else: nfproto = "ipv4" if toaddr and check_single_address("ipv6", toaddr): nfproto = "ipv6" expr_fragments.append({"match": {"left": {"meta": {"key": "nfproto"}}, "op": "==", "right": nfproto}}) chain_suffix = "allow" expr_fragments.append({"match": {"left": {"payload": {"protocol": protocol, "field": "dport"}}, "op": "==", "right": self._port_fragment(port)}}) if toaddr: if check_single_address("ipv6", toaddr): toaddr = normalizeIP6(toaddr) if toport and toport != "": expr_fragments.append({"dnat": {"addr": toaddr, "port": self._port_fragment(toport)}}) else: expr_fragments.append({"dnat": {"addr": toaddr}}) else: expr_fragments.append({"redirect": {"port": self._port_fragment(toport)}}) rule = {"family": "inet", "table": TABLE_NAME, "chain": "nat_%s_%s" % (_policy, chain_suffix), "expr": expr_fragments} rule.update(self._rich_rule_priority_fragment(rich_rule)) return [{add_del: {"rule": rule}}] def _icmp_types_to_nft_fragments(self, ipv, icmp_type): if icmp_type in ICMP_TYPES_FRAGMENTS[ipv]: return ICMP_TYPES_FRAGMENTS[ipv][icmp_type] else: raise FirewallError(INVALID_ICMPTYPE, "ICMP type '%s' not supported by %s for %s" % (icmp_type, self.name, ipv)) def build_policy_icmp_block_rules(self, enable, policy, ict, rich_rule=None): table = "filter" _policy = self._fw.policy.policy_base_chain_name(policy, table, POLICY_CHAIN_PREFIX) add_del = { True: "add", False: "delete" }[enable] if rich_rule and rich_rule.ipvs: ipvs = rich_rule.ipvs elif ict.destination: ipvs = [] if "ipv4" in ict.destination: ipvs.append("ipv4") if "ipv6" in ict.destination: ipvs.append("ipv6") else: ipvs = ["ipv4", "ipv6"] rules = [] for ipv in ipvs: if self._fw.policy.query_icmp_block_inversion(policy): final_chain = "%s_%s_allow" % (table, _policy) target_fragment = {"accept": None} else: final_chain = "%s_%s_deny" % (table, _policy) target_fragment = self._reject_fragment() expr_fragments = [] if rich_rule: expr_fragments.append(self._rich_rule_family_fragment(rich_rule.family)) expr_fragments.append(self._rich_rule_destination_fragment(rich_rule.destination)) expr_fragments.append(self._rich_rule_source_fragment(rich_rule.source)) expr_fragments.extend(self._icmp_types_to_nft_fragments(ipv, ict.name)) if rich_rule: rules.append(self._rich_rule_log(policy, rich_rule, enable, table, expr_fragments)) rules.append(self._rich_rule_audit(policy, rich_rule, enable, table, expr_fragments)) if rich_rule.action: rules.append(self._rich_rule_action(policy, rich_rule, enable, table, expr_fragments)) else: chain_suffix = self._rich_rule_chain_suffix(rich_rule) rule = {"family": "inet", "table": TABLE_NAME, "chain": "%s_%s_%s" % (table, _policy, chain_suffix), "expr": expr_fragments + [self._reject_fragment()]} rule.update(self._rich_rule_priority_fragment(rich_rule)) rules.append({add_del: {"rule": rule}}) else: if self._fw.get_log_denied() != "off" and not self._fw.policy.query_icmp_block_inversion(policy): rules.append({add_del: {"rule": {"family": "inet", "table": TABLE_NAME, "chain": final_chain, "expr": (expr_fragments + [self._pkttype_match_fragment(self._fw.get_log_denied()), {"log": {"prefix": "\"%s_%s_ICMP_BLOCK: \"" % (table, policy)}}])}}}) rules.append({add_del: {"rule": {"family": "inet", "table": TABLE_NAME, "chain": final_chain, "expr": expr_fragments + [target_fragment]}}}) return rules def build_policy_icmp_block_inversion_rules(self, enable, policy): table = "filter" _policy = self._fw.policy.policy_base_chain_name(policy, table, POLICY_CHAIN_PREFIX) rules = [] add_del = { True: "add", False: "delete" }[enable] if self._fw.policy.query_icmp_block_inversion(policy): target_fragment = self._reject_fragment() else: target_fragment = {"accept": None} # WARN: The "index" used here must be kept in sync with # build_policy_chain_rules() # rules.append({add_del: {"rule": {"family": "inet", "table": TABLE_NAME, "chain": "%s_%s" % (table, _policy), "index": 6, "expr": [self._icmp_match_fragment(), target_fragment]}}}) if self._fw.get_log_denied() != "off" and self._fw.policy.query_icmp_block_inversion(policy): rules.append({add_del: {"rule": {"family": "inet", "table": TABLE_NAME, "chain": "%s_%s" % (table, _policy), "index": 6, "expr": [self._icmp_match_fragment(), self._pkttype_match_fragment(self._fw.get_log_denied()), {"log": {"prefix": "%s_%s_ICMP_BLOCK: " % (table, policy)}}]}}}) return rules def build_rpfilter_rules(self, log_denied=False): rules = [] expr_fragments = [{"match": {"left": {"meta": {"key": "nfproto"}}, "op": "==", "right": "ipv6"}}, {"match": {"left": {"fib": {"flags": ["saddr", "iif", "mark"], "result": "oif"}}, "op": "==", "right": False}}] if log_denied != "off": expr_fragments.append({"log": {"prefix": "rpfilter_DROP: "}}) expr_fragments.append({"drop": None}) rules.append({"insert": {"rule": {"family": "inet", "table": TABLE_NAME, "chain": "filter_PREROUTING", "expr": expr_fragments}}}) # RHBZ#1058505, RHBZ#1575431 (bug in kernel 4.16-4.17) rules.append({"insert": {"rule": {"family": "inet", "table": TABLE_NAME, "chain": "filter_PREROUTING", "expr": [{"match": {"left": {"payload": {"protocol": "icmpv6", "field": "type"}}, "op": "==", "right": {"set": ["nd-router-advert", "nd-neighbor-solicit"]}}}, {"accept": None}]}}}) return rules def build_rfc3964_ipv4_rules(self): daddr_set = ["::0.0.0.0/96", # IPv4 compatible "::ffff:0.0.0.0/96", # IPv4 mapped "2002:0000::/24", # 0.0.0.0/8 (the system has no address assigned yet) "2002:0a00::/24", # 10.0.0.0/8 (private) "2002:7f00::/24", # 127.0.0.0/8 (loopback) "2002:ac10::/28", # 172.16.0.0/12 (private) "2002:c0a8::/32", # 192.168.0.0/16 (private) "2002:a9fe::/32", # 169.254.0.0/16 (IANA Assigned DHCP link-local) "2002:e000::/19", # 224.0.0.0/4 (multicast), 240.0.0.0/4 (reserved and broadcast) ] daddr_set = [{"prefix": {"addr": x.split("/")[0], "len": int(x.split("/")[1])}} for x in daddr_set] expr_fragments = [{"match": {"left": {"payload": {"protocol": "ip6", "field": "daddr"}}, "op": "==", "right": {"set": daddr_set}}}] if self._fw._log_denied in ["unicast", "all"]: expr_fragments.append({"log": {"prefix": "RFC3964_IPv4_REJECT: "}}) expr_fragments.append(self._reject_types_fragment("addr-unreach")) rules = [] # WARN: index must be kept in sync with build_default_rules() rules.append({"add": {"rule": {"family": "inet", "table": TABLE_NAME, "chain": "filter_OUTPUT", "index": 1, "expr": expr_fragments}}}) rules.append({"add": {"rule": {"family": "inet", "table": TABLE_NAME, "chain": "filter_FORWARD", "index": 2, "expr": expr_fragments}}}) return rules def build_policy_rich_source_destination_rules(self, enable, policy, rich_rule): table = "filter" expr_fragments = [] expr_fragments.append(self._rich_rule_family_fragment(rich_rule.family)) expr_fragments.append(self._rich_rule_destination_fragment(rich_rule.destination)) expr_fragments.append(self._rich_rule_source_fragment(rich_rule.source)) rules = [] rules.append(self._rich_rule_log(policy, rich_rule, enable, table, expr_fragments)) rules.append(self._rich_rule_audit(policy, rich_rule, enable, table, expr_fragments)) rules.append(self._rich_rule_action(policy, rich_rule, enable, table, expr_fragments)) return rules def is_ipv_supported(self, ipv): if ipv in ["ipv4", "ipv6", "eb"]: return True return False def _set_type_list(self, ipv, type): ipv_addr = { "ipv4" : "ipv4_addr", "ipv6" : "ipv6_addr", } types = { "hash:ip" : ipv_addr[ipv], "hash:ip,port" : [ipv_addr[ipv], "inet_proto", "inet_service"], "hash:ip,port,ip" : [ipv_addr[ipv], "inet_proto", "inet_service", ipv_addr[ipv]], "hash:ip,port,net" : [ipv_addr[ipv], "inet_proto", "inet_service", ipv_addr[ipv]], "hash:ip,mark" : [ipv_addr[ipv], "mark"], "hash:net" : ipv_addr[ipv], "hash:net,net" : [ipv_addr[ipv], ipv_addr[ipv]], "hash:net,port" : [ipv_addr[ipv], "inet_proto", "inet_service"], "hash:net,port,net" : [ipv_addr[ipv], "inet_proto", "inet_service", ipv_addr[ipv]], "hash:net,iface" : [ipv_addr[ipv], "ifname"], "hash:mac" : "ether_addr", } if type in types: return types[type] else: raise FirewallError(INVALID_TYPE, "ipset type name '%s' is not valid" % type) def build_set_create_rules(self, name, type, options=None): if options and "family" in options and options["family"] == "inet6": ipv = "ipv6" else: ipv = "ipv4" set_dict = {"family": "inet", "table": TABLE_NAME, "name": name, "type": self._set_type_list(ipv, type)} # Some types need the interval flag for t in type.split(":")[1].split(","): if t in ["ip", "net", "port"]: set_dict["flags"] = ["interval"] break if options: if "timeout" in options: set_dict["timeout"] = options["timeout"] if "maxelem" in options: set_dict["size"] = options["maxelem"] return [{"add": {"set": set_dict}}] def set_create(self, name, type, options=None): rules = self.build_set_create_rules(name, type, options) self.set_rules(rules, self._fw.get_log_denied()) def set_destroy(self, name): rule = {"delete": {"set": {"family": "inet", "table": TABLE_NAME, "name": name}}} self.set_rule(rule, self._fw.get_log_denied()) def _set_match_fragment(self, name, match_dest, invert=False): type_format = self._fw.ipset.get_ipset(name).type.split(":")[1].split(",") fragments = [] for i in range(len(type_format)): if type_format[i] == "port": fragments.append({"meta": {"key": "l4proto"}}) fragments.append({"payload": {"protocol": "th", "field": "dport" if match_dest else "sport"}}) elif type_format[i] in ["ip", "net", "mac"]: fragments.append({"payload": {"protocol": self._set_get_family(name), "field": "daddr" if match_dest else "saddr"}}) elif type_format[i] == "iface": fragments.append({"meta": {"key": "iifname" if match_dest else "oifname"}}) elif type_format[i] == "mark": fragments.append({"meta": {"key": "mark"}}) else: raise FirewallError("Unsupported ipset type for match fragment: %s" % (type_format[i])) return {"match": {"left": {"concat": fragments} if len(type_format) > 1 else fragments[0], "op": "!=" if invert else "==", "right": "@" + name}} def _set_entry_fragment(self, name, entry): # convert something like # 1.2.3.4,sctp:8080 (type hash:ip,port) # to # ["1.2.3.4", "sctp", "8080"] obj = self._fw.ipset.get_ipset(name) type_format = obj.type.split(":")[1].split(",") entry_tokens = entry.split(",") if len(type_format) != len(entry_tokens): raise FirewallError(INVALID_ENTRY, "Number of values does not match ipset type.") fragment = [] for i in range(len(type_format)): if type_format[i] == "port": try: index = entry_tokens[i].index(":") except ValueError: # no protocol means default tcp fragment.append("tcp") port_str = entry_tokens[i] else: fragment.append(entry_tokens[i][:index]) port_str = entry_tokens[i][index+1:] try: index = port_str.index("-") except ValueError: fragment.append(port_str) else: fragment.append({"range": [port_str[:index], port_str[index+1:]]}) elif type_format[i] in ["ip", "net"]: try: index = entry_tokens[i].index("/") except ValueError: addr = entry_tokens[i] if "family" in obj.options and obj.options["family"] == "inet6": addr = normalizeIP6(addr) fragment.append(addr) else: addr = entry_tokens[i][:index] if "family" in obj.options and obj.options["family"] == "inet6": addr = normalizeIP6(addr) fragment.append({"prefix": {"addr": addr, "len": int(entry_tokens[i][index+1:])}}) else: fragment.append(entry_tokens[i]) return [{"concat": fragment}] if len(type_format) > 1 else fragment def build_set_add_rules(self, name, entry): rules = [] element = self._set_entry_fragment(name, entry) rules.append({"add": {"element": {"family": "inet", "table": TABLE_NAME, "name": name, "elem": element}}}) return rules def set_add(self, name, entry): rules = self.build_set_add_rules(name, entry) self.set_rules(rules, self._fw.get_log_denied()) def set_delete(self, name, entry): element = self._set_entry_fragment(name, entry) rule = {"delete": {"element": {"family": "inet", "table": TABLE_NAME, "name": name, "elem": element}}} self.set_rule(rule, self._fw.get_log_denied()) def build_set_flush_rules(self, name): return [{"flush": {"set": {"family": "inet", "table": TABLE_NAME, "name": name}}}] def set_flush(self, name): rules = self.build_set_flush_rules(name) self.set_rules(rules, self._fw.get_log_denied()) def _set_get_family(self, name): ipset = self._fw.ipset.get_ipset(name) if ipset.type == "hash:mac": family = "ether" elif ipset.options and "family" in ipset.options \ and ipset.options["family"] == "inet6": family = "ip6" else: family = "ip" return family def set_restore(self, set_name, type_name, entries, create_options=None, entry_options=None): rules = [] rules.extend(self.build_set_create_rules(set_name, type_name, create_options)) rules.extend(self.build_set_flush_rules(set_name)) for entry in entries: rules.extend(self.build_set_add_rules(set_name, entry)) self.set_rules(rules, self._fw.get_log_denied()) PK ���Z�� core/icmp.pynu �[��� # -*- coding: utf-8 -*- # # Copyright (C) 2017 Red Hat, Inc. # # Authors: # Thomas Woerner <twoerner@redhat.com> # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see <http://www.gnu.org/licenses/>. # __all__ = [ "ICMP_TYPES", "ICMPV6_TYPES", "check_icmp_type", "check_icmpv6_type" ] ICMP_TYPES = { "echo-reply": "0/0", "pong": "0/0", "network-unreachable": "3/0", "host-unreachable": "3/1", "protocol-unreachable": "3/2", "port-unreachable": "3/3", "fragmentation-needed": "3/4", "source-route-failed": "3/5", "network-unknown": "3/6", "host-unknown": "3/7", "network-prohibited": "3/9", "host-prohibited": "3/10", "TOS-network-unreachable": "3/11", "TOS-host-unreachable": "3/12", "communication-prohibited": "3/13", "host-precedence-violation": "3/14", "precedence-cutoff": "3/15", "source-quench": "4/0", "network-redirect": "5/0", "host-redirect": "5/1", "TOS-network-redirect": "5/2", "TOS-host-redirect": "5/3", "echo-request": "8/0", "ping": "8/0", "router-advertisement": "9/0", "router-solicitation": "10/0", "ttl-zero-during-transit": "11/0", "ttl-zero-during-reassembly": "11/1", "ip-header-bad": "12/0", "required-option-missing": "12/1", "timestamp-request": "13/0", "timestamp-reply": "14/0", "address-mask-request": "17/0", "address-mask-reply": "18/0", } ICMPV6_TYPES = { "no-route": "1/0", "communication-prohibited": "1/1", "address-unreachable": "1/3", "port-unreachable": "1/4", "packet-too-big": "2/0", "ttl-zero-during-transit": "3/0", "ttl-zero-during-reassembly": "3/1", "bad-header": "4/0", "unknown-header-type": "4/1", "unknown-option": "4/2", "echo-request": "128/0", "ping": "128/0", "echo-reply": "129/0", "pong": "129/0", "router-solicitation": "133/0", "router-advertisement": "134/0", "neighbour-solicitation": "135/0", "neigbour-solicitation": "135/0", "neighbour-advertisement": "136/0", "neigbour-advertisement": "136/0", "redirect": "137/0", } def check_icmp_name(_name): if _name in ICMP_TYPES: return True return False def check_icmp_type(_type): if _type in ICMP_TYPES.values(): return True return False def check_icmpv6_name(_name): if _name in ICMP_TYPES: return True return False def check_icmpv6_type(_type): if _type in ICMPV6_TYPES.values(): return True return False PK ���Z����% �% core/fw_ipset.pynu �[��� # -*- coding: utf-8 -*- # # Copyright (C) 2015-2016 Red Hat, Inc. # # Authors: # Thomas Woerner <twoerner@redhat.com> # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see <http://www.gnu.org/licenses/>. # """ipset backend""" __all__ = [ "FirewallIPSet" ] from firewall.core.logger import log from firewall.core.ipset import remove_default_create_options as rm_def_cr_opts, \ normalize_ipset_entry, check_entry_overlaps_existing, \ check_for_overlapping_entries from firewall.core.io.ipset import IPSet from firewall import errors from firewall.errors import FirewallError class FirewallIPSet(object): def __init__(self, fw): self._fw = fw self._ipsets = { } def __repr__(self): return '%s(%r)' % (self.__class__, self._ipsets) # ipsets def cleanup(self): self._ipsets.clear() def check_ipset(self, name): if name not in self.get_ipsets(): raise FirewallError(errors.INVALID_IPSET, name) def query_ipset(self, name): return name in self.get_ipsets() def get_ipsets(self): return sorted(self._ipsets.keys()) def has_ipsets(self): return len(self._ipsets) > 0 def get_ipset(self, name, applied=False): self.check_ipset(name) obj = self._ipsets[name] if applied: self.check_applied_obj(obj) return obj def backends(self): backends = [] if self._fw.nftables_enabled: backends.append(self._fw.nftables_backend) if self._fw.ipset_enabled: backends.append(self._fw.ipset_backend) return backends def add_ipset(self, obj): if obj.type not in self._fw.ipset_supported_types: raise FirewallError(errors.INVALID_TYPE, "'%s' is not supported by ipset." % obj.type) self._ipsets[obj.name] = obj def remove_ipset(self, name, keep=False): obj = self._ipsets[name] if obj.applied and not keep: try: for backend in self.backends(): backend.set_destroy(name) except Exception as msg: raise FirewallError(errors.COMMAND_FAILED, msg) else: log.debug1("Keeping ipset '%s' because of timeout option", name) del self._ipsets[name] def apply_ipset(self, name): obj = self._ipsets[name] for backend in self.backends(): if backend.name == "ipset": active = backend.set_get_active_terse() if name in active and ("timeout" not in obj.options or \ obj.options["timeout"] == "0" or \ obj.type != active[name][0] or \ rm_def_cr_opts(obj.options) != \ active[name][1]): try: backend.set_destroy(name) except Exception as msg: raise FirewallError(errors.COMMAND_FAILED, msg) if self._fw._individual_calls: try: backend.set_create(obj.name, obj.type, obj.options) except Exception as msg: raise FirewallError(errors.COMMAND_FAILED, msg) else: obj.applied = True if "timeout" in obj.options and \ obj.options["timeout"] != "0": # no entries visible for ipsets with timeout continue try: backend.set_flush(obj.name) except Exception as msg: raise FirewallError(errors.COMMAND_FAILED, msg) for entry in obj.entries: try: backend.set_add(obj.name, entry) except Exception as msg: raise FirewallError(errors.COMMAND_FAILED, msg) else: try: backend.set_restore(obj.name, obj.type, obj.entries, obj.options, None) except Exception as msg: raise FirewallError(errors.COMMAND_FAILED, msg) else: obj.applied = True def apply_ipsets(self): for name in self.get_ipsets(): obj = self._ipsets[name] obj.applied = False log.debug1("Applying ipset '%s'" % name) self.apply_ipset(name) def flush(self): for backend in self.backends(): # nftables sets are part of the normal firewall ruleset. if backend.name == "nftables": continue for ipset in self.get_ipsets(): try: self.check_applied(ipset) backend.set_destroy(ipset) except FirewallError as msg: if msg.code != errors.NOT_APPLIED: raise msg # TYPE def get_type(self, name, applied=True): return self.get_ipset(name, applied=applied).type # DIMENSION def get_dimension(self, name): return len(self.get_ipset(name, applied=True).type.split(",")) def check_applied(self, name): obj = self.get_ipset(name) self.check_applied_obj(obj) def check_applied_obj(self, obj): if not obj.applied: raise FirewallError( errors.NOT_APPLIED, obj.name) # OPTIONS def get_family(self, name, applied=True): obj = self.get_ipset(name, applied=applied) if "family" in obj.options: if obj.options["family"] == "inet6": return "ipv6" return "ipv4" # ENTRIES def add_entry(self, name, entry): obj = self.get_ipset(name, applied=True) entry = normalize_ipset_entry(entry) IPSet.check_entry(entry, obj.options, obj.type) if entry in obj.entries: raise FirewallError(errors.ALREADY_ENABLED, "'%s' already is in '%s'" % (entry, name)) check_entry_overlaps_existing(entry, obj.entries) try: for backend in self.backends(): backend.set_add(obj.name, entry) except Exception as msg: raise FirewallError(errors.COMMAND_FAILED, msg) else: if "timeout" not in obj.options or obj.options["timeout"] == "0": # no entries visible for ipsets with timeout obj.entries.append(entry) def remove_entry(self, name, entry): obj = self.get_ipset(name, applied=True) entry = normalize_ipset_entry(entry) # no entry check for removal if entry not in obj.entries: raise FirewallError(errors.NOT_ENABLED, "'%s' not in '%s'" % (entry, name)) try: for backend in self.backends(): backend.set_delete(obj.name, entry) except Exception as msg: raise FirewallError(errors.COMMAND_FAILED, msg) else: if "timeout" not in obj.options or obj.options["timeout"] == "0": # no entries visible for ipsets with timeout obj.entries.remove(entry) def query_entry(self, name, entry): obj = self.get_ipset(name, applied=True) entry = normalize_ipset_entry(entry) if "timeout" in obj.options and obj.options["timeout"] != "0": # no entries visible for ipsets with timeout raise FirewallError(errors.IPSET_WITH_TIMEOUT, name) return entry in obj.entries def get_entries(self, name): obj = self.get_ipset(name, applied=True) return obj.entries def set_entries(self, name, entries): obj = self.get_ipset(name, applied=True) check_for_overlapping_entries(entries) for entry in entries: IPSet.check_entry(entry, obj.options, obj.type) if "timeout" not in obj.options or obj.options["timeout"] == "0": # no entries visible for ipsets with timeout obj.entries = entries try: for backend in self.backends(): backend.set_flush(obj.name) except Exception as msg: raise FirewallError(errors.COMMAND_FAILED, msg) else: obj.applied = True try: for backend in self.backends(): if self._fw._individual_calls: for entry in obj.entries: backend.set_add(obj.name, entry) else: backend.set_restore(obj.name, obj.type, obj.entries, obj.options, None) except Exception as msg: raise FirewallError(errors.COMMAND_FAILED, msg) else: obj.applied = True return PK ���Z�^ܪ>y >y core/logger.pynu �[��� # -*- coding: utf-8 -*- # # Copyright (C) 2005-2007,2012 Red Hat, Inc. # # Authors: # Thomas Woerner <twoerner@redhat.com> # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see <http://www.gnu.org/licenses/>. # __all__ = [ "LogTarget", "FileLog", "Logger", "log" ] import sys import types import time import inspect import fnmatch import syslog import traceback import fcntl import os.path import os # --------------------------------------------------------------------------- # abstract class for logging targets class LogTarget(object): """ Abstract class for logging targets. """ def __init__(self): self.fd = None def write(self, data, level, logger, is_debug=0): raise NotImplementedError("LogTarget.write is an abstract method") def flush(self): raise NotImplementedError("LogTarget.flush is an abstract method") def close(self): raise NotImplementedError("LogTarget.close is an abstract method") # --------------------------------------------------------------------------- # private class for stdout class _StdoutLog(LogTarget): def __init__(self): LogTarget.__init__(self) self.fd = sys.stdout def write(self, data, level, logger, is_debug=0): # ignore level self.fd.write(data) self.flush() def close(self): self.flush() def flush(self): self.fd.flush() # --------------------------------------------------------------------------- # private class for stderr class _StderrLog(_StdoutLog): def __init__(self): _StdoutLog.__init__(self) self.fd = sys.stderr # --------------------------------------------------------------------------- # private class for syslog class _SyslogLog(LogTarget): def __init__(self): # Only initialize LogTarget here as fs should be None LogTarget.__init__(self) # # Derived from: https://github.com/canvon/firewalld/commit/af0edfee1cc1891b7b13f302ca5911b24e9b0f13 # # Work around Python issue 27875, "Syslogs /usr/sbin/foo as /foo # instead of as foo" # (but using openlog explicitly might be better anyway) # # Set ident to basename, log PID as well, and log to facility "daemon". syslog.openlog(os.path.basename(sys.argv[0]), syslog.LOG_PID, syslog.LOG_DAEMON) def write(self, data, level, logger, is_debug=0): priority = None if is_debug: priority = syslog.LOG_DEBUG else: if level >= logger.INFO1: priority = syslog.LOG_INFO elif level == logger.WARNING: priority = syslog.LOG_WARNING elif level == logger.ERROR: priority = syslog.LOG_ERR elif level == logger.FATAL: priority = syslog.LOG_CRIT if data.endswith("\n"): data = data[:len(data)-1] if len(data) > 0: if priority is None: syslog.syslog(data) else: syslog.syslog(priority, data) def close(self): syslog.closelog() def flush(self): pass # --------------------------------------------------------------------------- class FileLog(LogTarget): """ FileLog class. File will be opened on the first write. """ def __init__(self, filename, mode="w"): LogTarget.__init__(self) self.filename = filename self.mode = mode def open(self): if self.fd: return flags = os.O_CREAT | os.O_WRONLY if self.mode.startswith('a'): flags |= os.O_APPEND self.fd = os.open(self.filename, flags, 0o640) # Make sure that existing file has correct perms os.fchmod(self.fd, 0o640) # Make it an object self.fd = os.fdopen(self.fd, self.mode) fcntl.fcntl(self.fd, fcntl.F_SETFD, fcntl.FD_CLOEXEC) def write(self, data, level, logger, is_debug=0): if not self.fd: self.open() self.fd.write(data) self.fd.flush() def close(self): if not self.fd: return self.fd.close() self.fd = None def flush(self): if not self.fd: return self.fd.flush() # --------------------------------------------------------------------------- class Logger(object): r""" Format string: %(class)s Calling class the function belongs to, else empty %(date)s Date using Logger.date_format, see time module %(domain)s Full Domain: %(module)s.%(class)s.%(function)s %(file)s Filename of the module %(function)s Function name, empty in __main__ %(label)s Label according to log function call from Logger.label %(level)d Internal logging level %(line)d Line number in module %(module)s Module name %(message)s Log message Standard levels: FATAL Fatal error messages ERROR Error messages WARNING Warning messages INFOx, x in [1..5] Information DEBUGy, y in [1..10] Debug messages NO_INFO No info output NO_DEBUG No debug output INFO_MAX Maximum info level DEBUG_MAX Maximum debug level x and y depend on info_max and debug_max from Logger class initialization. See __init__ function. Default logging targets: stdout Logs to stdout stderr Logs to stderr syslog Logs to syslog Additional arguments for logging functions (fatal, error, warning, info and debug): nl Disable newline at the end with nl=0, default is nl=1. fmt Format string for this logging entry, overloads global format string. Example: fmt="%(file)s:%(line)d %(message)s" nofmt Only output message with nofmt=1. The nofmt argument wins over the fmt argument. Example: from logger import log log.setInfoLogLevel(log.INFO1) log.setDebugLogLevel(log.DEBUG1) for i in range(1, log.INFO_MAX+1): log.setInfoLogLabel(i, "INFO%d: " % i) log.setFormat("%(date)s %(module)s:%(line)d [%(domain)s] %(label)s: " "%(level)d %(message)s") log.setDateFormat("%Y-%m-%d %H:%M:%S") fl = FileLog("/tmp/log", "a") log.addInfoLogging("*", fl) log.addDebugLogging("*", fl) log.addInfoLogging("*", log.syslog, fmt="%(label)s%(message)s") log.debug3("debug3") log.debug2("debug2") log.debug1("debug1") log.info2("info2") log.info1("info1") log.warning("warning\n", nl=0) log.error("error\n", nl=0) log.fatal("fatal") log.info(log.INFO1, "nofmt info", nofmt=1) """ ALL = -5 NOTHING = -4 FATAL = -3 TRACEBACK = -2 ERROR = -1 WARNING = 0 # Additional levels are generated in class initilization stdout = _StdoutLog() stderr = _StderrLog() syslog = _SyslogLog() def __init__(self, info_max=5, debug_max=10): """ Logger class initialization """ self._level = { } self._debug_level = { } self._format = "" self._date_format = "" self._label = { } self._debug_label = { } self._logging = { } self._debug_logging = { } self._domains = { } self._debug_domains = { } # INFO1 is required for standard log level if info_max < 1: raise ValueError("Logger: info_max %d is too low" % info_max) if debug_max < 0: raise ValueError("Logger: debug_max %d is too low" % debug_max) self.NO_INFO = self.WARNING # = 0 self.INFO_MAX = info_max self.NO_DEBUG = 0 self.DEBUG_MAX = debug_max self.setInfoLogLabel(self.FATAL, "FATAL ERROR: ") self.setInfoLogLabel(self.TRACEBACK, "") self.setInfoLogLabel(self.ERROR, "ERROR: ") self.setInfoLogLabel(self.WARNING, "WARNING: ") # generate info levels and infox functions for _level in range(1, self.INFO_MAX+1): setattr(self, "INFO%d" % _level, _level) self.setInfoLogLabel(_level, "") setattr(self, "info%d" % (_level), (lambda self, x: lambda message, *args, **kwargs: self.info(x, message, *args, **kwargs))(self, _level)) # pylint: disable=E0602 # generate debug levels and debugx functions for _level in range(1, self.DEBUG_MAX+1): setattr(self, "DEBUG%d" % _level, _level) self.setDebugLogLabel(_level, "DEBUG%d: " % _level) setattr(self, "debug%d" % (_level), (lambda self, x: lambda message, *args, **kwargs: self.debug(x, message, *args, **kwargs))(self, _level)) # pylint: disable=E0602 # set initial log levels, formats and targets self.setInfoLogLevel(self.INFO1) self.setDebugLogLevel(self.NO_DEBUG) self.setFormat("%(label)s%(message)s") self.setDateFormat("%d %b %Y %H:%M:%S") self.setInfoLogging("*", self.stderr, [ self.FATAL, self.ERROR, self.WARNING ]) self.setInfoLogging("*", self.stdout, [ i for i in range(self.INFO1, self.INFO_MAX+1) ]) self.setDebugLogging("*", self.stdout, [ i for i in range(1, self.DEBUG_MAX+1) ]) def close(self): """ Close all logging targets """ for level in range(self.FATAL, self.DEBUG_MAX+1): if level not in self._logging: continue for (dummy, target, dummy) in self._logging[level]: target.close() def getInfoLogLevel(self, domain="*"): """ Get info log level. """ self._checkDomain(domain) if domain in self._level: return self._level[domain] return self.NOTHING def setInfoLogLevel(self, level, domain="*"): """ Set log level [NOTHING .. INFO_MAX] """ self._checkDomain(domain) if level < self.NOTHING: level = self.NOTHING if level > self.INFO_MAX: level = self.INFO_MAX self._level[domain] = level def getDebugLogLevel(self, domain="*"): """ Get debug log level. """ self._checkDomain(domain) if domain in self._debug_level: return self._debug_level[domain] + self.NO_DEBUG return self.NO_DEBUG def setDebugLogLevel(self, level, domain="*"): """ Set debug log level [NO_DEBUG .. DEBUG_MAX] """ self._checkDomain(domain) if level < 0: level = 0 if level > self.DEBUG_MAX: level = self.DEBUG_MAX self._debug_level[domain] = level - self.NO_DEBUG def getFormat(self): return self._format def setFormat(self, _format): self._format = _format def getDateFormat(self): return self._date_format def setDateFormat(self, _format): self._date_format = _format def setInfoLogLabel(self, level, label): """ Set log label for level. Level can be a single level or an array of levels. """ levels = self._getLevels(level) for level in levels: self._checkLogLevel(level, min_level=self.FATAL, max_level=self.INFO_MAX) self._label[level] = label def setDebugLogLabel(self, level, label): """ Set log label for level. Level can be a single level or an array of levels. """ levels = self._getLevels(level, is_debug=1) for level in levels: self._checkLogLevel(level, min_level=self.INFO1, max_level=self.DEBUG_MAX) self._debug_label[level] = label def setInfoLogging(self, domain, target, level=ALL, fmt=None): """ Set info log target for domain and level. Level can be a single level or an array of levels. Use level ALL to set for all levels. If no format is specified, the default format will be used. """ self._setLogging(domain, target, level, fmt, is_debug=0) def setDebugLogging(self, domain, target, level=ALL, fmt=None): """ Set debug log target for domain and level. Level can be a single level or an array of levels. Use level ALL to set for all levels. If no format is specified, the default format will be used. """ self._setLogging(domain, target, level, fmt, is_debug=1) def addInfoLogging(self, domain, target, level=ALL, fmt=None): """ Add info log target for domain and level. Level can be a single level or an array of levels. Use level ALL to set for all levels. If no format is specified, the default format will be used. """ self._addLogging(domain, target, level, fmt, is_debug=0) def addDebugLogging(self, domain, target, level=ALL, fmt=None): """ Add debg log target for domain and level. Level can be a single level or an array of levels. Use level ALL to set for all levels. If no format is specified, the default format will be used. """ self._addLogging(domain, target, level, fmt, is_debug=1) def delInfoLogging(self, domain, target, level=ALL, fmt=None): """ Delete info log target for domain and level. Level can be a single level or an array of levels. Use level ALL to set for all levels. If no format is specified, the default format will be used. """ self._delLogging(domain, target, level, fmt, is_debug=0) def delDebugLogging(self, domain, target, level=ALL, fmt=None): """ Delete debug log target for domain and level. Level can be a single level or an array of levels. Use level ALL to set for all levels. If no format is specified, the default format will be used. """ self._delLogging(domain, target, level, fmt, is_debug=1) def isInfoLoggingHere(self, level): """ Is there currently any info logging for this log level (and domain)? """ return self._isLoggingHere(level, is_debug=0) def isDebugLoggingHere(self, level): """ Is there currently any debug logging for this log level (and domain)? """ return self._isLoggingHere(level, is_debug=1) ### log functions def fatal(self, _format, *args, **kwargs): """ Fatal error log. """ self._checkKWargs(kwargs) kwargs["is_debug"] = 0 self._log(self.FATAL, _format, *args, **kwargs) def error(self, _format, *args, **kwargs): """ Error log. """ self._checkKWargs(kwargs) kwargs["is_debug"] = 0 self._log(self.ERROR, _format, *args, **kwargs) def warning(self, _format, *args, **kwargs): """ Warning log. """ self._checkKWargs(kwargs) kwargs["is_debug"] = 0 self._log(self.WARNING, _format, *args, **kwargs) def info(self, level, _format, *args, **kwargs): """ Information log using info level [1..info_max]. There are additional infox functions according to info_max from __init__""" self._checkLogLevel(level, min_level=1, max_level=self.INFO_MAX) self._checkKWargs(kwargs) kwargs["is_debug"] = 0 self._log(level+self.NO_INFO, _format, *args, **kwargs) def debug(self, level, _format, *args, **kwargs): """ Debug log using debug level [1..debug_max]. There are additional debugx functions according to debug_max from __init__""" self._checkLogLevel(level, min_level=1, max_level=self.DEBUG_MAX) self._checkKWargs(kwargs) kwargs["is_debug"] = 1 self._log(level, _format, *args, **kwargs) def exception(self): self._log(self.TRACEBACK, traceback.format_exc(), args=[], kwargs={}) ### internal functions def _checkLogLevel(self, level, min_level, max_level): if level < min_level or level > max_level: raise ValueError("Level %d out of range, should be [%d..%d]." % \ (level, min_level, max_level)) def _checkKWargs(self, kwargs): if not kwargs: return for key in kwargs.keys(): if key not in [ "nl", "fmt", "nofmt" ]: raise ValueError("Key '%s' is not allowed as argument for logging." % key) def _checkDomain(self, domain): if not domain or domain == "": raise ValueError("Domain '%s' is not valid." % domain) def _getLevels(self, level, is_debug=0): """ Generate log level array. """ if level != self.ALL: if isinstance(level, list) or isinstance(level, tuple): levels = level else: levels = [ level ] for level in levels: if is_debug: self._checkLogLevel(level, min_level=1, max_level=self.DEBUG_MAX) else: self._checkLogLevel(level, min_level=self.FATAL, max_level=self.INFO_MAX) else: if is_debug: levels = [ i for i in range(self.DEBUG1, self.DEBUG_MAX) ] else: levels = [ i for i in range(self.FATAL, self.INFO_MAX) ] return levels def _getTargets(self, target): """ Generate target array. """ if isinstance(target, list) or isinstance(target, tuple): targets = target else: targets = [ target ] for _target in targets: if not issubclass(_target.__class__, LogTarget): raise ValueError("'%s' is no valid logging target." % \ _target.__class__.__name__) return targets def _genDomains(self, is_debug=0): # private method for self._domains array creation, speeds up """ Generate dict with domain by level. """ if is_debug: _domains = self._debug_domains _logging = self._debug_logging _range = ( 1, self.DEBUG_MAX+1 ) else: _domains = self._domains _logging = self._logging _range = ( self.FATAL, self.INFO_MAX+1 ) if len(_domains) > 0: _domains.clear() for level in range(_range[0], _range[1]): if level not in _logging: continue for (domain, dummy, dummy) in _logging[level]: if domain not in _domains: _domains.setdefault(level, [ ]).append(domain) def _setLogging(self, domain, target, level=ALL, fmt=None, is_debug=0): self._checkDomain(domain) levels = self._getLevels(level, is_debug) targets = self._getTargets(target) if is_debug: _logging = self._debug_logging else: _logging = self._logging for level in levels: for target in targets: _logging[level] = [ (domain, target, fmt) ] self._genDomains(is_debug) def _addLogging(self, domain, target, level=ALL, fmt=None, is_debug=0): self._checkDomain(domain) levels = self._getLevels(level, is_debug) targets = self._getTargets(target) if is_debug: _logging = self._debug_logging else: _logging = self._logging for level in levels: for target in targets: _logging.setdefault(level, [ ]).append((domain, target, fmt)) self._genDomains(is_debug) def _delLogging(self, domain, target, level=ALL, fmt=None, is_debug=0): self._checkDomain(domain) levels = self._getLevels(level, is_debug) targets = self._getTargets(target) if is_debug: _logging = self._debug_logging else: _logging = self._logging for _level in levels: for target in targets: if _level not in _logging: continue if (domain, target, fmt) in _logging[_level]: _logging[_level].remove( (domain, target, fmt) ) if len(_logging[_level]) == 0: del _logging[_level] continue if level != self.ALL: raise ValueError("No mathing logging for " \ "level %d, domain %s, target %s and format %s." % \ (_level, domain, target.__class__.__name__, fmt)) self._genDomains(is_debug) def _isLoggingHere(self, level, is_debug=0): _dict = self._genDict(level, is_debug) if not _dict: return False point_domain = _dict["domain"] + "." if is_debug: _logging = self._debug_logging else: _logging = self._logging # do we need to log? for (domain, dummy, dummy) in _logging[level]: if domain == "*" or \ point_domain.startswith(domain) or \ fnmatch.fnmatchcase(_dict["domain"], domain): return True return False def _getClass(self, frame): """ Function to get calling class. Returns class or None. """ # get class by first function argument, if there are any if frame.f_code.co_argcount > 0: selfname = frame.f_code.co_varnames[0] if selfname in frame.f_locals: _self = frame.f_locals[selfname] obj = self._getClass2(_self.__class__, frame.f_code) if obj: return obj module = inspect.getmodule(frame.f_code) code = frame.f_code # function in module? if code.co_name in module.__dict__: if hasattr(module.__dict__[code.co_name], "func_code") and \ module.__dict__[code.co_name].__code__ == code: return None # class in module for (dummy, obj) in module.__dict__.items(): if isinstance(obj, types.ClassType): if hasattr(obj, code.co_name): value = getattr(obj, code.co_name) if isinstance(value, types.FunctionType): if value.__code__ == code: return obj # nothing found return None def _getClass2(self, obj, code): """ Internal function to get calling class. Returns class or None. """ for value in obj.__dict__.values(): if isinstance(value, types.FunctionType): if value.__code__ == code: return obj for base in obj.__bases__: _obj = self._getClass2(base, code) if _obj: return _obj return None # internal log class def _log(self, level, _format, *args, **kwargs): is_debug = 0 if "is_debug" in kwargs: is_debug = kwargs["is_debug"] nl = 1 if "nl" in kwargs: nl = kwargs["nl"] nofmt = 0 if "nofmt" in kwargs: nofmt = kwargs["nofmt"] _dict = self._genDict(level, is_debug) if not _dict: return if len(args) > 1: _dict['message'] = _format % args elif len(args) == 1: # needed for _format % _dict _dict['message'] = _format % args[0] else: _dict['message'] = _format point_domain = _dict["domain"] + "." if is_debug: _logging = self._debug_logging else: _logging = self._logging used_targets = [ ] # log to target(s) for (domain, target, _format) in _logging[level]: if target in used_targets: continue if domain == "*" \ or point_domain.startswith(domain+".") \ or fnmatch.fnmatchcase(_dict["domain"], domain): if not _format: _format = self._format if "fmt" in kwargs: _format = kwargs["fmt"] if nofmt: target.write(_dict["message"], level, self, is_debug) else: target.write(_format % _dict, level, self, is_debug) if nl: # newline target.write("\n", level, self, is_debug) used_targets.append(target) # internal function to generate the dict, needed for logging def _genDict(self, level, is_debug=0): """ Internal function. """ check_domains = [ ] simple_match = False if is_debug: _dict = self._debug_level _domains = self._debug_domains _label = self._debug_label else: _dict = self._level _domains = self._domains _label = self._label # no debug for domain in _dict: if domain == "*": # '*' matches everything: simple match if _dict[domain] >= level: simple_match = True if len(check_domains) > 0: check_domains = [ ] break else: if _dict[domain] >= level: check_domains.append(domain) if not simple_match and len(check_domains) < 1: return None if level not in _domains: return None f = inspect.currentframe() # go outside of logger module as long as there is a lower frame while f and f.f_back and f.f_globals["__name__"] == self.__module__: f = f.f_back if not f: raise ValueError("Frame information not available.") # get module name module_name = f.f_globals["__name__"] # simple module match test for all entries of check_domain point_module = module_name + "." for domain in check_domains: if point_module.startswith(domain): # found domain in module name check_domains = [ ] break # get code co = f.f_code # optimization: bail out early if domain can not match at all _len = len(module_name) for domain in _domains[level]: i = domain.find("*") if i == 0: continue elif i > 0: d = domain[:i] else: d = domain if _len >= len(d): if not module_name.startswith(d): return None else: if not d.startswith(module_name): return None # generate _dict for format output level_str = "" if level in _label: level_str = _label[level] _dict = { 'file': co.co_filename, 'line': f.f_lineno, 'module': module_name, 'class': '', 'function': co.co_name, 'domain': '', 'label' : level_str, 'level' : level, 'date' : time.strftime(self._date_format, time.localtime()) } if _dict["function"] == "?": _dict["function"] = "" # domain match needed? domain_needed = False for domain in _domains[level]: # standard domain, matches everything if domain == "*": continue # domain is needed domain_needed = True break # do we need to get the class object? if self._format.find("%(domain)") >= 0 or \ self._format.find("%(class)") >= 0 or \ domain_needed or \ len(check_domains) > 0: obj = self._getClass(f) if obj: _dict["class"] = obj.__name__ # build domain string _dict["domain"] = "" + _dict["module"] if _dict["class"] != "": _dict["domain"] += "." + _dict["class"] if _dict["function"] != "": _dict["domain"] += "." + _dict["function"] if len(check_domains) < 1: return _dict point_domain = _dict["domain"] + "." for domain in check_domains: if point_domain.startswith(domain) or \ fnmatch.fnmatchcase(_dict["domain"], domain): return _dict return None # --------------------------------------------------------------------------- # Global logging object. log = Logger() # --------------------------------------------------------------------------- """ # Example if __name__ == '__main__': log.setInfoLogLevel(log.INFO2) log.setDebugLogLevel(log.DEBUG5) for i in range(log.INFO1, log.INFO_MAX+1): log.setInfoLogLabel(i, "INFO%d: " % i) for i in range(log.DEBUG1, log.DEBUG_MAX+1): log.setDebugLogLabel(i, "DEBUG%d: " % i) log.setFormat("%(date)s %(module)s:%(line)d %(label)s" "%(message)s") log.setDateFormat("%Y-%m-%d %H:%M:%S") fl = FileLog("/tmp/log", "a") log.addInfoLogging("*", fl) log.delDebugLogging("*", log.stdout) log.setDebugLogging("*", log.stdout, [ log.DEBUG1, log.DEBUG2 ] ) log.addDebugLogging("*", fl) # log.addInfoLogging("*", log.syslog, fmt="%(label)s%(message)s") # log.addDebugLogging("*", log.syslog, fmt="%(label)s%(message)s") log.debug10("debug10") log.debug9("debug9") log.debug8("debug8") log.debug7("debug7") log.debug6("debug6") log.debug5("debug5") log.debug4("debug4") log.debug3("debug3") log.debug2("debug2", fmt="%(file)s:%(line)d %(message)s") log.debug1("debug1", nofmt=1) log.info5("info5") log.info4("info4") log.info3("info3") log.info2("info2") log.info1("info1") log.warning("warning\n", nl=0) log.error("error ", nl=0) log.error("error", nofmt=1) log.fatal("fatal") log.info(log.INFO1, "nofmt info", nofmt=1) log.info(log.INFO2, "info2 fmt", fmt="%(file)s:%(line)d %(message)s") try: a = b except Exception as e: log.exception() """ # vim:ts=4:sw=4:showmatch:expandtab PK ���ZV�_P) ) core/fw_helper.pynu �[��� # -*- coding: utf-8 -*- # # Copyright (C) 2015-2016 Red Hat, Inc. # # Authors: # Thomas Woerner <twoerner@redhat.com> # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see <http://www.gnu.org/licenses/>. # """helper backend""" __all__ = [ "FirewallHelper" ] from firewall import errors from firewall.errors import FirewallError class FirewallHelper(object): def __init__(self, fw): self._fw = fw self._helpers = { } def __repr__(self): return '%s(%r)' % (self.__class__, self._helpers) # helpers def cleanup(self): self._helpers.clear() def check_helper(self, name): if name not in self.get_helpers(): raise FirewallError(errors.INVALID_HELPER, name) def query_helper(self, name): return name in self.get_helpers() def get_helpers(self): return sorted(self._helpers.keys()) def has_helpers(self): return len(self._helpers) > 0 def get_helper(self, name): self.check_helper(name) return self._helpers[name] def add_helper(self, obj): self._helpers[obj.name] = obj def remove_helper(self, name): if name not in self._helpers: raise FirewallError(errors.INVALID_HELPER, name) del self._helpers[name] PK ���Zy���R R core/fw_icmptype.pynu �[��� # -*- coding: utf-8 -*- # # Copyright (C) 2011-2016 Red Hat, Inc. # # Authors: # Thomas Woerner <twoerner@redhat.com> # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see <http://www.gnu.org/licenses/>. # __all__ = [ "FirewallIcmpType" ] import copy from firewall.core.logger import log from firewall import errors from firewall.errors import FirewallError class FirewallIcmpType(object): def __init__(self, fw): self._fw = fw self._icmptypes = { } def __repr__(self): return '%s(%r)' % (self.__class__, self._icmptypes) def cleanup(self): self._icmptypes.clear() # zones def get_icmptypes(self): return sorted(self._icmptypes.keys()) def check_icmptype(self, icmptype): if icmptype not in self._icmptypes: raise FirewallError(errors.INVALID_ICMPTYPE, icmptype) def get_icmptype(self, icmptype): self.check_icmptype(icmptype) return self._icmptypes[icmptype] def add_icmptype(self, obj): orig_ipvs = obj.destination if len(orig_ipvs) == 0: orig_ipvs = [ "ipv4", "ipv6" ] ipvs = orig_ipvs[:] for ipv in orig_ipvs: if ipv == "ipv4": if not self._fw.ip4tables_enabled and not self._fw.nftables_enabled: continue supported_icmps = self._fw.ipv4_supported_icmp_types elif ipv == "ipv6": if not self._fw.ip6tables_enabled and not self._fw.nftables_enabled: continue supported_icmps = self._fw.ipv6_supported_icmp_types else: supported_icmps = [ ] if obj.name.lower() not in supported_icmps: log.info1("ICMP type '%s' is not supported by the kernel for %s." % (obj.name, ipv)) ipvs.remove(ipv) if len(ipvs) != len(orig_ipvs): if len(ipvs) < 1: raise FirewallError(errors.INVALID_ICMPTYPE, "No supported ICMP type.") new_obj = copy.deepcopy(obj) new_obj.destination = ipvs self._icmptypes[obj.name] = new_obj else: self._icmptypes[obj.name] = obj def remove_icmptype(self, icmptype): self.check_icmptype(icmptype) del self._icmptypes[icmptype] PK ���Zř�Rʩ ʩ core/fw_zone.pynu �[��� # -*- coding: utf-8 -*- # # Copyright (C) 2011-2016 Red Hat, Inc. # # Authors: # Thomas Woerner <twoerner@redhat.com> # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see <http://www.gnu.org/licenses/>. # import copy from firewall.core.base import SHORTCUTS, DEFAULT_ZONE_TARGET, SOURCE_IPSET_TYPES from firewall.core.fw_transaction import FirewallTransaction from firewall.core.io.policy import Policy from firewall.core.logger import log from firewall.core.rich import ( Rich_ForwardPort, Rich_IcmpBlock, Rich_IcmpType, Rich_Mark, Rich_Masquerade, Rich_Port, Rich_Protocol, Rich_Rule, Rich_Service, Rich_SourcePort, Rich_Tcp_Mss_Clamp ) from firewall.core.fw_nm import nm_get_bus_name from firewall.functions import checkIPnMask, checkIP6nMask, check_mac from firewall import errors from firewall.errors import FirewallError class FirewallZone(object): ZONE_POLICY_PRIORITY = 0 def __init__(self, fw): self._fw = fw self._zones = { } self._zone_policies = { } def __repr__(self): return '%s(%r)' % (self.__class__, self._zones) def cleanup(self): self._zones.clear() self._zone_policies.clear() def new_transaction(self): t = FirewallTransaction(self._fw) t.add_pre(self._fw.full_check_config) return t def policy_name_from_zones(self, fromZone, toZone): return "zone_{fromZone}_{toZone}".format(fromZone=fromZone, toZone=toZone) # zones def get_zones(self): return sorted(self._zones.keys()) def get_active_zones(self): active_zones = [] for zone in self.get_zones(): if self.list_interfaces(zone) or self.list_sources(zone): active_zones.append(zone) return active_zones def get_zone_of_interface(self, interface): interface_id = self.__interface_id(interface) for zone in self._zones: if interface_id in self._zones[zone].interfaces: # an interface can only be part of one zone return zone return None def get_zone_of_source(self, source): source_id = self.__source_id(source) for zone in self._zones: if source_id in self._zones[zone].sources: # a source_id can only be part of one zone return zone return None def get_zone(self, zone): z = self._fw.check_zone(zone) return self._zones[z] def policy_obj_from_zone_obj(self, z_obj, fromZone, toZone): p_obj = Policy() p_obj.derived_from_zone = z_obj.name p_obj.name = self.policy_name_from_zones(fromZone, toZone) p_obj.priority = self.ZONE_POLICY_PRIORITY p_obj.target = z_obj.target p_obj.ingress_zones = [fromZone] p_obj.egress_zones = [toZone] # copy zone permanent config to policy permanent config # WARN: This assumes the same attribute names. # for setting in ["services", "ports", "masquerade", "forward_ports", "source_ports", "icmp_blocks", "icmp_block_inversion", "rules_str", "protocols"]: if fromZone == z_obj.name and toZone == "HOST" and \ setting in ["services", "ports", "source_ports", "icmp_blocks", "icmp_block_inversion", "protocols"]: # zone --> HOST setattr(p_obj, setting, copy.deepcopy(getattr(z_obj, setting))) elif fromZone == "ANY" and toZone == z_obj.name and setting in ["masquerade"]: # any zone --> zone setattr(p_obj, setting, copy.deepcopy(getattr(z_obj, setting))) elif fromZone == z_obj.name and toZone == "ANY" and \ setting in ["forward_ports"]: # zone --> any zone setattr(p_obj, setting, copy.deepcopy(getattr(z_obj, setting))) elif setting in ["rules_str"]: p_obj.rules_str = [] p_obj.rules = [] for rule_str in z_obj.rules_str: current_policy = self.policy_name_from_zones(fromZone, toZone) rule = Rich_Rule(rule_str=rule_str) if current_policy in self._rich_rule_to_policies(z_obj.name, rule): p_obj.rules_str.append(rule_str) p_obj.rules.append(rule) return p_obj def add_zone(self, obj): self._zones[obj.name] = obj self._zone_policies[obj.name] = [] # Create policy objects, will need many: # - (zone --> HOST) - ports, service, etc # - (any zone --> zone) - masquerade # - (zone --> any zone) # - also includes forward-ports because it works on (nat, # PREROUTING) and therefore applies to redirects to the local # host or dnat to a different host. # - also includes rich rule "mark" action for the same reason # for fromZone,toZone in [(obj.name, "HOST"), ("ANY", obj.name), (obj.name, "ANY")]: p_obj = self.policy_obj_from_zone_obj(obj, fromZone, toZone) self._fw.policy.add_policy(p_obj) self._zone_policies[obj.name].append(p_obj.name) def remove_zone(self, zone): obj = self._zones[zone] if obj.applied: self.unapply_zone_settings(zone) del self._zones[zone] del self._zone_policies[zone] def apply_zones(self, use_transaction=None): for zone in self.get_zones(): z_obj = self._zones[zone] if len(z_obj.interfaces) > 0 or len(z_obj.sources) > 0: log.debug1("Applying zone '%s'", zone) self.apply_zone_settings(zone, use_transaction=use_transaction) def set_zone_applied(self, zone, applied): obj = self._zones[zone] obj.applied = applied # zone from chain def zone_from_chain(self, chain): if "_" not in chain: # no zone chain return None splits = chain.split("_") if len(splits) < 2: return None _chain = None for x in SHORTCUTS: if splits[0] == SHORTCUTS[x]: _chain = x if _chain is not None: # next part needs to be zone name if splits[1] not in self.get_zones(): return None if len(splits) == 2 or \ (len(splits) == 3 and splits[2] in [ "pre", "log", "deny", "allow", "post" ]): return (splits[1], _chain) return None def policy_from_chain(self, chain): x = self.zone_from_chain(chain) if x is None: return None (zone, _chain) = x # derived from _get_table_chains_for_zone_dispatch() if _chain in ["PREROUTING", "FORWARD"]: fromZone = zone toZone = "ANY" elif _chain in ["INPUT"]: fromZone = zone toZone = "HOST" elif _chain in ["POSTROUTING"]: fromZone = "ANY" toZone = zone else: raise FirewallError(errors.INVALID_CHAIN, "chain '%s' can't be mapped to a policy" % (chain)) return (self.policy_name_from_zones(fromZone, toZone), _chain) def create_zone_base_by_chain(self, ipv, table, chain, use_transaction=None): # Create zone base chains if the chain is reserved for a zone if ipv in [ "ipv4", "ipv6" ]: x = self.policy_from_chain(chain) if x is not None: (policy, _chain) = self.policy_from_chain(chain) if use_transaction is None: transaction = self.new_transaction() else: transaction = use_transaction self._fw.policy.gen_chain_rules(policy, True, table, _chain, transaction) if use_transaction is None: transaction.execute(True) def _zone_settings(self, enable, zone, transaction): for key in ["interfaces", "sources", "forward", "icmp_block_inversion"]: args_list = getattr(self.get_zone(zone), key) if isinstance(args_list, bool): args_list = [args_list] for args in args_list: if key == "interfaces": self._interface(enable, zone, args, transaction) elif key == "sources": ipv = self.check_source(args) self._source(enable, zone, ipv, args, transaction) elif key == "icmp_block_inversion": continue elif key == "forward": # no need to call this when applying the zone as the rules # will be generated when adding the interfaces/sources pass else: log.warning("Zone '%s': Unknown setting '%s:%s', " "unable to apply", zone, key, args) # ICMP-block-inversion is always applied if enable: self._icmp_block_inversion(enable, zone, transaction) def apply_zone_settings(self, zone, use_transaction=None): _zone = self._fw.check_zone(zone) obj = self._zones[_zone] if obj.applied: return obj.applied = True if use_transaction is None: transaction = self.new_transaction() else: transaction = use_transaction for policy in self._zone_policies[_zone]: log.debug1("Applying policy (%s) derived from zone '%s'", policy, zone) self._fw.policy.apply_policy_settings(policy, use_transaction=transaction) self._zone_settings(True, _zone, transaction) if use_transaction is None: transaction.execute(True) def unapply_zone_settings(self, zone, use_transaction=None): _zone = self._fw.check_zone(zone) obj = self._zones[_zone] if not obj.applied: return if use_transaction is None: transaction = self.new_transaction() else: transaction = use_transaction for policy in self._zone_policies[_zone]: self._fw.policy.unapply_policy_settings(policy, use_transaction=transaction) self._zone_settings(False, _zone, transaction) if use_transaction is None: transaction.execute(True) def get_config_with_settings(self, zone): """ :return: exported config updated with runtime settings """ obj = self.get_zone(zone) conf_dict = self.get_config_with_settings_dict(zone) conf_list = [] for i in range(16): # tuple based API has 16 elements if obj.IMPORT_EXPORT_STRUCTURE[i][0] not in conf_dict: # old API needs the empty elements as well. Grab it from the # class otherwise we don't know the type. conf_list.append(copy.deepcopy(getattr(obj, obj.IMPORT_EXPORT_STRUCTURE[i][0]))) else: conf_list.append(conf_dict[obj.IMPORT_EXPORT_STRUCTURE[i][0]]) return tuple(conf_list) def get_config_with_settings_dict(self, zone): """ :return: exported config updated with runtime settings """ permanent = self.get_zone(zone).export_config_dict() if permanent["target"] == DEFAULT_ZONE_TARGET: permanent["target"] = "default" runtime = { "services": self.list_services(zone), "ports": self.list_ports(zone), "icmp_blocks": self.list_icmp_blocks(zone), "masquerade": self.query_masquerade(zone), "forward_ports": self.list_forward_ports(zone), "interfaces": self.list_interfaces(zone), "sources": self.list_sources(zone), "rules_str": self.list_rules(zone), "protocols": self.list_protocols(zone), "source_ports": self.list_source_ports(zone), "icmp_block_inversion": self.query_icmp_block_inversion(zone), "forward": self.query_forward(zone), } return self._fw.combine_runtime_with_permanent_settings(permanent, runtime) def set_config_with_settings_dict(self, zone, settings, sender): # stupid wrappers to convert rich rule string to rich rule object def add_rule_wrapper(zone, rule_str, timeout=0, sender=None): self.add_rule(zone, Rich_Rule(rule_str=rule_str), timeout=0, sender=sender) def remove_rule_wrapper(zone, rule_str): self.remove_rule(zone, Rich_Rule(rule_str=rule_str)) setting_to_fn = { "services": (self.add_service, self.remove_service), "ports": (self.add_port, self.remove_port), "icmp_blocks": (self.add_icmp_block, self.remove_icmp_block), "masquerade": (self.add_masquerade, self.remove_masquerade), "forward_ports": (self.add_forward_port, self.remove_forward_port), "interfaces": (self.add_interface, self.remove_interface), "sources": (self.add_source, self.remove_source), "rules_str": (add_rule_wrapper, remove_rule_wrapper), "protocols": (self.add_protocol, self.remove_protocol), "source_ports": (self.add_source_port, self.remove_source_port), "icmp_block_inversion": (self.add_icmp_block_inversion, self.remove_icmp_block_inversion), "forward": (self.add_forward, self.remove_forward), } # do a full config check on a temporary object before trying to make # the runtime changes old_obj = self.get_zone(zone) check_obj = copy.copy(old_obj) check_obj.import_config_dict(settings, self._fw.get_all_io_objects_dict()) self._fw.full_check_config({"zones": [check_obj]}) old_settings = self.get_config_with_settings_dict(zone) (add_settings, remove_settings) = self._fw.get_added_and_removed_settings(old_settings, settings) for key in remove_settings: if isinstance(remove_settings[key], list): for args in remove_settings[key]: if isinstance(args, tuple): setting_to_fn[key][1](zone, *args) else: setting_to_fn[key][1](zone, args) else: # bool setting_to_fn[key][1](zone) for key in add_settings: if isinstance(add_settings[key], list): for args in add_settings[key]: if key in ["interfaces", "sources"]: # no timeout arg setting_to_fn[key][0](zone, args, sender=sender) else: if isinstance(args, tuple): setting_to_fn[key][0](zone, *args, timeout=0, sender=sender) else: setting_to_fn[key][0](zone, args, timeout=0, sender=sender) else: # bool if key in ["icmp_block_inversion"]: # no timeout arg setting_to_fn[key][0](zone, sender=sender) else: setting_to_fn[key][0](zone, timeout=0, sender=sender) # INTERFACES def check_interface(self, interface): self._fw.check_interface(interface) def __interface_id(self, interface): self.check_interface(interface) return interface def add_interface(self, zone, interface, sender=None, use_transaction=None, allow_apply=True): self._fw.check_panic() _zone = self._fw.check_zone(zone) _obj = self._zones[_zone] interface_id = self.__interface_id(interface) if interface_id in _obj.interfaces: raise FirewallError(errors.ZONE_ALREADY_SET, "'%s' already bound to '%s'" % (interface, zone)) zoi = self.get_zone_of_interface(interface) if zoi is not None: raise FirewallError(errors.ZONE_CONFLICT, "'%s' already bound to '%s'" % (interface, zoi)) log.debug1("Setting zone of interface '%s' to '%s'" % (interface, _zone)) if use_transaction is None: transaction = self.new_transaction() else: transaction = use_transaction if not _obj.applied and allow_apply: self.apply_zone_settings(zone, use_transaction=transaction) transaction.add_fail(self.set_zone_applied, _zone, False) if allow_apply: self._interface(True, _zone, interface, transaction) self.__register_interface(_obj, interface_id, zone, sender) transaction.add_fail(self.__unregister_interface, _obj, interface_id) if use_transaction is None: transaction.execute(True) return _zone def __register_interface(self, _obj, interface_id, zone, sender): _obj.interfaces.append(interface_id) if not zone or zone == "": self._fw._default_zone_interfaces.append(interface_id) if sender == nm_get_bus_name(): self._fw._nm_assigned_interfaces.append(interface_id) def change_zone_of_interface(self, zone, interface, sender=None): self._fw.check_panic() _old_zone = self.get_zone_of_interface(interface) _new_zone = self._fw.check_zone(zone) if _new_zone == _old_zone: return _old_zone if _old_zone is not None: self.remove_interface(_old_zone, interface) _zone = self.add_interface(zone, interface, sender) return _zone def change_default_zone(self, old_zone, new_zone, use_transaction=None): self._fw.check_panic() if use_transaction is None: transaction = self.new_transaction() else: transaction = use_transaction self.apply_zone_settings(new_zone, transaction) self._interface(True, new_zone, "+", transaction, append=True) if old_zone is not None and old_zone != "": self._interface(False, old_zone, "+", transaction, append=True) if use_transaction is None: transaction.execute(True) def remove_interface(self, zone, interface, use_transaction=None): self._fw.check_panic() zoi = self.get_zone_of_interface(interface) if zoi is None: raise FirewallError(errors.UNKNOWN_INTERFACE, "'%s' is not in any zone" % interface) _zone = zoi if zone == "" else self._fw.check_zone(zone) if zoi != _zone: raise FirewallError(errors.ZONE_CONFLICT, "remove_interface(%s, %s): zoi='%s'" % \ (zone, interface, zoi)) if use_transaction is None: transaction = self.new_transaction() else: transaction = use_transaction _obj = self._zones[_zone] interface_id = self.__interface_id(interface) transaction.add_post(self.__unregister_interface, _obj, interface_id) self._interface(False, _zone, interface, transaction) if use_transaction is None: transaction.execute(True) return _zone def __unregister_interface(self, _obj, interface_id): if interface_id in _obj.interfaces: _obj.interfaces.remove(interface_id) if interface_id in self._fw._default_zone_interfaces: self._fw._default_zone_interfaces.remove(interface_id) if interface_id in self._fw._nm_assigned_interfaces: self._fw._nm_assigned_interfaces.remove(interface_id) def query_interface(self, zone, interface): return self.__interface_id(interface) in self.get_zone(zone).interfaces def list_interfaces(self, zone): return self.get_zone(zone).interfaces # SOURCES def check_source(self, source, applied=False): if checkIPnMask(source): return "ipv4" elif checkIP6nMask(source): return "ipv6" elif check_mac(source): return "" elif source.startswith("ipset:"): self._check_ipset_type_for_source(source[6:]) if applied: self._check_ipset_applied(source[6:]) return self._ipset_family(source[6:]) else: raise FirewallError(errors.INVALID_ADDR, source) def __source_id(self, source, applied=False): self.check_source(source, applied=applied) return source def add_source(self, zone, source, sender=None, use_transaction=None, allow_apply=True): self._fw.check_panic() _zone = self._fw.check_zone(zone) _obj = self._zones[_zone] if check_mac(source): source = source.upper() ipv = self.check_source(source, applied=allow_apply) source_id = self.__source_id(source, applied=allow_apply) if source_id in _obj.sources: raise FirewallError(errors.ZONE_ALREADY_SET, "'%s' already bound to '%s'" % (source, _zone)) if self.get_zone_of_source(source) is not None: raise FirewallError(errors.ZONE_CONFLICT, "'%s' already bound to a zone" % source) if use_transaction is None: transaction = self.new_transaction() else: transaction = use_transaction if not _obj.applied and allow_apply: self.apply_zone_settings(zone, use_transaction=transaction) transaction.add_fail(self.set_zone_applied, _zone, False) if allow_apply: self._source(True, _zone, ipv, source_id, transaction) self.__register_source(_obj, source_id, zone, sender) transaction.add_fail(self.__unregister_source, _obj, source_id) if use_transaction is None: transaction.execute(True) return _zone def __register_source(self, _obj, source_id, zone, sender): _obj.sources.append(source_id) def change_zone_of_source(self, zone, source, sender=None): self._fw.check_panic() _old_zone = self.get_zone_of_source(source) _new_zone = self._fw.check_zone(zone) if _new_zone == _old_zone: return _old_zone if check_mac(source): source = source.upper() if _old_zone is not None: self.remove_source(_old_zone, source) _zone = self.add_source(zone, source, sender) return _zone def remove_source(self, zone, source, use_transaction=None): self._fw.check_panic() if check_mac(source): source = source.upper() zos = self.get_zone_of_source(source) if zos is None: raise FirewallError(errors.UNKNOWN_SOURCE, "'%s' is not in any zone" % source) _zone = zos if zone == "" else self._fw.check_zone(zone) if zos != _zone: raise FirewallError(errors.ZONE_CONFLICT, "remove_source(%s, %s): zos='%s'" % \ (zone, source, zos)) if use_transaction is None: transaction = self.new_transaction() else: transaction = use_transaction _obj = self._zones[_zone] ipv = self.check_source(source) source_id = self.__source_id(source) transaction.add_post(self.__unregister_source, _obj, source_id) self._source(False, _zone, ipv, source_id, transaction) if use_transaction is None: transaction.execute(True) return _zone def __unregister_source(self, _obj, source_id): if source_id in _obj.sources: _obj.sources.remove(source_id) def query_source(self, zone, source): if check_mac(source): source = source.upper() return self.__source_id(source) in self.get_zone(zone).sources def list_sources(self, zone): return self.get_zone(zone).sources def _interface(self, enable, zone, interface, transaction, append=False): for backend in self._fw.enabled_backends(): if not backend.policies_supported: continue for policy in self._zone_policies[zone]: for (table, chain) in self._fw.policy._get_table_chains_for_zone_dispatch(policy): rules = backend.build_zone_source_interface_rules(enable, zone, policy, interface, table, chain, append) transaction.add_rules(backend, rules) # intra zone forward policy = self.policy_name_from_zones(zone, "ANY") # Skip adding wildcard/catch-all interface (for default # zone). Otherwise it would allow forwarding from interface # in default zone -> interface not in default zone (but in # a different zone). if self.get_zone(zone).forward and interface not in ["+", "*"]: rules = backend.build_zone_forward_rules(enable, zone, policy, "filter", interface=interface) transaction.add_rules(backend, rules) # update policy dispatch for any policy using this zone in ingress # or egress for policy in self._fw.policy.get_policies_not_derived_from_zone(): if zone not in self._fw.policy.list_ingress_zones(policy) and \ zone not in self._fw.policy.list_egress_zones(policy): continue if policy in self._fw.policy.get_active_policies_not_derived_from_zone() and self._fw.policy.get_policy(policy).applied: # first remove the old set of interfaces using the current zone # settings. if not enable and len(self.list_interfaces(zone)) == 1: self._fw.policy.unapply_policy_settings(policy, use_transaction=transaction) else: self._fw.policy._ingress_egress_zones(False, policy, transaction) # after the transaction ends and therefore the interface # has been added to the zone's settings, update the # dependent policies transaction.add_post(lambda p: (p in self._fw.policy.get_active_policies_not_derived_from_zone()) and \ self._fw.policy._ingress_egress_zones_transaction(True, p), policy) elif enable: transaction.add_post(lambda p: (p in self._fw.policy.get_active_policies_not_derived_from_zone()) and \ self._fw.policy.apply_policy_settings(p), policy) # IPSETS def _ipset_family(self, name): if self._ipset_type(name) == "hash:mac": return None return self._fw.ipset.get_family(name, applied=False) def _ipset_type(self, name): return self._fw.ipset.get_type(name, applied=False) def _ipset_match_flags(self, name, flag): return ",".join([flag] * self._fw.ipset.get_dimension(name)) def _check_ipset_applied(self, name): return self._fw.ipset.check_applied(name) def _check_ipset_type_for_source(self, name): _type = self._ipset_type(name) if _type not in SOURCE_IPSET_TYPES: raise FirewallError( errors.INVALID_IPSET, "ipset '%s' with type '%s' not usable as source" % \ (name, _type)) def _source(self, enable, zone, ipv, source, transaction): # For mac source bindings ipv is an empty string, the mac source will # be added for ipv4 and ipv6 for backend in [self._fw.get_backend_by_ipv(ipv)] if ipv else self._fw.enabled_backends(): if not backend.policies_supported: continue for policy in self._zone_policies[zone]: for (table, chain) in self._fw.policy._get_table_chains_for_zone_dispatch(policy): rules = backend.build_zone_source_address_rules(enable, zone, policy, source, table, chain) transaction.add_rules(backend, rules) # intra zone forward policy = self.policy_name_from_zones(zone, "ANY") if self.get_zone(zone).forward: rules = backend.build_zone_forward_rules(enable, zone, policy, "filter", source=source) transaction.add_rules(backend, rules) # update policy dispatch for any policy using this zone in ingress # or egress for policy in self._fw.policy.get_policies_not_derived_from_zone(): if zone not in self._fw.policy.list_ingress_zones(policy) and \ zone not in self._fw.policy.list_egress_zones(policy): continue if policy in self._fw.policy.get_active_policies_not_derived_from_zone() and self._fw.policy.get_policy(policy).applied: # first remove the old set of sources using the current zone # settings. if not enable and len(self.list_sources(zone)) == 1: self._fw.policy.unapply_policy_settings(policy, use_transaction=transaction) else: self._fw.policy._ingress_egress_zones(False, policy, transaction) # after the transaction ends and therefore the sources # has been added to the zone's settings, update the # dependent policies transaction.add_post(lambda p: (p in self._fw.policy.get_active_policies_not_derived_from_zone()) and \ self._fw.policy._ingress_egress_zones_transaction(True, p), policy) elif enable: transaction.add_post(lambda p: (p in self._fw.policy.get_active_policies_not_derived_from_zone()) and \ self._fw.policy.apply_policy_settings(p), policy) def add_service(self, zone, service, timeout=0, sender=None): zone = self._fw.check_zone(zone) p_name = self.policy_name_from_zones(zone, "HOST") self._fw.policy.add_service(p_name, service, timeout, sender) return zone def remove_service(self, zone, service): zone = self._fw.check_zone(zone) p_name = self.policy_name_from_zones(zone, "HOST") self._fw.policy.remove_service(p_name, service) return zone def query_service(self, zone, service): zone = self._fw.check_zone(zone) p_name = self.policy_name_from_zones(zone, "HOST") return self._fw.policy.query_service(p_name, service) def list_services(self, zone): zone = self._fw.check_zone(zone) p_name = self.policy_name_from_zones(zone, "HOST") return self._fw.policy.list_services(p_name) def add_port(self, zone, port, protocol, timeout=0, sender=None): zone = self._fw.check_zone(zone) p_name = self.policy_name_from_zones(zone, "HOST") self._fw.policy.add_port(p_name, port, protocol, timeout, sender) return zone def remove_port(self, zone, port, protocol): zone = self._fw.check_zone(zone) p_name = self.policy_name_from_zones(zone, "HOST") self._fw.policy.remove_port(p_name, port, protocol) return zone def query_port(self, zone, port, protocol): zone = self._fw.check_zone(zone) p_name = self.policy_name_from_zones(zone, "HOST") return self._fw.policy.query_port(p_name, port, protocol) def list_ports(self, zone): zone = self._fw.check_zone(zone) p_name = self.policy_name_from_zones(zone, "HOST") return self._fw.policy.list_ports(p_name) def add_source_port(self, zone, source_port, protocol, timeout=0, sender=None): zone = self._fw.check_zone(zone) p_name = self.policy_name_from_zones(zone, "HOST") self._fw.policy.add_source_port(p_name, source_port, protocol, timeout, sender) return zone def remove_source_port(self, zone, source_port, protocol): zone = self._fw.check_zone(zone) p_name = self.policy_name_from_zones(zone, "HOST") self._fw.policy.remove_source_port(p_name, source_port, protocol) return zone def query_source_port(self, zone, source_port, protocol): zone = self._fw.check_zone(zone) p_name = self.policy_name_from_zones(zone, "HOST") return self._fw.policy.query_source_port(p_name, source_port, protocol) def list_source_ports(self, zone): zone = self._fw.check_zone(zone) p_name = self.policy_name_from_zones(zone, "HOST") return self._fw.policy.list_source_ports(p_name) def _rich_rule_to_policies(self, zone, rule): zone = self._fw.check_zone(zone) if type(rule.action) == Rich_Mark: return [self.policy_name_from_zones(zone, "ANY")] elif type(rule.element) in [Rich_Service, Rich_Port, Rich_Protocol, Rich_SourcePort, Rich_IcmpBlock, Rich_IcmpType]: return [self.policy_name_from_zones(zone, "HOST")] elif type(rule.element) in [Rich_ForwardPort]: return [self.policy_name_from_zones(zone, "ANY")] elif type(rule.element) in [Rich_Masquerade]: return [self.policy_name_from_zones("ANY", zone)] elif type(rule.element) in [Rich_Tcp_Mss_Clamp]: return [self.policy_name_from_zones(zone, "ANY")] elif rule.element is None: return [self.policy_name_from_zones(zone, "HOST")] else: raise FirewallError("Rich rule type (%s) not handled." % (type(rule.element))) def add_rule(self, zone, rule, timeout=0, sender=None): for p_name in self._rich_rule_to_policies(zone, rule): self._fw.policy.add_rule(p_name, rule, timeout, sender) return zone def remove_rule(self, zone, rule): for p_name in self._rich_rule_to_policies(zone, rule): self._fw.policy.remove_rule(p_name, rule) return zone def query_rule(self, zone, rule): ret = True for p_name in self._rich_rule_to_policies(zone, rule): ret = ret and self._fw.policy.query_rule(p_name, rule) return ret def list_rules(self, zone): zone = self._fw.check_zone(zone) ret = set() for p_name in [self.policy_name_from_zones(zone, "ANY"), self.policy_name_from_zones(zone, "HOST"), self.policy_name_from_zones("ANY", zone)]: ret.update(set(self._fw.policy.list_rules(p_name))) return list(ret) def add_protocol(self, zone, protocol, timeout=0, sender=None): zone = self._fw.check_zone(zone) p_name = self.policy_name_from_zones(zone, "HOST") self._fw.policy.add_protocol(p_name, protocol, timeout, sender) return zone def remove_protocol(self, zone, protocol): zone = self._fw.check_zone(zone) p_name = self.policy_name_from_zones(zone, "HOST") self._fw.policy.remove_protocol(p_name, protocol) return zone def query_protocol(self, zone, protocol): zone = self._fw.check_zone(zone) p_name = self.policy_name_from_zones(zone, "HOST") return self._fw.policy.query_protocol(p_name, protocol) def list_protocols(self, zone): zone = self._fw.check_zone(zone) p_name = self.policy_name_from_zones(zone, "HOST") return self._fw.policy.list_protocols(p_name) def add_masquerade(self, zone, timeout=0, sender=None): zone = self._fw.check_zone(zone) p_name = self.policy_name_from_zones("ANY", zone) self._fw.policy.add_masquerade(p_name, timeout, sender) return zone def remove_masquerade(self, zone): zone = self._fw.check_zone(zone) p_name = self.policy_name_from_zones("ANY", zone) self._fw.policy.remove_masquerade(p_name) return zone def query_masquerade(self, zone): zone = self._fw.check_zone(zone) p_name = self.policy_name_from_zones("ANY", zone) return self._fw.policy.query_masquerade(p_name) def add_forward_port(self, zone, port, protocol, toport=None, toaddr=None, timeout=0, sender=None): zone = self._fw.check_zone(zone) p_name = self.policy_name_from_zones(zone, "ANY") self._fw.policy.add_forward_port(p_name, port, protocol, toport, toaddr, timeout, sender) return zone def remove_forward_port(self, zone, port, protocol, toport=None, toaddr=None): zone = self._fw.check_zone(zone) p_name = self.policy_name_from_zones(zone, "ANY") self._fw.policy.remove_forward_port(p_name, port, protocol, toport, toaddr) return zone def query_forward_port(self, zone, port, protocol, toport=None, toaddr=None): zone = self._fw.check_zone(zone) p_name = self.policy_name_from_zones(zone, "ANY") return self._fw.policy.query_forward_port(p_name, port, protocol, toport, toaddr) def list_forward_ports(self, zone): zone = self._fw.check_zone(zone) p_name = self.policy_name_from_zones(zone, "ANY") return self._fw.policy.list_forward_ports(p_name) def add_icmp_block(self, zone, icmp, timeout=0, sender=None): zone = self._fw.check_zone(zone) p_name = self.policy_name_from_zones(zone, "HOST") self._fw.policy.add_icmp_block(p_name, icmp, timeout, sender) return zone def remove_icmp_block(self, zone, icmp): zone = self._fw.check_zone(zone) p_name = self.policy_name_from_zones(zone, "HOST") self._fw.policy.remove_icmp_block(p_name, icmp) return zone def query_icmp_block(self, zone, icmp): zone = self._fw.check_zone(zone) p_name_host = self.policy_name_from_zones(zone, "HOST") return self._fw.policy.query_icmp_block(p_name_host, icmp) def list_icmp_blocks(self, zone): zone = self._fw.check_zone(zone) p_name_host = self.policy_name_from_zones(zone, "HOST") return sorted(set(self._fw.policy.list_icmp_blocks(p_name_host))) def add_icmp_block_inversion(self, zone, sender=None): zone = self._fw.check_zone(zone) p_name = self.policy_name_from_zones(zone, "HOST") self._fw.policy.add_icmp_block_inversion(p_name, sender) return zone def _icmp_block_inversion(self, enable, zone, transaction): zone = self._fw.check_zone(zone) p_name = self.policy_name_from_zones(zone, "HOST") self._fw.policy._icmp_block_inversion(enable, p_name, transaction) def remove_icmp_block_inversion(self, zone): zone = self._fw.check_zone(zone) p_name = self.policy_name_from_zones(zone, "HOST") self._fw.policy.remove_icmp_block_inversion(p_name) return zone def query_icmp_block_inversion(self, zone): zone = self._fw.check_zone(zone) p_name_host = self.policy_name_from_zones(zone, "HOST") return self._fw.policy.query_icmp_block_inversion(p_name_host) def _forward(self, enable, zone, transaction): p_name = self.policy_name_from_zones(zone, "ANY") for interface in self._zones[zone].interfaces: for backend in self._fw.enabled_backends(): if not backend.policies_supported: continue rules = backend.build_zone_forward_rules(enable, zone, p_name, "filter", interface=interface) transaction.add_rules(backend, rules) for source in self._zones[zone].sources: ipv = self.check_source(source) for backend in [self._fw.get_backend_by_ipv(ipv)] if ipv else self._fw.enabled_backends(): if not backend.policies_supported: continue rules = backend.build_zone_forward_rules(enable, zone, p_name, "filter", source=source) transaction.add_rules(backend, rules) def add_forward(self, zone, timeout=0, sender=None, use_transaction=None): _zone = self._fw.check_zone(zone) self._fw.check_timeout(timeout) self._fw.check_panic() _obj = self._zones[_zone] if _obj.forward: raise FirewallError(errors.ALREADY_ENABLED, "forward already enabled in '%s'" % _zone) if use_transaction is None: transaction = self.new_transaction() else: transaction = use_transaction if _obj.applied: self._forward(True, _zone, transaction) self.__register_forward(_obj, timeout, sender) transaction.add_fail(self.__unregister_forward, _obj) if use_transaction is None: transaction.execute(True) return _zone def __register_forward(self, _obj, timeout, sender): _obj.forward = True def remove_forward(self, zone, use_transaction=None): _zone = self._fw.check_zone(zone) self._fw.check_panic() _obj = self._zones[_zone] if not _obj.forward: raise FirewallError(errors.NOT_ENABLED, "forward not enabled in '%s'" % _zone) if use_transaction is None: transaction = self.new_transaction() else: transaction = use_transaction if _obj.applied: self._forward(False, _zone, transaction) transaction.add_post(self.__unregister_forward, _obj) if use_transaction is None: transaction.execute(True) return _zone def __unregister_forward(self, _obj): _obj.forward = False def query_forward(self, zone): return self.get_zone(zone).forward PK ���ZƟ8C$ $ core/helper.pynu �[��� # -*- coding: utf-8 -*- # # Copyright (C) 2016 Red Hat, Inc. # # Authors: # Thomas Woerner <twoerner@redhat.com> # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see <http://www.gnu.org/licenses/>. # """The helper maxnamelen""" HELPER_MAXNAMELEN = 32 PK ���Z���:]� ]� core/fw_config.pynu �[��� # -*- coding: utf-8 -*- # # Copyright (C) 2011-2016 Red Hat, Inc. # # Authors: # Thomas Woerner <twoerner@redhat.com> # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see <http://www.gnu.org/licenses/>. # __all__ = [ "FirewallConfig" ] import copy import os import os.path import shutil from typing import Dict, List from firewall import config from firewall.core.logger import log from firewall.core.io.io_object import IO_Object from firewall.core.io.icmptype import IcmpType, icmptype_reader, icmptype_writer from firewall.core.io.service import Service, service_reader, service_writer from firewall.core.io.zone import Zone, zone_reader, zone_writer from firewall.core.io.ipset import IPSet, ipset_reader, ipset_writer from firewall.core.io.helper import Helper, helper_reader, helper_writer from firewall.core.io.policy import Policy, policy_reader, policy_writer from firewall import errors from firewall.errors import FirewallError class FirewallConfig(object): def __init__(self, fw): self._fw = fw self.__init_vars() def __repr__(self): return '%s(%r, %r, %r, %r, %r, %r, %r, %r, %r, %r, %r, %r, %r, %r, %r)' % \ (self.__class__, self._ipsets, self._icmptypes, self._services, self._zones, self._helpers, self.policy_objects, self._builtin_ipsets, self._builtin_icmptypes, self._builtin_services, self._builtin_zones, self._builtin_helpers, self._builtin_policy_objects, self._firewalld_conf, self._policies, self._direct) def __init_vars(self): self._ipsets = { } self._icmptypes = { } self._services = { } self._zones = { } self._helpers = { } self._policy_objects = { } self._builtin_ipsets = { } self._builtin_icmptypes = { } self._builtin_services = { } self._builtin_zones = { } self._builtin_helpers = { } self._builtin_policy_objects = { } self._firewalld_conf = None self._policies = None self._direct = None def cleanup(self): for x in list(self._builtin_ipsets.keys()): self._builtin_ipsets[x].cleanup() del self._builtin_ipsets[x] for x in list(self._ipsets.keys()): self._ipsets[x].cleanup() del self._ipsets[x] for x in list(self._builtin_icmptypes.keys()): self._builtin_icmptypes[x].cleanup() del self._builtin_icmptypes[x] for x in list(self._icmptypes.keys()): self._icmptypes[x].cleanup() del self._icmptypes[x] for x in list(self._builtin_services.keys()): self._builtin_services[x].cleanup() del self._builtin_services[x] for x in list(self._services.keys()): self._services[x].cleanup() del self._services[x] for x in list(self._builtin_zones.keys()): self._builtin_zones[x].cleanup() del self._builtin_zones[x] for x in list(self._zones.keys()): self._zones[x].cleanup() del self._zones[x] for x in list(self._builtin_helpers.keys()): self._builtin_helpers[x].cleanup() del self._builtin_helpers[x] for x in list(self._helpers.keys()): self._helpers[x].cleanup() del self._helpers[x] if self._firewalld_conf: self._firewalld_conf.cleanup() del self._firewalld_conf self._firewalld_conf = None if self._policies: self._policies.cleanup() del self._policies self._policies = None if self._direct: self._direct.cleanup() del self._direct self._direct = None self.__init_vars() def get_all_io_objects_dict(self): """ Returns a dict of dicts of all permanent config objects. """ conf_dict = {} conf_dict["ipsets"] = {ipset: self.get_ipset(ipset) for ipset in self.get_ipsets()} conf_dict["helpers"] = {helper: self.get_helper(helper) for helper in self.get_helpers()} conf_dict["icmptypes"] = {icmptype: self.get_icmptype(icmptype) for icmptype in self.get_icmptypes()} conf_dict["services"] = {service: self.get_service(service) for service in self.get_services()} conf_dict["zones"] = {zone: self.get_zone(zone) for zone in self.get_zones()} conf_dict["policies"] = {policy: self.get_policy_object(policy) for policy in self.get_policy_objects()} return conf_dict def full_check_config(self, extra_io_objects: Dict[str, List[IO_Object]] = {}): all_io_objects = self.get_all_io_objects_dict() # mix in the extra objects for type_key in extra_io_objects: for obj in extra_io_objects[type_key]: all_io_objects[type_key][obj.name] = obj # we need to check in a well defined order because some io_objects will # cross-check others order = ["ipsets", "helpers", "icmptypes", "services", "zones", "policies"] for io_obj_type in order: io_objs = all_io_objects[io_obj_type] for (name, io_obj) in io_objs.items(): io_obj.check_config_dict(io_obj.export_config_dict(), all_io_objects) # access check def lockdown_enabled(self): return self._fw.policies.query_lockdown() def access_check(self, key, value): return self._fw.policies.access_check(key, value) # firewalld_conf def set_firewalld_conf(self, conf): self._firewalld_conf = conf def get_firewalld_conf(self): return self._firewalld_conf def update_firewalld_conf(self): if not os.path.exists(config.FIREWALLD_CONF): self._firewalld_conf.clear() else: self._firewalld_conf.read() # policies def set_policies(self, policies): self._policies = policies def get_policies(self): return self._policies def update_lockdown_whitelist(self): if not os.path.exists(config.LOCKDOWN_WHITELIST): self._policies.lockdown_whitelist.cleanup() else: self._policies.lockdown_whitelist.read() # direct def set_direct(self, direct): self._direct = direct def get_direct(self): return self._direct def update_direct(self): if not os.path.exists(config.FIREWALLD_DIRECT): self._direct.cleanup() else: self._direct.read() # ipset def get_ipsets(self): return sorted(set(list(self._ipsets.keys()) + \ list(self._builtin_ipsets.keys()))) def add_ipset(self, obj): if obj.builtin: self._builtin_ipsets[obj.name] = obj else: self._ipsets[obj.name] = obj def get_ipset(self, name): if name in self._ipsets: return self._ipsets[name] elif name in self._builtin_ipsets: return self._builtin_ipsets[name] raise FirewallError(errors.INVALID_IPSET, name) def load_ipset_defaults(self, obj): if obj.name not in self._ipsets: raise FirewallError(errors.NO_DEFAULTS, obj.name) elif self._ipsets[obj.name] != obj: raise FirewallError(errors.NO_DEFAULTS, "self._ipsets[%s] != obj" % obj.name) elif obj.name not in self._builtin_ipsets: raise FirewallError(errors.NO_DEFAULTS, "'%s' not a built-in ipset" % obj.name) self._remove_ipset(obj) return self._builtin_ipsets[obj.name] def get_ipset_config(self, obj): return obj.export_config() def set_ipset_config(self, obj, conf): x = copy.copy(obj) if obj.builtin: x.path = config.ETC_FIREWALLD_IPSETS x.builtin = False if obj.path != x.path: x.default = False x.import_config(conf, self.get_all_io_objects_dict()) self.full_check_config({"ipsets": [x]}) self.add_ipset(x) ipset_writer(x) return x def new_ipset(self, name, conf): if name in self._ipsets or name in self._builtin_ipsets: raise FirewallError(errors.NAME_CONFLICT, "new_ipset(): '%s'" % name) x = IPSet() x.check_name(name) x.name = name x.filename = "%s.xml" % name x.path = config.ETC_FIREWALLD_IPSETS # It is not possible to add a new one with a name of a buitin x.builtin = False x.default = True x.import_config(conf, self.get_all_io_objects_dict()) self.full_check_config({"ipsets": [x]}) self.add_ipset(x) ipset_writer(x) return x def update_ipset_from_path(self, name): filename = os.path.basename(name) path = os.path.dirname(name) if not os.path.exists(name): # removed file if path == config.ETC_FIREWALLD_IPSETS: # removed custom ipset for x in self._ipsets.keys(): obj = self._ipsets[x] if obj.filename == filename: del self._ipsets[x] if obj.name in self._builtin_ipsets: return ("update", self._builtin_ipsets[obj.name]) return ("remove", obj) else: # removed builtin ipset for x in self._builtin_ipsets.keys(): obj = self._builtin_ipsets[x] if obj.filename == filename: del self._builtin_ipsets[x] if obj.name not in self._ipsets: # update dbus ipset return ("remove", obj) else: # builtin hidden, no update needed return (None, None) # ipset not known to firewalld, yet (timeout, ..) return (None, None) # new or updated file log.debug1("Loading ipset file '%s'", name) try: obj = ipset_reader(filename, path) except Exception as msg: log.error("Failed to load ipset file '%s': %s", filename, msg) return (None, None) # new ipset if obj.name not in self._builtin_ipsets and obj.name not in self._ipsets: self.add_ipset(obj) return ("new", obj) # updated ipset if path == config.ETC_FIREWALLD_IPSETS: # custom ipset update if obj.name in self._ipsets: obj.default = self._ipsets[obj.name].default self._ipsets[obj.name] = obj return ("update", obj) else: if obj.name in self._builtin_ipsets: # builtin ipset update del self._builtin_ipsets[obj.name] self._builtin_ipsets[obj.name] = obj if obj.name not in self._ipsets: # update dbus ipset return ("update", obj) else: # builtin hidden, no update needed return (None, None) # ipset not known to firewalld, yet (timeout, ..) return (None, None) def _remove_ipset(self, obj): if obj.name not in self._ipsets: raise FirewallError(errors.INVALID_IPSET, obj.name) if obj.path != config.ETC_FIREWALLD_IPSETS: raise FirewallError(errors.INVALID_DIRECTORY, "'%s' != '%s'" % (obj.path, config.ETC_FIREWALLD_IPSETS)) name = "%s/%s.xml" % (obj.path, obj.name) try: shutil.move(name, "%s.old" % name) except Exception as msg: log.error("Backup of file '%s' failed: %s", name, msg) os.remove(name) del self._ipsets[obj.name] def check_builtin_ipset(self, obj): if obj.builtin or not obj.default: raise FirewallError(errors.BUILTIN_IPSET, "'%s' is built-in ipset" % obj.name) def remove_ipset(self, obj): self.check_builtin_ipset(obj) self._remove_ipset(obj) def rename_ipset(self, obj, name): self.check_builtin_ipset(obj) new_ipset = self._copy_ipset(obj, name) self._remove_ipset(obj) return new_ipset def _copy_ipset(self, obj, name): return self.new_ipset(name, obj.export_config()) # icmptypes def get_icmptypes(self): return sorted(set(list(self._icmptypes.keys()) + \ list(self._builtin_icmptypes.keys()))) def add_icmptype(self, obj): if obj.builtin: self._builtin_icmptypes[obj.name] = obj else: self._icmptypes[obj.name] = obj def get_icmptype(self, name): if name in self._icmptypes: return self._icmptypes[name] elif name in self._builtin_icmptypes: return self._builtin_icmptypes[name] raise FirewallError(errors.INVALID_ICMPTYPE, name) def load_icmptype_defaults(self, obj): if obj.name not in self._icmptypes: raise FirewallError(errors.NO_DEFAULTS, obj.name) elif self._icmptypes[obj.name] != obj: raise FirewallError(errors.NO_DEFAULTS, "self._icmptypes[%s] != obj" % obj.name) elif obj.name not in self._builtin_icmptypes: raise FirewallError(errors.NO_DEFAULTS, "'%s' not a built-in icmptype" % obj.name) self._remove_icmptype(obj) return self._builtin_icmptypes[obj.name] def get_icmptype_config(self, obj): return obj.export_config() def set_icmptype_config(self, obj, conf): x = copy.copy(obj) if obj.builtin: x.path = config.ETC_FIREWALLD_ICMPTYPES x.builtin = False if obj.path != x.path: x.default = False x.import_config(conf, self.get_all_io_objects_dict()) self.full_check_config({"icmptypes": [x]}) self.add_icmptype(x) icmptype_writer(x) return x def new_icmptype(self, name, conf): if name in self._icmptypes or name in self._builtin_icmptypes: raise FirewallError(errors.NAME_CONFLICT, "new_icmptype(): '%s'" % name) x = IcmpType() x.check_name(name) x.name = name x.filename = "%s.xml" % name x.path = config.ETC_FIREWALLD_ICMPTYPES # It is not possible to add a new one with a name of a buitin x.builtin = False x.default = True x.import_config(conf, self.get_all_io_objects_dict()) self.full_check_config({"icmptypes": [x]}) self.add_icmptype(x) icmptype_writer(x) return x def update_icmptype_from_path(self, name): filename = os.path.basename(name) path = os.path.dirname(name) if not os.path.exists(name): # removed file if path == config.ETC_FIREWALLD_ICMPTYPES: # removed custom icmptype for x in self._icmptypes.keys(): obj = self._icmptypes[x] if obj.filename == filename: del self._icmptypes[x] if obj.name in self._builtin_icmptypes: return ("update", self._builtin_icmptypes[obj.name]) return ("remove", obj) else: # removed builtin icmptype for x in self._builtin_icmptypes.keys(): obj = self._builtin_icmptypes[x] if obj.filename == filename: del self._builtin_icmptypes[x] if obj.name not in self._icmptypes: # update dbus icmptype return ("remove", obj) else: # builtin hidden, no update needed return (None, None) # icmptype not known to firewalld, yet (timeout, ..) return (None, None) # new or updated file log.debug1("Loading icmptype file '%s'", name) try: obj = icmptype_reader(filename, path) except Exception as msg: log.error("Failed to load icmptype file '%s': %s", filename, msg) return (None, None) # new icmptype if obj.name not in self._builtin_icmptypes and obj.name not in self._icmptypes: self.add_icmptype(obj) return ("new", obj) # updated icmptype if path == config.ETC_FIREWALLD_ICMPTYPES: # custom icmptype update if obj.name in self._icmptypes: obj.default = self._icmptypes[obj.name].default self._icmptypes[obj.name] = obj return ("update", obj) else: if obj.name in self._builtin_icmptypes: # builtin icmptype update del self._builtin_icmptypes[obj.name] self._builtin_icmptypes[obj.name] = obj if obj.name not in self._icmptypes: # update dbus icmptype return ("update", obj) else: # builtin hidden, no update needed return (None, None) # icmptype not known to firewalld, yet (timeout, ..) return (None, None) def _remove_icmptype(self, obj): if obj.name not in self._icmptypes: raise FirewallError(errors.INVALID_ICMPTYPE, obj.name) if obj.path != config.ETC_FIREWALLD_ICMPTYPES: raise FirewallError(errors.INVALID_DIRECTORY, "'%s' != '%s'" % \ (obj.path, config.ETC_FIREWALLD_ICMPTYPES)) name = "%s/%s.xml" % (obj.path, obj.name) try: shutil.move(name, "%s.old" % name) except Exception as msg: log.error("Backup of file '%s' failed: %s", name, msg) os.remove(name) del self._icmptypes[obj.name] def check_builtin_icmptype(self, obj): if obj.builtin or not obj.default: raise FirewallError(errors.BUILTIN_ICMPTYPE, "'%s' is built-in icmp type" % obj.name) def remove_icmptype(self, obj): self.check_builtin_icmptype(obj) self._remove_icmptype(obj) def rename_icmptype(self, obj, name): self.check_builtin_icmptype(obj) new_icmptype = self._copy_icmptype(obj, name) self._remove_icmptype(obj) return new_icmptype def _copy_icmptype(self, obj, name): return self.new_icmptype(name, obj.export_config()) # services def get_services(self): return sorted(set(list(self._services.keys()) + \ list(self._builtin_services.keys()))) def add_service(self, obj): if obj.builtin: self._builtin_services[obj.name] = obj else: self._services[obj.name] = obj def get_service(self, name): if name in self._services: return self._services[name] elif name in self._builtin_services: return self._builtin_services[name] raise FirewallError(errors.INVALID_SERVICE, "get_service(): '%s'" % name) def load_service_defaults(self, obj): if obj.name not in self._services: raise FirewallError(errors.NO_DEFAULTS, obj.name) elif self._services[obj.name] != obj: raise FirewallError(errors.NO_DEFAULTS, "self._services[%s] != obj" % obj.name) elif obj.name not in self._builtin_services: raise FirewallError(errors.NO_DEFAULTS, "'%s' not a built-in service" % obj.name) self._remove_service(obj) return self._builtin_services[obj.name] def get_service_config(self, obj): conf_dict = obj.export_config_dict() conf_list = [] for i in range(8): # tuple based dbus API has 8 elements if obj.IMPORT_EXPORT_STRUCTURE[i][0] not in conf_dict: # old API needs the empty elements as well. Grab it from the # object otherwise we don't know the type. conf_list.append(copy.deepcopy(getattr(obj, obj.IMPORT_EXPORT_STRUCTURE[i][0]))) else: conf_list.append(conf_dict[obj.IMPORT_EXPORT_STRUCTURE[i][0]]) return tuple(conf_list) def get_service_config_dict(self, obj): return obj.export_config_dict() def set_service_config(self, obj, conf): conf_dict = {} for i,value in enumerate(conf): conf_dict[obj.IMPORT_EXPORT_STRUCTURE[i][0]] = value return self.set_service_config_dict(obj, conf_dict) def set_service_config_dict(self, obj, conf): x = copy.copy(obj) if obj.builtin: x.path = config.ETC_FIREWALLD_SERVICES x.builtin = False if obj.path != x.path: x.default = False x.import_config_dict(conf, self.get_all_io_objects_dict()) self.full_check_config({"services": [x]}) self.add_service(x) service_writer(x) return x def new_service(self, name, conf): if name in self._services or name in self._builtin_services: raise FirewallError(errors.NAME_CONFLICT, "new_service(): '%s'" % name) conf_dict = {} for i,value in enumerate(conf): conf_dict[Service.IMPORT_EXPORT_STRUCTURE[i][0]] = value return self.new_service_dict(name, conf_dict) def new_service_dict(self, name, conf): if name in self._services or name in self._builtin_services: raise FirewallError(errors.NAME_CONFLICT, "new_service(): '%s'" % name) x = Service() x.check_name(name) x.name = name x.filename = "%s.xml" % name x.path = config.ETC_FIREWALLD_SERVICES # It is not possible to add a new one with a name of a buitin x.builtin = False x.default = True x.import_config_dict(conf, self.get_all_io_objects_dict()) self.full_check_config({"services": [x]}) self.add_service(x) service_writer(x) return x def update_service_from_path(self, name): filename = os.path.basename(name) path = os.path.dirname(name) if not os.path.exists(name): # removed file if path == config.ETC_FIREWALLD_SERVICES: # removed custom service for x in self._services.keys(): obj = self._services[x] if obj.filename == filename: del self._services[x] if obj.name in self._builtin_services: return ("update", self._builtin_services[obj.name]) return ("remove", obj) else: # removed builtin service for x in self._builtin_services.keys(): obj = self._builtin_services[x] if obj.filename == filename: del self._builtin_services[x] if obj.name not in self._services: # update dbus service return ("remove", obj) else: # builtin hidden, no update needed return (None, None) # service not known to firewalld, yet (timeout, ..) return (None, None) # new or updated file log.debug1("Loading service file '%s'", name) try: obj = service_reader(filename, path) except Exception as msg: log.error("Failed to load service file '%s': %s", filename, msg) return (None, None) # new service if obj.name not in self._builtin_services and obj.name not in self._services: self.add_service(obj) return ("new", obj) # updated service if path == config.ETC_FIREWALLD_SERVICES: # custom service update if obj.name in self._services: obj.default = self._services[obj.name].default self._services[obj.name] = obj return ("update", obj) else: if obj.name in self._builtin_services: # builtin service update del self._builtin_services[obj.name] self._builtin_services[obj.name] = obj if obj.name not in self._services: # update dbus service return ("update", obj) else: # builtin hidden, no update needed return (None, None) # service not known to firewalld, yet (timeout, ..) return (None, None) def _remove_service(self, obj): if obj.name not in self._services: raise FirewallError(errors.INVALID_SERVICE, obj.name) if obj.path != config.ETC_FIREWALLD_SERVICES: raise FirewallError(errors.INVALID_DIRECTORY, "'%s' != '%s'" % \ (obj.path, config.ETC_FIREWALLD_SERVICES)) name = "%s/%s.xml" % (obj.path, obj.name) try: shutil.move(name, "%s.old" % name) except Exception as msg: log.error("Backup of file '%s' failed: %s", name, msg) os.remove(name) del self._services[obj.name] def check_builtin_service(self, obj): if obj.builtin or not obj.default: raise FirewallError(errors.BUILTIN_SERVICE, "'%s' is built-in service" % obj.name) def remove_service(self, obj): self.check_builtin_service(obj) self._remove_service(obj) def rename_service(self, obj, name): self.check_builtin_service(obj) new_service = self._copy_service(obj, name) self._remove_service(obj) return new_service def _copy_service(self, obj, name): return self.new_service_dict(name, obj.export_config_dict()) # zones def get_zones(self): return sorted(set(list(self._zones.keys()) + \ list(self._builtin_zones.keys()))) def add_zone(self, obj): if obj.builtin: self._builtin_zones[obj.name] = obj else: self._zones[obj.name] = obj def forget_zone(self, name): if name in self._builtin_zones: del self._builtin_zones[name] if name in self._zones: del self._zones[name] def get_zone(self, name): if name in self._zones: return self._zones[name] elif name in self._builtin_zones: return self._builtin_zones[name] raise FirewallError(errors.INVALID_ZONE, "get_zone(): %s" % name) def load_zone_defaults(self, obj): if obj.name not in self._zones: raise FirewallError(errors.NO_DEFAULTS, obj.name) elif self._zones[obj.name] != obj: raise FirewallError(errors.NO_DEFAULTS, "self._zones[%s] != obj" % obj.name) elif obj.name not in self._builtin_zones: raise FirewallError(errors.NO_DEFAULTS, "'%s' not a built-in zone" % obj.name) self._remove_zone(obj) return self._builtin_zones[obj.name] def get_zone_config(self, obj): conf_dict = obj.export_config_dict() conf_list = [] for i in range(16): # tuple based dbus API has 16 elements if obj.IMPORT_EXPORT_STRUCTURE[i][0] not in conf_dict: # old API needs the empty elements as well. Grab it from the # object otherwise we don't know the type. conf_list.append(copy.deepcopy(getattr(obj, obj.IMPORT_EXPORT_STRUCTURE[i][0]))) else: conf_list.append(conf_dict[obj.IMPORT_EXPORT_STRUCTURE[i][0]]) return tuple(conf_list) def get_zone_config_dict(self, obj): return obj.export_config_dict() def set_zone_config(self, obj, conf): conf_dict = {} for i,value in enumerate(conf): conf_dict[obj.IMPORT_EXPORT_STRUCTURE[i][0]] = value return self.set_zone_config_dict(obj, conf_dict) def set_zone_config_dict(self, obj, conf): x = copy.copy(obj) if obj.builtin: x.path = config.ETC_FIREWALLD_ZONES x.builtin = False if obj.path != x.path: x.default = False x.import_config_dict(conf, self.get_all_io_objects_dict()) self.full_check_config({"zones": [x]}) self.add_zone(x) zone_writer(x) return x def new_zone(self, name, conf): if name in self._zones or name in self._builtin_zones: raise FirewallError(errors.NAME_CONFLICT, "new_zone(): '%s'" % name) conf_dict = {} for i,value in enumerate(conf): conf_dict[Zone.IMPORT_EXPORT_STRUCTURE[i][0]] = value return self.new_zone_dict(name, conf_dict) def new_zone_dict(self, name, conf): if name in self._zones or name in self._builtin_zones: raise FirewallError(errors.NAME_CONFLICT, "new_zone(): '%s'" % name) x = Zone() x.check_name(name) x.name = name x.filename = "%s.xml" % name x.path = config.ETC_FIREWALLD_ZONES # It is not possible to add a new one with a name of a buitin x.builtin = False x.default = True x.import_config_dict(conf, self.get_all_io_objects_dict()) self.full_check_config({"zones": [x]}) self.add_zone(x) zone_writer(x) return x def update_zone_from_path(self, name): filename = os.path.basename(name) path = os.path.dirname(name) if not os.path.exists(name): # removed file if path.startswith(config.ETC_FIREWALLD_ZONES): # removed custom zone for x in self._zones.keys(): obj = self._zones[x] if obj.filename == filename: del self._zones[x] if obj.name in self._builtin_zones: return ("update", self._builtin_zones[obj.name]) return ("remove", obj) else: # removed builtin zone for x in self._builtin_zones.keys(): obj = self._builtin_zones[x] if obj.filename == filename: del self._builtin_zones[x] if obj.name not in self._zones: # update dbus zone return ("remove", obj) else: # builtin hidden, no update needed return (None, None) # zone not known to firewalld, yet (timeout, ..) return (None, None) # new or updated file log.debug1("Loading zone file '%s'", name) try: obj = zone_reader(filename, path) except Exception as msg: log.error("Failed to load zone file '%s': %s", filename, msg) return (None, None) if path.startswith(config.ETC_FIREWALLD_ZONES) and \ len(path) > len(config.ETC_FIREWALLD_ZONES): # custom combined zone part obj.name = "%s/%s" % (os.path.basename(path), os.path.basename(filename)[0:-4]) # new zone if obj.name not in self._builtin_zones and obj.name not in self._zones: self.add_zone(obj) return ("new", obj) # updated zone if path.startswith(config.ETC_FIREWALLD_ZONES): # custom zone update if obj.name in self._zones: obj.default = self._zones[obj.name].default self._zones[obj.name] = obj return ("update", obj) else: if obj.name in self._builtin_zones: # builtin zone update del self._builtin_zones[obj.name] self._builtin_zones[obj.name] = obj if obj.name not in self._zones: # update dbus zone return ("update", obj) else: # builtin hidden, no update needed return (None, None) # zone not known to firewalld, yet (timeout, ..) return (None, None) def _remove_zone(self, obj): if obj.name not in self._zones: raise FirewallError(errors.INVALID_ZONE, obj.name) if not obj.path.startswith(config.ETC_FIREWALLD_ZONES): raise FirewallError(errors.INVALID_DIRECTORY, "'%s' doesn't start with '%s'" % \ (obj.path, config.ETC_FIREWALLD_ZONES)) name = "%s/%s.xml" % (obj.path, obj.name) try: shutil.move(name, "%s.old" % name) except Exception as msg: log.error("Backup of file '%s' failed: %s", name, msg) os.remove(name) del self._zones[obj.name] def check_builtin_zone(self, obj): if obj.builtin or not obj.default: raise FirewallError(errors.BUILTIN_ZONE, "'%s' is built-in zone" % obj.name) def remove_zone(self, obj): self.check_builtin_zone(obj) self._remove_zone(obj) def rename_zone(self, obj, name): self.check_builtin_zone(obj) obj_conf = obj.export_config_dict() self._remove_zone(obj) try: new_zone = self.new_zone_dict(name, obj_conf) except: # re-add original if rename failed self.new_zone_dict(obj.name, obj_conf) raise return new_zone # policy objects def get_policy_objects(self): return sorted(set(list(self._policy_objects.keys()) + \ list(self._builtin_policy_objects.keys()))) def add_policy_object(self, obj): if obj.builtin: self._builtin_policy_objects[obj.name] = obj else: self._policy_objects[obj.name] = obj def get_policy_object(self, name): if name in self._policy_objects: return self._policy_objects[name] elif name in self._builtin_policy_objects: return self._builtin_policy_objects[name] raise FirewallError(errors.INVALID_POLICY, "get_policy_object(): %s" % name) def load_policy_object_defaults(self, obj): if obj.name not in self._policy_objects: raise FirewallError(errors.NO_DEFAULTS, obj.name) elif self._policy_objects[obj.name] != obj: raise FirewallError(errors.NO_DEFAULTS, "self._policy_objects[%s] != obj" % obj.name) elif obj.name not in self._builtin_policy_objects: raise FirewallError(errors.NO_DEFAULTS, "'%s' not a built-in policy" % obj.name) self._remove_policy_object(obj) return self._builtin_policy_objects[obj.name] def get_policy_object_config_dict(self, obj): return obj.export_config_dict() def set_policy_object_config_dict(self, obj, conf): x = copy.copy(obj) if obj.builtin: x.path = config.ETC_FIREWALLD_POLICIES x.builtin = False if obj.path != x.path: x.default = False x.import_config_dict(conf, self.get_all_io_objects_dict()) self.full_check_config({"policies": [x]}) self.add_policy_object(x) policy_writer(x) return x def new_policy_object_dict(self, name, conf): if name in self._policy_objects or name in self._builtin_policy_objects: raise FirewallError(errors.NAME_CONFLICT, "new_policy_object(): '%s'" % name) x = Policy() x.check_name(name) x.name = name x.filename = "%s.xml" % name x.path = config.ETC_FIREWALLD_POLICIES # It is not possible to add a new one with a name of a buitin x.builtin = False x.default = True x.import_config_dict(conf, self.get_all_io_objects_dict()) self.full_check_config({"policies": [x]}) self.add_policy_object(x) policy_writer(x) return x def update_policy_object_from_path(self, name): filename = os.path.basename(name) path = os.path.dirname(name) if not os.path.exists(name): # removed file if path.startswith(config.ETC_FIREWALLD_POLICIES): # removed custom policy_object for x in self._policy_objects.keys(): obj = self._policy_objects[x] if obj.filename == filename: del self._policy_objects[x] if obj.name in self._builtin_policy_objects: return ("update", self._builtin_policy_objects[obj.name]) return ("remove", obj) else: # removed builtin policy_object for x in self._builtin_policy_objects.keys(): obj = self._builtin_policy_objects[x] if obj.filename == filename: del self._builtin_policy_objects[x] if obj.name not in self._policy_objects: # update dbus policy_object return ("remove", obj) else: # builtin hidden, no update needed return (None, None) # policy_object not known to firewalld, yet (timeout, ..) return (None, None) # new or updated file log.debug1("Loading policy file '%s'", name) try: obj = policy_reader(filename, path) except Exception as msg: log.error("Failed to load policy file '%s': %s", filename, msg) return (None, None) if path.startswith(config.ETC_FIREWALLD_POLICIES) and \ len(path) > len(config.ETC_FIREWALLD_POLICIES): # custom combined policy_object part obj.name = "%s/%s" % (os.path.basename(path), os.path.basename(filename)[0:-4]) # new policy_object if obj.name not in self._builtin_policy_objects and obj.name not in self._policy_objects: self.add_policy_object(obj) return ("new", obj) # updated policy_object if path.startswith(config.ETC_FIREWALLD_POLICIES): # custom policy_object update if obj.name in self._policy_objects: obj.default = self._policy_objects[obj.name].default self._policy_objects[obj.name] = obj return ("update", obj) else: if obj.name in self._builtin_policy_objects: # builtin policy_object update del self._builtin_policy_objects[obj.name] self._builtin_policy_objects[obj.name] = obj if obj.name not in self._policy_objects: # update dbus policy_object return ("update", obj) else: # builtin hidden, no update needed return (None, None) # policy_object not known to firewalld, yet (timeout, ..) return (None, None) def _remove_policy_object(self, obj): if obj.name not in self._policy_objects: raise FirewallError(errors.INVALID_POLICY, obj.name) if not obj.path.startswith(config.ETC_FIREWALLD_POLICIES): raise FirewallError(errors.INVALID_DIRECTORY, "'%s' doesn't start with '%s'" % \ (obj.path, config.ETC_FIREWALLD_POLICIES)) name = "%s/%s.xml" % (obj.path, obj.name) try: shutil.move(name, "%s.old" % name) except Exception as msg: log.error("Backup of file '%s' failed: %s", name, msg) os.remove(name) del self._policy_objects[obj.name] def check_builtin_policy_object(self, obj): if obj.builtin or not obj.default: raise FirewallError(errors.BUILTIN_POLICY, "'%s' is built-in policy" % obj.name) def remove_policy_object(self, obj): self.check_builtin_policy_object(obj) self._remove_policy_object(obj) def rename_policy_object(self, obj, name): self.check_builtin_policy_object(obj) new_policy_object = self._copy_policy_object(obj, name) self._remove_policy_object(obj) return new_policy_object def _copy_policy_object(self, obj, name): return self.new_policy_object_dict(name, obj.export_config_dict()) # helper def get_helpers(self): return sorted(set(list(self._helpers.keys()) + \ list(self._builtin_helpers.keys()))) def add_helper(self, obj): if obj.builtin: self._builtin_helpers[obj.name] = obj else: self._helpers[obj.name] = obj def get_helper(self, name): if name in self._helpers: return self._helpers[name] elif name in self._builtin_helpers: return self._builtin_helpers[name] raise FirewallError(errors.INVALID_HELPER, name) def load_helper_defaults(self, obj): if obj.name not in self._helpers: raise FirewallError(errors.NO_DEFAULTS, obj.name) elif self._helpers[obj.name] != obj: raise FirewallError(errors.NO_DEFAULTS, "self._helpers[%s] != obj" % obj.name) elif obj.name not in self._builtin_helpers: raise FirewallError(errors.NO_DEFAULTS, "'%s' not a built-in helper" % obj.name) self._remove_helper(obj) return self._builtin_helpers[obj.name] def get_helper_config(self, obj): return obj.export_config() def set_helper_config(self, obj, conf): x = copy.copy(obj) if obj.builtin: x.path = config.ETC_FIREWALLD_HELPERS x.builtin = False if obj.path != x.path: x.default = False x.import_config(conf, self.get_all_io_objects_dict()) self.full_check_config({"helpers": [x]}) self.add_helper(x) helper_writer(x) return x def new_helper(self, name, conf): if name in self._helpers or name in self._builtin_helpers: raise FirewallError(errors.NAME_CONFLICT, "new_helper(): '%s'" % name) x = Helper() x.check_name(name) x.name = name x.filename = "%s.xml" % name x.path = config.ETC_FIREWALLD_HELPERS # It is not possible to add a new one with a name of a buitin x.builtin = False x.default = True x.import_config(conf, self.get_all_io_objects_dict()) self.full_check_config({"helpers": [x]}) self.add_helper(x) helper_writer(x) return x def update_helper_from_path(self, name): filename = os.path.basename(name) path = os.path.dirname(name) if not os.path.exists(name): # removed file if path == config.ETC_FIREWALLD_HELPERS: # removed custom helper for x in self._helpers.keys(): obj = self._helpers[x] if obj.filename == filename: del self._helpers[x] if obj.name in self._builtin_helpers: return ("update", self._builtin_helpers[obj.name]) return ("remove", obj) else: # removed builtin helper for x in self._builtin_helpers.keys(): obj = self._builtin_helpers[x] if obj.filename == filename: del self._builtin_helpers[x] if obj.name not in self._helpers: # update dbus helper return ("remove", obj) else: # builtin hidden, no update needed return (None, None) # helper not known to firewalld, yet (timeout, ..) return (None, None) # new or updated file log.debug1("Loading helper file '%s'", name) try: obj = helper_reader(filename, path) except Exception as msg: log.error("Failed to load helper file '%s': %s", filename, msg) return (None, None) # new helper if obj.name not in self._builtin_helpers and obj.name not in self._helpers: self.add_helper(obj) return ("new", obj) # updated helper if path == config.ETC_FIREWALLD_HELPERS: # custom helper update if obj.name in self._helpers: obj.default = self._helpers[obj.name].default self._helpers[obj.name] = obj return ("update", obj) else: if obj.name in self._builtin_helpers: # builtin helper update del self._builtin_helpers[obj.name] self._builtin_helpers[obj.name] = obj if obj.name not in self._helpers: # update dbus helper return ("update", obj) else: # builtin hidden, no update needed return (None, None) # helper not known to firewalld, yet (timeout, ..) return (None, None) def _remove_helper(self, obj): if obj.name not in self._helpers: raise FirewallError(errors.INVALID_HELPER, obj.name) if obj.path != config.ETC_FIREWALLD_HELPERS: raise FirewallError(errors.INVALID_DIRECTORY, "'%s' != '%s'" % (obj.path, config.ETC_FIREWALLD_HELPERS)) name = "%s/%s.xml" % (obj.path, obj.name) try: shutil.move(name, "%s.old" % name) except Exception as msg: log.error("Backup of file '%s' failed: %s", name, msg) os.remove(name) del self._helpers[obj.name] def check_builtin_helper(self, obj): if obj.builtin or not obj.default: raise FirewallError(errors.BUILTIN_HELPER, "'%s' is built-in helper" % obj.name) def remove_helper(self, obj): self.check_builtin_helper(obj) self._remove_helper(obj) def rename_helper(self, obj, name): self.check_builtin_helper(obj) new_helper = self._copy_helper(obj, name) self._remove_helper(obj) return new_helper def _copy_helper(self, obj, name): return self.new_helper(name, obj.export_config()) PK ���Zَ�: core/fw_ifcfg.pynu �[��� # -*- coding: utf-8 -*- # # Copyright (C) 2010-2016 Red Hat, Inc. # # Authors: # Thomas Woerner <twoerner@redhat.com> # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see <http://www.gnu.org/licenses/>. # """Functions to search for and change ifcfg files""" __all__ = [ "search_ifcfg_of_interface", "ifcfg_set_zone_of_interface" ] import os import os.path from firewall import config from firewall.core.logger import log from firewall.core.io.ifcfg import ifcfg def search_ifcfg_of_interface(interface): """search ifcfg file for the interface in config.IFCFGDIR""" # Return quickly if config.IFCFGDIR does not exist if not os.path.exists(config.IFCFGDIR): return None for filename in sorted(os.listdir(config.IFCFGDIR)): if not filename.startswith("ifcfg-"): continue for ignored in [ ".bak", ".orig", ".rpmnew", ".rpmorig", ".rpmsave", "-range" ]: if filename.endswith(ignored): continue if "." in filename: continue ifcfg_file = ifcfg("%s/%s" % (config.IFCFGDIR, filename)) ifcfg_file.read() if ifcfg_file.get("DEVICE") == interface: return ifcfg_file # Wasn't found above, so assume filename matches the device we want filename = "%s/ifcfg-%s" % (config.IFCFGDIR, interface) if os.path.exists(filename): ifcfg_file = ifcfg(filename) ifcfg_file.read() return ifcfg_file return None def ifcfg_set_zone_of_interface(zone, interface): """Set zone (ZONE=<zone>) in the ifcfg file that uses the interface (DEVICE=<interface>)""" if zone is None: zone = "" ifcfg_file = search_ifcfg_of_interface(interface) if ifcfg_file is not None and ifcfg_file.get("ZONE") != zone and not \ (ifcfg_file.get("ZONE") is None and zone == ""): log.debug1("Setting ZONE=%s in '%s'" % (zone, ifcfg_file.filename)) ifcfg_file.set("ZONE", zone) ifcfg_file.write() PK ���Z�:_UO� O� core/fw.pynu �[��� # -*- coding: utf-8 -*- # # Copyright (C) 2010-2016 Red Hat, Inc. # # Authors: # Thomas Woerner <twoerner@redhat.com> # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see <http://www.gnu.org/licenses/>. # __all__ = [ "Firewall" ] import os.path import sys import copy import time import traceback from typing import Dict, List from firewall import config from firewall import functions from firewall.core import ipXtables from firewall.core import ebtables from firewall.core import nftables from firewall.core import ipset from firewall.core import modules from firewall.core.fw_icmptype import FirewallIcmpType from firewall.core.fw_service import FirewallService from firewall.core.fw_zone import FirewallZone from firewall.core.fw_direct import FirewallDirect from firewall.core.fw_config import FirewallConfig from firewall.core.fw_policies import FirewallPolicies from firewall.core.fw_ipset import FirewallIPSet from firewall.core.fw_transaction import FirewallTransaction from firewall.core.fw_helper import FirewallHelper from firewall.core.fw_policy import FirewallPolicy from firewall.core.fw_nm import nm_get_bus_name, nm_get_interfaces_in_zone from firewall.core.logger import log from firewall.core.io.io_object import IO_Object from firewall.core.io.firewalld_conf import firewalld_conf from firewall.core.io.direct import Direct from firewall.core.io.service import service_reader from firewall.core.io.icmptype import icmptype_reader from firewall.core.io.zone import zone_reader, Zone from firewall.core.io.ipset import ipset_reader from firewall.core.ipset import IPSET_TYPES from firewall.core.io.helper import helper_reader from firewall.core.io.policy import policy_reader from firewall.core.rich import Rich_Rule from firewall import errors from firewall.errors import FirewallError ############################################################################ # # class Firewall # ############################################################################ class Firewall(object): def __init__(self, offline=False): self._firewalld_conf = firewalld_conf(config.FIREWALLD_CONF) self._offline = offline if self._offline: self.ip4tables_enabled = False self.ip6tables_enabled = False self.ebtables_enabled = False self.ipset_enabled = False self.ipset_supported_types = IPSET_TYPES self.nftables_enabled = False else: self.ip4tables_backend = ipXtables.ip4tables(self) self.ip4tables_enabled = True self.ipv4_supported_icmp_types = [ ] self.ip6tables_backend = ipXtables.ip6tables(self) self.ip6tables_enabled = True self.ipv6_supported_icmp_types = [ ] self.ebtables_backend = ebtables.ebtables() self.ebtables_enabled = True self.ipset_backend = ipset.ipset() self.ipset_enabled = True self.ipset_supported_types = IPSET_TYPES self.nftables_backend = nftables.nftables(self) self.nftables_enabled = True self.modules_backend = modules.modules() self.icmptype = FirewallIcmpType(self) self.service = FirewallService(self) self.zone = FirewallZone(self) self.direct = FirewallDirect(self) self.config = FirewallConfig(self) self.policies = FirewallPolicies() self.ipset = FirewallIPSet(self) self.helper = FirewallHelper(self) self.policy = FirewallPolicy(self) self.__init_vars() def __repr__(self): return '%s(%r, %r, %r, %r, %r, %r, %r, %r, %r, %r, %r, %r, %r, %r)' % \ (self.__class__, self.ip4tables_enabled, self.ip6tables_enabled, self.ebtables_enabled, self._state, self._panic, self._default_zone, self._module_refcount, self._marks, self.cleanup_on_exit, self.cleanup_modules_on_exit, self.ipv6_rpfilter_enabled, self.ipset_enabled, self._individual_calls, self._log_denied) def __init_vars(self): self._state = "INIT" self._panic = False self._default_zone = "" self._default_zone_interfaces = [] self._nm_assigned_interfaces = [] self._module_refcount = { } self._marks = [ ] # fallback settings will be overloaded by firewalld.conf self.cleanup_on_exit = config.FALLBACK_CLEANUP_ON_EXIT self.cleanup_modules_on_exit = config.FALLBACK_CLEANUP_MODULES_ON_EXIT self.ipv6_rpfilter_enabled = config.FALLBACK_IPV6_RPFILTER self._individual_calls = config.FALLBACK_INDIVIDUAL_CALLS self._log_denied = config.FALLBACK_LOG_DENIED self._firewall_backend = config.FALLBACK_FIREWALL_BACKEND self._flush_all_on_reload = config.FALLBACK_FLUSH_ALL_ON_RELOAD self._rfc3964_ipv4 = config.FALLBACK_RFC3964_IPV4 self._allow_zone_drifting = config.FALLBACK_ALLOW_ZONE_DRIFTING def get_all_io_objects_dict(self): """ Returns a dict of dicts of all runtime config objects. """ conf_dict = {} conf_dict["ipsets"] = {_ipset: self.ipset.get_ipset(_ipset) for _ipset in self.ipset.get_ipsets()} conf_dict["helpers"] = {helper: self.helper.get_helper(helper) for helper in self.helper.get_helpers()} conf_dict["icmptypes"] = {icmptype: self.icmptype.get_icmptype(icmptype) for icmptype in self.icmptype.get_icmptypes()} conf_dict["services"] = {service: self.service.get_service(service) for service in self.service.get_services()} conf_dict["zones"] = {zone: self.zone.get_zone(zone) for zone in self.zone.get_zones()} conf_dict["policies"] = {policy: self.policy.get_policy(policy) for policy in self.policy.get_policies_not_derived_from_zone()} # The runtime might not actually support all the defined icmptypes. # This is the case if ipv6 (ip6tables) is disabled. Unfortunately users # disable IPv6 and also expect the IPv6 stuff to be silently ignored. # This is problematic for defaults that include IPv6 stuff, e.g. policy # 'allow-host-ipv6'. Use this to make a better decision about errors vs # warnings. # conf_dict["icmptypes_unsupported"] = {} for icmptype in (set(self.config.get_icmptypes()).difference( set(self.icmptype.get_icmptypes()))): conf_dict["icmptypes_unsupported"][icmptype] = self.config.get_icmptype(icmptype) # Some icmptypes support multiple families. Add those that are missing # support for a subset of families. for icmptype in (set(self.config.get_icmptypes()).intersection( set(self.icmptype.get_icmptypes()))): if icmptype not in self.ipv4_supported_icmp_types or \ icmptype not in self.ipv6_supported_icmp_types: conf_dict["icmptypes_unsupported"][icmptype] = copy.copy(self.config.get_icmptype(icmptype)) conf_dict["icmptypes_unsupported"][icmptype].destination = [] if icmptype not in self.ipv4_supported_icmp_types: conf_dict["icmptypes_unsupported"][icmptype].destination.append("ipv4") if icmptype not in self.ipv6_supported_icmp_types: conf_dict["icmptypes_unsupported"][icmptype].destination.append("ipv6") return conf_dict def full_check_config(self, extra_io_objects: Dict[str, List[IO_Object]] = {}): all_io_objects = self.get_all_io_objects_dict() # mix in the extra objects for type_key in extra_io_objects: for obj in extra_io_objects[type_key]: all_io_objects[type_key][obj.name] = obj # we need to check in a well defined order because some io_objects will # cross-check others order = ["ipsets", "helpers", "icmptypes", "services", "zones", "policies"] for io_obj_type in order: io_objs = all_io_objects[io_obj_type] for (name, io_obj) in io_objs.items(): io_obj.check_config_dict(io_obj.export_config_dict(), all_io_objects) def _check_tables(self): # check if iptables, ip6tables and ebtables are usable, else disable if self.ip4tables_enabled and \ "filter" not in self.ip4tables_backend.get_available_tables(): log.info1("iptables is not usable.") self.ip4tables_enabled = False if self.ip6tables_enabled and \ "filter" not in self.ip6tables_backend.get_available_tables(): log.info1("ip6tables is not usable.") self.ip6tables_enabled = False if self.ebtables_enabled and \ "filter" not in self.ebtables_backend.get_available_tables(): log.info1("ebtables is not usable.") self.ebtables_enabled = False # is there at least support for ipv4 or ipv6 if not self.ip4tables_enabled and not self.ip6tables_enabled \ and not self.nftables_enabled: log.fatal("No IPv4 and IPv6 firewall.") sys.exit(1) def _start_check(self): try: self.ipset_backend.set_list() except ValueError: if self.nftables_enabled: log.info1("ipset not usable, disabling ipset usage in firewall. Other set backends (nftables) remain usable.") else: log.warning("ipset not usable, disabling ipset usage in firewall.") self.ipset_supported_types = [ ] # ipset is not usable self.ipset_enabled = False else: # ipset is usable, get all supported types self.ipset_supported_types = self.ipset_backend.set_supported_types() self.ip4tables_backend.fill_exists() if not self.ip4tables_backend.restore_command_exists: if self.ip4tables_backend.command_exists: log.warning("iptables-restore is missing, using " "individual calls for IPv4 firewall.") else: if self.nftables_enabled: log.info1("iptables-restore and iptables are missing, " "IPv4 direct rules won't be usable.") else: log.warning("iptables-restore and iptables are missing, " "disabling IPv4 firewall.") self.ip4tables_enabled = False if self.nftables_enabled: self.ipv4_supported_icmp_types = self.nftables_backend.supported_icmp_types("ipv4") else: if self.ip4tables_enabled: self.ipv4_supported_icmp_types = self.ip4tables_backend.supported_icmp_types() else: self.ipv4_supported_icmp_types = [ ] self.ip6tables_backend.fill_exists() if not self.ip6tables_backend.restore_command_exists: if self.ip6tables_backend.command_exists: log.warning("ip6tables-restore is missing, using " "individual calls for IPv6 firewall.") else: if self.nftables_enabled: log.info1("ip6tables-restore and ip6tables are missing, " "IPv6 direct rules won't be usable.") else: log.warning("ip6tables-restore and ip6tables are missing, " "disabling IPv6 firewall.") self.ip6tables_enabled = False if self.nftables_enabled: self.ipv6_supported_icmp_types = self.nftables_backend.supported_icmp_types("ipv6") else: if self.ip6tables_enabled: self.ipv6_supported_icmp_types = self.ip6tables_backend.supported_icmp_types() else: self.ipv6_supported_icmp_types = [ ] self.ebtables_backend.fill_exists() if not self.ebtables_backend.restore_command_exists: if self.ebtables_backend.command_exists: log.warning("ebtables-restore is missing, using " "individual calls for bridge firewall.") else: if self.nftables_enabled: log.info1("ebtables-restore and ebtables are missing, " "eb direct rules won't be usable.") else: log.warning("ebtables-restore and ebtables are missing, " "disabling bridge firewall.") self.ebtables_enabled = False if self.ebtables_enabled and not self._individual_calls and \ not self.ebtables_backend.restore_noflush_option: log.debug1("ebtables-restore is not supporting the --noflush " "option, will therefore not be used") def _start(self, reload=False, complete_reload=False): # initialize firewall default_zone = config.FALLBACK_ZONE # load firewalld config log.debug1("Loading firewalld config file '%s'", config.FIREWALLD_CONF) try: self._firewalld_conf.read() except Exception as msg: log.warning(msg) log.warning("Using fallback firewalld configuration settings.") else: if self._firewalld_conf.get("DefaultZone"): default_zone = self._firewalld_conf.get("DefaultZone") if self._firewalld_conf.get("CleanupOnExit"): value = self._firewalld_conf.get("CleanupOnExit") if value is not None and value.lower() in [ "no", "false" ]: self.cleanup_on_exit = False log.debug1("CleanupOnExit is set to '%s'", self.cleanup_on_exit) if self._firewalld_conf.get("CleanupModulesOnExit"): value = self._firewalld_conf.get("CleanupModulesOnExit") if value is not None and value.lower() in [ "yes", "true" ]: self.cleanup_modules_on_exit = True log.debug1("CleanupModulesOnExit is set to '%s'", self.cleanup_modules_on_exit) if self._firewalld_conf.get("Lockdown"): value = self._firewalld_conf.get("Lockdown") if value is not None and value.lower() in [ "yes", "true" ]: log.debug1("Lockdown is enabled") try: self.policies.enable_lockdown() except FirewallError: # already enabled, this is probably reload pass if self._firewalld_conf.get("IPv6_rpfilter"): value = self._firewalld_conf.get("IPv6_rpfilter") if value is not None: if value.lower() in [ "no", "false" ]: self.ipv6_rpfilter_enabled = False if value.lower() in [ "yes", "true" ]: self.ipv6_rpfilter_enabled = True if self.ipv6_rpfilter_enabled: log.debug1("IPv6 rpfilter is enabled") else: log.debug1("IPV6 rpfilter is disabled") if self._firewalld_conf.get("IndividualCalls"): value = self._firewalld_conf.get("IndividualCalls") if value is not None and value.lower() in [ "yes", "true" ]: log.debug1("IndividualCalls is enabled") self._individual_calls = True if self._firewalld_conf.get("LogDenied"): value = self._firewalld_conf.get("LogDenied") if value is None or value.lower() == "no": self._log_denied = "off" else: self._log_denied = value.lower() log.debug1("LogDenied is set to '%s'", self._log_denied) if self._firewalld_conf.get("FirewallBackend"): self._firewall_backend = self._firewalld_conf.get("FirewallBackend") log.debug1("FirewallBackend is set to '%s'", self._firewall_backend) if self._firewalld_conf.get("FlushAllOnReload"): value = self._firewalld_conf.get("FlushAllOnReload") if value.lower() in [ "no", "false" ]: self._flush_all_on_reload = False else: self._flush_all_on_reload = True log.debug1("FlushAllOnReload is set to '%s'", self._flush_all_on_reload) if self._firewalld_conf.get("RFC3964_IPv4"): value = self._firewalld_conf.get("RFC3964_IPv4") if value.lower() in [ "no", "false" ]: self._rfc3964_ipv4 = False else: self._rfc3964_ipv4 = True log.debug1("RFC3964_IPv4 is set to '%s'", self._rfc3964_ipv4) self.config.set_firewalld_conf(copy.deepcopy(self._firewalld_conf)) self._select_firewall_backend(self._firewall_backend) if not self._offline: self._start_check() # load lockdown whitelist log.debug1("Loading lockdown whitelist") try: self.policies.lockdown_whitelist.read() except Exception as msg: if self.policies.query_lockdown(): log.error("Failed to load lockdown whitelist '%s': %s", self.policies.lockdown_whitelist.filename, msg) else: log.debug1("Failed to load lockdown whitelist '%s': %s", self.policies.lockdown_whitelist.filename, msg) # copy policies to config interface self.config.set_policies(copy.deepcopy(self.policies)) # load ipset files self._loader(config.FIREWALLD_IPSETS, "ipset") self._loader(config.ETC_FIREWALLD_IPSETS, "ipset") # load icmptype files self._loader(config.FIREWALLD_ICMPTYPES, "icmptype") self._loader(config.ETC_FIREWALLD_ICMPTYPES, "icmptype") if len(self.icmptype.get_icmptypes()) == 0: log.error("No icmptypes found.") # load helper files self._loader(config.FIREWALLD_HELPERS, "helper") self._loader(config.ETC_FIREWALLD_HELPERS, "helper") # load service files self._loader(config.FIREWALLD_SERVICES, "service") self._loader(config.ETC_FIREWALLD_SERVICES, "service") if len(self.service.get_services()) == 0: log.error("No services found.") # load zone files self._loader(config.FIREWALLD_ZONES, "zone") self._loader(config.ETC_FIREWALLD_ZONES, "zone") if len(self.zone.get_zones()) == 0: log.fatal("No zones found.") sys.exit(1) # load policy files self._loader(config.FIREWALLD_POLICIES, "policy") self._loader(config.ETC_FIREWALLD_POLICIES, "policy") # check minimum required zones error = False for z in [ "block", "drop", "trusted" ]: if z not in self.zone.get_zones(): log.fatal("Zone '%s' is not available.", z) error = True if error: sys.exit(1) # check if default_zone is a valid zone if default_zone not in self.zone.get_zones(): if "public" in self.zone.get_zones(): zone = "public" elif "external" in self.zone.get_zones(): zone = "external" else: zone = "block" # block is a base zone, therefore it has to exist log.error("Default zone '%s' is not valid. Using '%s'.", default_zone, zone) default_zone = zone else: log.debug1("Using default zone '%s'", default_zone) # load direct rules obj = Direct(config.FIREWALLD_DIRECT) if os.path.exists(config.FIREWALLD_DIRECT): log.debug1("Loading direct rules file '%s'" % \ config.FIREWALLD_DIRECT) try: obj.read() except Exception as msg: log.error("Failed to load direct rules file '%s': %s", config.FIREWALLD_DIRECT, msg) self.direct.set_permanent_config(obj) self.config.set_direct(copy.deepcopy(obj)) self._default_zone = self.check_zone(default_zone) if self._offline: return # check if needed tables are there self._check_tables() if log.getDebugLogLevel() > 0: # get time before flushing and applying tm1 = time.time() # Start transaction transaction = FirewallTransaction(self) # flush rules self.flush(use_transaction=transaction) # If modules need to be unloaded in complete reload or if there are # ipsets to get applied, limit the transaction to flush. # # Future optimization for the ipset case in reload: The transaction # only needs to be split here if there are conflicting ipset types in # exsting ipsets and the configuration in firewalld. if (reload and complete_reload) or \ (self.ipset.backends() and self.ipset.has_ipsets()): transaction.execute(True) transaction.clear() # complete reload: unload modules also if reload and complete_reload: log.debug1("Unloading firewall modules") self.modules_backend.unload_firewall_modules() self.apply_default_tables(use_transaction=transaction) transaction.execute(True) transaction.clear() # apply settings for loaded ipsets while reloading here if (self.ipset.backends()) and self.ipset.has_ipsets(): log.debug1("Applying ipsets") self.ipset.apply_ipsets() # Start or continue with transaction # apply default rules log.debug1("Applying default rule set") self.apply_default_rules(use_transaction=transaction) # apply settings for loaded zones log.debug1("Applying used zones") self.zone.apply_zones(use_transaction=transaction) self.zone.change_default_zone(None, self._default_zone, use_transaction=transaction) # apply policies log.debug1("Applying used policies") self.policy.apply_policies(use_transaction=transaction) # Execute transaction transaction.execute(True) # Start new transaction for direct rules transaction.clear() # apply direct chains, rules and passthrough rules if self.direct.has_configuration(): log.debug1("Applying direct chains rules and passthrough rules") self.direct.apply_direct(transaction) # since direct rules are easy to make syntax errors lets highlight # the cause if the transaction fails. try: transaction.execute(True) transaction.clear() except FirewallError as e: raise FirewallError(e.code, "Direct: %s" % (e.msg if e.msg else "")) except Exception: raise del transaction if log.getDebugLogLevel() > 1: # get time after flushing and applying tm2 = time.time() log.debug2("Flushing and applying took %f seconds" % (tm2 - tm1)) def start(self): try: self._start() except Exception: self._state = "FAILED" self.set_policy("ACCEPT") raise else: self._state = "RUNNING" self.set_policy("ACCEPT") def _loader(self, path, reader_type, combine=False): # combine: several zone files are getting combined into one obj if not os.path.isdir(path): return if combine: if path.startswith(config.ETC_FIREWALLD) and reader_type == "zone": combined_zone = Zone() combined_zone.name = os.path.basename(path) combined_zone.check_name(combined_zone.name) combined_zone.path = path combined_zone.default = False else: combine = False for filename in sorted(os.listdir(path)): if not filename.endswith(".xml"): if path.startswith(config.ETC_FIREWALLD) and \ reader_type == "zone" and \ os.path.isdir("%s/%s" % (path, filename)): self._loader("%s/%s" % (path, filename), reader_type, combine=True) continue name = "%s/%s" % (path, filename) log.debug1("Loading %s file '%s'", reader_type, name) try: if reader_type == "icmptype": obj = icmptype_reader(filename, path) if obj.name in self.icmptype.get_icmptypes(): orig_obj = self.icmptype.get_icmptype(obj.name) log.debug1(" Overloads %s '%s' ('%s/%s')", reader_type, orig_obj.name, orig_obj.path, orig_obj.filename) self.icmptype.remove_icmptype(orig_obj.name) elif obj.path.startswith(config.ETC_FIREWALLD): obj.default = True try: self.icmptype.add_icmptype(obj) except FirewallError as error: log.info1("%s: %s, ignoring for run-time." % \ (obj.name, str(error))) # add a deep copy to the configuration interface self.config.add_icmptype(copy.deepcopy(obj)) elif reader_type == "service": obj = service_reader(filename, path) if obj.name in self.service.get_services(): orig_obj = self.service.get_service(obj.name) log.debug1(" Overloads %s '%s' ('%s/%s')", reader_type, orig_obj.name, orig_obj.path, orig_obj.filename) self.service.remove_service(orig_obj.name) elif obj.path.startswith(config.ETC_FIREWALLD): obj.default = True self.service.add_service(obj) # add a deep copy to the configuration interface self.config.add_service(copy.deepcopy(obj)) elif reader_type == "zone": obj = zone_reader(filename, path, no_check_name=combine) if combine: # Change name for permanent configuration obj.name = "%s/%s" % ( os.path.basename(path), os.path.basename(filename)[0:-4]) obj.check_name(obj.name) # Copy object before combine config_obj = copy.deepcopy(obj) if obj.name in self.zone.get_zones(): orig_obj = self.zone.get_zone(obj.name) self.zone.remove_zone(orig_obj.name) if orig_obj.combined: log.debug1(" Combining %s '%s' ('%s/%s')", reader_type, obj.name, path, filename) obj.combine(orig_obj) else: log.debug1(" Overloads %s '%s' ('%s/%s')", reader_type, orig_obj.name, orig_obj.path, orig_obj.filename) elif obj.path.startswith(config.ETC_FIREWALLD): obj.default = True config_obj.default = True self.config.add_zone(config_obj) if combine: log.debug1(" Combining %s '%s' ('%s/%s')", reader_type, combined_zone.name, path, filename) combined_zone.combine(obj) else: self.zone.add_zone(obj) elif reader_type == "ipset": obj = ipset_reader(filename, path) if obj.name in self.ipset.get_ipsets(): orig_obj = self.ipset.get_ipset(obj.name) log.debug1(" Overloads %s '%s' ('%s/%s')", reader_type, orig_obj.name, orig_obj.path, orig_obj.filename) self.ipset.remove_ipset(orig_obj.name) elif obj.path.startswith(config.ETC_FIREWALLD): obj.default = True try: self.ipset.add_ipset(obj) except FirewallError as error: log.warning("%s: %s, ignoring for run-time." % \ (obj.name, str(error))) # add a deep copy to the configuration interface self.config.add_ipset(copy.deepcopy(obj)) elif reader_type == "helper": obj = helper_reader(filename, path) if obj.name in self.helper.get_helpers(): orig_obj = self.helper.get_helper(obj.name) log.debug1(" Overloads %s '%s' ('%s/%s')", reader_type, orig_obj.name, orig_obj.path, orig_obj.filename) self.helper.remove_helper(orig_obj.name) elif obj.path.startswith(config.ETC_FIREWALLD): obj.default = True self.helper.add_helper(obj) # add a deep copy to the configuration interface self.config.add_helper(copy.deepcopy(obj)) elif reader_type == "policy": obj = policy_reader(filename, path) if obj.name in self.policy.get_policies(): orig_obj = self.policy.get_policy(obj.name) log.debug1(" Overloads %s '%s' ('%s/%s')", reader_type, orig_obj.name, orig_obj.path, orig_obj.filename) self.policy.remove_policy(orig_obj.name) elif obj.path.startswith(config.ETC_FIREWALLD): obj.default = True self.policy.add_policy(obj) # add a deep copy to the configuration interface self.config.add_policy_object(copy.deepcopy(obj)) else: log.fatal("Unknown reader type %s", reader_type) except FirewallError as msg: log.error("Failed to load %s file '%s': %s", reader_type, name, msg) except Exception: log.error("Failed to load %s file '%s':", reader_type, name) log.exception() if combine and combined_zone.combined: if combined_zone.name in self.zone.get_zones(): orig_obj = self.zone.get_zone(combined_zone.name) log.debug1(" Overloading and deactivating %s '%s' ('%s/%s')", reader_type, orig_obj.name, orig_obj.path, orig_obj.filename) try: self.zone.remove_zone(combined_zone.name) except Exception: pass self.config.forget_zone(combined_zone.name) self.zone.add_zone(combined_zone) def cleanup(self): self.icmptype.cleanup() self.service.cleanup() self.zone.cleanup() self.ipset.cleanup() self.helper.cleanup() self.config.cleanup() self.direct.cleanup() self.policies.cleanup() self.policy.cleanup() self._firewalld_conf.cleanup() self.__init_vars() def stop(self): if not self._offline: if self.cleanup_on_exit: self.flush() self.ipset.flush() self.set_policy("ACCEPT") if self.cleanup_modules_on_exit: log.debug1('Unloading firewall kernel modules') self.modules_backend.unload_firewall_modules() self.cleanup() # handle modules def handle_modules(self, _modules, enable): num_failed = 0 error_msgs = "" for i,module in enumerate(_modules): if enable: (status, msg) = self.modules_backend.load_module(module) else: if self._module_refcount[module] > 1: status = 0 # module referenced more then one, do not unload else: (status, msg) = self.modules_backend.unload_module(module) if status != 0: num_failed += 1 error_msgs += msg continue if enable: self._module_refcount.setdefault(module, 0) self._module_refcount[module] += 1 else: if module in self._module_refcount: self._module_refcount[module] -= 1 if self._module_refcount[module] == 0: del self._module_refcount[module] return (num_failed, error_msgs) def _select_firewall_backend(self, backend): if backend != "nftables": self.nftables_enabled = False # even if using nftables, the other backends are enabled for use with # the direct interface. nftables is used for the firewalld primitives. def get_backend_by_name(self, name): for backend in self.all_backends(): if backend.name == name: return backend raise FirewallError(errors.UNKNOWN_ERROR, "'%s' backend does not exist" % name) def get_backend_by_ipv(self, ipv): if self.nftables_enabled: return self.nftables_backend if ipv == "ipv4" and self.ip4tables_enabled: return self.ip4tables_backend elif ipv == "ipv6" and self.ip6tables_enabled: return self.ip6tables_backend elif ipv == "eb" and self.ebtables_enabled: return self.ebtables_backend raise FirewallError(errors.INVALID_IPV, "'%s' is not a valid backend or is unavailable" % ipv) def get_direct_backend_by_ipv(self, ipv): if ipv == "ipv4" and self.ip4tables_enabled: return self.ip4tables_backend elif ipv == "ipv6" and self.ip6tables_enabled: return self.ip6tables_backend elif ipv == "eb" and self.ebtables_enabled: return self.ebtables_backend raise FirewallError(errors.INVALID_IPV, "'%s' is not a valid backend or is unavailable" % ipv) def is_backend_enabled(self, name): if name == "ip4tables": return self.ip4tables_enabled elif name == "ip6tables": return self.ip6tables_enabled elif name == "ebtables": return self.ebtables_enabled elif name == "nftables": return self.nftables_enabled return False def is_ipv_enabled(self, ipv): if self.nftables_enabled: return True if ipv == "ipv4": return self.ip4tables_enabled elif ipv == "ipv6": return self.ip6tables_enabled elif ipv == "eb": return self.ebtables_enabled return False def enabled_backends(self): backends = [] if self.nftables_enabled: backends.append(self.nftables_backend) else: if self.ip4tables_enabled: backends.append(self.ip4tables_backend) if self.ip6tables_enabled: backends.append(self.ip6tables_backend) if self.ebtables_enabled: backends.append(self.ebtables_backend) return backends def all_backends(self): backends = [] if self.ip4tables_enabled: backends.append(self.ip4tables_backend) if self.ip6tables_enabled: backends.append(self.ip6tables_backend) if self.ebtables_enabled: backends.append(self.ebtables_backend) if self.nftables_enabled: backends.append(self.nftables_backend) return backends def apply_default_tables(self, use_transaction=None): if use_transaction is None: transaction = FirewallTransaction(self) else: transaction = use_transaction for backend in self.enabled_backends(): transaction.add_rules(backend, backend.build_default_tables()) if use_transaction is None: transaction.execute(True) def apply_default_rules(self, use_transaction=None): if use_transaction is None: transaction = FirewallTransaction(self) else: transaction = use_transaction for backend in self.enabled_backends(): rules = backend.build_default_rules(self._log_denied) transaction.add_rules(backend, rules) if self.is_ipv_enabled("ipv6"): ipv6_backend = self.get_backend_by_ipv("ipv6") if "raw" in ipv6_backend.get_available_tables(): if self.ipv6_rpfilter_enabled: rules = ipv6_backend.build_rpfilter_rules(self._log_denied) transaction.add_rules(ipv6_backend, rules) if self.is_ipv_enabled("ipv6") and self._rfc3964_ipv4: rules = ipv6_backend.build_rfc3964_ipv4_rules() transaction.add_rules(ipv6_backend, rules) if use_transaction is None: transaction.execute(True) # flush and policy def flush(self, use_transaction=None): if use_transaction is None: transaction = FirewallTransaction(self) else: transaction = use_transaction log.debug1("Flushing rule set") for backend in self.all_backends(): rules = backend.build_flush_rules() transaction.add_rules(backend, rules) if use_transaction is None: transaction.execute(True) def set_policy(self, policy, use_transaction=None): if use_transaction is None: transaction = FirewallTransaction(self) else: transaction = use_transaction log.debug1("Setting policy to '%s'", policy) for backend in self.enabled_backends(): rules = backend.build_set_policy_rules(policy) transaction.add_rules(backend, rules) if use_transaction is None: transaction.execute(True) # rule function used in handle_ functions def rule(self, backend_name, rule): if not rule: return "" backend = self.get_backend_by_name(backend_name) if not backend: raise FirewallError(errors.INVALID_IPV, "'%s' is not a valid backend" % backend_name) if not self.is_backend_enabled(backend_name): return "" return backend.set_rule(rule, self._log_denied) def rules(self, backend_name, rules): _rules = list(filter(None, rules)) backend = self.get_backend_by_name(backend_name) if not backend: raise FirewallError(errors.INVALID_IPV, "'%s' is not a valid backend" % backend_name) if not self.is_backend_enabled(backend_name): return if self._individual_calls or \ not backend.restore_command_exists or \ (backend_name == "ebtables" and not self.ebtables_backend.restore_noflush_option): for i,rule in enumerate(_rules): try: backend.set_rule(rule, self._log_denied) except Exception as msg: log.debug1(traceback.format_exc()) log.error(msg) for rule in reversed(_rules[:i]): try: backend.set_rule(backend.reverse_rule(rule), self._log_denied) except Exception: # ignore errors here pass raise msg else: backend.set_rules(_rules, self._log_denied) # check functions def check_panic(self): if self._panic: raise FirewallError(errors.PANIC_MODE) def check_policy(self, policy): _policy = policy if _policy not in self.policy.get_policies(): raise FirewallError(errors.INVALID_POLICY, _policy) return _policy def check_zone(self, zone): _zone = zone if not _zone or _zone == "": _zone = self.get_default_zone() if _zone not in self.zone.get_zones(): raise FirewallError(errors.INVALID_ZONE, _zone) return _zone def check_interface(self, interface): if not functions.checkInterface(interface): raise FirewallError(errors.INVALID_INTERFACE, interface) def check_service(self, service): self.service.check_service(service) def check_port(self, port): if not functions.check_port(port): raise FirewallError(errors.INVALID_PORT, port) def check_tcpudp(self, protocol): if not protocol: raise FirewallError(errors.MISSING_PROTOCOL) if protocol not in [ "tcp", "udp", "sctp", "dccp" ]: raise FirewallError(errors.INVALID_PROTOCOL, "'%s' not in {'tcp'|'udp'|'sctp'|'dccp'}" % \ protocol) def check_ip(self, ip): if not functions.checkIP(ip): raise FirewallError(errors.INVALID_ADDR, ip) def check_address(self, ipv, source): if ipv == "ipv4": if not functions.checkIPnMask(source): raise FirewallError(errors.INVALID_ADDR, source) elif ipv == "ipv6": if not functions.checkIP6nMask(source): raise FirewallError(errors.INVALID_ADDR, source) else: raise FirewallError(errors.INVALID_IPV, "'%s' not in {'ipv4'|'ipv6'}") def check_icmptype(self, icmp): self.icmptype.check_icmptype(icmp) def check_timeout(self, timeout): if not isinstance(timeout, int): raise TypeError("%s is %s, expected int" % (timeout, type(timeout))) if int(timeout) < 0: raise FirewallError(errors.INVALID_VALUE, "timeout '%d' is not positive number" % timeout) # RELOAD def reload(self, stop=False): _panic = self._panic # must stash this. The value may change after _start() flush_all = self._flush_all_on_reload if not flush_all: # save zone interfaces _zone_interfaces = { } for zone in self.zone.get_zones(): _zone_interfaces[zone] = self.zone.get_zone(zone).interfaces # save direct config _direct_config = self.direct.get_runtime_config() _old_dz = self.get_default_zone() _ipset_objs = [] for _name in self.ipset.get_ipsets(): _ipset_objs.append(self.ipset.get_ipset(_name)) if not _panic: self.set_policy("DROP") # stop self.cleanup() start_exception = None try: self._start(reload=True, complete_reload=stop) except Exception as e: # save the exception for later, but continue restoring interfaces, # etc. We'll re-raise it at the end. start_exception = e # destroy ipsets no longer in the permanent configuration if flush_all: for obj in _ipset_objs: if not self.ipset.query_ipset(obj.name): for backend in self.ipset.backends(): # nftables sets are part of the normal firewall ruleset. if backend.name == "nftables": continue backend.set_destroy(obj.name) if not flush_all: # handle interfaces in the default zone and move them to the new # default zone if it changed _new_dz = self.get_default_zone() if _new_dz != _old_dz: # if_new_dz has been introduced with the reload, we need to add it # https://github.com/firewalld/firewalld/issues/53 if _new_dz not in _zone_interfaces: _zone_interfaces[_new_dz] = { } # default zone changed. Move interfaces from old default zone to # the new one. for iface in _zone_interfaces[_old_dz]: if iface in self._default_zone_interfaces: # move only those that were added to default zone # (not those that were added to specific zone same as # default) _zone_interfaces[_new_dz][iface] = \ _zone_interfaces[_old_dz][iface] del _zone_interfaces[_old_dz][iface] # add interfaces to zones again for zone in self.zone.get_zones(): if zone in _zone_interfaces: for interface_id in _zone_interfaces[zone]: self.zone.change_zone_of_interface(zone, interface_id) del _zone_interfaces[zone] else: log.info1("New zone '%s'.", zone) if len(_zone_interfaces) > 0: for zone in list(_zone_interfaces.keys()): log.info1("Lost zone '%s', zone interfaces dropped.", zone) del _zone_interfaces[zone] del _zone_interfaces # restore runtime-only ipsets for obj in _ipset_objs: if self.ipset.query_ipset(obj.name): for entry in obj.entries: try: self.ipset.add_entry(obj.name, entry) except FirewallError as msg: if msg.code != errors.ALREADY_ENABLED: raise msg else: self.ipset.add_ipset(obj) self.ipset.apply_ipset(obj.name) # restore direct config self.direct.set_config(_direct_config) # Restore permanent interfaces from NetworkManager nm_bus_name = nm_get_bus_name() if nm_bus_name: for zone in self.zone.get_zones() + [""]: for interface in nm_get_interfaces_in_zone(zone): self.zone.change_zone_of_interface(zone, interface, sender=nm_bus_name) self._panic = _panic if not self._panic: self.set_policy("ACCEPT") if start_exception: self._state = "FAILED" raise start_exception else: self._state = "RUNNING" # STATE def get_state(self): return self._state # PANIC MODE def enable_panic_mode(self): if self._panic: raise FirewallError(errors.ALREADY_ENABLED, "panic mode already enabled") try: self.set_policy("PANIC") except Exception as msg: raise FirewallError(errors.COMMAND_FAILED, msg) self._panic = True def disable_panic_mode(self): if not self._panic: raise FirewallError(errors.NOT_ENABLED, "panic mode is not enabled") try: self.set_policy("ACCEPT") except Exception as msg: raise FirewallError(errors.COMMAND_FAILED, msg) self._panic = False def query_panic_mode(self): return self._panic # LOG DENIED def get_log_denied(self): return self._log_denied def set_log_denied(self, value): if value not in config.LOG_DENIED_VALUES: raise FirewallError(errors.INVALID_VALUE, "'%s', choose from '%s'" % \ (value, "','".join(config.LOG_DENIED_VALUES))) if value != self.get_log_denied(): self._log_denied = value self._firewalld_conf.set("LogDenied", value) self._firewalld_conf.write() else: raise FirewallError(errors.ALREADY_SET, value) # DEFAULT ZONE def get_default_zone(self): return self._default_zone def set_default_zone(self, zone): _zone = self.check_zone(zone) if _zone != self._default_zone: _old_dz = self._default_zone self._default_zone = _zone self._firewalld_conf.set("DefaultZone", _zone) self._firewalld_conf.write() if self._offline: return # remove old default zone from ZONES and add new default zone self.zone.change_default_zone(_old_dz, _zone) # Move interfaces from old default zone to the new one. for iface in self.zone.get_zone(_old_dz).interfaces: if iface in self._default_zone_interfaces: # move only those that were added to default zone # (not those that were added to specific zone same as default) self.zone.change_zone_of_interface("", iface) else: raise FirewallError(errors.ZONE_ALREADY_SET, _zone) def combine_runtime_with_permanent_settings(self, permanent, runtime): combined = permanent.copy() for key,value in runtime.items(): # omit empty entries if value or isinstance(value, bool): combined[key] = value # make sure to remove values that were in permanent, but no # longer in runtime. elif key in combined: del combined[key] return combined def get_added_and_removed_settings(self, old_settings, new_settings): # normalize rich rules, zones and policies use a different key for rich_key in ["rich_rules", "rules_str"]: if rich_key in new_settings: new_settings[rich_key] = [str(Rich_Rule(rule_str=rule_str)) for rule_str in new_settings[rich_key]] add_settings = {} remove_settings = {} for key in (set(old_settings.keys()) | set(new_settings.keys())): if key in new_settings: if isinstance(new_settings[key], list): old = set(old_settings[key] if key in old_settings else []) add_settings[key] = list(set(new_settings[key]) - old) remove_settings[key] = list((old ^ set(new_settings[key])) & old) # check for bool or int because dbus.Boolean is a subclass of # int (because bool can't be subclassed). elif isinstance(new_settings[key], bool) or isinstance(new_settings[key], int): if not old_settings[key] and new_settings[key]: add_settings[key] = True elif old_settings[key] and not new_settings[key]: remove_settings[key] = False else: raise FirewallError(errors.INVALID_SETTING, "Unhandled setting type {} key {}".format(type(new_settings[key]), key)) return (add_settings, remove_settings) PK ���Z core/__init__.pynu �[��� PK ���Z����g g core/fw_service.pynu �[��� # -*- coding: utf-8 -*- # # Copyright (C) 2011-2016 Red Hat, Inc. # # Authors: # Thomas Woerner <twoerner@redhat.com> # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see <http://www.gnu.org/licenses/>. # __all__ = [ "FirewallService" ] from firewall import errors from firewall.errors import FirewallError class FirewallService(object): def __init__(self, fw): self._fw = fw self._services = { } def __repr__(self): return '%s(%r)' % (self.__class__, self._services) def cleanup(self): self._services.clear() # zones def get_services(self): return sorted(self._services.keys()) def check_service(self, service): if service not in self._services: raise FirewallError(errors.INVALID_SERVICE, service) def get_service(self, service): self.check_service(service) return self._services[service] def add_service(self, obj): self._services[obj.name] = obj def remove_service(self, service): self.check_service(service) del self._services[service] PK ���Z*!PŐ� �� client.pynu �[��� # -*- coding: utf-8 -*- # # Copyright (C) 2009-2016 Red Hat, Inc. # # Authors: # Thomas Woerner <twoerner@redhat.com> # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see <http://www.gnu.org/licenses/>. # from gi.repository import GLib import dbus.mainloop.glib import functools from firewall import config from firewall.core.base import DEFAULT_ZONE_TARGET, DEFAULT_POLICY_TARGET, DEFAULT_POLICY_PRIORITY from firewall.dbus_utils import dbus_to_python from firewall.core.rich import Rich_Rule from firewall.core.ipset import normalize_ipset_entry, check_entry_overlaps_existing, \ check_for_overlapping_entries from firewall import errors from firewall.errors import FirewallError import dbus import traceback exception_handler = None not_authorized_loop = False def handle_exceptions(func): """Decorator to handle exceptions """ @functools.wraps(func) def _impl(*args, **kwargs): authorized = False while not authorized: try: return func(*args, **kwargs) except dbus.exceptions.DBusException as e: dbus_message = e.get_dbus_message() # returns unicode dbus_name = e.get_dbus_name() if not exception_handler: raise if "NotAuthorizedException" in dbus_name: exception_handler("NotAuthorizedException") elif "org.freedesktop.DBus.Error" in dbus_name: # dbus error, try again exception_handler(dbus_message) else: authorized = True if dbus_message: exception_handler(dbus_message) else: exception_handler(str(e)) except FirewallError as e: if not exception_handler: raise else: exception_handler(str(e)) except Exception: if not exception_handler: raise else: exception_handler(traceback.format_exc()) if not not_authorized_loop: break return _impl # zone config setings class FirewallClientZoneSettings(object): @handle_exceptions def __init__(self, settings = None): self.settings = ["", "", "", False, DEFAULT_ZONE_TARGET, [], [], [], False, [], [], [], [], [], [], False, False] self.settings_name = ["version", "short", "description", "UNUSED", "target", "services", "ports", "icmp_blocks", "masquerade", "forward_ports", "interfaces", "sources", "rules_str", "protocols", "source_ports", "icmp_block_inversion", "forward"] self.settings_dbus_type = ["s", "s", "s", "b", "s", "s", "(ss)", "s", "b", "(ssss)", "s", "s", "s", "s", "(ss)", "b", "b"] if settings: if isinstance(settings, list): for i,v in enumerate(settings): self.settings[i] = settings[i] if isinstance(settings, dict): self.setSettingsDict(settings) @handle_exceptions def __repr__(self): return '%s(%r)' % (self.__class__, self.settings) @handle_exceptions def getSettingsDict(self): settings = {} for key,value in zip(self.settings_name, self.settings): if key == 'UNUSED': continue settings[key] = value return settings @handle_exceptions def setSettingsDict(self, settings): for key in settings: self.settings[self.settings_name.index(key)] = settings[key] @handle_exceptions def getSettingsDbusDict(self): settings = {} for key,value,sig in zip(self.settings_name, self.settings, self.settings_dbus_type): if key == 'UNUSED': continue if type(value) is list: settings[key] = dbus.Array(value, signature=sig) elif type(value) is dict: settings[key] = dbus.Dictionary(value, signature=sig) else: settings[key] = value return settings @handle_exceptions def getRuntimeSettingsDict(self): settings = self.getSettingsDict() # These are not configurable at runtime: del settings['version'] del settings['short'] del settings['description'] del settings['target'] return settings @handle_exceptions def getRuntimeSettingsDbusDict(self): settings = self.getSettingsDbusDict() # These are not configurable at runtime: del settings['version'] del settings['short'] del settings['description'] del settings['target'] return settings @handle_exceptions def getVersion(self): return self.settings[0] @handle_exceptions def setVersion(self, version): self.settings[0] = version @handle_exceptions def getShort(self): return self.settings[1] @handle_exceptions def setShort(self, short): self.settings[1] = short @handle_exceptions def getDescription(self): return self.settings[2] @handle_exceptions def setDescription(self, description): self.settings[2] = description # self.settings[3] was used for 'immutable' @handle_exceptions def getTarget(self): return self.settings[4] if self.settings[4] != DEFAULT_ZONE_TARGET else "default" @handle_exceptions def setTarget(self, target): self.settings[4] = target if target != "default" else DEFAULT_ZONE_TARGET @handle_exceptions def getServices(self): return self.settings[5] @handle_exceptions def setServices(self, services): self.settings[5] = services @handle_exceptions def addService(self, service): if service not in self.settings[5]: self.settings[5].append(service) else: raise FirewallError(errors.ALREADY_ENABLED, service) @handle_exceptions def removeService(self, service): if service in self.settings[5]: self.settings[5].remove(service) else: raise FirewallError(errors.NOT_ENABLED, service) @handle_exceptions def queryService(self, service): return service in self.settings[5] @handle_exceptions def getPorts(self): return self.settings[6] @handle_exceptions def setPorts(self, ports): self.settings[6] = ports @handle_exceptions def addPort(self, port, protocol): if (port,protocol) not in self.settings[6]: self.settings[6].append((port,protocol)) else: raise FirewallError(errors.ALREADY_ENABLED, "'%s:%s'" % (port, protocol)) @handle_exceptions def removePort(self, port, protocol): if (port,protocol) in self.settings[6]: self.settings[6].remove((port,protocol)) else: raise FirewallError(errors.NOT_ENABLED, "'%s:%s'" % (port, protocol)) @handle_exceptions def queryPort(self, port, protocol): return (port,protocol) in self.settings[6] @handle_exceptions def getProtocols(self): return self.settings[13] @handle_exceptions def setProtocols(self, protocols): self.settings[13] = protocols @handle_exceptions def addProtocol(self, protocol): if protocol not in self.settings[13]: self.settings[13].append(protocol) else: raise FirewallError(errors.ALREADY_ENABLED, protocol) @handle_exceptions def removeProtocol(self, protocol): if protocol in self.settings[13]: self.settings[13].remove(protocol) else: raise FirewallError(errors.NOT_ENABLED, protocol) @handle_exceptions def queryProtocol(self, protocol): return protocol in self.settings[13] @handle_exceptions def getSourcePorts(self): return self.settings[14] @handle_exceptions def setSourcePorts(self, ports): self.settings[14] = ports @handle_exceptions def addSourcePort(self, port, protocol): if (port,protocol) not in self.settings[14]: self.settings[14].append((port,protocol)) else: raise FirewallError(errors.ALREADY_ENABLED, "'%s:%s'" % (port, protocol)) @handle_exceptions def removeSourcePort(self, port, protocol): if (port,protocol) in self.settings[14]: self.settings[14].remove((port,protocol)) else: raise FirewallError(errors.NOT_ENABLED, "'%s:%s'" % (port, protocol)) @handle_exceptions def querySourcePort(self, port, protocol): return (port,protocol) in self.settings[14] @handle_exceptions def getIcmpBlocks(self): return self.settings[7] @handle_exceptions def setIcmpBlocks(self, icmpblocks): self.settings[7] = icmpblocks @handle_exceptions def addIcmpBlock(self, icmptype): if icmptype not in self.settings[7]: self.settings[7].append(icmptype) else: raise FirewallError(errors.ALREADY_ENABLED, icmptype) @handle_exceptions def removeIcmpBlock(self, icmptype): if icmptype in self.settings[7]: self.settings[7].remove(icmptype) else: raise FirewallError(errors.NOT_ENABLED, icmptype) @handle_exceptions def queryIcmpBlock(self, icmptype): return icmptype in self.settings[7] @handle_exceptions def getIcmpBlockInversion(self): return self.settings[15] @handle_exceptions def setIcmpBlockInversion(self, flag): self.settings[15] = flag @handle_exceptions def addIcmpBlockInversion(self): if not self.settings[15]: self.settings[15] = True else: FirewallError(errors.ALREADY_ENABLED, "icmp-block-inversion") @handle_exceptions def removeIcmpBlockInversion(self): if self.settings[15]: self.settings[15] = False else: FirewallError(errors.NOT_ENABLED, "icmp-block-inversion") @handle_exceptions def queryIcmpBlockInversion(self): return self.settings[15] @handle_exceptions def getForward(self): return self.settings[16] @handle_exceptions def setForward(self, forward): self.settings[16] = forward @handle_exceptions def addForward(self): if not self.settings[16]: self.settings[16] = True else: FirewallError(errors.ALREADY_ENABLED, "forward") @handle_exceptions def removeForward(self): if self.settings[16]: self.settings[16] = False else: FirewallError(errors.NOT_ENABLED, "forward") @handle_exceptions def queryForward(self): return self.settings[16] @handle_exceptions def getMasquerade(self): return self.settings[8] @handle_exceptions def setMasquerade(self, masquerade): self.settings[8] = masquerade @handle_exceptions def addMasquerade(self): if not self.settings[8]: self.settings[8] = True else: FirewallError(errors.ALREADY_ENABLED, "masquerade") @handle_exceptions def removeMasquerade(self): if self.settings[8]: self.settings[8] = False else: FirewallError(errors.NOT_ENABLED, "masquerade") @handle_exceptions def queryMasquerade(self): return self.settings[8] @handle_exceptions def getForwardPorts(self): return self.settings[9] @handle_exceptions def setForwardPorts(self, ports): self.settings[9] = ports @handle_exceptions def addForwardPort(self, port, protocol, to_port, to_addr): if to_port is None: to_port = '' if to_addr is None: to_addr = '' if (port,protocol,to_port,to_addr) not in self.settings[9]: self.settings[9].append((port,protocol,to_port,to_addr)) else: raise FirewallError(errors.ALREADY_ENABLED, "'%s:%s:%s:%s'" % \ (port, protocol, to_port, to_addr)) @handle_exceptions def removeForwardPort(self, port, protocol, to_port, to_addr): if to_port is None: to_port = '' if to_addr is None: to_addr = '' if (port,protocol,to_port,to_addr) in self.settings[9]: self.settings[9].remove((port,protocol,to_port,to_addr)) else: raise FirewallError(errors.NOT_ENABLED, "'%s:%s:%s:%s'" % \ (port, protocol, to_port, to_addr)) @handle_exceptions def queryForwardPort(self, port, protocol, to_port, to_addr): if to_port is None: to_port = '' if to_addr is None: to_addr = '' return (port,protocol,to_port,to_addr) in self.settings[9] @handle_exceptions def getInterfaces(self): return self.settings[10] @handle_exceptions def setInterfaces(self, interfaces): self.settings[10] = interfaces @handle_exceptions def addInterface(self, interface): if interface not in self.settings[10]: self.settings[10].append(interface) else: raise FirewallError(errors.ALREADY_ENABLED, interface) @handle_exceptions def removeInterface(self, interface): if interface in self.settings[10]: self.settings[10].remove(interface) else: raise FirewallError(errors.NOT_ENABLED, interface) @handle_exceptions def queryInterface(self, interface): return interface in self.settings[10] @handle_exceptions def getSources(self): return self.settings[11] @handle_exceptions def setSources(self, sources): self.settings[11] = sources @handle_exceptions def addSource(self, source): if source not in self.settings[11]: self.settings[11].append(source) else: raise FirewallError(errors.ALREADY_ENABLED, source) @handle_exceptions def removeSource(self, source): if source in self.settings[11]: self.settings[11].remove(source) else: raise FirewallError(errors.NOT_ENABLED, source) @handle_exceptions def querySource(self, source): return source in self.settings[11] @handle_exceptions def getRichRules(self): return self.settings[12] @handle_exceptions def setRichRules(self, rules): rules = [ str(Rich_Rule(rule_str=r)) for r in rules ] self.settings[12] = rules @handle_exceptions def addRichRule(self, rule): rule = str(Rich_Rule(rule_str=rule)) if rule not in self.settings[12]: self.settings[12].append(rule) else: raise FirewallError(errors.ALREADY_ENABLED, rule) @handle_exceptions def removeRichRule(self, rule): rule = str(Rich_Rule(rule_str=rule)) if rule in self.settings[12]: self.settings[12].remove(rule) else: raise FirewallError(errors.NOT_ENABLED, rule) @handle_exceptions def queryRichRule(self, rule): rule = str(Rich_Rule(rule_str=rule)) return rule in self.settings[12] # zone config class FirewallClientConfigZone(object): def __init__(self, bus, path): self.bus = bus self.path = path self.dbus_obj = self.bus.get_object(config.dbus.DBUS_INTERFACE, path) self.fw_zone = dbus.Interface( self.dbus_obj, dbus_interface=config.dbus.DBUS_INTERFACE_CONFIG_ZONE) self.fw_properties = dbus.Interface( self.dbus_obj, dbus_interface='org.freedesktop.DBus.Properties') #TODO: check interface version and revision (need to match client # version) @handle_exceptions def get_property(self, prop): return dbus_to_python(self.fw_properties.Get( config.dbus.DBUS_INTERFACE_CONFIG_ZONE, prop)) @handle_exceptions def get_properties(self): return dbus_to_python(self.fw_properties.GetAll( config.dbus.DBUS_INTERFACE_CONFIG_ZONE)) @handle_exceptions def set_property(self, prop, value): self.fw_properties.Set(config.dbus.DBUS_INTERFACE_CONFIG_ZONE, prop, value) @handle_exceptions def getSettings(self): return FirewallClientZoneSettings(dbus_to_python(self.fw_zone.getSettings2())) @handle_exceptions def update(self, settings): self.fw_zone.update2(settings.getSettingsDbusDict()) @handle_exceptions def loadDefaults(self): self.fw_zone.loadDefaults() @handle_exceptions def remove(self): self.fw_zone.remove() @handle_exceptions def rename(self, name): self.fw_zone.rename(name) # version @handle_exceptions def getVersion(self): return self.fw_zone.getVersion() @handle_exceptions def setVersion(self, version): self.fw_zone.setVersion(version) # short @handle_exceptions def getShort(self): return self.fw_zone.getShort() @handle_exceptions def setShort(self, short): self.fw_zone.setShort(short) # description @handle_exceptions def getDescription(self): return self.fw_zone.getDescription() @handle_exceptions def setDescription(self, description): self.fw_zone.setDescription(description) # target @handle_exceptions def getTarget(self): return self.fw_zone.getTarget() @handle_exceptions def setTarget(self, target): self.fw_zone.setTarget(target) # service @handle_exceptions def getServices(self): return self.fw_zone.getServices() @handle_exceptions def setServices(self, services): self.fw_zone.setServices(services) @handle_exceptions def addService(self, service): self.fw_zone.addService(service) @handle_exceptions def removeService(self, service): self.fw_zone.removeService(service) @handle_exceptions def queryService(self, service): return self.fw_zone.queryService(service) # port @handle_exceptions def getPorts(self): return self.fw_zone.getPorts() @handle_exceptions def setPorts(self, ports): self.fw_zone.setPorts(ports) @handle_exceptions def addPort(self, port, protocol): self.fw_zone.addPort(port, protocol) @handle_exceptions def removePort(self, port, protocol): self.fw_zone.removePort(port, protocol) @handle_exceptions def queryPort(self, port, protocol): return self.fw_zone.queryPort(port, protocol) # protocol @handle_exceptions def getProtocols(self): return self.fw_zone.getProtocols() @handle_exceptions def setProtocols(self, protocols): self.fw_zone.setProtocols(protocols) @handle_exceptions def addProtocol(self, protocol): self.fw_zone.addProtocol(protocol) @handle_exceptions def removeProtocol(self, protocol): self.fw_zone.removeProtocol(protocol) @handle_exceptions def queryProtocol(self, protocol): return self.fw_zone.queryProtocol(protocol) # source-port @handle_exceptions def getSourcePorts(self): return self.fw_zone.getSourcePorts() @handle_exceptions def setSourcePorts(self, ports): self.fw_zone.setSourcePorts(ports) @handle_exceptions def addSourcePort(self, port, protocol): self.fw_zone.addSourcePort(port, protocol) @handle_exceptions def removeSourcePort(self, port, protocol): self.fw_zone.removeSourcePort(port, protocol) @handle_exceptions def querySourcePort(self, port, protocol): return self.fw_zone.querySourcePort(port, protocol) # icmp block @handle_exceptions def getIcmpBlocks(self): return self.fw_zone.getIcmpBlocks() @handle_exceptions def setIcmpBlocks(self, icmptypes): self.fw_zone.setIcmpBlocks(icmptypes) @handle_exceptions def addIcmpBlock(self, icmptype): self.fw_zone.addIcmpBlock(icmptype) @handle_exceptions def removeIcmpBlock(self, icmptype): self.fw_zone.removeIcmpBlock(icmptype) @handle_exceptions def queryIcmpBlock(self, icmptype): return self.fw_zone.queryIcmpBlock(icmptype) # icmp-block-inversion @handle_exceptions def getIcmpBlockInversion(self): return self.fw_zone.getIcmpBlockInversion() @handle_exceptions def setIcmpBlockInversion(self, inversion): self.fw_zone.setIcmpBlockInversion(inversion) @handle_exceptions def addIcmpBlockInversion(self): self.fw_zone.addIcmpBlockInversion() @handle_exceptions def removeIcmpBlockInversion(self): self.fw_zone.removeIcmpBlockInversion() @handle_exceptions def queryIcmpBlockInversion(self): return self.fw_zone.queryIcmpBlockInversion() # forward @handle_exceptions def getForward(self): return self.fw_zone.getSettings2()["forward"] @handle_exceptions def setForward(self, forward): self.fw_zone.update2({"forward": forward}) @handle_exceptions def addForward(self): self.fw_zone.update2({"forward": True}) @handle_exceptions def removeForward(self): self.fw_zone.update2({"forward": False}) @handle_exceptions def queryForward(self): return self.fw_zone.getSettings2()["forward"] # masquerade @handle_exceptions def getMasquerade(self): return self.fw_zone.getMasquerade() @handle_exceptions def setMasquerade(self, masquerade): self.fw_zone.setMasquerade(masquerade) @handle_exceptions def addMasquerade(self): self.fw_zone.addMasquerade() @handle_exceptions def removeMasquerade(self): self.fw_zone.removeMasquerade() @handle_exceptions def queryMasquerade(self): return self.fw_zone.queryMasquerade() # forward port @handle_exceptions def getForwardPorts(self): return self.fw_zone.getForwardPorts() @handle_exceptions def setForwardPorts(self, ports): self.fw_zone.setForwardPorts(ports) @handle_exceptions def addForwardPort(self, port, protocol, toport, toaddr): if toport is None: toport = '' if toaddr is None: toaddr = '' self.fw_zone.addForwardPort(port, protocol, toport, toaddr) @handle_exceptions def removeForwardPort(self, port, protocol, toport, toaddr): if toport is None: toport = '' if toaddr is None: toaddr = '' self.fw_zone.removeForwardPort(port, protocol, toport, toaddr) @handle_exceptions def queryForwardPort(self, port, protocol, toport, toaddr): if toport is None: toport = '' if toaddr is None: toaddr = '' return self.fw_zone.queryForwardPort(port, protocol, toport, toaddr) # interface @handle_exceptions def getInterfaces(self): return self.fw_zone.getInterfaces() @handle_exceptions def setInterfaces(self, interfaces): self.fw_zone.setInterfaces(interfaces) @handle_exceptions def addInterface(self, interface): self.fw_zone.addInterface(interface) @handle_exceptions def removeInterface(self, interface): self.fw_zone.removeInterface(interface) @handle_exceptions def queryInterface(self, interface): return self.fw_zone.queryInterface(interface) # source @handle_exceptions def getSources(self): return self.fw_zone.getSources() @handle_exceptions def setSources(self, sources): self.fw_zone.setSources(sources) @handle_exceptions def addSource(self, source): self.fw_zone.addSource(source) @handle_exceptions def removeSource(self, source): self.fw_zone.removeSource(source) @handle_exceptions def querySource(self, source): return self.fw_zone.querySource(source) # rich rule @handle_exceptions def getRichRules(self): return self.fw_zone.getRichRules() @handle_exceptions def setRichRules(self, rules): self.fw_zone.setRichRules(rules) @handle_exceptions def addRichRule(self, rule): self.fw_zone.addRichRule(rule) @handle_exceptions def removeRichRule(self, rule): self.fw_zone.removeRichRule(rule) @handle_exceptions def queryRichRule(self, rule): return self.fw_zone.queryRichRule(rule) class FirewallClientPolicySettings(object): @handle_exceptions def __init__(self, settings=None): self.settings = {"description": "", "egress_zones": [], "forward_ports": [], "icmp_blocks": [], "ingress_zones": [], "masquerade": False, "ports": [], "priority": DEFAULT_POLICY_PRIORITY, "protocols": [], "rich_rules": [], "services": [], "short": "", "source_ports": [], "target": DEFAULT_POLICY_TARGET, "version": "", } self.settings_dbus_type = ["s", "s", "(ssss)", "s", "s", "b", "(ss)", "i", "s", "s", "s", "s", "(ss)", "s", "s"] if settings: self.setSettingsDict(settings) @handle_exceptions def __repr__(self): return '%s(%r)' % (self.__class__, self.settings) @handle_exceptions def getSettingsDict(self): return self.settings @handle_exceptions def setSettingsDict(self, settings): for key in settings: self.settings[key] = settings[key] @handle_exceptions def getSettingsDbusDict(self): settings = {} for key,sig in zip(self.settings, self.settings_dbus_type): value = self.settings[key] if type(value) is list: settings[key] = dbus.Array(value, signature=sig) elif type(value) is dict: settings[key] = dbus.Dictionary(value, signature=sig) else: settings[key] = value return settings def getRuntimeSettingsDbusDict(self): settings = self.getSettingsDbusDict() for key in ["version", "short", "description", "target"]: del settings[key] return settings @handle_exceptions def getVersion(self): return self.settings["version"] @handle_exceptions def setVersion(self, version): self.settings["version"] = version @handle_exceptions def getShort(self): return self.settings["short"] @handle_exceptions def setShort(self, short): self.settings["short"] = short @handle_exceptions def getDescription(self): return self.settings["description"] @handle_exceptions def setDescription(self, description): self.settings["description"] = description @handle_exceptions def getTarget(self): return self.settings["target"] @handle_exceptions def setTarget(self, target): self.settings["target"] = target @handle_exceptions def getServices(self): return self.settings["services"] @handle_exceptions def setServices(self, services): self.settings["services"] = services @handle_exceptions def addService(self, service): if service not in self.settings["services"]: self.settings["services"].append(service) else: raise FirewallError(errors.ALREADY_ENABLED, service) @handle_exceptions def removeService(self, service): if service in self.settings["services"]: self.settings["services"].remove(service) else: raise FirewallError(errors.NOT_ENABLED, service) @handle_exceptions def queryService(self, service): return service in self.settings["services"] @handle_exceptions def getPorts(self): return self.settings["ports"] @handle_exceptions def setPorts(self, ports): self.settings["ports"] = ports @handle_exceptions def addPort(self, port, protocol): if (port,protocol) not in self.settings["ports"]: self.settings["ports"].append((port,protocol)) else: raise FirewallError(errors.ALREADY_ENABLED, "'%s:%s'" % (port, protocol)) @handle_exceptions def removePort(self, port, protocol): if (port,protocol) in self.settings["ports"]: self.settings["ports"].remove((port,protocol)) else: raise FirewallError(errors.NOT_ENABLED, "'%s:%s'" % (port, protocol)) @handle_exceptions def queryPort(self, port, protocol): return (port,protocol) in self.settings["ports"] @handle_exceptions def getProtocols(self): return self.settings["protocols"] @handle_exceptions def setProtocols(self, protocols): self.settings["protocols"] = protocols @handle_exceptions def addProtocol(self, protocol): if protocol not in self.settings["protocols"]: self.settings["protocols"].append(protocol) else: raise FirewallError(errors.ALREADY_ENABLED, protocol) @handle_exceptions def removeProtocol(self, protocol): if protocol in self.settings["protocols"]: self.settings["protocols"].remove(protocol) else: raise FirewallError(errors.NOT_ENABLED, protocol) @handle_exceptions def queryProtocol(self, protocol): return protocol in self.settings["protocols"] @handle_exceptions def getSourcePorts(self): return self.settings["source_ports"] @handle_exceptions def setSourcePorts(self, ports): self.settings["source_ports"] = ports @handle_exceptions def addSourcePort(self, port, protocol): if (port,protocol) not in self.settings["source_ports"]: self.settings["source_ports"].append((port,protocol)) else: raise FirewallError(errors.ALREADY_ENABLED, "'%s:%s'" % (port, protocol)) @handle_exceptions def removeSourcePort(self, port, protocol): if (port,protocol) in self.settings["source_ports"]: self.settings["source_ports"].remove((port,protocol)) else: raise FirewallError(errors.NOT_ENABLED, "'%s:%s'" % (port, protocol)) @handle_exceptions def querySourcePort(self, port, protocol): return (port,protocol) in self.settings["source_ports"] @handle_exceptions def getIcmpBlocks(self): return self.settings["icmp_blocks"] @handle_exceptions def setIcmpBlocks(self, icmpblocks): self.settings["icmp_blocks"] = icmpblocks @handle_exceptions def addIcmpBlock(self, icmptype): if icmptype not in self.settings["icmp_blocks"]: self.settings["icmp_blocks"].append(icmptype) else: raise FirewallError(errors.ALREADY_ENABLED, icmptype) @handle_exceptions def removeIcmpBlock(self, icmptype): if icmptype in self.settings["icmp_blocks"]: self.settings["icmp_blocks"].remove(icmptype) else: raise FirewallError(errors.NOT_ENABLED, icmptype) @handle_exceptions def queryIcmpBlock(self, icmptype): return icmptype in self.settings["icmp_blocks"] @handle_exceptions def getMasquerade(self): return self.settings["masquerade"] @handle_exceptions def setMasquerade(self, masquerade): self.settings["masquerade"] = masquerade @handle_exceptions def addMasquerade(self): if not self.settings["masquerade"]: self.settings["masquerade"] = True else: FirewallError(errors.ALREADY_ENABLED, "masquerade") @handle_exceptions def removeMasquerade(self): if self.settings["masquerade"]: self.settings["masquerade"] = False else: FirewallError(errors.NOT_ENABLED, "masquerade") @handle_exceptions def queryMasquerade(self): return self.settings["masquerade"] @handle_exceptions def getForwardPorts(self): return self.settings["forward_ports"] @handle_exceptions def setForwardPorts(self, ports): self.settings["forward_ports"] = ports @handle_exceptions def addForwardPort(self, port, protocol, to_port, to_addr): if to_port is None: to_port = '' if to_addr is None: to_addr = '' if (port,protocol,to_port,to_addr) not in self.settings["forward_ports"]: self.settings["forward_ports"].append((port,protocol,to_port,to_addr)) else: raise FirewallError(errors.ALREADY_ENABLED, "'%s:%s:%s:%s'" % \ (port, protocol, to_port, to_addr)) @handle_exceptions def removeForwardPort(self, port, protocol, to_port, to_addr): if to_port is None: to_port = '' if to_addr is None: to_addr = '' if (port,protocol,to_port,to_addr) in self.settings["forward_ports"]: self.settings["forward_ports"].remove((port,protocol,to_port,to_addr)) else: raise FirewallError(errors.NOT_ENABLED, "'%s:%s:%s:%s'" % \ (port, protocol, to_port, to_addr)) @handle_exceptions def queryForwardPort(self, port, protocol, to_port, to_addr): if to_port is None: to_port = '' if to_addr is None: to_addr = '' return (port,protocol,to_port,to_addr) in self.settings["forward_ports"] @handle_exceptions def getRichRules(self): return self.settings["rich_rules"] @handle_exceptions def setRichRules(self, rules): rules = [ str(Rich_Rule(rule_str=r)) for r in rules ] self.settings["rich_rules"] = rules @handle_exceptions def addRichRule(self, rule): rule = str(Rich_Rule(rule_str=rule)) if rule not in self.settings["rich_rules"]: self.settings["rich_rules"].append(rule) else: raise FirewallError(errors.ALREADY_ENABLED, rule) @handle_exceptions def removeRichRule(self, rule): rule = str(Rich_Rule(rule_str=rule)) if rule in self.settings["rich_rules"]: self.settings["rich_rules"].remove(rule) else: raise FirewallError(errors.NOT_ENABLED, rule) @handle_exceptions def queryRichRule(self, rule): rule = str(Rich_Rule(rule_str=rule)) return rule in self.settings["rich_rules"] @handle_exceptions def getIngressZones(self): return self.settings["ingress_zones"] @handle_exceptions def setIngressZones(self, ingress_zones): self.settings["ingress_zones"] = ingress_zones @handle_exceptions def addIngressZone(self, ingress_zone): if ingress_zone not in self.settings["ingress_zones"]: self.settings["ingress_zones"].append(ingress_zone) else: raise FirewallError(errors.ALREADY_ENABLED, ingress_zone) @handle_exceptions def removeIngressZone(self, ingress_zone): if ingress_zone in self.settings["ingress_zones"]: self.settings["ingress_zones"].remove(ingress_zone) else: raise FirewallError(errors.NOT_ENABLED, ingress_zone) @handle_exceptions def queryIngressZone(self, ingress_zone): return ingress_zone in self.settings["ingress_zones"] @handle_exceptions def getEgressZones(self): return self.settings["egress_zones"] @handle_exceptions def setEgressZones(self, egress_zones): self.settings["egress_zones"] = egress_zones @handle_exceptions def addEgressZone(self, egress_zone): if egress_zone not in self.settings["egress_zones"]: self.settings["egress_zones"].append(egress_zone) else: raise FirewallError(errors.ALREADY_ENABLED, egress_zone) @handle_exceptions def removeEgressZone(self, egress_zone): if egress_zone in self.settings["egress_zones"]: self.settings["egress_zones"].remove(egress_zone) else: raise FirewallError(errors.NOT_ENABLED, egress_zone) @handle_exceptions def queryEgressZone(self, egress_zone): return egress_zone in self.settings["egress_zones"] @handle_exceptions def getPriority(self): return self.settings["priority"] @handle_exceptions def setPriority(self, priority): self.settings["priority"] = int(priority) class FirewallClientConfigPolicy(object): def __init__(self, bus, path): self.bus = bus self.path = path self.dbus_obj = self.bus.get_object(config.dbus.DBUS_INTERFACE, path) self.fw_policy = dbus.Interface( self.dbus_obj, dbus_interface=config.dbus.DBUS_INTERFACE_CONFIG_POLICY) self.fw_properties = dbus.Interface( self.dbus_obj, dbus_interface='org.freedesktop.DBus.Properties') @handle_exceptions def get_property(self, prop): return dbus_to_python(self.fw_properties.Get( config.dbus.DBUS_INTERFACE_CONFIG_POLICY, prop)) @handle_exceptions def get_properties(self): return dbus_to_python(self.fw_properties.GetAll( config.dbus.DBUS_INTERFACE_CONFIG_POLICY)) @handle_exceptions def set_property(self, prop, value): self.fw_properties.Set(config.dbus.DBUS_INTERFACE_CONFIG_POLICY, prop, value) @handle_exceptions def getSettings(self): return FirewallClientPolicySettings(dbus_to_python(self.fw_policy.getSettings())) @handle_exceptions def update(self, settings): self.fw_policy.update(settings.getSettingsDbusDict()) @handle_exceptions def loadDefaults(self): self.fw_policy.loadDefaults() @handle_exceptions def remove(self): self.fw_policy.remove() @handle_exceptions def rename(self, name): self.fw_policy.rename(name) # service config settings class FirewallClientServiceSettings(object): @handle_exceptions def __init__(self, settings=None): self.settings = ["", "", "", [], [], {}, [], [], [], []] self.settings_name = ["version", "short", "description", "ports", "modules", "destination", "protocols", "source_ports", "includes", "helpers"] self.settings_dbus_type = ["s", "s", "s", "(ss)", "s", "ss", "s", "(ss)", "s", "s"] if settings: if type(settings) is list: for i,v in enumerate(settings): self.settings[i] = settings[i] elif type(settings) is dict: self.setSettingsDict(settings) @handle_exceptions def __repr__(self): return '%s(%r)' % (self.__class__, self.settings) @handle_exceptions def getSettingsDict(self): settings = {} for key,value in zip(self.settings_name, self.settings): settings[key] = value return settings @handle_exceptions def setSettingsDict(self, settings): for key in settings: self.settings[self.settings_name.index(key)] = settings[key] @handle_exceptions def getSettingsDbusDict(self): settings = {} for key,value,sig in zip(self.settings_name, self.settings, self.settings_dbus_type): if type(value) is list: settings[key] = dbus.Array(value, signature=sig) elif type(value) is dict: settings[key] = dbus.Dictionary(value, signature=sig) else: settings[key] = value return settings @handle_exceptions def getVersion(self): return self.settings[0] @handle_exceptions def setVersion(self, version): self.settings[0] = version @handle_exceptions def getShort(self): return self.settings[1] @handle_exceptions def setShort(self, short): self.settings[1] = short @handle_exceptions def getDescription(self): return self.settings[2] @handle_exceptions def setDescription(self, description): self.settings[2] = description @handle_exceptions def getPorts(self): return self.settings[3] @handle_exceptions def setPorts(self, ports): self.settings[3] = ports @handle_exceptions def addPort(self, port, protocol): if (port,protocol) not in self.settings[3]: self.settings[3].append((port,protocol)) else: raise FirewallError(errors.ALREADY_ENABLED, "'%s:%s'" % (port, protocol)) @handle_exceptions def removePort(self, port, protocol): if (port,protocol) in self.settings[3]: self.settings[3].remove((port,protocol)) else: raise FirewallError(errors.NOT_ENABLED, "'%s:%s'" % (port, protocol)) @handle_exceptions def queryPort(self, port, protocol): return (port,protocol) in self.settings[3] @handle_exceptions def getProtocols(self): return self.settings[6] @handle_exceptions def setProtocols(self, protocols): self.settings[6] = protocols @handle_exceptions def addProtocol(self, protocol): if protocol not in self.settings[6]: self.settings[6].append(protocol) else: raise FirewallError(errors.ALREADY_ENABLED, protocol) @handle_exceptions def removeProtocol(self, protocol): if protocol in self.settings[6]: self.settings[6].remove(protocol) else: raise FirewallError(errors.NOT_ENABLED, protocol) @handle_exceptions def queryProtocol(self, protocol): return protocol in self.settings[6] @handle_exceptions def getSourcePorts(self): return self.settings[7] @handle_exceptions def setSourcePorts(self, ports): self.settings[7] = ports @handle_exceptions def addSourcePort(self, port, protocol): if (port,protocol) not in self.settings[7]: self.settings[7].append((port,protocol)) else: raise FirewallError(errors.ALREADY_ENABLED, "'%s:%s'" % (port, protocol)) @handle_exceptions def removeSourcePort(self, port, protocol): if (port,protocol) in self.settings[7]: self.settings[7].remove((port,protocol)) else: raise FirewallError(errors.NOT_ENABLED, "'%s:%s'" % (port, protocol)) @handle_exceptions def querySourcePort(self, port, protocol): return (port,protocol) in self.settings[7] @handle_exceptions def getModules(self): return self.settings[4] @handle_exceptions def setModules(self, modules): self.settings[4] = modules @handle_exceptions def addModule(self, module): if module not in self.settings[4]: self.settings[4].append(module) else: raise FirewallError(errors.ALREADY_ENABLED, module) @handle_exceptions def removeModule(self, module): if module in self.settings[4]: self.settings[4].remove(module) else: raise FirewallError(errors.NOT_ENABLED, module) @handle_exceptions def queryModule(self, module): return module in self.settings[4] @handle_exceptions def getDestinations(self): return self.settings[5] @handle_exceptions def setDestinations(self, destinations): self.settings[5] = destinations @handle_exceptions def setDestination(self, dest_type, address): if dest_type not in self.settings[5] or \ self.settings[5][dest_type] != address: self.settings[5][dest_type] = address else: raise FirewallError(errors.ALREADY_ENABLED, "'%s:%s'" % \ (dest_type, address)) @handle_exceptions def removeDestination(self, dest_type, address=None): if dest_type in self.settings[5]: if address is not None and self.settings[5][dest_type] != address: raise FirewallError(errors.NOT_ENABLED, "'%s:%s'" % \ (dest_type, address)) del self.settings[5][dest_type] else: raise FirewallError(errors.NOT_ENABLED, "'%s'" % dest_type) @handle_exceptions def queryDestination(self, dest_type, address): return (dest_type in self.settings[5] and \ address == self.settings[5][dest_type]) @handle_exceptions def getIncludes(self): return self.settings[8] @handle_exceptions def setIncludes(self, includes): self.settings[8] = includes @handle_exceptions def addInclude(self, include): if include not in self.settings[8]: self.settings[8].append(include) else: raise FirewallError(errors.ALREADY_ENABLED, include) @handle_exceptions def removeInclude(self, include): if include in self.settings[8]: self.settings[8].remove(include) else: raise FirewallError(errors.NOT_ENABLED, include) @handle_exceptions def queryInclude(self, include): return include in self.settings[8] @handle_exceptions def getHelpers(self): return self.settings[9] @handle_exceptions def setHelpers(self, helpers): self.settings[9] = helpers @handle_exceptions def addHelper(self, helper): if helper not in self.settings[9]: self.settings[9].append(helper) else: raise FirewallError(errors.ALREADY_ENABLED, helper) @handle_exceptions def removeHelper(self, helper): if helper in self.settings[9]: self.settings[9].remove(helper) else: raise FirewallError(errors.NOT_ENABLED, helper) @handle_exceptions def queryHelper(self, helper): return helper in self.settings[9] # ipset config settings class FirewallClientIPSetSettings(object): @handle_exceptions def __init__(self, settings=None): if settings: self.settings = settings else: self.settings = ["", "", "", "", {}, []] @handle_exceptions def __repr__(self): return '%s(%r)' % (self.__class__, self.settings) @handle_exceptions def getVersion(self): return self.settings[0] @handle_exceptions def setVersion(self, version): self.settings[0] = version @handle_exceptions def getShort(self): return self.settings[1] @handle_exceptions def setShort(self, short): self.settings[1] = short @handle_exceptions def getDescription(self): return self.settings[2] @handle_exceptions def setDescription(self, description): self.settings[2] = description @handle_exceptions def getType(self): return self.settings[3] @handle_exceptions def setType(self, ipset_type): self.settings[3] = ipset_type @handle_exceptions def getOptions(self): return self.settings[4] @handle_exceptions def setOptions(self, options): self.settings[4] = options @handle_exceptions def addOption(self, key, value): if key not in self.settings[4] or self.settings[4][key] != value: self.settings[4][key] = value else: raise FirewallError(errors.ALREADY_ENABLED, "'%s=%s'" % (key,value) if value else key) @handle_exceptions def removeOption(self, key): if key in self.settings[4]: del self.settings[4][key] else: raise FirewallError(errors.NOT_ENABLED, key) @handle_exceptions def queryOption(self, key, value): return key in self.settings[4] and self.settings[4][key] == value @handle_exceptions def getEntries(self): return self.settings[5] @handle_exceptions def setEntries(self, entries): if "timeout" in self.settings[4] and \ self.settings[4]["timeout"] != "0": raise FirewallError(errors.IPSET_WITH_TIMEOUT) check_for_overlapping_entries(entries) self.settings[5] = entries @handle_exceptions def addEntry(self, entry): if "timeout" in self.settings[4] and \ self.settings[4]["timeout"] != "0": raise FirewallError(errors.IPSET_WITH_TIMEOUT) entry = normalize_ipset_entry(entry) if entry not in self.settings[5]: check_entry_overlaps_existing(entry, self.settings[5]) self.settings[5].append(entry) else: raise FirewallError(errors.ALREADY_ENABLED, entry) @handle_exceptions def removeEntry(self, entry): if "timeout" in self.settings[4] and \ self.settings[4]["timeout"] != "0": raise FirewallError(errors.IPSET_WITH_TIMEOUT) entry = normalize_ipset_entry(entry) if entry in self.settings[5]: self.settings[5].remove(entry) else: raise FirewallError(errors.NOT_ENABLED, entry) @handle_exceptions def queryEntry(self, entry): if "timeout" in self.settings[4] and \ self.settings[4]["timeout"] != "0": raise FirewallError(errors.IPSET_WITH_TIMEOUT) entry = normalize_ipset_entry(entry) return entry in self.settings[5] # ipset config class FirewallClientConfigIPSet(object): @handle_exceptions def __init__(self, bus, path): self.bus = bus self.path = path self.dbus_obj = self.bus.get_object(config.dbus.DBUS_INTERFACE, path) self.fw_ipset = dbus.Interface( self.dbus_obj, dbus_interface=config.dbus.DBUS_INTERFACE_CONFIG_IPSET) self.fw_properties = dbus.Interface( self.dbus_obj, dbus_interface='org.freedesktop.DBus.Properties') @handle_exceptions def get_property(self, prop): return dbus_to_python(self.fw_properties.Get( config.dbus.DBUS_INTERFACE_CONFIG_IPSET, prop)) @handle_exceptions def get_properties(self): return dbus_to_python(self.fw_properties.GetAll( config.dbus.DBUS_INTERFACE_CONFIG_IPSET)) @handle_exceptions def set_property(self, prop, value): self.fw_properties.Set(config.dbus.DBUS_INTERFACE_CONFIG_IPSET, prop, value) @handle_exceptions def getSettings(self): return FirewallClientIPSetSettings(list(dbus_to_python(\ self.fw_ipset.getSettings()))) @handle_exceptions def update(self, settings): self.fw_ipset.update(tuple(settings.settings)) @handle_exceptions def loadDefaults(self): self.fw_ipset.loadDefaults() @handle_exceptions def remove(self): self.fw_ipset.remove() @handle_exceptions def rename(self, name): self.fw_ipset.rename(name) # version @handle_exceptions def getVersion(self): return self.fw_ipset.getVersion() @handle_exceptions def setVersion(self, version): self.fw_ipset.setVersion(version) # short @handle_exceptions def getShort(self): return self.fw_ipset.getShort() @handle_exceptions def setShort(self, short): self.fw_ipset.setShort(short) # description @handle_exceptions def getDescription(self): return self.fw_ipset.getDescription() @handle_exceptions def setDescription(self, description): self.fw_ipset.setDescription(description) # entry @handle_exceptions def getEntries(self): return self.fw_ipset.getEntries() @handle_exceptions def setEntries(self, entries): self.fw_ipset.setEntries(entries) @handle_exceptions def addEntry(self, entry): self.fw_ipset.addEntry(entry) @handle_exceptions def removeEntry(self, entry): self.fw_ipset.removeEntry(entry) @handle_exceptions def queryEntry(self, entry): return self.fw_ipset.queryEntry(entry) # helper config settings class FirewallClientHelperSettings(object): @handle_exceptions def __init__(self, settings=None): if settings: self.settings = settings else: self.settings = ["", "", "", "", "", [ ]] @handle_exceptions def __repr__(self): return '%s(%r)' % (self.__class__, self.settings) @handle_exceptions def getVersion(self): return self.settings[0] @handle_exceptions def setVersion(self, version): self.settings[0] = version @handle_exceptions def getShort(self): return self.settings[1] @handle_exceptions def setShort(self, short): self.settings[1] = short @handle_exceptions def getDescription(self): return self.settings[2] @handle_exceptions def setDescription(self, description): self.settings[2] = description @handle_exceptions def getFamily(self): return self.settings[3] @handle_exceptions def setFamily(self, ipv): if ipv is None: self.settings[3] = "" self.settings[3] = ipv @handle_exceptions def getModule(self): return self.settings[4] @handle_exceptions def setModule(self, module): self.settings[4] = module @handle_exceptions def getPorts(self): return self.settings[5] @handle_exceptions def setPorts(self, ports): self.settings[5] = ports @handle_exceptions def addPort(self, port, protocol): if (port,protocol) not in self.settings[5]: self.settings[5].append((port,protocol)) else: raise FirewallError(errors.ALREADY_ENABLED, "'%s:%s'" % (port, protocol)) @handle_exceptions def removePort(self, port, protocol): if (port,protocol) in self.settings[5]: self.settings[5].remove((port,protocol)) else: raise FirewallError(errors.NOT_ENABLED, "'%s:%s'" % (port, protocol)) @handle_exceptions def queryPort(self, port, protocol): return (port,protocol) in self.settings[5] # helper config class FirewallClientConfigHelper(object): @handle_exceptions def __init__(self, bus, path): self.bus = bus self.path = path self.dbus_obj = self.bus.get_object(config.dbus.DBUS_INTERFACE, path) self.fw_helper = dbus.Interface( self.dbus_obj, dbus_interface=config.dbus.DBUS_INTERFACE_CONFIG_HELPER) self.fw_properties = dbus.Interface( self.dbus_obj, dbus_interface='org.freedesktop.DBus.Properties') @handle_exceptions def get_property(self, prop): return dbus_to_python(self.fw_properties.Get( config.dbus.DBUS_INTERFACE_CONFIG_HELPER, prop)) @handle_exceptions def get_properties(self): return dbus_to_python(self.fw_properties.GetAll( config.dbus.DBUS_INTERFACE_CONFIG_HELPER)) @handle_exceptions def set_property(self, prop, value): self.fw_properties.Set(config.dbus.DBUS_INTERFACE_CONFIG_HELPER, prop, value) @handle_exceptions def getSettings(self): return FirewallClientHelperSettings(list(dbus_to_python(\ self.fw_helper.getSettings()))) @handle_exceptions def update(self, settings): self.fw_helper.update(tuple(settings.settings)) @handle_exceptions def loadDefaults(self): self.fw_helper.loadDefaults() @handle_exceptions def remove(self): self.fw_helper.remove() @handle_exceptions def rename(self, name): self.fw_helper.rename(name) # version @handle_exceptions def getVersion(self): return self.fw_helper.getVersion() @handle_exceptions def setVersion(self, version): self.fw_helper.setVersion(version) # short @handle_exceptions def getShort(self): return self.fw_helper.getShort() @handle_exceptions def setShort(self, short): self.fw_helper.setShort(short) # description @handle_exceptions def getDescription(self): return self.fw_helper.getDescription() @handle_exceptions def setDescription(self, description): self.fw_helper.setDescription(description) # port @handle_exceptions def getPorts(self): return self.fw_helper.getPorts() @handle_exceptions def setPorts(self, ports): self.fw_helper.setPorts(ports) @handle_exceptions def addPort(self, port, protocol): self.fw_helper.addPort(port, protocol) @handle_exceptions def removePort(self, port, protocol): self.fw_helper.removePort(port, protocol) @handle_exceptions def queryPort(self, port, protocol): return self.fw_helper.queryPort(port, protocol) # family @handle_exceptions def getFamily(self): return self.fw_helper.getFamily() @handle_exceptions def setFamily(self, ipv): if ipv is None: self.fw_helper.setFamily("") self.fw_helper.setFamily(ipv) # module @handle_exceptions def getModule(self): return self.fw_helper.getModule() @handle_exceptions def setModule(self, module): self.fw_helper.setModule(module) # service config class FirewallClientConfigService(object): @handle_exceptions def __init__(self, bus, path): self.bus = bus self.path = path self.dbus_obj = self.bus.get_object(config.dbus.DBUS_INTERFACE, path) self.fw_service = dbus.Interface( self.dbus_obj, dbus_interface=config.dbus.DBUS_INTERFACE_CONFIG_SERVICE) self.fw_properties = dbus.Interface( self.dbus_obj, dbus_interface='org.freedesktop.DBus.Properties') @handle_exceptions def get_property(self, prop): return dbus_to_python(self.fw_properties.Get( config.dbus.DBUS_INTERFACE_CONFIG_SERVICE, prop)) @handle_exceptions def get_properties(self): return dbus_to_python(self.fw_properties.GetAll( config.dbus.DBUS_INTERFACE_CONFIG_SERVICE)) @handle_exceptions def set_property(self, prop, value): self.fw_properties.Set(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE, prop, value) @handle_exceptions def getSettings(self): return FirewallClientServiceSettings(dbus_to_python( self.fw_service.getSettings2())) @handle_exceptions def update(self, settings): self.fw_service.update2(settings.getSettingsDbusDict()) @handle_exceptions def loadDefaults(self): self.fw_service.loadDefaults() @handle_exceptions def remove(self): self.fw_service.remove() @handle_exceptions def rename(self, name): self.fw_service.rename(name) # version @handle_exceptions def getVersion(self): return self.fw_service.getVersion() @handle_exceptions def setVersion(self, version): self.fw_service.setVersion(version) # short @handle_exceptions def getShort(self): return self.fw_service.getShort() @handle_exceptions def setShort(self, short): self.fw_service.setShort(short) # description @handle_exceptions def getDescription(self): return self.fw_service.getDescription() @handle_exceptions def setDescription(self, description): self.fw_service.setDescription(description) # port @handle_exceptions def getPorts(self): return self.fw_service.getPorts() @handle_exceptions def setPorts(self, ports): self.fw_service.setPorts(ports) @handle_exceptions def addPort(self, port, protocol): self.fw_service.addPort(port, protocol) @handle_exceptions def removePort(self, port, protocol): self.fw_service.removePort(port, protocol) @handle_exceptions def queryPort(self, port, protocol): return self.fw_service.queryPort(port, protocol) # protocol @handle_exceptions def getProtocols(self): return self.fw_service.getProtocols() @handle_exceptions def setProtocols(self, protocols): self.fw_service.setProtocols(protocols) @handle_exceptions def addProtocol(self, protocol): self.fw_service.addProtocol(protocol) @handle_exceptions def removeProtocol(self, protocol): self.fw_service.removeProtocol(protocol) @handle_exceptions def queryProtocol(self, protocol): return self.fw_service.queryProtocol(protocol) # source-port @handle_exceptions def getSourcePorts(self): return self.fw_service.getSourcePorts() @handle_exceptions def setSourcePorts(self, ports): self.fw_service.setSourcePorts(ports) @handle_exceptions def addSourcePort(self, port, protocol): self.fw_service.addSourcePort(port, protocol) @handle_exceptions def removeSourcePort(self, port, protocol): self.fw_service.removeSourcePort(port, protocol) @handle_exceptions def querySourcePort(self, port, protocol): return self.fw_service.querySourcePort(port, protocol) # module @handle_exceptions def getModules(self): return self.fw_service.getModules() @handle_exceptions def setModules(self, modules): self.fw_service.setModules(modules) @handle_exceptions def addModule(self, module): self.fw_service.addModule(module) @handle_exceptions def removeModule(self, module): self.fw_service.removeModule(module) @handle_exceptions def queryModule(self, module): return self.fw_service.queryModule(module) # destination @handle_exceptions def getDestinations(self): return self.fw_service.getDestinations() @handle_exceptions def setDestinations(self, destinations): self.fw_service.setDestinations(destinations) @handle_exceptions def getDestination(self, destination): return self.fw_service.getDestination(destination) @handle_exceptions def setDestination(self, destination, address): self.fw_service.setDestination(destination, address) @handle_exceptions def removeDestination(self, destination, address=None): if address is not None and self.getDestination(destination) != address: raise FirewallError(errors.NOT_ENABLED, "'%s:%s'" % \ (destination, address)) self.fw_service.removeDestination(destination) @handle_exceptions def queryDestination(self, destination, address): return self.fw_service.queryDestination(destination, address) # include @handle_exceptions def getIncludes(self): return self.fw_service.getIncludes() @handle_exceptions def setIncludes(self, includes): self.fw_service.setIncludes(includes) @handle_exceptions def addInclude(self, include): self.fw_service.addInclude(include) @handle_exceptions def removeInclude(self, include): self.fw_service.removeInclude(include) @handle_exceptions def queryInclude(self, include): return self.fw_service.queryInclude(include) # icmptype config settings class FirewallClientIcmpTypeSettings(object): @handle_exceptions def __init__(self, settings=None): if settings: self.settings = settings else: self.settings = ["", "", "", []] @handle_exceptions def __repr__(self): return '%s(%r)' % (self.__class__, self.settings) @handle_exceptions def getVersion(self): return self.settings[0] @handle_exceptions def setVersion(self, version): self.settings[0] = version @handle_exceptions def getShort(self): return self.settings[1] @handle_exceptions def setShort(self, short): self.settings[1] = short @handle_exceptions def getDescription(self): return self.settings[2] @handle_exceptions def setDescription(self, description): self.settings[2] = description @handle_exceptions def getDestinations(self): return self.settings[3] @handle_exceptions def setDestinations(self, destinations): self.settings[3] = destinations @handle_exceptions def addDestination(self, destination): # empty means all if not self.settings[3]: raise FirewallError(errors.ALREADY_ENABLED, destination) elif destination not in self.settings[3]: self.settings[3].append(destination) else: raise FirewallError(errors.ALREADY_ENABLED, destination) @handle_exceptions def removeDestination(self, destination): if destination in self.settings[3]: self.settings[3].remove(destination) # empty means all elif not self.settings[3]: self.setDestinations(list(set(['ipv4','ipv6']) - \ set([destination]))) else: raise FirewallError(errors.NOT_ENABLED, destination) @handle_exceptions def queryDestination(self, destination): # empty means all return not self.settings[3] or \ destination in self.settings[3] # icmptype config class FirewallClientConfigIcmpType(object): @handle_exceptions def __init__(self, bus, path): self.bus = bus self.path = path self.dbus_obj = self.bus.get_object(config.dbus.DBUS_INTERFACE, path) self.fw_icmptype = dbus.Interface( self.dbus_obj, dbus_interface=config.dbus.DBUS_INTERFACE_CONFIG_ICMPTYPE) self.fw_properties = dbus.Interface( self.dbus_obj, dbus_interface='org.freedesktop.DBus.Properties') @handle_exceptions def get_property(self, prop): return dbus_to_python(self.fw_properties.Get( config.dbus.DBUS_INTERFACE_CONFIG_ICMPTYPE, prop)) @handle_exceptions def get_properties(self): return dbus_to_python(self.fw_properties.GetAll( config.dbus.DBUS_INTERFACE_CONFIG_ICMPTYPE)) @handle_exceptions def set_property(self, prop, value): self.fw_properties.Set(config.dbus.DBUS_INTERFACE_CONFIG_ICMPTYPE, prop, value) @handle_exceptions def getSettings(self): return FirewallClientIcmpTypeSettings(list(dbus_to_python(\ self.fw_icmptype.getSettings()))) @handle_exceptions def update(self, settings): self.fw_icmptype.update(tuple(settings.settings)) @handle_exceptions def loadDefaults(self): self.fw_icmptype.loadDefaults() @handle_exceptions def remove(self): self.fw_icmptype.remove() @handle_exceptions def rename(self, name): self.fw_icmptype.rename(name) # version @handle_exceptions def getVersion(self): return self.fw_icmptype.getVersion() @handle_exceptions def setVersion(self, version): self.fw_icmptype.setVersion(version) # short @handle_exceptions def getShort(self): return self.fw_icmptype.getShort() @handle_exceptions def setShort(self, short): self.fw_icmptype.setShort(short) # description @handle_exceptions def getDescription(self): return self.fw_icmptype.getDescription() @handle_exceptions def setDescription(self, description): self.fw_icmptype.setDescription(description) # destination @handle_exceptions def getDestinations(self): return self.fw_icmptype.getDestinations() @handle_exceptions def setDestinations(self, destinations): self.fw_icmptype.setDestinations(destinations) @handle_exceptions def addDestination(self, destination): self.fw_icmptype.addDestination(destination) @handle_exceptions def removeDestination(self, destination): self.fw_icmptype.removeDestination(destination) @handle_exceptions def queryDestination(self, destination): return self.fw_icmptype.queryDestination(destination) # config.policies lockdown whitelist class FirewallClientPoliciesLockdownWhitelist(object): @handle_exceptions def __init__(self, settings=None): if settings: self.settings = settings else: self.settings = [ [], [], [], [] ] @handle_exceptions def __repr__(self): return '%s(%r)' % (self.__class__, self.settings) @handle_exceptions def getCommands(self): return self.settings[0] @handle_exceptions def setCommands(self, commands): self.settings[0] = commands @handle_exceptions def addCommand(self, command): if command not in self.settings[0]: self.settings[0].append(command) @handle_exceptions def removeCommand(self, command): if command in self.settings[0]: self.settings[0].remove(command) @handle_exceptions def queryCommand(self, command): return command in self.settings[0] @handle_exceptions def getContexts(self): return self.settings[1] @handle_exceptions def setContexts(self, contexts): self.settings[1] = contexts @handle_exceptions def addContext(self, context): if context not in self.settings[1]: self.settings[1].append(context) @handle_exceptions def removeContext(self, context): if context in self.settings[1]: self.settings[1].remove(context) @handle_exceptions def queryContext(self, context): return context in self.settings[1] @handle_exceptions def getUsers(self): return self.settings[2] @handle_exceptions def setUsers(self, users): self.settings[2] = users @handle_exceptions def addUser(self, user): if user not in self.settings[2]: self.settings[2].append(user) @handle_exceptions def removeUser(self, user): if user in self.settings[2]: self.settings[2].remove(user) @handle_exceptions def queryUser(self, user): return user in self.settings[2] @handle_exceptions def getUids(self): return self.settings[3] @handle_exceptions def setUids(self, uids): self.settings[3] = uids @handle_exceptions def addUid(self, uid): if uid not in self.settings[3]: self.settings[3].append(uid) @handle_exceptions def removeUid(self, uid): if uid in self.settings[3]: self.settings[3].remove(uid) @handle_exceptions def queryUid(self, uid): return uid in self.settings[3] # config.policies class FirewallClientConfigPolicies(object): @handle_exceptions def __init__(self, bus): self.bus = bus self.dbus_obj = self.bus.get_object(config.dbus.DBUS_INTERFACE, config.dbus.DBUS_PATH_CONFIG) self.fw_policies = dbus.Interface( self.dbus_obj, dbus_interface=config.dbus.DBUS_INTERFACE_CONFIG_POLICIES) @handle_exceptions def getLockdownWhitelist(self): return FirewallClientPoliciesLockdownWhitelist( \ list(dbus_to_python(self.fw_policies.getLockdownWhitelist()))) @handle_exceptions def setLockdownWhitelist(self, settings): self.fw_policies.setLockdownWhitelist(tuple(settings.settings)) # command @handle_exceptions def addLockdownWhitelistCommand(self, command): self.fw_policies.addLockdownWhitelistCommand(command) @handle_exceptions def removeLockdownWhitelistCommand(self, command): self.fw_policies.removeLockdownWhitelistCommand(command) @handle_exceptions def queryLockdownWhitelistCommand(self, command): return dbus_to_python(self.fw_policies.queryLockdownWhitelistCommand(command)) @handle_exceptions def getLockdownWhitelistCommands(self): return dbus_to_python(self.fw_policies.getLockdownWhitelistCommands()) # context @handle_exceptions def addLockdownWhitelistContext(self, context): self.fw_policies.addLockdownWhitelistContext(context) @handle_exceptions def removeLockdownWhitelistContext(self, context): self.fw_policies.removeLockdownWhitelistContext(context) @handle_exceptions def queryLockdownWhitelistContext(self, context): return dbus_to_python(self.fw_policies.queryLockdownWhitelistContext(context)) @handle_exceptions def getLockdownWhitelistContexts(self): return dbus_to_python(self.fw_policies.getLockdownWhitelistContexts()) # user @handle_exceptions def addLockdownWhitelistUser(self, user): self.fw_policies.addLockdownWhitelistUser(user) @handle_exceptions def removeLockdownWhitelistUser(self, user): self.fw_policies.removeLockdownWhitelistUser(user) @handle_exceptions def queryLockdownWhitelistUser(self, user): return dbus_to_python(self.fw_policies.queryLockdownWhitelistUser(user)) @handle_exceptions def getLockdownWhitelistUsers(self): return dbus_to_python(self.fw_policies.getLockdownWhitelistUsers()) # uid @handle_exceptions def getLockdownWhitelistUids(self): return dbus_to_python(self.fw_policies.getLockdownWhitelistUids()) @handle_exceptions def setLockdownWhitelistUids(self, uids): self.fw_policies.setLockdownWhitelistUids(uids) @handle_exceptions def addLockdownWhitelistUid(self, uid): self.fw_policies.addLockdownWhitelistUid(uid) @handle_exceptions def removeLockdownWhitelistUid(self, uid): self.fw_policies.removeLockdownWhitelistUid(uid) @handle_exceptions def queryLockdownWhitelistUid(self, uid): return dbus_to_python(self.fw_policies.queryLockdownWhitelistUid(uid)) # config.direct class FirewallClientDirect(object): @handle_exceptions def __init__(self, settings=None): if settings: self.settings = settings else: self.settings = [ [], [], [], ] @handle_exceptions def __repr__(self): return '%s(%r)' % (self.__class__, self.settings) @handle_exceptions def getAllChains(self): return self.settings[0] @handle_exceptions def getChains(self, ipv, table): return [ entry[2] for entry in self.settings[0] \ if entry[0] == ipv and entry[1] == table ] @handle_exceptions def setAllChains(self, chains): self.settings[0] = chains @handle_exceptions def addChain(self, ipv, table, chain): idx = (ipv, table, chain) if idx not in self.settings[0]: self.settings[0].append(idx) @handle_exceptions def removeChain(self, ipv, table, chain): idx = (ipv, table, chain) if idx in self.settings[0]: self.settings[0].remove(idx) @handle_exceptions def queryChain(self, ipv, table, chain): idx = (ipv, table, chain) return idx in self.settings[0] @handle_exceptions def getAllRules(self): return self.settings[1] @handle_exceptions def getRules(self, ipv, table, chain): return [ entry[3:] for entry in self.settings[1] \ if entry[0] == ipv and entry[1] == table \ and entry[2] == chain ] @handle_exceptions def setAllRules(self, rules): self.settings[1] = rules @handle_exceptions def addRule(self, ipv, table, chain, priority, args): idx = (ipv, table, chain, priority, args) if idx not in self.settings[1]: self.settings[1].append(idx) @handle_exceptions def removeRule(self, ipv, table, chain, priority, args): idx = (ipv, table, chain, priority, args) if idx in self.settings[1]: self.settings[1].remove(idx) @handle_exceptions def removeRules(self, ipv, table, chain): for idx in list(self.settings[1]): if idx[0] == ipv and idx[1] == table and idx[2] == chain: self.settings[1].remove(idx) @handle_exceptions def queryRule(self, ipv, table, chain, priority, args): idx = (ipv, table, chain, priority, args) return idx in self.settings[1] @handle_exceptions def getAllPassthroughs(self): return self.settings[2] @handle_exceptions def setAllPassthroughs(self, passthroughs): self.settings[2] = passthroughs @handle_exceptions def removeAllPassthroughs(self): self.settings[2] = [] @handle_exceptions def getPassthroughs(self, ipv): return [ entry[1] for entry in self.settings[2] \ if entry[0] == ipv ] @handle_exceptions def addPassthrough(self, ipv, args): idx = (ipv, args) if idx not in self.settings[2]: self.settings[2].append(idx) @handle_exceptions def removePassthrough(self, ipv, args): idx = (ipv, args) if idx in self.settings[2]: self.settings[2].remove(idx) @handle_exceptions def queryPassthrough(self, ipv, args): idx = (ipv, args) return idx in self.settings[2] # config.direct class FirewallClientConfigDirect(object): @handle_exceptions def __init__(self, bus): self.bus = bus self.dbus_obj = self.bus.get_object(config.dbus.DBUS_INTERFACE, config.dbus.DBUS_PATH_CONFIG) self.fw_direct = dbus.Interface( self.dbus_obj, dbus_interface=config.dbus.DBUS_INTERFACE_CONFIG_DIRECT) @handle_exceptions def getSettings(self): return FirewallClientDirect( \ list(dbus_to_python(self.fw_direct.getSettings()))) @handle_exceptions def update(self, settings): self.fw_direct.update(tuple(settings.settings)) # direct chain @handle_exceptions def addChain(self, ipv, table, chain): self.fw_direct.addChain(ipv, table, chain) @handle_exceptions def removeChain(self, ipv, table, chain): self.fw_direct.removeChain(ipv, table, chain) @handle_exceptions def queryChain(self, ipv, table, chain): return dbus_to_python(self.fw_direct.queryChain(ipv, table, chain)) @handle_exceptions def getChains(self, ipv, table): return dbus_to_python(self.fw_direct.getChains(ipv, table)) @handle_exceptions def getAllChains(self): return dbus_to_python(self.fw_direct.getAllChains()) # direct rule @handle_exceptions def addRule(self, ipv, table, chain, priority, args): self.fw_direct.addRule(ipv, table, chain, priority, args) @handle_exceptions def removeRule(self, ipv, table, chain, priority, args): self.fw_direct.removeRule(ipv, table, chain, priority, args) @handle_exceptions def removeRules(self, ipv, table, chain): self.fw_direct.removeRules(ipv, table, chain) @handle_exceptions def queryRule(self, ipv, table, chain, priority, args): return dbus_to_python(self.fw_direct.queryRule(ipv, table, chain, priority, args)) @handle_exceptions def getRules(self, ipv, table, chain): return dbus_to_python(self.fw_direct.getRules(ipv, table, chain)) @handle_exceptions def getAllRules(self): return dbus_to_python(self.fw_direct.getAllRules()) # tracked passthrough @handle_exceptions def addPassthrough(self, ipv, args): self.fw_direct.addPassthrough(ipv, args) @handle_exceptions def removePassthrough(self, ipv, args): self.fw_direct.removePassthrough(ipv, args) @handle_exceptions def queryPassthrough(self, ipv, args): return dbus_to_python(self.fw_direct.queryPassthrough(ipv, args)) @handle_exceptions def getPassthroughs(self, ipv): return dbus_to_python(self.fw_direct.getPassthroughs(ipv)) @handle_exceptions def getAllPassthroughs(self): return dbus_to_python(self.fw_direct.getAllPassthroughs()) # config class FirewallClientConfig(object): @handle_exceptions def __init__(self, bus): self.bus = bus self.dbus_obj = self.bus.get_object(config.dbus.DBUS_INTERFACE, config.dbus.DBUS_PATH_CONFIG) self.fw_config = dbus.Interface( self.dbus_obj, dbus_interface=config.dbus.DBUS_INTERFACE_CONFIG) self.fw_properties = dbus.Interface( self.dbus_obj, dbus_interface='org.freedesktop.DBus.Properties') self._policies = FirewallClientConfigPolicies(self.bus) self._direct = FirewallClientConfigDirect(self.bus) # properties @handle_exceptions def get_property(self, prop): return dbus_to_python(self.fw_properties.Get( config.dbus.DBUS_INTERFACE_CONFIG, prop)) @handle_exceptions def get_properties(self): return dbus_to_python(self.fw_properties.GetAll( config.dbus.DBUS_INTERFACE_CONFIG)) @handle_exceptions def set_property(self, prop, value): self.fw_properties.Set(config.dbus.DBUS_INTERFACE_CONFIG, prop, value) # ipset @handle_exceptions def getIPSetNames(self): return dbus_to_python(self.fw_config.getIPSetNames()) @handle_exceptions def listIPSets(self): return dbus_to_python(self.fw_config.listIPSets()) @handle_exceptions def getIPSet(self, path): return FirewallClientConfigIPSet(self.bus, path) @handle_exceptions def getIPSetByName(self, name): path = dbus_to_python(self.fw_config.getIPSetByName(name)) return FirewallClientConfigIPSet(self.bus, path) @handle_exceptions def addIPSet(self, name, settings): if isinstance(settings, FirewallClientIPSetSettings): path = self.fw_config.addIPSet(name, tuple(settings.settings)) else: path = self.fw_config.addIPSet(name, tuple(settings)) return FirewallClientConfigIPSet(self.bus, path) # zone @handle_exceptions def getZoneNames(self): return dbus_to_python(self.fw_config.getZoneNames()) @handle_exceptions def listZones(self): return dbus_to_python(self.fw_config.listZones()) @handle_exceptions def getZone(self, path): return FirewallClientConfigZone(self.bus, path) @handle_exceptions def getZoneByName(self, name): path = dbus_to_python(self.fw_config.getZoneByName(name)) return FirewallClientConfigZone(self.bus, path) @handle_exceptions def getZoneOfInterface(self, iface): return dbus_to_python(self.fw_config.getZoneOfInterface(iface)) @handle_exceptions def getZoneOfSource(self, source): return dbus_to_python(self.fw_config.getZoneOfSource(source)) @handle_exceptions def addZone(self, name, settings): if isinstance(settings, FirewallClientZoneSettings): path = self.fw_config.addZone2(name, settings.getSettingsDbusDict()) elif isinstance(settings, dict): path = self.fw_config.addZone2(name, settings) else: # tuple based dbus API has 16 elements. Slice what we're given down # to the expected size. path = self.fw_config.addZone(name, tuple(settings[:16])) return FirewallClientConfigZone(self.bus, path) # policy @handle_exceptions def getPolicyNames(self): return dbus_to_python(self.fw_config.getPolicyNames()) @handle_exceptions def listPolicies(self): return dbus_to_python(self.fw_config.listPolicies()) @handle_exceptions def getPolicy(self, path): return FirewallClientConfigPolicy(self.bus, path) @handle_exceptions def getPolicyByName(self, name): path = dbus_to_python(self.fw_config.getPolicyByName(name)) return FirewallClientConfigPolicy(self.bus, path) @handle_exceptions def addPolicy(self, name, settings): if isinstance(settings, FirewallClientPolicySettings): path = self.fw_config.addPolicy(name, settings.getSettingsDbusDict()) else: # dict path = self.fw_config.addPolicy(name, settings) return FirewallClientConfigPolicy(self.bus, path) # service @handle_exceptions def getServiceNames(self): return dbus_to_python(self.fw_config.getServiceNames()) @handle_exceptions def listServices(self): return dbus_to_python(self.fw_config.listServices()) @handle_exceptions def getService(self, path): return FirewallClientConfigService(self.bus, path) @handle_exceptions def getServiceByName(self, name): path = dbus_to_python(self.fw_config.getServiceByName(name)) return FirewallClientConfigService(self.bus, path) @handle_exceptions def addService(self, name, settings): if isinstance(settings, FirewallClientServiceSettings): path = self.fw_config.addService2(name, settings.getSettingsDbusDict()) elif type(settings) is dict: path = self.fw_config.addService2(name, settings) else: # tuple based dbus API has 8 elements. Slice what we're given down # to the expected size. path = self.fw_config.addService(name, tuple(settings[:8])) return FirewallClientConfigService(self.bus, path) # icmptype @handle_exceptions def getIcmpTypeNames(self): return dbus_to_python(self.fw_config.getIcmpTypeNames()) @handle_exceptions def listIcmpTypes(self): return dbus_to_python(self.fw_config.listIcmpTypes()) @handle_exceptions def getIcmpType(self, path): return FirewallClientConfigIcmpType(self.bus, path) @handle_exceptions def getIcmpTypeByName(self, name): path = dbus_to_python(self.fw_config.getIcmpTypeByName(name)) return FirewallClientConfigIcmpType(self.bus, path) @handle_exceptions def addIcmpType(self, name, settings): if isinstance(settings, FirewallClientIcmpTypeSettings): path = self.fw_config.addIcmpType(name, tuple(settings.settings)) else: path = self.fw_config.addIcmpType(name, tuple(settings)) return FirewallClientConfigIcmpType(self.bus, path) @handle_exceptions def policies(self): return self._policies @handle_exceptions def direct(self): return self._direct # helper @handle_exceptions def getHelperNames(self): return dbus_to_python(self.fw_config.getHelperNames()) @handle_exceptions def listHelpers(self): return dbus_to_python(self.fw_config.listHelpers()) @handle_exceptions def getHelper(self, path): return FirewallClientConfigHelper(self.bus, path) @handle_exceptions def getHelperByName(self, name): path = dbus_to_python(self.fw_config.getHelperByName(name)) return FirewallClientConfigHelper(self.bus, path) @handle_exceptions def addHelper(self, name, settings): if isinstance(settings, FirewallClientHelperSettings): path = self.fw_config.addHelper(name, tuple(settings.settings)) else: path = self.fw_config.addHelper(name, tuple(settings)) return FirewallClientConfigHelper(self.bus, path) # class FirewallClient(object): @handle_exceptions def __init__(self, bus=None, wait=0, quiet=True): if not bus: dbus.mainloop.glib.DBusGMainLoop(set_as_default=True) try: self.bus = dbus.SystemBus() except dbus.exceptions.DBusException as e: raise FirewallError(errors.DBUS_ERROR, e.get_dbus_message()) else: self.bus = bus self.bus.add_signal_receiver( handler_function=self._dbus_connection_changed, signal_name="NameOwnerChanged", dbus_interface="org.freedesktop.DBus", arg0=config.dbus.DBUS_INTERFACE) for interface in [ config.dbus.DBUS_INTERFACE, config.dbus.DBUS_INTERFACE_IPSET, config.dbus.DBUS_INTERFACE_ZONE, config.dbus.DBUS_INTERFACE_POLICY, config.dbus.DBUS_INTERFACE_DIRECT, config.dbus.DBUS_INTERFACE_POLICIES, config.dbus.DBUS_INTERFACE_CONFIG, config.dbus.DBUS_INTERFACE_CONFIG_IPSET, config.dbus.DBUS_INTERFACE_CONFIG_ZONE, config.dbus.DBUS_INTERFACE_CONFIG_POLICY, config.dbus.DBUS_INTERFACE_CONFIG_SERVICE, config.dbus.DBUS_INTERFACE_CONFIG_HELPER, config.dbus.DBUS_INTERFACE_CONFIG_DIRECT, config.dbus.DBUS_INTERFACE_CONFIG_ICMPTYPE, config.dbus.DBUS_INTERFACE_CONFIG_POLICIES ]: self.bus.add_signal_receiver(self._signal_receiver, dbus_interface=interface, interface_keyword='interface', member_keyword='member', path_keyword='path') # callbacks self._callback = { } self._callbacks = { # client callbacks "connection-changed": "connection-changed", "connection-established": "connection-established", "connection-lost": "connection-lost", # firewalld callbacks "log-denied-changed": "LogDeniedChanged", "default-zone-changed": "DefaultZoneChanged", "panic-mode-enabled": "PanicModeEnabled", "panic-mode-disabled": "PanicModeDisabled", "reloaded": "Reloaded", "service-added": "ServiceAdded", "service-removed": "ServiceRemoved", "port-added": "PortAdded", "port-removed": "PortRemoved", "source-port-added": "SourcePortAdded", "source-port-removed": "SourcePortRemoved", "protocol-added": "ProtocolAdded", "protocol-removed": "ProtocolRemoved", "masquerade-added": "MasqueradeAdded", "masquerade-removed": "MasqueradeRemoved", "forward-port-added": "ForwardPortAdded", "forward-port-removed": "ForwardPortRemoved", "icmp-block-added": "IcmpBlockAdded", "icmp-block-removed": "IcmpBlockRemoved", "icmp-block-inversion-added": "IcmpBlockInversionAdded", "icmp-block-inversion-removed": "IcmpBlockInversionRemoved", "richrule-added": "RichRuleAdded", "richrule-removed": "RichRuleRemoved", "interface-added": "InterfaceAdded", "interface-removed": "InterfaceRemoved", "zone-changed": "ZoneOfInterfaceChanged", # DEPRECATED, use zone-of-interface-changed instead "zone-of-interface-changed": "ZoneOfInterfaceChanged", "source-added": "SourceAdded", "source-removed": "SourceRemoved", "zone-of-source-changed": "ZoneOfSourceChanged", "zone-updated": "ZoneUpdated", "policy-updated": "PolicyUpdated", # ipset callbacks "ipset-entry-added": "EntryAdded", "ipset-entry-removed": "EntryRemoved", # direct callbacks "direct:chain-added": "ChainAdded", "direct:chain-removed": "ChainRemoved", "direct:rule-added": "RuleAdded", "direct:rule-removed": "RuleRemoved", "direct:passthrough-added": "PassthroughAdded", "direct:passthrough-removed": "PassthroughRemoved", "config:direct:updated": "config:direct:Updated", # policy callbacks "lockdown-enabled": "LockdownEnabled", "lockdown-disabled": "LockdownDisabled", "lockdown-whitelist-command-added": "LockdownWhitelistCommandAdded", "lockdown-whitelist-command-removed": "LockdownWhitelistCommandRemoved", "lockdown-whitelist-context-added": "LockdownWhitelistContextAdded", "lockdown-whitelist-context-removed": "LockdownWhitelistContextRemoved", "lockdown-whitelist-uid-added": "LockdownWhitelistUidAdded", "lockdown-whitelist-uid-removed": "LockdownWhitelistUidRemoved", "lockdown-whitelist-user-added": "LockdownWhitelistUserAdded", "lockdown-whitelist-user-removed": "LockdownWhitelistUserRemoved", # firewalld.config callbacks "config:policies:lockdown-whitelist-updated": "config:policies:LockdownWhitelistUpdated", "config:ipset-added": "config:IPSetAdded", "config:ipset-updated": "config:IPSetUpdated", "config:ipset-removed": "config:IPSetRemoved", "config:ipset-renamed": "config:IPSetRenamed", "config:zone-added": "config:ZoneAdded", "config:zone-updated": "config:ZoneUpdated", "config:zone-removed": "config:ZoneRemoved", "config:zone-renamed": "config:ZoneRenamed", "config:policy-added": "config:PolicyAdded", "config:policy-updated": "config:PolicyUpdated", "config:policy-removed": "config:PolicyRemoved", "config:policy-renamed": "config:PolicyRenamed", "config:service-added": "config:ServiceAdded", "config:service-updated": "config:ServiceUpdated", "config:service-removed": "config:ServiceRemoved", "config:service-renamed": "config:ServiceRenamed", "config:icmptype-added": "config:IcmpTypeAdded", "config:icmptype-updated": "config:IcmpTypeUpdated", "config:icmptype-removed": "config:IcmpTypeRemoved", "config:icmptype-renamed": "config:IcmpTypeRenamed", "config:helper-added": "config:HelperAdded", "config:helper-updated": "config:HelperUpdated", "config:helper-removed": "config:HelperRemoved", "config:helper-renamed": "config:HelperRenamed", } # initialize variables used for connection self._init_vars() self.quiet = quiet if wait > 0: # connect in one second GLib.timeout_add_seconds(wait, self._connection_established) else: self._connection_established() @handle_exceptions def _init_vars(self): self.fw = None self.fw_ipset = None self.fw_zone = None self.fw_policy = None self.fw_helper = None self.fw_direct = None self.fw_properties = None self._config = None self.connected = False @handle_exceptions def getExceptionHandler(self): return exception_handler @handle_exceptions def setExceptionHandler(self, handler): global exception_handler exception_handler = handler @handle_exceptions def getNotAuthorizedLoop(self): return not_authorized_loop @handle_exceptions def setNotAuthorizedLoop(self, enable): global not_authorized_loop not_authorized_loop = enable @handle_exceptions def connect(self, name, callback, *args): if name in self._callbacks: self._callback[self._callbacks[name]] = (callback, args) else: raise ValueError("Unknown callback name '%s'" % name) @handle_exceptions def _dbus_connection_changed(self, name, old_owner, new_owner): if name != config.dbus.DBUS_INTERFACE: return if new_owner: # connection established self._connection_established() else: # connection lost self._connection_lost() @handle_exceptions def _connection_established(self): try: self.dbus_obj = self.bus.get_object(config.dbus.DBUS_INTERFACE, config.dbus.DBUS_PATH) self.fw = dbus.Interface(self.dbus_obj, dbus_interface=config.dbus.DBUS_INTERFACE) self.fw_ipset = dbus.Interface( self.dbus_obj, dbus_interface=config.dbus.DBUS_INTERFACE_IPSET) self.fw_zone = dbus.Interface( self.dbus_obj, dbus_interface=config.dbus.DBUS_INTERFACE_ZONE) self.fw_policy = dbus.Interface( self.dbus_obj, dbus_interface=config.dbus.DBUS_INTERFACE_POLICY) self.fw_direct = dbus.Interface( self.dbus_obj, dbus_interface=config.dbus.DBUS_INTERFACE_DIRECT) self.fw_policies = dbus.Interface( self.dbus_obj, dbus_interface=config.dbus.DBUS_INTERFACE_POLICIES) self.fw_properties = dbus.Interface( self.dbus_obj, dbus_interface='org.freedesktop.DBus.Properties') except dbus.exceptions.DBusException as e: # ignore dbus errors if not self.quiet: print ("DBusException", e.get_dbus_message()) return except Exception as e: if not self.quiet: print ("Exception", e) return self._config = FirewallClientConfig(self.bus) self.connected = True self._signal_receiver(member="connection-established", interface=config.dbus.DBUS_INTERFACE) self._signal_receiver(member="connection-changed", interface=config.dbus.DBUS_INTERFACE) @handle_exceptions def _connection_lost(self): self._init_vars() self._signal_receiver(member="connection-lost", interface=config.dbus.DBUS_INTERFACE) self._signal_receiver(member="connection-changed", interface=config.dbus.DBUS_INTERFACE) @handle_exceptions def _signal_receiver(self, *args, **kwargs): if "member" not in kwargs or "interface" not in kwargs: return signal = kwargs["member"] interface = kwargs["interface"] # config signals need special treatment # pimp signal name if interface.startswith(config.dbus.DBUS_INTERFACE_CONFIG_ZONE): signal = "config:Zone" + signal if interface.startswith(config.dbus.DBUS_INTERFACE_CONFIG_POLICY): signal = "config:Policy" + signal elif interface.startswith(config.dbus.DBUS_INTERFACE_CONFIG_IPSET): signal = "config:IPSet" + signal elif interface.startswith(config.dbus.DBUS_INTERFACE_CONFIG_SERVICE): signal = "config:Service" + signal elif interface.startswith(config.dbus.DBUS_INTERFACE_CONFIG_ICMPTYPE): signal = "config:IcmpType" + signal elif interface.startswith(config.dbus.DBUS_INTERFACE_CONFIG_HELPER): signal = "config:Helper" + signal elif interface == config.dbus.DBUS_INTERFACE_CONFIG: signal = "config:" + signal elif interface == config.dbus.DBUS_INTERFACE_CONFIG_POLICIES: signal = "config:policies:" + signal elif interface == config.dbus.DBUS_INTERFACE_CONFIG_DIRECT: signal = "config:direct:" + signal cb = None for callback in self._callbacks: if self._callbacks[callback] == signal and \ self._callbacks[callback] in self._callback: cb = self._callback[self._callbacks[callback]] if cb is None: return # call back with args converted to python types ... cb_args = [ dbus_to_python(arg) for arg in args ] try: if cb[1]: # add call data cb_args.extend(cb[1]) # call back cb[0](*cb_args) except Exception as msg: print(msg) @handle_exceptions def config(self): return self._config @handle_exceptions def reload(self): self.fw.reload() @handle_exceptions def complete_reload(self): self.fw.completeReload() @handle_exceptions def runtimeToPermanent(self): self.fw.runtimeToPermanent() @handle_exceptions def checkPermanentConfig(self): self.fw.checkPermanentConfig() @handle_exceptions def get_property(self, prop): return dbus_to_python(self.fw_properties.Get( config.dbus.DBUS_INTERFACE, prop)) @handle_exceptions def get_properties(self): return dbus_to_python(self.fw_properties.GetAll( config.dbus.DBUS_INTERFACE)) @handle_exceptions def set_property(self, prop, value): self.fw_properties.Set(config.dbus.DBUS_INTERFACE, prop, value) # panic mode @handle_exceptions def enablePanicMode(self): self.fw.enablePanicMode() @handle_exceptions def disablePanicMode(self): self.fw.disablePanicMode() @handle_exceptions def queryPanicMode(self): return dbus_to_python(self.fw.queryPanicMode()) # list functions @handle_exceptions def getZoneSettings(self, zone): return FirewallClientZoneSettings(dbus_to_python(self.fw_zone.getZoneSettings2(zone))) @handle_exceptions def getIPSets(self): return dbus_to_python(self.fw_ipset.getIPSets()) @handle_exceptions def getIPSetSettings(self, ipset): return FirewallClientIPSetSettings(list(dbus_to_python(\ self.fw_ipset.getIPSetSettings(ipset)))) @handle_exceptions def addEntry(self, ipset, entry): self.fw_ipset.addEntry(ipset, entry) @handle_exceptions def getEntries(self, ipset): return self.fw_ipset.getEntries(ipset) @handle_exceptions def setEntries(self, ipset, entries): return self.fw_ipset.setEntries(ipset, entries) @handle_exceptions def removeEntry(self, ipset, entry): self.fw_ipset.removeEntry(ipset, entry) @handle_exceptions def queryEntry(self, ipset, entry): return dbus_to_python(self.fw_ipset.queryEntry(ipset, entry)) @handle_exceptions def listServices(self): return dbus_to_python(self.fw.listServices()) @handle_exceptions def getServiceSettings(self, service): return FirewallClientServiceSettings(dbus_to_python( self.fw.getServiceSettings2(service))) @handle_exceptions def listIcmpTypes(self): return dbus_to_python(self.fw.listIcmpTypes()) @handle_exceptions def getIcmpTypeSettings(self, icmptype): return FirewallClientIcmpTypeSettings(list(dbus_to_python(\ self.fw.getIcmpTypeSettings(icmptype)))) @handle_exceptions def getHelpers(self): return dbus_to_python(self.fw.getHelpers()) @handle_exceptions def getHelperSettings(self, helper): return FirewallClientHelperSettings(list(dbus_to_python(\ self.fw.getHelperSettings(helper)))) # automatic helper setting @handle_exceptions def getAutomaticHelpers(self): return dbus_to_python(self.fw.getAutomaticHelpers()) @handle_exceptions def setAutomaticHelpers(self, value): self.fw.setAutomaticHelpers(value) # log denied @handle_exceptions def getLogDenied(self): return dbus_to_python(self.fw.getLogDenied()) @handle_exceptions def setLogDenied(self, value): self.fw.setLogDenied(value) # default zone @handle_exceptions def getDefaultZone(self): return dbus_to_python(self.fw.getDefaultZone()) @handle_exceptions def setDefaultZone(self, zone): self.fw.setDefaultZone(zone) # zone @handle_exceptions def setZoneSettings(self, zone, settings): self.fw_zone.setZoneSettings2(zone, settings.getRuntimeSettingsDbusDict()) @handle_exceptions def getZones(self): return dbus_to_python(self.fw_zone.getZones()) @handle_exceptions def getActiveZones(self): return dbus_to_python(self.fw_zone.getActiveZones()) @handle_exceptions def getZoneOfInterface(self, interface): return dbus_to_python(self.fw_zone.getZoneOfInterface(interface)) @handle_exceptions def getZoneOfSource(self, source): return dbus_to_python(self.fw_zone.getZoneOfSource(source)) @handle_exceptions def isImmutable(self, zone): return dbus_to_python(self.fw_zone.isImmutable(zone)) # policy @handle_exceptions def getPolicySettings(self, policy): return FirewallClientPolicySettings(dbus_to_python(self.fw_policy.getPolicySettings(policy))) @handle_exceptions def setPolicySettings(self, policy, settings): self.fw_policy.setPolicySettings(policy, settings.getRuntimeSettingsDbusDict()) @handle_exceptions def getPolicies(self): return dbus_to_python(self.fw_policy.getPolicies()) @handle_exceptions def getActivePolicies(self): return dbus_to_python(self.fw_policy.getActivePolicies()) @handle_exceptions def isPolicyImmutable(self, policy): return dbus_to_python(self.fw_policy.isImmutable(policy)) # interfaces @handle_exceptions def addInterface(self, zone, interface): return dbus_to_python(self.fw_zone.addInterface(zone, interface)) @handle_exceptions def changeZone(self, zone, interface): # DEPRECATED return dbus_to_python(self.fw_zone.changeZone(zone, interface)) @handle_exceptions def changeZoneOfInterface(self, zone, interface): return dbus_to_python(self.fw_zone.changeZoneOfInterface(zone, interface)) @handle_exceptions def getInterfaces(self, zone): return dbus_to_python(self.fw_zone.getInterfaces(zone)) @handle_exceptions def queryInterface(self, zone, interface): return dbus_to_python(self.fw_zone.queryInterface(zone, interface)) @handle_exceptions def removeInterface(self, zone, interface): return dbus_to_python(self.fw_zone.removeInterface(zone, interface)) # sources @handle_exceptions def addSource(self, zone, source): return dbus_to_python(self.fw_zone.addSource(zone, source)) @handle_exceptions def changeZoneOfSource(self, zone, source): return dbus_to_python(self.fw_zone.changeZoneOfSource(zone, source)) @handle_exceptions def getSources(self, zone): return dbus_to_python(self.fw_zone.getSources(zone)) @handle_exceptions def querySource(self, zone, source): return dbus_to_python(self.fw_zone.querySource(zone, source)) @handle_exceptions def removeSource(self, zone, source): return dbus_to_python(self.fw_zone.removeSource(zone, source)) # rich rules @handle_exceptions def addRichRule(self, zone, rule, timeout=0): return dbus_to_python(self.fw_zone.addRichRule(zone, rule, timeout)) @handle_exceptions def getRichRules(self, zone): return dbus_to_python(self.fw_zone.getRichRules(zone)) @handle_exceptions def queryRichRule(self, zone, rule): return dbus_to_python(self.fw_zone.queryRichRule(zone, rule)) @handle_exceptions def removeRichRule(self, zone, rule): return dbus_to_python(self.fw_zone.removeRichRule(zone, rule)) # services @handle_exceptions def addService(self, zone, service, timeout=0): return dbus_to_python(self.fw_zone.addService(zone, service, timeout)) @handle_exceptions def getServices(self, zone): return dbus_to_python(self.fw_zone.getServices(zone)) @handle_exceptions def queryService(self, zone, service): return dbus_to_python(self.fw_zone.queryService(zone, service)) @handle_exceptions def removeService(self, zone, service): return dbus_to_python(self.fw_zone.removeService(zone, service)) # ports @handle_exceptions def addPort(self, zone, port, protocol, timeout=0): return dbus_to_python(self.fw_zone.addPort(zone, port, protocol, timeout)) @handle_exceptions def getPorts(self, zone): return dbus_to_python(self.fw_zone.getPorts(zone)) @handle_exceptions def queryPort(self, zone, port, protocol): return dbus_to_python(self.fw_zone.queryPort(zone, port, protocol)) @handle_exceptions def removePort(self, zone, port, protocol): return dbus_to_python(self.fw_zone.removePort(zone, port, protocol)) # protocols @handle_exceptions def addProtocol(self, zone, protocol, timeout=0): return dbus_to_python(self.fw_zone.addProtocol(zone, protocol, timeout)) @handle_exceptions def getProtocols(self, zone): return dbus_to_python(self.fw_zone.getProtocols(zone)) @handle_exceptions def queryProtocol(self, zone, protocol): return dbus_to_python(self.fw_zone.queryProtocol(zone, protocol)) @handle_exceptions def removeProtocol(self, zone, protocol): return dbus_to_python(self.fw_zone.removeProtocol(zone, protocol)) # forward @handle_exceptions def addForward(self, zone): self.fw_zone.setZoneSettings2(zone, {"forward": True}) @handle_exceptions def queryForward(self, zone): return dbus_to_python(self.fw_zone.getZoneSettings2(zone))["forward"] @handle_exceptions def removeForward(self, zone): self.fw_zone.setZoneSettings2(zone, {"forward": False}) # masquerade @handle_exceptions def addMasquerade(self, zone, timeout=0): return dbus_to_python(self.fw_zone.addMasquerade(zone, timeout)) @handle_exceptions def queryMasquerade(self, zone): return dbus_to_python(self.fw_zone.queryMasquerade(zone)) @handle_exceptions def removeMasquerade(self, zone): return dbus_to_python(self.fw_zone.removeMasquerade(zone)) # forward ports @handle_exceptions def addForwardPort(self, zone, port, protocol, toport, toaddr, timeout=0): if toport is None: toport = "" if toaddr is None: toaddr = "" return dbus_to_python(self.fw_zone.addForwardPort(zone, port, protocol, toport, toaddr, timeout)) @handle_exceptions def getForwardPorts(self, zone): return dbus_to_python(self.fw_zone.getForwardPorts(zone)) @handle_exceptions def queryForwardPort(self, zone, port, protocol, toport, toaddr): if toport is None: toport = "" if toaddr is None: toaddr = "" return dbus_to_python(self.fw_zone.queryForwardPort(zone, port, protocol, toport, toaddr)) @handle_exceptions def removeForwardPort(self, zone, port, protocol, toport, toaddr): if toport is None: toport = "" if toaddr is None: toaddr = "" return dbus_to_python(self.fw_zone.removeForwardPort(zone, port, protocol, toport, toaddr)) # source ports @handle_exceptions def addSourcePort(self, zone, port, protocol, timeout=0): return dbus_to_python(self.fw_zone.addSourcePort(zone, port, protocol, timeout)) @handle_exceptions def getSourcePorts(self, zone): return dbus_to_python(self.fw_zone.getSourcePorts(zone)) @handle_exceptions def querySourcePort(self, zone, port, protocol): return dbus_to_python(self.fw_zone.querySourcePort(zone, port, protocol)) @handle_exceptions def removeSourcePort(self, zone, port, protocol): return dbus_to_python(self.fw_zone.removeSourcePort(zone, port, protocol)) # icmpblock @handle_exceptions def addIcmpBlock(self, zone, icmp, timeout=0): return dbus_to_python(self.fw_zone.addIcmpBlock(zone, icmp, timeout)) @handle_exceptions def getIcmpBlocks(self, zone): return dbus_to_python(self.fw_zone.getIcmpBlocks(zone)) @handle_exceptions def queryIcmpBlock(self, zone, icmp): return dbus_to_python(self.fw_zone.queryIcmpBlock(zone, icmp)) @handle_exceptions def removeIcmpBlock(self, zone, icmp): return dbus_to_python(self.fw_zone.removeIcmpBlock(zone, icmp)) # icmp block inversion @handle_exceptions def addIcmpBlockInversion(self, zone): return dbus_to_python(self.fw_zone.addIcmpBlockInversion(zone)) @handle_exceptions def queryIcmpBlockInversion(self, zone): return dbus_to_python(self.fw_zone.queryIcmpBlockInversion(zone)) @handle_exceptions def removeIcmpBlockInversion(self, zone): return dbus_to_python(self.fw_zone.removeIcmpBlockInversion(zone)) # direct chain @handle_exceptions def addChain(self, ipv, table, chain): self.fw_direct.addChain(ipv, table, chain) @handle_exceptions def removeChain(self, ipv, table, chain): self.fw_direct.removeChain(ipv, table, chain) @handle_exceptions def queryChain(self, ipv, table, chain): return dbus_to_python(self.fw_direct.queryChain(ipv, table, chain)) @handle_exceptions def getChains(self, ipv, table): return dbus_to_python(self.fw_direct.getChains(ipv, table)) @handle_exceptions def getAllChains(self): return dbus_to_python(self.fw_direct.getAllChains()) # direct rule @handle_exceptions def addRule(self, ipv, table, chain, priority, args): self.fw_direct.addRule(ipv, table, chain, priority, args) @handle_exceptions def removeRule(self, ipv, table, chain, priority, args): self.fw_direct.removeRule(ipv, table, chain, priority, args) @handle_exceptions def removeRules(self, ipv, table, chain): self.fw_direct.removeRules(ipv, table, chain) @handle_exceptions def queryRule(self, ipv, table, chain, priority, args): return dbus_to_python(self.fw_direct.queryRule(ipv, table, chain, priority, args)) @handle_exceptions def getRules(self, ipv, table, chain): return dbus_to_python(self.fw_direct.getRules(ipv, table, chain)) @handle_exceptions def getAllRules(self): return dbus_to_python(self.fw_direct.getAllRules()) # direct passthrough @handle_exceptions def passthrough(self, ipv, args): return dbus_to_python(self.fw_direct.passthrough(ipv, args)) # tracked passthrough @handle_exceptions def getAllPassthroughs(self): return dbus_to_python(self.fw_direct.getAllPassthroughs()) @handle_exceptions def removeAllPassthroughs(self): self.fw_direct.removeAllPassthroughs() @handle_exceptions def getPassthroughs(self, ipv): return dbus_to_python(self.fw_direct.getPassthroughs(ipv)) @handle_exceptions def addPassthrough(self, ipv, args): self.fw_direct.addPassthrough(ipv, args) @handle_exceptions def removePassthrough(self, ipv, args): self.fw_direct.removePassthrough(ipv, args) @handle_exceptions def queryPassthrough(self, ipv, args): return dbus_to_python(self.fw_direct.queryPassthrough(ipv, args)) # lockdown @handle_exceptions def enableLockdown(self): self.fw_policies.enableLockdown() @handle_exceptions def disableLockdown(self): self.fw_policies.disableLockdown() @handle_exceptions def queryLockdown(self): return dbus_to_python(self.fw_policies.queryLockdown()) # policies # lockdown white list commands @handle_exceptions def addLockdownWhitelistCommand(self, command): self.fw_policies.addLockdownWhitelistCommand(command) @handle_exceptions def getLockdownWhitelistCommands(self): return dbus_to_python(self.fw_policies.getLockdownWhitelistCommands()) @handle_exceptions def queryLockdownWhitelistCommand(self, command): return dbus_to_python(self.fw_policies.queryLockdownWhitelistCommand(command)) @handle_exceptions def removeLockdownWhitelistCommand(self, command): self.fw_policies.removeLockdownWhitelistCommand(command) # lockdown white list contexts @handle_exceptions def addLockdownWhitelistContext(self, context): self.fw_policies.addLockdownWhitelistContext(context) @handle_exceptions def getLockdownWhitelistContexts(self): return dbus_to_python(self.fw_policies.getLockdownWhitelistContexts()) @handle_exceptions def queryLockdownWhitelistContext(self, context): return dbus_to_python(self.fw_policies.queryLockdownWhitelistContext(context)) @handle_exceptions def removeLockdownWhitelistContext(self, context): self.fw_policies.removeLockdownWhitelistContext(context) # lockdown white list uids @handle_exceptions def addLockdownWhitelistUid(self, uid): self.fw_policies.addLockdownWhitelistUid(uid) @handle_exceptions def getLockdownWhitelistUids(self): return dbus_to_python(self.fw_policies.getLockdownWhitelistUids()) @handle_exceptions def queryLockdownWhitelistUid(self, uid): return dbus_to_python(self.fw_policies.queryLockdownWhitelistUid(uid)) @handle_exceptions def removeLockdownWhitelistUid(self, uid): self.fw_policies.removeLockdownWhitelistUid(uid) # lockdown white list users @handle_exceptions def addLockdownWhitelistUser(self, user): self.fw_policies.addLockdownWhitelistUser(user) @handle_exceptions def getLockdownWhitelistUsers(self): return dbus_to_python(self.fw_policies.getLockdownWhitelistUsers()) @handle_exceptions def queryLockdownWhitelistUser(self, user): return dbus_to_python(self.fw_policies.queryLockdownWhitelistUser(user)) @handle_exceptions def removeLockdownWhitelistUser(self, user): self.fw_policies.removeLockdownWhitelistUser(user) @handle_exceptions def authorizeAll(self): """ Authorize once for all polkit actions. """ self.fw.authorizeAll() PK ���Z __init__.pynu �[��� PK ���Z#�,`4 4 errors.pynu �[��� # -*- coding: utf-8 -*- # # Copyright (C) 2010-2012 Red Hat, Inc. # # Authors: # Thomas Woerner <twoerner@redhat.com> # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see <http://www.gnu.org/licenses/>. # ALREADY_ENABLED = 11 NOT_ENABLED = 12 COMMAND_FAILED = 13 NO_IPV6_NAT = 14 PANIC_MODE = 15 ZONE_ALREADY_SET = 16 UNKNOWN_INTERFACE = 17 ZONE_CONFLICT = 18 BUILTIN_CHAIN = 19 EBTABLES_NO_REJECT = 20 NOT_OVERLOADABLE = 21 NO_DEFAULTS = 22 BUILTIN_ZONE = 23 BUILTIN_SERVICE = 24 BUILTIN_ICMPTYPE = 25 NAME_CONFLICT = 26 NAME_MISMATCH = 27 PARSE_ERROR = 28 ACCESS_DENIED = 29 UNKNOWN_SOURCE = 30 RT_TO_PERM_FAILED = 31 IPSET_WITH_TIMEOUT = 32 BUILTIN_IPSET = 33 ALREADY_SET = 34 MISSING_IMPORT = 35 DBUS_ERROR = 36 BUILTIN_HELPER = 37 NOT_APPLIED = 38 INVALID_ACTION = 100 INVALID_SERVICE = 101 INVALID_PORT = 102 INVALID_PROTOCOL = 103 INVALID_INTERFACE = 104 INVALID_ADDR = 105 INVALID_FORWARD = 106 INVALID_ICMPTYPE = 107 INVALID_TABLE = 108 INVALID_CHAIN = 109 INVALID_TARGET = 110 INVALID_IPV = 111 INVALID_ZONE = 112 INVALID_PROPERTY = 113 INVALID_VALUE = 114 INVALID_OBJECT = 115 INVALID_NAME = 116 INVALID_FILENAME = 117 INVALID_DIRECTORY = 118 INVALID_TYPE = 119 INVALID_SETTING = 120 INVALID_DESTINATION = 121 INVALID_RULE = 122 INVALID_LIMIT = 123 INVALID_FAMILY = 124 INVALID_LOG_LEVEL = 125 INVALID_AUDIT_TYPE = 126 INVALID_MARK = 127 INVALID_CONTEXT = 128 INVALID_COMMAND = 129 INVALID_USER = 130 INVALID_UID = 131 INVALID_MODULE = 132 INVALID_PASSTHROUGH = 133 INVALID_MAC = 134 INVALID_IPSET = 135 INVALID_ENTRY = 136 INVALID_OPTION = 137 INVALID_HELPER = 138 INVALID_PRIORITY = 139 INVALID_POLICY = 140 INVALID_LOG_PREFIX = 141 INVALID_NFLOG_GROUP = 142 INVALID_NFLOG_QUEUE = 143 MISSING_TABLE = 200 MISSING_CHAIN = 201 MISSING_PORT = 202 MISSING_PROTOCOL = 203 MISSING_ADDR = 204 MISSING_NAME = 205 MISSING_SETTING = 206 MISSING_FAMILY = 207 RUNNING_BUT_FAILED = 251 NOT_RUNNING = 252 NOT_AUTHORIZED = 253 UNKNOWN_ERROR = 254 import sys class FirewallError(Exception): def __init__(self, code, msg=None): self.code = code if msg is not None: # escape msg if needed if sys.version < '3': try: x = str(msg) # noqa: F841 except UnicodeEncodeError: msg = unicode(msg).encode("unicode_escape") # noqa: F821 self.msg = msg def __repr__(self): return '%s(%r, %r)' % (self.__class__, self.code, self.msg) def __str__(self): if self.msg: return "%s: %s" % (self.errors[self.code], self.msg) return self.errors[self.code] def get_code(msg): if ":" in msg: idx = msg.index(":") ecode = msg[:idx] else: ecode = msg try: code = FirewallError.codes[ecode] except KeyError: code = UNKNOWN_ERROR return code get_code = staticmethod(get_code) mod = sys.modules[FirewallError.__module__] FirewallError.errors = { getattr(mod,varname) : varname for varname in dir(mod) if not varname.startswith("_") and \ type(getattr(mod,varname)) == int } FirewallError.codes = { FirewallError.errors[code] : code for code in FirewallError.errors } PK ���Z�9� � + config/__pycache__/__init__.cpython-310.pycnu �[��� PK ���Z}w{� ' Y config/__pycache__/dbus.cpython-310.pycnu �[��� PK ���Z��; � config/dbus.pynu �[��� PK ���Z`PR�� � config/__init__.pynu �[��� PK ���Z���P�^ �^ #2 command.pynu �[��� PK ���Z�6 �� � � fw_types.pynu �[��� PK ���Z�f�� � $ � __pycache__/__init__.cpython-310.pycnu �[��� PK ���Z����� �� " ͚ __pycache__/client.cpython-310.pycnu �[��� PK ���Z ;A] & �v __pycache__/dbus_utils.cpython-310.pycnu �[��� PK ���Z� ��� � " ,� __pycache__/errors.cpython-310.pycnu �[��� PK ���Z..�.UD UD # � __pycache__/command.cpython-310.pycnu �[��� PK ���Z�5�?�; �; % �� __pycache__/functions.cpython-310.pycnu �[��� PK ���Z�غ�� � $ � __pycache__/fw_types.cpython-310.pycnu �[��� PK ���Z��l>J >J �+ functions.pynu �[��� PK ���Zs�ԯ*D *D v server/config_helper.pynu �[��� PK ���Z���ە � �� server/decorators.pynu �[��� PK ���Z��5� � - d� server/__pycache__/decorators.cpython-310.pycnu �[��� PK ���ZP>�d� � , �� server/__pycache__/firewalld.cpython-310.pycnu �[��� PK ���Z�(�u' u' 2 �� server/__pycache__/config_icmptype.cpython-310.pycnu �[��� PK ���Z�H��- �- 0 v server/__pycache__/config_helper.cpython-310.pycnu �[��� PK ���Zھ�> ) eK server/__pycache__/server.cpython-310.pycnu �[��� PK ���Z?X�� � + �T server/__pycache__/__init__.cpython-310.pycnu �[��� PK ���Z�~t�J �J 1 �U server/__pycache__/config_service.cpython-310.pycnu �[��� PK ���Z�ku 0 � server/__pycache__/config_policy.cpython-310.pycnu �[��� PK ���Zi[� ?l ?l . e� server/__pycache__/config_zone.cpython-310.pycnu �[��� PK ���Z�� u ' ( server/__pycache__/dbus.cpython-310.pycnu �[��� PK ���Zpq)��� �� ) b. server/__pycache__/config.cpython-310.pycnu �[��� PK ���Zq��0 �0 / G� server/__pycache__/config_ipset.cpython-310.pycnu �[��� PK ���Z4�7}�9 �9 `� server/config_icmptype.pynu �[��� PK ���ZLO _u _u �7 server/config_service.pynu �[��� PK ���Z��I�� � C� server/dbus.pynu �[��� PK ���Zxki�� �� 5� server/config_zone.pynu �[��� PK ���ZO0�" " qf server/config.pynu �[��� PK ���Z��ϬI I �~ server/config_ipset.pynu �[��� PK ���Z��{��� �� 3� server/firewalld.pynu �[��� PK ���ZqiVY Y 3� server/server.pynu �[��� PK ���Zn���� � ̜ server/config_policy.pynu �[��� PK ���Z � server/__init__.pynu �[��� PK ���Zc�!��$ �$ "� dbus_utils.pynu �[��� PK ���Z����$ �$ � core/ebtables.pynu �[��� PK ���Z{��G2 G2 core/ipset.pynu �[��� PK ���Z��d �: core/base.pynu �[��� PK ���ZD��� � �B core/prog.pynu �[��� PK ���Z�rz z I core/fw_nm.pynu �[��� PK ���Z �M V V �c core/fw_direct.pynu �[��� PK ���Zӊ�%� %� * � core/__pycache__/fw_policy.cpython-310.pycnu �[��� PK ���Z��H H ( �k core/__pycache__/modules.cpython-310.pycnu �[��� PK ���Z(��� � * +w core/__pycache__/ipXtables.cpython-310.pycnu �[��� PK ���Z�2*�_ _ , x� core/__pycache__/fw_policies.cpython-310.pycnu �[��� PK ���Z��<� � + 3 core/__pycache__/fw_service.cpython-310.pycnu �[��� PK ���Z=m��� � ) J core/__pycache__/ebtables.cpython-310.pycnu �[��� PK ���Z���� � % �, core/__pycache__/prog.cpython-310.pycnu �[��� PK ���Zڙ� � � ) �/ core/__pycache__/__init__.cpython-310.pycnu �[��� PK ���Z��#_@s @s # �0 core/__pycache__/fw.cpython-310.pycnu �[��� PK ���Z��V�Ns Ns ( H� core/__pycache__/fw_zone.cpython-310.pycnu �[��� PK ���Z�g�d ) � core/__pycache__/fw_ipset.cpython-310.pycnu �[��� PK ���Z���Q Q % O5 core/__pycache__/rich.cpython-310.pycnu �[��� PK ���Z�En� * �� core/__pycache__/fw_helper.cpython-310.pycnu �[��� PK ���Zv��cW cW ' � core/__pycache__/logger.cpython-310.pycnu �[��� PK ���Zz��� � , �� core/__pycache__/fw_icmptype.cpython-310.pycnu �[��� PK ���Z���Oe Oe * �� core/__pycache__/fw_config.cpython-310.pycnu �[��� PK ���Z���[@1 @1 * SV core/__pycache__/fw_direct.cpython-310.pycnu �[��� PK ���Z2�?)� � ' � core/__pycache__/helper.cpython-310.pycnu �[��� PK ���Z�υ�" " & � core/__pycache__/ipset.cpython-310.pycnu �[��� PK ���Z�y�� � ) �� core/__pycache__/fw_ifcfg.cpython-310.pycnu �[��� PK ���Z��o9 & � core/__pycache__/fw_nm.cpython-310.pycnu �[��� PK ���Z�W�] ] % �� core/__pycache__/base.cpython-310.pycnu �[��� PK ���Z}�䋶 � ( �� core/__pycache__/watcher.cpython-310.pycnu �[��� PK ���Z�l� / �� core/__pycache__/fw_transaction.cpython-310.pycnu �[��� PK ���Z�t,�� �� ) #� core/__pycache__/nftables.cpython-310.pycnu �[��� PK ���Z,3�E E % v� core/__pycache__/icmp.cpython-310.pycnu �[��� PK ���ZC-{I� I� � core/ipXtables.pynu �[��� PK ���Z���~� � �� core/watcher.pynu �[��� PK ���Z�H��� � u� core/modules.pynu �[��� PK ���Z �~�. �. 6� core/fw_policy.pynu �[��� PK ���Z�_� � � core/fw_transaction.pynu �[��� PK ���Z��1�� � =� core/fw_policies.pynu �[��� PK ���Z.��,� ,� s� core/rich.pynu �[��� PK ���Z�`-�"P "P ۂ core/io/ipset.pynu �[��� PK ���Z�ζ �. �. =� core/io/service.pynu �[��� PK ���Z�w{�{ { 2 e core/io/__pycache__/firewalld_conf.cpython-310.pycnu �[��� PK ���Z���m� � , B core/io/__pycache__/icmptype.cpython-310.pycnu �[��� PK ���Zx�8W� � ) !1 core/io/__pycache__/ifcfg.cpython-310.pycnu �[��� PK ���ZS���� � , A core/io/__pycache__/__init__.cpython-310.pycnu �[��� PK ���Z@��& �& - 3D core/io/__pycache__/io_object.cpython-310.pycnu �[��� PK ���Z� �r r + fk core/io/__pycache__/service.cpython-310.pycnu �[��� PK ���Z���� � * 3� core/io/__pycache__/helper.cpython-310.pycnu �[��� PK ���Z���<J( J( ) Y� core/io/__pycache__/ipset.cpython-310.pycnu �[��� PK ���Z�$8��] �] * �� core/io/__pycache__/policy.cpython-310.pycnu �[��� PK ���Z�*X�, �, * �" core/io/__pycache__/direct.cpython-310.pycnu �[��� PK ���ZֲNv� � - �O core/io/__pycache__/functions.cpython-310.pycnu �[��� PK ���Z��"�� � 6 HZ core/io/__pycache__/lockdown_whitelist.cpython-310.pycnu �[��� PK ���Z��- - ( �{ core/io/__pycache__/zone.cpython-310.pycnu �[��� PK ���Z8�W�� � �� core/io/functions.pynu �[��� PK ���Z�:2��5 �5 � core/io/firewalld_conf.pynu �[��� PK ���Z��p�J J 1� core/io/zone.pynu �[��� PK ���Z,E?|�< �< v: core/io/direct.pynu �[��� PK ���Z <�᭾ �� �w core/io/policy.pynu �[��� PK ���ZT���- �- �6 core/io/io_object.pynu �[��� PK ���ZP�h֕ � �d core/io/icmptype.pynu �[��� PK ���Z�eΪ� � �} core/io/ifcfg.pynu �[��� PK ���Z��@�> > \� core/io/helper.pynu �[��� PK ���Z� $��/ �/ ۴ core/io/lockdown_whitelist.pynu �[��� PK ���Z,�:< < � core/io/__init__.pynu �[��� PK ���Z�Gܞ�t �t �� core/nftables.pynu �[��� PK ���Z�� g` core/icmp.pynu �[��� PK ���Z����% �% �l core/fw_ipset.pynu �[��� PK ���Z�^ܪ>y >y ʒ core/logger.pynu �[��� PK ���ZV�_P) ) F core/fw_helper.pynu �[��� PK ���Zy���R R � core/fw_icmptype.pynu �[��� PK ���Zř�Rʩ ʩ E core/fw_zone.pynu �[��� PK ���ZƟ8C$ $ N� core/helper.pynu �[��� PK ���Z���:]� ]� �� core/fw_config.pynu �[��� PK ���Zَ�: N� core/fw_ifcfg.pynu �[��� PK ���Z�:_UO� O� �� core/fw.pynu �[��� PK ���Z d core/__init__.pynu �[��� PK ���Z����g g Yd core/fw_service.pynu �[��� PK ���Z*!PŐ� �� k client.pynu �[��� PK ���Z �D __init__.pynu �[��� PK ���Z#�,`4 4 E errors.pynu �[��� PK x x �+ sV
| ver. 1.4 |
Github
|
.
| PHP 8.2.28 | Generation time: 0.07 |
proxy
|
phpinfo
|
Settings