3
Yj^ @ sf d Z dgZddlZddlmZ ddlmZ ddlmZ ddl m
Z
m Z m Z m
Z
mZ G dd deZdS ) z Z d?d@ Z dg dAfdBdCZ!dg fdDdEZ"dg fdFdGZ#dHdI Z$dJdK Z%dLdM Z&dNdO Z'dPdQ Z(dRdS Z)dTdU Z*dVdW Z+dXdY Z,dZd[ Z-dS )nr Fc C s || _ || _d| _d | _d S )NT)quietverbose'_FirewallCommand__use_exception_handlerfw)selfr r r /usr/lib/python3.6/command.py__init__# s zFirewallCommand.__init__c C s
|| _ d S )N)r )r r r r r set_fw) s zFirewallCommand.set_fwc C s
|| _ d S )N)r )r flagr r r set_quiet, s zFirewallCommand.set_quietc C s | j S )N)r )r r r r get_quiet/ s zFirewallCommand.get_quietc C s
|| _ d S )N)r )r r r r r set_verbose2 s zFirewallCommand.set_verbosec C s | j S )N)r )r r r r get_verbose5 s zFirewallCommand.get_verboseNc C s$ |d k r | j r tjj|d d S )N
)r sysstdoutwrite)r msgr r r print_msg8 s zFirewallCommand.print_msgc C s$ |d k r | j r tjj|d d S )Nr )r r stderrr )r r r r r print_error_msg< s z FirewallCommand.print_error_msgc C s, d}d}t jj r || | }| j| d S )Nz[91mz[00m)r r isattyr )r r ZFAILZENDr r r
print_warning@ s
z FirewallCommand.print_warningr c C s, |dkr| j | n
| j| tj| d S )N )r" r r exit)r r Z exit_coder r r print_and_exitG s
z FirewallCommand.print_and_exitc C s | j |d d S )N )r% )r r r r r failR s zFirewallCommand.failc C s" |d k r | j r tjj|d d S )Nr )r r r r )r r r r r print_if_verboseU s z FirewallCommand.print_if_verbosec
C s | j d k r| j j g }
d} g } x|D ]}
|d k ry ||
}
W nx tk
r } z\tjt|}t|dkrz| jd| n| jd| | || kr| j | | d7 } w&W Y d d }~X nX |
j |
q&W xb|
D ]X}
g }|d k r||7 }t
|
t ot
|
t r|j |
n||
7 }|d k r(||7 }| j
y || W n ttfk
r } zt
|trx| j|j |j }nt|}tj|}|tjtjtjtjgkrd}t|dkr| jd| n,|dkr| jd| d S | jd| | || kr| j | | d7 } W Y d d }~X nX | j qW | st|| ksJd| krNd S t| dkrltj| d nt| dkrtjtj d S )Nr r# z Warning: %sz Error: %s)r Z authorizeAll Exceptionr get_codestrlenr" r% append
isinstancelisttuple deactivate_exception_handlerr fail_if_not_authorized
get_dbus_nameget_dbus_messager ALREADY_ENABLED NOT_ENABLEDZONE_ALREADY_SET ALREADY_SETactivate_exception_handlerr r$ Z
UNKNOWN_ERROR)r Zcmd_typeoption
action_method query_method parse_methodmessage
start_argsend_argsno_exititemsZ_errorsZ _error_codesitemr code call_itemr r r Z__cmd_sequenceY sr
z FirewallCommand.__cmd_sequencec C s | j d||||||d d S )Nadd)rA ) _FirewallCommand__cmd_sequence)r r: r; r< r= r> rA r r r add_sequence s z FirewallCommand.add_sequencec
C s | j d||||||g|d d S )NrF )r? rA )rG )r xr: r; r< r= r> rA r r r x_add_sequence s z FirewallCommand.x_add_sequencec C s$ | j d||||||g|g|d d S )NrF )r? r@ rA )rG ) r zoner: r; r< r= r> ZtimeoutrA r r r zone_add_timeout_sequence s z)FirewallCommand.zone_add_timeout_sequencec C s | j d||||||d d S )Nremove)rA )rG )r r: r; r< r= r> rA r r r remove_sequence s z FirewallCommand.remove_sequencec
C s | j d||||||g|d d S )NrM )r? rA )rG )r rI r: r; r< r= r> rA r r r x_remove_sequence s z!FirewallCommand.x_remove_sequencec
C s g }x|D ]}|d k ry ||}W n^ t k
r } zBt|dkrR| jd| w
n tjt| }
| jd| |
W Y d d } ~ X nX |j| q
W xv|D ]l}g } |d k r| |7 } t|t rt|t
r| j| n| |7 } | j y || } W n t k
rj } zZ| j
| j tj| j }
t|dkrF| jd| j wn| jd| j |
W Y d d } ~ X n` t k
r } zBtjt| }
t|dkr| jd| n| jd| |
W Y d d } ~ X nX | j t|dkr| jd|| d| f q| j| qW |stjd d S ) Nr# z Warning: %sz Error: %sz%s: %snoyesr )rP rQ )r) r, r" r r* r+ r% r- r. r/ r0 r1 r r2 r3 r4 r9 r print_query_resultr r$ )
r r: r< r= r> r? rA rB rC r rD rE resr r r Z__query_sequence sR
" " z FirewallCommand.__query_sequencec C s | j |||||d d S )N)rA ) _FirewallCommand__query_sequence)r r: r< r= r> rA r r r query_sequence s
z FirewallCommand.query_sequencec C s | j |||||g|d d S )N)r? rA )rT )r rI r: r< r= r> rA r r r x_query_sequence s
z FirewallCommand.x_query_sequencec C sJ t | rFt| rFt| rF|jdo2t|dk rFttjd| |S )Nzipset: z8'%s' is no valid IPv4, IPv6 or MAC address, nor an ipset)r r r
startswithr, r r INVALID_ADDR)r valuer r r parse_source s
z FirewallCommand.parse_source/c
C sl y|j |\}}W n$ tk
r6 ttjd| Y nX t|sLttj||dkrdttjd| ||fS )NzTbad port (most likely missing protocol), correct syntax is portid[-portid]%sprotocoltcpudpsctpdccpz''%s' not in {'tcp'|'udp'|'sctp'|'dccp'})r] r^ r_ r` )split
ValueErrorr r INVALID_PORTr INVALID_PROTOCOL)r rZ Z separatorportprotor r r
parse_port s zFirewallCommand.parse_portc
C s d }d }d }d }d}xd||d kr||d j ddd }|t|d 7 }d||d krx||d j ddd } n ||d } |t| d 7 }|dkr| }q|dkr| }q|dkr| }q|dkr| }q|d kr|rqttjd
| qW |s ttjd |sttjd |p|s*ttjd
t|s@ttj||dkrZttjd| |rxt| rxttj||rtd| r|std| rttj |||||fS )Nr =r# :re rf toporttoaddrifz invalid forward port arg '%s'z missing portzmissing protocolzmissing destinationr] r^ r_ r` z''%s' not in {'tcp'|'udp'|'sctp'|'dccp'}ipv4ipv6)r] r^ r_ r` )
ra r, r r ZINVALID_FORWARDr rc rd r
rY )
r rZ compatre Zprotocolrj rk ioptvalr r r parse_forward_port sT
z"FirewallCommand.parse_forward_portc C sF |j d}t|dkr"|d dfS t|dkr2|S ttjd| d S )Nrh r# r r& zinvalid ipset option '%s')ra r, r r ZINVALID_OPTION)r rZ argsr r r parse_ipset_optionH s
z"FirewallCommand.parse_ipset_optionc C s. ddg}||kr*t tjd|dj|f |S )Nrm rn z'invalid argument: %s (choose from '%s')z', ')r r INVALID_IPVjoin)r rZ ipvsr r r check_destination_ipvR s z%FirewallCommand.check_destination_ipvc C sD y|j dd\}}W n tk
r4 ttjdY nX | j||fS )Nri r# z(destination syntax is ipv:address[/mask])ra rb r r ZINVALID_DESTINATIONrz )r rZ ZipvZ destinationr r r parse_service_destinationZ s z)FirewallCommand.parse_service_destinationc C s0 dddg}||kr,t tjd|dj|f |S )Nrm rn Zebz'invalid argument: %s (choose from '%s')z', ')r r rw rx )r rZ ry r r r check_ipvb s
zFirewallCommand.check_ipvc C s0 dddg}||kr,t tjd|dj|f |S )Nrt rm rn z'invalid argument: %s (choose from '%s')z', ')r r rw rx )r rZ ry r r r check_helper_familyj s
z#FirewallCommand.check_helper_familyc C sB |j dsttjd| t|jdddk r>ttjd| |S )NZ
nf_conntrack_z('%s' does not start with 'nf_conntrack_'rt r# zModule name '%s' too short)rX r r ZINVALID_MODULEr, replace)r rZ r r r check_moduler s
z FirewallCommand.check_moduleTc C s |j }|j }|j }|j } |j }
|j } |j } |j }
|j }|j }|j
}|rv|j }|j }|j
}n,|j }tt|j | }|j }|j }dd }g }|d k r||kr|jd | r|s|s|r|r|r|jd |r|ddj| }| j| | jr2| jd| | jd| |rJ| jd t| | jd
| |sv| jd |rnd nd
|r| jddj| | jddj| n(| jddj| | jddj| | jddjt| | jddjdd |D | jddjt| |s:| jd|r2d nd
| jd|
rJd nd
| jd| rbdnd djd d | D | jd djd d | D | jd dj|
| jd!|rdnd djt||d" d S )#Nc S sf d}d}y| j |}W n tk
r* Y n8X |t|7 }t| ||| |d j d jdd}|S )Nr z priority= "rt )indexrb r, intr~ )ZrulepriorityZ
search_strrp r r r rich_rule_sorted_key s *zDFirewallCommand.print_zone_policy_info..rich_rule_sorted_keydefaultZactivez (%s)z, z summary: z description: z priority: z
target: z icmp-block-inversion: %srQ rP z ingress-zones: r z egress-zones: z interfaces: z sources: z services: z ports: c S s g | ]}d |d |d f qS )z%s/%sr r# r ).0re r r r
s z:FirewallCommand.print_zone_policy_info..z
protocols: z
forward: %sz masquerade: %sz forward-ports: z
rt c S s$ g | ] \}}}}d ||||f qS )z$port=%s:proto=%s:toport=%s:toaddr=%sr )r re rf rj rk r r r r s z source-ports: c S s g | ]}d |d |d f qS )z%s/%sr r# r )r re r r r r s z icmp-blocks: z rich rules: )key)Z getTargetZ getServicesgetPorts getProtocolsZ
getMasqueradeZgetForwardPortsgetSourcePortsZ
getIcmpBlocksZ getRichRulesgetDescriptiongetShortZgetIngressZonesZgetEgressZonesZ getPriorityZgetIcmpBlockInversionsortedsetZ
getInterfacesZ
getSourcesZ
getForwardr- rx r r r+ )r rK settings default_zoneextra_interfacesisPolicytargetZservicesports protocolsZ
masqueradeZ
forward_ports source_portsZ icmp_blocksZrules descriptionshort_descriptionZ
ingress_zonesZ egress_zonesr Zicmp_block_inversionZ
interfacesZsourcesZforwardr Z
attributesr r r print_zone_policy_info| sx
z&FirewallCommand.print_zone_policy_infoc C s | j ||||dd d S )NF)r r r )r )r rK r r r r r r print_zone_info s z FirewallCommand.print_zone_infoc C s | j ||||dd d S )NT)r r r )r )r Zpolicyr r r r r r print_policy_info s z!FirewallCommand.print_policy_infoc C s. |j }|j }|j }|j }|j }|j }|j } |j }
|j } | j | | j
rt| j d| | j d| | j ddj dd |D | j ddj | | j ddj d d |D | j d
dj | | j d dj d d |j D | j d
dj t
|
| j ddj t
| d S )Nz summary: z description: z ports: r c S s g | ]}d |d |d f qS )z%s/%sr r# r )r re r r r r s z6FirewallCommand.print_service_info..z
protocols: z source-ports: c S s g | ]}d |d |d f qS )z%s/%sr r# r )r re r r r r s z modules: z destination: c S s g | ]\}}d ||f qS )z%s:%sr )r kvr r r r s z includes: z helpers: )r r r Z
getModulesr getDestinationsr Z getIncludesZ
getHelpersr r rx rB r ) r Zservicer r r r modulesr destinationsr ZincludesZhelpersr r r print_service_info s2
z"FirewallCommand.print_service_infoc C sp |j }|j }|j }t|dkr,ddg}| j| | jrX| jd| | jd| | jddj| d S )Nr rm rn z summary: z description: z destination: r )r r r r, r r rx )r Zicmptyper r r r r r r print_icmptype_info s
z#FirewallCommand.print_icmptype_infoc C s |j }|j }|j }|j }|j }| j| | jrT| jd| | jd| | jd| | jddjdd |j D | jddj| d S ) Nz summary: z description: z type: z options: r c S s$ g | ] \}}|r d ||f n|qS )z%s=%sr )r r r r r r r s z4FirewallCommand.print_ipset_info..z entries: ) ZgetTypeZ
getOptionsZ
getEntriesr r r r rx rB )r Zipsetr Z
ipset_typeZoptionsentriesr r r r r print_ipset_info s
z FirewallCommand.print_ipset_infoc C s |j }|j }|j }|j }|j }| j| | jrT| jd| | jd| | jd| | jd| | jddjdd |D d S ) Nz summary: z description: z
family: z
module: z ports: r c S s g | ]}d |d |d f qS )z%s/%sr r# r )r re r r r r s z5FirewallCommand.print_helper_info..)r Z getModuleZ getFamilyr r r r rx )r helperr r moduleZfamilyr r r r r print_helper_info s
z!FirewallCommand.print_helper_infoc C s |r| j d n | j dd d S )NrQ rP r# )r% )r rZ r r r rR s z"FirewallCommand.print_query_resultc C s\ | j s | j| tjt|}|tjtjtjtj gkrH| j
d| n| j d| | d S )Nz Warning: %sz Error: %s) r
r2 r r* r+ r r5 r6 r7 r8 r" r% )r exception_messagerD r r r exception_handler s
z!FirewallCommand.exception_handlerc C s d|krd}| j |tj d S )NZNotAuthorizedExceptionz`Authorization failed.
Make sure polkit agent is running or run the application as superuser.)r% r ZNOT_AUTHORIZED)r r r r r r r2 ' s z&FirewallCommand.fail_if_not_authorizedc C s
d| _ d S )NF)r
)r r r r r1 - s z,FirewallCommand.deactivate_exception_handlerc C s
d| _ d S )NT)r
)r r r r r9 0 s z*FirewallCommand.activate_exception_handlerc C sp g }t }t|}xP|D ]H}|s"P |j }t|dk s|d dkrDq||kr|j| |j| qW |j |S )Nr# r #;)r r )r openstripr, r- rF close)r filenamer Z entries_setfliner r r get_ipset_entries_from_file3 s
z+FirewallCommand.get_ipset_entries_from_file)FF)N)N)N)Nr )N)N)NNF)F)F)F)F)F)NF)F)F)r\ )F).__name__
__module__ __qualname__r r r r r r r r r" r% r' r( rG rH rJ rL rN rO rT rU rV r[ rg rs rv rz r{ r| r} r r r r r r r r rR r r2 r1 r9 r r r r r r " sX
J
2
2
O )__doc____all__r Zfirewallr Zfirewall.errorsr Zdbus.exceptionsr Zfirewall.functionsr r r r r
objectr r r r r s