3
Yj'K # @ s d ddddddddd d
d d d
ddddddddddddddd d d d d d!d"g#Z d#d$lZd#d$lZd#d$lZd#d$lZd#d$lZd#d$lZd#d$lZd#d$lZd#d%l m
Z
d#d&l m Z m
Z
ejd'k Zd(d) ed#d*D Zd+d Zd,d ZdXd.dZd/d0 Zd1d2 Zd3d4 Zd5d Zd6d Zd7d8 Zd9d Zd:d Z d;d" Z dd
Z d?d Z!d@d Z"dAd
Z#dBd Z$dCd Z%dDd Z&dEdF Z'dGd Z(dHd Z)dId Z*dJd Z+dKd Z,dLd Z-dMd! Z.dNd Z/dOd Z0dPd Z1dQd Z2dRd Z3dSd Z4dTd Z5dUd Z6dVd Z7dWd Z8d$S )YPY2 getPortID getPortRangeportStrgetServiceNamecheckIPcheckIP6 checkIPnMask
checkIP6nMask
checkProtocolcheckInterface checkUINT32firewalld_is_activetempFilereadfile writefileenable_ip_forwarding
check_port
check_addresscheck_single_address check_macuniqify ppid_of_pidmax_zone_name_len checkUsercheckUid checkCommand checkContextjoinArgs splitArgsb2uu2b
u2b_if_py2max_policy_name_lenstripNonPrintableCharacters N)log)FIREWALLD_TEMPDIRFIREWALLD_PIDFILE3c C s" i | ]}|d ko|dk sd|qS ) N ).0ir+ r+ /usr/lib/python3.6/functions.py
. s r/ c C st t | tr| }nT| r | j } y t| }W n: tk
rb ytj| }W n tjk
r\ dS X Y nX |dkrpdS |S )z Check and Get port id from port string or port id using socket.getservbyname
@param port port string or port id
@return Port id if valid, -1 if port can not be found and -2 if port is too big
i )
isinstanceintstrip
ValueErrorsocketZ
getservbynameerror)portZ_idr+ r+ r. r 7 s
c C s t | tst | tr| S t | ts*| j rDt| }|dkr@|fS |S | jd}t|dkr|d j r|d j rt|d }t|d }|dkr|dkr||k r||fS ||kr||fS |fS g }xtt|ddD ]}tdj |d| }dj ||d }t|dkrnt|}|dkr|dkr||k rF|j
||f n&||kr`|j
||f n |j
|f q|dkr|j
|f |t|krP qW t|dk rdS t|dkrdS |d S )aI Get port range for port range string or single port id
@param ports an integer or port string or port range string
@return Array containing start and end port id for a valid range or -1 if port can not be found and -2 if port is too big for integer input or -1 for invalid ranges or None if the range is ambiguous.
r$ -r2 r1 Nr3 r3 ) r5 tuplelistr6 isdigitr splitlenrangejoinappend)ZportsZid1splitsZid2Zmatchedr- Zport2r+ r+ r. r N sL
$
:c C sX | dkr dS t | }t|tr*|dk r*dS t|dkr>d| S d|d ||d f S dS )a Create port and port range string
@param port port or port range int or [int, int]
@param delimiter of the output string for port ranges, default ':'
@return Port or port range string, empty string if port isn't specified, None if port or port range is not valid
r$ Nr1 z%sz%s%s%s)r r5 r6 rA )r; Z delimiter_ranger+ r+ r. r s c C s t | }t |}t|dkrt|dkr@t|d t|d kS t|dkrt|d t|d krt|d t|d krdS n|t|dkrt|dkrt|d t|d krt|d t|d krt|d t|d krt|d t|d krdS dS )Nr1 r$ r2 TF)r rA r )r; rB Z_portrH r+ r+ r. portInPortRange s 0 00rI c C sT t | }t|dkr$|d |d f}tt |}ttdd |dd d}g }x|D ]}|d |d kr|d |d kr|j| qR|d |d kr|d |d k r|d |d kr|j| |d |d f}qR|d |d ko|d |d ko|d |d krR|j| |d |d f}qRW ttdd |}|d |d krJ|d f}|g|fS )z Coalesce a port range with existing list of port ranges
@param new_range tuple/list/string
@param ranges list of tuple/list/string
@return tuple of (list of ranges added after coalescing, list of removed original ranges)
r1 r$ c S s t | dkr | d | d fS | S )Nr1 r$ )rA )xr+ r+ r. s z#coalescePortRange..c S s | d S )Nr$ r+ )rJ r+ r+ r. rK s )keyc S s | d | d kr| d fS | S )Nr$ r1 r+ )rJ r+ r+ r. rK s )r rA mapsortedrD r> )Z new_rangerangesZcoalesced_range_rangesremoved_rangesrB r+ r+ r. coalescePortRange s*
rR c C s t | } t| dkr$| d | d f} tt |}ttdd |dd d}g }g }xJ|D ]@}| d |d kr| d |d kr|j| qX| d |d kr| d |d k r| d |d kr|j| |j| d d |d f qX| d |d kr<| d |d kr<| d |d kr<|j| |j|d | d d f qX| d |d krX| d |d k rX|j| |j|d | d d f |j| d d |d f qXW ttdd |}ttdd |}||fS ) z break a port range from existing list of port ranges
@param remove_range tuple/list/string
@param ranges list of tuple/list/string
@return tuple of (list of ranges added after breaking up, list of removed original ranges)
r1 r$ c S s t | dkr | d | d fS | S )Nr1 r$ )rA )rJ r+ r+ r. rK s z breakPortRange..c S s | d S )Nr$ r+ )rJ r+ r+ r. rK s )rL c S s | d | d kr| d fS | S )Nr$ r1 r+ )rJ r+ r+ r. rK s c S s | d | d kr| d fS | S )Nr$ r1 r+ )rJ r+ r+ r. rK s )r rA rM rN rD r> )Z remove_rangerO rP rQ Z added_rangesrB r+ r+ r. breakPortRange s2
$
rS c C s0 yt jt| |}W n t jk
r* dS X |S )z Check and Get service name from port and proto string combination using socket.getservbyport
@param port string or id
@param protocol string
@return Service name if port and protocol are valid, else None
N)r9 Z
getservbyportr6 r: )r; protonamer+ r+ r. r s
c C s. yt jt j| W n t jk
r( dS X dS )zl Check IPv4 address.
@param ip address string
@return True if address is valid, else False
FT)r9 inet_ptonZAF_INETr: )ipr+ r+ r. r s
c C s
| j dS )z Normalize the IPv6 address
This is mostly about converting URL-like IPv6 address to normal ones.
e.g. [1234::4321] --> 1234:4321
z[])r7 )rW r+ r+ r. normalizeIP6 s rX c C s2 yt jt jt| W n t jk
r, dS X dS )zl Check IPv6 address.
@param ip address string
@return True if address is valid, else False
FT)r9 rV ZAF_INET6rX r: )rW r+ r+ r. r s
c C s d| krN| d | j d }| | j dd d }t|dk sHt|dk rVdS n| }d }t|sbdS |rd|krvt|S y t|}W n tk
r dS X |dk s|dkrdS dS )N/r1 F.r$ T)indexrA r r6 r8 )rW addrmaskr- r+ r+ r. r - s& c C s
| j tS )N) translateNOPRINT_TRANS_TABLE)Zrule_strr+ r+ r. r# D s c C s d| krN| d | j d }| | j dd d }t|dk sHt|dk rVdS n| }d }t|sbdS |ry t|}W n tk
r dS X |dk s|dkrdS dS )NrY r1 Fr$ T)r\ rA r r6 r8 )rW r] r^ r- r+ r+ r. r G s" c C s` y t | }W n: tk
rF ytj| W n tjk
r@ dS X Y nX |dk sX|dkr\dS dS )NFr$ T)r6 r8 r9 Zgetprotobynamer: )Zprotocolr- r+ r+ r. r
\ s c C s4 | st | dkrdS xdD ]}|| kr dS q W dS ) z Check interface string
@param interface string
@return True if interface is valid (maximum 16 chars and does not contain ' ', '/', '!', ':', '*'), else False
F rY !*T)rd rY re rf )rA )Zifacechr+ r+ r. r k s
c C s< yt | d}W n tk
r" dS X |dkr8|dkr8dS dS )Nr$ Fl T)r6 r8 )valrJ r+ r+ r. r ~ s c C s t jjtsdS y"ttd} | j }W dQ R X W n tk
rF dS X t jjd| s\dS y&td| d} | j }W dQ R X W n tk
r dS X d|krdS dS )zv Check if firewalld is active
@return True if there is a firewalld pid file and the pid is used by firewalld
FrNz/proc/%sz/proc/%s/cmdlineZ firewalldT)ospathexistsr' openreadline Exception)fdpidZcmdliner+ r+ r. r
s" c C sb y*t jjtst jtd tjddtddS tk
r\ } ztj d| W Y d d } ~ X nX d S )Ni Zwtztemp.F)modeprefixdirdeletez#Failed to create temporary file: %s)
rj rk rl r& mkdirtempfileZNamedTemporaryFilero r% r: )msgr+ r+ r. r s
c C sX y t | d
}|j S Q R X W n4 tk
rR } ztjd| |f W Y d d }~X nX d S )Nri z Failed to read file "%s": %s)rm readlinesro r% r: )filenamefer+ r+ r. r s $c C s\ y$t | d}|j| W d Q R X W n2 tk
rV } ztjd| |f dS d }~X nX dS )Nwz Failed to write to file "%s": %sFT)rm writero r% r: )rz liner{ r| r+ r+ r. r s c C s( | dkrt ddS | dkr$t ddS dS )Nipv4z /proc/sys/net/ipv4/ip_forwardz1
ipv6z&/proc/sys/net/ipv6/conf/all/forwardingF)r )ipvr+ r+ r. r s
c C s | j ddj ddS )N_r< z
nf-conntrack-rG )replace)moduler+ r+ r. get_nf_conntrack_short_name s r c C s t | }|d
ks<|d ks<|d ks 65535z'%s': port is invalidz'%s': port is ambiguousz'%s': range start >= endFTr4 r3 r4 r3 )r rA r% Zdebug2)r; rH r+ r+ r. r s c C s( | dkrt |S | dkr t|S dS d S )Nr r F)r r )r sourcer+ r+ r. r s
c C s( | dkrt |S | dkr t|S dS d S )Nr r F)r r )r r r+ r+ r. r s
c C sR t | dkrNx dD ]}| | dkrdS qW x dD ]}| | tjkr0dS q0W dS dS )N r2 rF Fr$ r1
rc T )r2 r r r r ) r$ r1 r r r r r r r r r rc )rA stringZ hexdigits)Zmacr- r+ r+ r. r s
c C s( g }x | D ]}||kr
|j | q
W |S )N)rD )Z_listoutputrJ r+ r+ r. r s
c C sH y.t jd| }t|j d j } |j W n tk
rB dS X | S )z Get parent for pid z ps -o ppid -h -p %d 2>/dev/nullr$ N)rj popenr6 ry r7 closero )rq r{ r+ r+ r. r s c C sB ddl m} ddlm} ttt|j }d|t| td S )z
iptables limits length of chain to (currently) 28 chars.
The longest chain we create is POST__allow,
which leaves 28 - 11 = 17 chars for .
r$ )POLICY_CHAIN_PREFIX) SHORTCUTS Z_allow)Zfirewall.core.ipXtablesr firewall.core.baser maxrM rA values)r r longest_shortcutr+ r+ r. r" s c C s. ddl m} ttt| j }d|td S )z
Netfilter limits length of chain to (currently) 28 chars.
The longest chain we create is FWDI__allow,
which leaves 28 - 11 = 17 chars for .
r$ )r r Z__allow)r r r rM rA r )r r r+ r+ r. r s c C sT t | dk s t | tjdkr"dS x,| D ]$}|tjkr(|tjkr(|d kr(dS q(W dS )
Nr1 SC_LOGIN_NAME_MAXFrZ r< r $T)rZ r< r r )rA rj sysconfr Z
ascii_lettersZdigits)usercr+ r+ r. r s
c C sD t | tr,y t| } W n tk
r* dS X | dkr@| dkr@dS dS ) NFr$ r2 r) r1 Tl i)r5 strr6 r8 )Zuidr+ r+ r. r ( s
c C sJ t | dk st | dkr dS xd
D ]}|| kr"dS q"W | d dkrFdS d S ) Nr1 i F|
r$ rY T)r r r )rA )Zcommandrg r+ r+ r. r 2 s
c C s | j d}t|dkrdS |d dkr>|d dd dkr>dS |d dd d
krVdS |d dd d krndS t|d d k rdS d
S )NrF r r Fr$ rootr2 Z_ur1 Z_rZ_tr T)r r r4 r4 r4 )r@ rA )contextrE r+ r+ r. r < s
c C s8 dt tkr djdd | D S djdd | D S d S )Nquoterd c s s | ]}t j|V qd S )N)shlexr )r, ar+ r+ r. P s zjoinArgs..c s s | ]}t j|V qd S )N)pipesr )r, r r+ r+ r. r R s )rt r rC )argsr+ r+ r. r N s c C s8 t r*t| tr*t| } tj| }tt|S tj| S d S )N)r r5 unicoder r r@ rM r )_stringrE r+ r+ r. r T s
c C s t | tr| jddS | S )z bytes to unicode zUTF-8r )r5 bytesdecode)r r+ r+ r. r ] s
c C s t | ts| jddS | S )z unicode to bytes zUTF-8r )r5 r encode)r r+ r+ r. r c s
c C s t rt| tr| jddS | S )z" unicode to bytes only if Python 2zUTF-8r )r r5 r r )r r+ r+ r. r! i s )rF )9__all__r9 rj Zos.pathr r r sysrw Zfirewall.core.loggerr% Zfirewall.configr& r' versionr rB r` r r r rI rR rS r r rX r r r# r r
r r r
r r r r r r r r r r r r" r r r r r r r r r r! r+ r+ r+ r. sz
:
&+