3
Yj @ sd d dl mZ d dlZeejd< d dlZd dlZd dlZd dlZd dl Zd dl
m Z d dl m
Z
d dlmZ d dlmZ d dlmZmZmZ d d lmZ d d
lmZ d d lmZ d d l m Z d d
l m Z d dl m!Z! d dl"m#Z# d dl$m%Z% d dl&m'Z' d dl(m)Z) d dl*m+Z+ d dl,m-Z-m.Z.m/Z/m0Z0m1Z1m2Z2m3Z3 d dl
m4Z4 d dl5m6Z6 G dd dejj7j8Z9dS ) )GObjectNZgobject)config)DEFAULT_ZONE_TARGET)Watcher)log)handle_exceptionsdbus_handle_exceptionsdbus_service_method)FirewallDConfigIcmpType)FirewallDConfigService)FirewallDConfigZone)FirewallDConfigPolicy)FirewallDConfigIPSet)FirewallDConfigHelper)IcmpType)IPSet)Helper)LockdownWhitelist)Direct)dbus_to_pythoncommand_of_sendercontext_of_sender
uid_of_sender user_of_uid%dbus_introspection_prepare_properties!dbus_introspection_add_properties)errors)
FirewallErrorc s@ e Zd ZdZdZejjZe fddZ
e dd Z e dd Z e d d
Z
e d d Ze d
d Ze dd Ze dd Ze dd Ze dd Ze dd Ze dd Ze dd Ze d d Ze d d Ze d!d" Ze d#d$ Ze d%d& Ze d'd( Z e d)d* Z e d+d, Z e d-d. Z e d/d0 Z e!d1d2 Z"e!d3d4 Z#e!d5d6 Z$e%ej&d7d8d9e!dd;d<Z'e%ej&d=d>d9e!dd?d@Z(e)jj*j+ejje%ej&dAdBe!ddCdDZ,ej-j.ej&dEdFdGdH Z/e)jj*j+ejj0e%ej1d=dIe!d fdJdK Z2e%ejj3e4j5dIe!ddLdMZ6e%ejj3e4j5dBe!ddNdOZ7ej-j.ejj3e!dPdQ Z8e%ejj3d=dBe!ddRdSZ9e%ejj3d=dBe!ddTdUZ:e%ejj3d=dVd9e!ddWdXZ;e%ejj3dYdIe!ddZd[Ze%ejj3d=dVd9e!dd`daZ?e%ejj3dYdIe!ddbdcZ@e%ejj3d=dBe!ddddeZAe%ejj3d=dBe!ddfdgZBe%ejj3d=dVd9e!ddhdiZCe%ejj3dYdIe!ddjdkZDe%ejj3dldBe!d dmdnZEe%ejj3dldBe!ddodpZFe%ejj3dldVd9e!ddqdrZGe%ejj3dsdIe!ddtduZHe%ejjIdvdIe!ddwdxZJe%ejjIdYdIe!ddydzZKe%ejjId=d{d9e!dd|d}ZLe%ejjId=eMj5 d{d9e!dd~dZNej-j.ejjId=dFe!dd ZOe%ejjIdvdIe!dddZPe%ejjIdYdIe!d ddZQe%ejjId=d{d9e!d
ddZRe%ejjId=eSj5 d{d9e!d ddZTej-j.ejjId=dFe!dd ZUe%ejjIdvdIe!d ddZVe%ejjIdYdIe!d
ddZWe%ejjId=d{d9e!dddZXe%ejjIdd{d9e!dddZYe%ejjIdd{d9e!dddZZej-j.ejjId=dFe!dd Z[e%ejjIdvdIe!dddZ\e%ejjIdYdIe!dddZ]e%ejjId=d{d9e!dddZ^e%ejjId=d=d9e!dddZ_e%ejjId=d=d9e!dddZ`e%ejjIdd{d9e!dddZae%ejjIdd{d9e!dddZbej-j.ejjId=dFe!dd Zce%ejjIdvdIe!dddZde%ejjIdYdIe!dddZee%ejjId=d{d9e!dddZfe%ejjIdd{d9e!dddZgej-j.ejjId=dFe!dd Zhe%ejjIdvdIe!d ddZie%ejjIdYdIe!d ddZje%ejjId=d{d9e!d ddZke%ejjId=elj5 d{d9e!d ddZmej-j.ejjId=dFe!dd Zne%ejjoepj5dIe!d ddZqe%ejjoepj5dBe!d!ddZrej-j.ejjoe!ddĄ Zse%ejjoddBe!d"ddDŽZte%ejjoddBe!d#ddɄZue%ejjoddVd9e!d$dd˄Zve%ejjod7dYd9e!d%dd̈́Zwe%ejjoddd9e!d&ddфZxe%ejjoddBe!d'ddԄZye%ejjoddBe!d(ddքZze%ejjoddVd9e!d)ddZ{e%ejjoddBe!d*ddڄZ|e%ejjoddd9e!d+dd݄Z}e%ejjoddd9e!d,ddZ~e%ejjoddBe!d-ddZe%ejjoddBe!d.ddZe%ejjoddVd9e!d/ddZe%ejjod=dd9e!d0ddZe%ejjoddIe!d1ddZ ZS (2 FirewallDConfigzFirewallD main classTc s t t| j|| || _|d | _|d | _| j t| jd| _ | j j
tj | j j
tj | j j
tj
| j j
tj | j j
tj | j j
tj | j j
tj | j j
tj | j j
tj | j j
tj | j j
tj | j j
tj tjjtjr>xBttjtjD ].}dtj|f }tjj|r | j j
| q W | j j tj | j j tj | j j tj t | tj!j"ddddddddddddd d S )Nr z%s/%sZ readwrite)
CleanupOnExitCleanupModulesOnExit
IPv6_rpfilterLockdown MinimalMarkIndividualCalls LogDeniedAutomaticHelpersFirewallBackendFlushAllOnReload RFC3964_IPv4AllowZoneDrifting)#superr __init__r busnamepath
_init_varsr
watch_updaterwatcher
add_watch_dirFIREWALLD_IPSETSETC_FIREWALLD_IPSETSFIREWALLD_ICMPTYPESETC_FIREWALLD_ICMPTYPESFIREWALLD_HELPERSETC_FIREWALLD_HELPERSFIREWALLD_SERVICESETC_FIREWALLD_SERVICESFIREWALLD_ZONESETC_FIREWALLD_ZONESFIREWALLD_POLICIESETC_FIREWALLD_POLICIESosexistssortedlistdirisdirZadd_watch_fileLOCKDOWN_WHITELISTFIREWALLD_DIRECTFIREWALLD_CONFr dbusDBUS_INTERFACE_CONFIG)selfZconfargskwargsfilenamer0 ) __class__ /usr/lib/python3.6/config.pyr. F sP
zFirewallDConfig.__init__c C s2 g | _ d| _g | _d| _g | _d| _g | _d| _g | _d| _ g | _
d| _ x$| j j
D ]}| j| j j| qTW x$| j j D ]}| j| j j| qzW x$| j j D ]}| j| j j| qW x$| j j D ]}| j| j j| qW x$| j j D ]}| j| j j| qW x&| j j D ]}| j | j j | qW d S )Nr ) ipsets ipset_idx icmptypes icmptype_idxservices service_idxzoneszone_idxhelpers
helper_idxpolicy_objectspolicy_object_idxr Z
get_ipsets _addIPSetZ get_ipsetZ
get_icmptypes _addIcmpTypeZ get_icmptypeZ get_services _addServiceZ get_serviceZ get_zones_addZoneZget_zoneZ get_helpers
_addHelperZ
get_helperZget_policy_objects
_addPolicyZget_policy_object)rK ipseticmptypeservicezonehelperpolicyrP rP rQ r1 t s0 zFirewallDConfig._init_varsc C s d S )NrP )rK rP rP rQ __del__ s zFirewallDConfig.__del__c C s x&t | jdkr&| jj }|j ~qW x&t | jdkrN| jj }|j ~q*W x&t | jdkrv| jj }|j ~qRW x&t | jdkr| jj }|j ~qzW x&t | jdkr| jj }|j ~qW x&t | jdkr| jj }|j ~qW | j d S )Nr )
lenrR pop
unregisterrT rV rX rZ r\ r1 )rK itemrP rP rQ reload s2
zFirewallDConfig.reloadc C sJ |t jkr| jt jj}tjdt j y| j j W n2 tk
rf } ztj d||f d S d }~X nX | jt jjj
}x2t |j D ]"}||kr|| || kr||= qW t
|dkr| jt jj|g d S |jt js|jt jo|jdry| j j|\}}W n4 tk
r< } ztj d||f d S d }~X nX |dkrT| j| n*|dkrj| j| n|dkrF| j| n|jt js|jt jr8|jdr8y| j j|\}}W n4 tk
r } ztj d ||f d S d }~X nX |dkr
| j| n*|dkr | j| n|dkrF| j | n|jt j sT|jt j rr|jdry| j j |\}}W n4 tk
r } ztj d
||f d S d }~X nX |dkr| j | n*|dkr| j!| n|dkrn| j"| n|jt j rF|j#t j d j$d }t
|d
k s&d |kr*d S t%j&j'|rT| j(j)|sn| j(j*| n| j(j)|rF| j(j+| n|jt j,s|jt j-r(|jdr(y| j j.|\}}W n4 tk
r } ztj d||f d S d }~X nX |dkr| j/| n*|dkr| j0| n|dkrF| j1| n |jt j2sD|jt j3r|jdry| j j4|\}}W n4 tk
r } ztj d||f d S d }~X nX |dkr| j5| n*|dkr| j6| n|dkrF| j7| nh|t j8kr:y| j j9 W n4 tk
r, } ztj d||f d S d }~X nX | j: n |t j;kry| j j< W n4 tk
r } ztj d||f d S d }~X nX | j= n|jt j>s|jt j?rF|jdrFy| j j@|\}}W n4 tk
r } ztj d||f d S d }~X nX |dkr | jA| n*|dkr2| jB| n|dkrF| jC| d S )Nz,config: Reloading firewalld config file '%s'z+Failed to load firewalld.conf file '%s': %sr z.xmlz%Failed to load icmptype file '%s': %snewremoveupdatez$Failed to load service file '%s': %sz!Failed to load zone file '%s': %s /r z"Failed to load ipset file '%s': %sz#Failed to load helper file '%s': %sz/Failed to load lockdown whitelist file '%s': %sz)Failed to load direct rules file '%s': %sz#Failed to load policy file '%s': %s)Dr rH GetAllrI rJ r debug1Zupdate_firewalld_conf Exceptionerrorcopylistkeysrk PropertiesChanged
startswithr7 r8 endswithZupdate_icmptype_from_pathr_ removeIcmpType_updateIcmpTyper; r< Zupdate_service_from_pathr`
removeService_updateServicer= r> Zupdate_zone_from_pathra
removeZone _updateZonereplacestriprA r0 rE r3 Z has_watchr4 Z remove_watchr5 r6 Zupdate_ipset_from_pathr^ removeIPSet _updateIPSetr9 r: Zupdate_helper_from_pathrb removeHelper
_updateHelperrF Zupdate_lockdown_whitelistLockdownWhitelistUpdatedrG Z
update_directUpdatedr? r@ Z update_policy_object_from_pathrc removePolicy
_updatePolicy) rK nameZ old_propsmsgZpropskeyZwhatobj_namerP rP rQ r2 s
z FirewallDConfig.watch_updaterc C sP t | | j|| j| jdtjj| jf }| jj| | jd7 _| j|j |S )Nz%s/%dr )
r
r rU r/ rI ZDBUS_PATH_CONFIG_ICMPTYPErT append
IcmpTypeAddedr )rK r config_icmptyperP rP rQ r_ A s z FirewallDConfig._addIcmpTypec C sP xJ| j D ]@}|jj|jkr|jj|jkr|jj|jkr||_|j|j qW d S )N)rT r r r0 rN r )rK r re rP rP rQ r M s z FirewallDConfig._updateIcmpTypec C s d}xT| j D ]J}|j }|j|| kr || j|j | jj|j||_|j|jj q W x\| jD ]R}|j }d|krb|j|d krb|d j|j | jj |j||_|j|jj qbW x:| j
D ]0}|j|kr|j |j |j | j
j| ~qW d S )N Z icmp_blocks)
rX getSettingsr rq r set_zone_configr r r\ set_policy_object_config_dictrT Removedrm )rK r indexrg settingsri re rP rP rQ r V s&
z FirewallDConfig.removeIcmpTypec C sP t | | j|| j| jdtjj| jf }| jj| | jd7 _| j|j |S )Nz%s/%dr )
r r rW r/ rI ZDBUS_PATH_CONFIG_SERVICErV r ServiceAddedr )rK r config_servicerP rP rQ r` p s zFirewallDConfig._addServicec C sP xJ| j D ]@}|jj|jkr|jj|jkr|jj|jkr||_|j|j qW d S )N)rV r r r0 rN r )rK r rf rP rP rQ r { s z FirewallDConfig._updateServicec C s d}xT| j D ]J}|j }|j|| kr || j|j | jj|j||_|j|jj q W x\| jD ]R}|j }d|krb|j|d krb|d j|j | jj |j||_|j|jj qbW x:| j
D ]0}|j|kr|j |j |j | j
j| ~qW d S )Nr rV )
rX r r rq r r r r r\ r rV r rm )rK r r rg r ri rf rP rP rQ r s&
z FirewallDConfig.removeServicec C sP t | | j|| j| jdtjj| jf }| jj| | jd7 _| j|j |S )Nz%s/%dr )
r r rY r/ rI ZDBUS_PATH_CONFIG_ZONErX r ZoneAddedr )rK r config_zonerP rP rQ ra s zFirewallDConfig._addZonec C sP xJ| j D ]@}|jj|jkr|jj|jkr|jj|jkr||_|j|j qW d S )N)rX r r r0 rN r )rK r rg rP rP rQ r s
zFirewallDConfig._updateZonec C s@ x:| j D ]0}|j|kr|j|j |j | j j| ~qW d S )N)rX r r r rm rq )rK r rg rP rP rQ r s
zFirewallDConfig.removeZonec C sP t | | j|| j| jdtjj| jf }| jj| | jd7 _| j|j |S )Nz%s/%dr )
r
r r] r/ rI ZDBUS_PATH_CONFIG_POLICYr\ r PolicyAddedr )rK r
config_policyrP rP rQ rc s zFirewallDConfig._addPolicyc C sP xJ| j D ]@}|jj|jkr|jj|jkr|jj|jkr||_|j|j qW d S )N)r\ r r r0 rN r )rK r ri rP rP rQ r s
z FirewallDConfig._updatePolicyc C s@ x:| j D ]0}|j|kr|j|j |j | j j| ~qW d S )N)r\ r r r rm rq )rK r ri rP rP rQ r s
z FirewallDConfig.removePolicyc C sP t | | j|| j| jdtjj| jf }| jj| | jd7 _| j|j |S )Nz%s/%dr )
r r rS r/ rI ZDBUS_PATH_CONFIG_IPSETrR r
IPSetAddedr )rK r config_ipsetrP rP rQ r^ s zFirewallDConfig._addIPSetc C sP xJ| j D ]@}|jj|jkr|jj|jkr|jj|jkr||_|j|j qW d S )N)rR r r r0 rN r )rK r rd rP rP rQ r s
z FirewallDConfig._updateIPSetc C s@ x:| j D ]0}|j|kr|j|j |j | j j| ~qW d S )N)rR r r r rm rq )rK r rd rP rP rQ r s
zFirewallDConfig.removeIPSetc C sP t | | j|| j| jdtjj| jf }| jj| | jd7 _| j|j |S )Nz%s/%dr )
r r r[ r/ rI ZDBUS_PATH_CONFIG_HELPERrZ r HelperAddedr )rK r
config_helperrP rP rQ rb s zFirewallDConfig._addHelperc C sP xJ| j D ]@}|jj|jkr|jj|jkr|jj|jkr||_|j|j qW d S )N)rZ r r r0 rN r )rK r rh rP rP rQ r s
z FirewallDConfig._updateHelperc C s@ x:| j D ]0}|j|kr|j|j |j | j j| ~qW d S )N)rZ r r r rm rq )rK r rh rP rP rQ r s
z FirewallDConfig.removeHelperc C s | j j r|d kr tjd d S tj }t||}| j jd|rDd S t||}| j jd|r`d S t |}| j jd|rzd S t
||}| j jd|rd S t t j
dd S )Nz&Lockdown not possible, sender not set.contextuidusercommandzlockdown is enabled)r Zlockdown_enabledr rx rI Z SystemBusr Z access_checkr r r r r Z
ACCESS_DENIED)rK senderZbusr r r r rP rP rQ accessCheck s$
zFirewallDConfig.accessCheckc C sF |dkrt jjd| | jj j|}|dkrH|d kr>tj}t j|S |dkrr|d kr`tj}nt |}t j
|S |dkr|d krtj rdnd}t j|S |dkr|d krtj rdnd}t j|S |dk r|d k rtj
rdnd}t j|S |dkr |d krtjrdnd}t j|S |dkrL|d krBtjr>dnd}t j|S |dkrp|d krftj}t j|S |d kr|d krtj}t j|S |d
kr|d krtj}t j|S |d kr|d krtjrdnd}t j|S |d kr|d kr
tjrdnd}t j|S |d
krB|d kr8tjr4dnd}t j|S d S )N DefaultZoner% r! r" r$ r# r& r' r( r) r* r+ r, zDorg.freedesktop.DBus.Error.InvalidArgs: Property '%s' does not existyesno)
r r% r! r" r$ r# r& r' r( r) r* r+ r, )rI
exceptions
DBusExceptionr get_firewalld_confgetZ
FALLBACK_ZONEStringZFALLBACK_MINIMAL_MARKintInt32ZFALLBACK_CLEANUP_ON_EXITZ FALLBACK_CLEANUP_MODULES_ON_EXITZFALLBACK_LOCKDOWNZFALLBACK_IPV6_RPFILTERZFALLBACK_INDIVIDUAL_CALLSZFALLBACK_LOG_DENIEDZFALLBACK_AUTOMATIC_HELPERSZFALLBACK_FIREWALL_BACKENDZ FALLBACK_FLUSH_ALL_ON_RELOADZFALLBACK_RFC3964_IPV4Z FALLBACK_ALLOW_ZONE_DRIFTING)rK propvaluerP rP rQ
_get_property+ s|
z FirewallDConfig._get_propertyc C sT |dkrt j| j|S |dkr0t j| j|S |dkrHt j| j|S |dkr`t j| j|S |dkrxt j| j|S |dkrt j| j|S |dkrt j| j|S |dkrt j| j|S |d krt j| j|S |d
k rt j| j|S |d kr t j| j|S |d kr&t j| j|S |d
kr@t j| j|S t jjd| d S )Nr r% r! r" r$ r# r& r' r( r) r* r+ r, zDorg.freedesktop.DBus.Error.InvalidArgs: Property '%s' does not exist)rI r r r r r )rK r rP rP rQ _get_dbus_propertyo s:
z"FirewallDConfig._get_dbus_propertyZssv) in_signature
out_signatureNc C sx t |t}t |t}tjd|| |tjjkr8| j|S |tjjtjj gkr^tj
j d| ntj
j d| | j|S )Nzconfig.Get('%s', '%s')zDorg.freedesktop.DBus.Error.InvalidArgs: Property '%s' does not existzJorg.freedesktop.DBus.Error.UnknownInterface: Interface '%s' does not exist) r strr rv r rI rJ r DBUS_INTERFACE_CONFIG_DIRECT DBUS_INTERFACE_CONFIG_POLICIESr r )rK interface_name
property_namer rP rP rQ Get s
zFirewallDConfig.Getsza{sv}c
C sx t |t}tjd| i }|tjjkrDxBdD ]}| j|||< q,W n&|tjjtjj gkrZntj
j d| tj |ddS )Nzconfig.GetAll('%s')r r% r! r" r$ r# r& r' r( r) r* r+ r, zJorg.freedesktop.DBus.Error.UnknownInterface: Interface '%s' does not existZsv) signature)
r r% r! r" r$ r# r& r' r( r) r* r+ r, )
r r r rv r rI rJ r r r r r Z
Dictionary)rK r r retxrP rP rQ ru s"
zFirewallDConfig.GetAllZssv)r c C s t |t}t |t}t |}tjd||| | j| |tjjkr|dkrz|dkrv|j dkrvt t
j d||f |dkr|tj krt t
j d||f |dkr|tj
krt t
j d||f |d k r|j dk rt t
j d||f |d
kr|j dkrt t
j d||f |d krF|j dkrFt t
j d||f | jj j|| | jj j | j|||ig n |dkrntjjd| n8|tjjtjjgkrtjjd| ntjjd| d S ) Nz config.Set('%s', '%s', '%s')r! r$ r" r# r& r' r) r* r+ r, r r truefalsez '%s' for %sr% r( zDorg.freedesktop.DBus.Error.InvalidArgs: Property '%s' does not existzJorg.freedesktop.DBus.Error.UnknownInterface: Interface '%s' does not exist)
r! r$ r" r# r& r' r) r* r+ r, )r! r$ r" r# r& )r r r r )r r r r )r r r r )r r r r )r% r( )r r r rv r r rI rJ lowerr r Z
INVALID_VALUEZLOG_DENIED_VALUESZFIREWALL_BACKEND_VALUESr setwriter| r r r r )rK r r Z new_valuer rP rP rQ Set sz
zFirewallDConfig.Setzsa{sv}as)r c C s. t |t}t |}t |}tjd||| d S )Nz*config.PropertiesChanged('%s', '%s', '%s'))r r r rv )rK r Zchanged_propertiesZinvalidated_propertiesrP rP rQ r| s
z!FirewallDConfig.PropertiesChanged)r c s4 t jd tt| j| j| jj }t| |t j
j S )Nzconfig.Introspect()) r Zdebug2r- r
Introspectr0 r/ Zget_busr r rI rJ )rK r data)rO rP rQ r s
zFirewallDConfig.Introspectc C s t jd | jj jj S )Nz&config.policies.getLockdownWhitelist())r rv r get_policieslockdown_whitelist
export_config)rK r rP rP rQ getLockdownWhitelist s
z$FirewallDConfig.getLockdownWhitelistc C s@ t jd t|}| jj jj| | jj jj | j d S )Nz)config.policies.setLockdownWhitelist(...)) r rv r r r r
import_configr r )rK r r rP rP rQ setLockdownWhitelist& s
z$FirewallDConfig.setLockdownWhitelistc C s t jd d S )Nz*config.policies.LockdownWhitelistUpdated())r rv )rK rP rP rQ r 0 s z(FirewallDConfig.LockdownWhitelistUpdatedc C s^ t |}tjd| | j| t| j }||d krBttj||d j | | j
| d S )Nz1config.policies.addLockdownWhitelistCommand('%s')r ) r r rv r rz r r r ALREADY_ENABLEDr r )rK r r r rP rP rQ addLockdownWhitelistCommand7 s
z+FirewallDConfig.addLockdownWhitelistCommandc C s^ t |}tjd| | j| t| j }||d krBttj||d j | | j
| d S )Nz4config.policies.removeLockdownWhitelistCommand('%s')r ) r r rv r rz r r r NOT_ENABLEDrq r )rK r r r rP rP rQ removeLockdownWhitelistCommandD s
z.FirewallDConfig.removeLockdownWhitelistCommandbc C s$ t |}tjd| || j d kS )Nz3config.policies.queryLockdownWhitelistCommand('%s')r )r r rv r )rK r r rP rP rQ queryLockdownWhitelistCommandR s z-FirewallDConfig.queryLockdownWhitelistCommandasc C s t jd | j d S )Nz.config.policies.getLockdownWhitelistCommands()r )r rv r )rK r rP rP rQ getLockdownWhitelistCommands[ s
z,FirewallDConfig.getLockdownWhitelistCommandsc C s^ t |}tjd| | j| t| j }||d krBttj||d j | | j
| d S )Nz1config.policies.addLockdownWhitelistContext('%s')r ) r r rv r rz r r r r r r )rK r r r rP rP rQ addLockdownWhitelistContextd s
z+FirewallDConfig.addLockdownWhitelistContextc C s^ t |}tjd| | j| t| j }||d krBttj||d j | | j
| d S )Nz4config.policies.removeLockdownWhitelistContext('%s')r ) r r rv r rz r r r r rq r )rK r r r rP rP rQ removeLockdownWhitelistContextq s
z.FirewallDConfig.removeLockdownWhitelistContextc C s$ t |}tjd| || j d kS )Nz3config.policies.queryLockdownWhitelistContext('%s')r )r r rv r )rK r r rP rP rQ queryLockdownWhitelistContext s z-FirewallDConfig.queryLockdownWhitelistContextc C s t jd | j d S )Nz.config.policies.getLockdownWhitelistContexts()r )r rv r )rK r rP rP rQ getLockdownWhitelistContexts s
z,FirewallDConfig.getLockdownWhitelistContextsc C s^ t |}tjd| | j| t| j }||d krBttj||d j | | j
| d S )Nz.config.policies.addLockdownWhitelistUser('%s') ) r r rv r rz r r r r r r )rK r r r rP rP rQ addLockdownWhitelistUser s
z(FirewallDConfig.addLockdownWhitelistUserc C s^ t |}tjd| | j| t| j }||d krBttj||d j | | j
| d S )Nz1config.policies.removeLockdownWhitelistUser('%s')r ) r r rv r rz r r r r rq r )rK r r r rP rP rQ removeLockdownWhitelistUser s
z+FirewallDConfig.removeLockdownWhitelistUserc C s$ t |}tjd| || j d kS )Nz0config.policies.queryLockdownWhitelistUser('%s')r )r r rv r )rK r r rP rP rQ queryLockdownWhitelistUser s z*FirewallDConfig.queryLockdownWhitelistUserc C s t jd | j d S )Nz+config.policies.getLockdownWhitelistUsers()r )r rv r )rK r rP rP rQ getLockdownWhitelistUsers s
z)FirewallDConfig.getLockdownWhitelistUsersic C s^ t |}tjd| | j| t| j }||d krBttj||d j | | j
| d S )Nz+config.policies.addLockdownWhitelistUid(%d) ) r r rv r rz r r r r r r )rK r r r rP rP rQ addLockdownWhitelistUid s
z'FirewallDConfig.addLockdownWhitelistUidc C s^ t |}tjd| | j| t| j }||d krBttj||d j | | j
| d S )Nz.config.policies.removeLockdownWhitelistUid(%d)r ) r r rv r rz r r r r rq r )rK r r r rP rP rQ removeLockdownWhitelistUid s
z*FirewallDConfig.removeLockdownWhitelistUidc C s$ t |}tjd| || j d kS )Nz-config.policies.queryLockdownWhitelistUid(%d)r )r r rv r )rK r r rP rP rQ queryLockdownWhitelistUid s z)FirewallDConfig.queryLockdownWhitelistUidZaic C s t jd | j d S )Nz*config.policies.getLockdownWhitelistUids()r )r rv r )rK r rP rP rQ getLockdownWhitelistUids s
z(FirewallDConfig.getLockdownWhitelistUidsZaoc C s t jd | jS )z"list ipsets objects paths
zconfig.listIPSets())r rv rR )rK r rP rP rQ
listIPSets s
zFirewallDConfig.listIPSetsc C s4 t jd g }x | jD ]}|j|jj qW t|S )zget ipset names
zconfig.getIPSetNames())r rv rR r r r rC )rK r rR r rP rP rQ
getIPSetNames s
z FirewallDConfig.getIPSetNamesoc C sF t |t}tjd| x | jD ]}|jj|kr |S q W ttj |dS )z-object path of ipset with given name
zconfig.getIPSetByName('%s')N)
r r r rv rR r r r r Z
INVALID_IPSET)rK rd r r rP rP rQ getIPSetByName s
z FirewallDConfig.getIPSetByNamec C sD t |t}t |}tjd| | j| | jj||}| j|}|S )z/add ipset with given name and settings
zconfig.addIPSet('%s'))r r r rv r r Z new_ipsetr^ )rK rd r r r r rP rP rQ addIPSet s
zFirewallDConfig.addIPSetc C s t |t}tjd| d S )Nzconfig.IPSetAdded('%s'))r r r rv )rK rd rP rP rQ r s
zFirewallDConfig.IPSetAddedc C s t jd | jS )z%list icmptypes objects paths
zconfig.listIcmpTypes())r rv rT )rK r rP rP rQ
listIcmpTypes s
z FirewallDConfig.listIcmpTypesc C s4 t jd g }x | jD ]}|j|jj qW t|S )zget icmptype names
zconfig.getIcmpTypeNames())r rv rT r r r rC )rK r rT r rP rP rQ getIcmpTypeNames( s
z FirewallDConfig.getIcmpTypeNamesc C sF t |t}tjd| x | jD ]}|jj|kr |S q W ttj |dS )z0object path of icmptype with given name
z config.getIcmpTypeByName('%s')N)
r r r rv rT r r r r ZINVALID_ICMPTYPE)rK re r r rP rP rQ getIcmpTypeByName3 s
z!FirewallDConfig.getIcmpTypeByNamec C sD t |t}t |}tjd| | j| | jj||}| j|}|S )z2add icmptype with given name and settings
zconfig.addIcmpType('%s'))r r r rv r r Z new_icmptyper_ )rK re r r r r rP rP rQ addIcmpType@ s
zFirewallDConfig.addIcmpTypec C s t jd| d S )Nzconfig.IcmpTypeAdded('%s'))r rv )rK re rP rP rQ r O s z FirewallDConfig.IcmpTypeAddedc C s t jd | jS )z$list services objects paths
zconfig.listServices())r rv rV )rK r rP rP rQ listServicesV s
z FirewallDConfig.listServicesc C s4 t jd g }x | jD ]}|j|jj qW t|S )zget service names
zconfig.getServiceNames())r rv rV r r r rC )rK r rV r rP rP rQ getServiceNames^ s
z FirewallDConfig.getServiceNamesc C sF t |t}tjd| x | jD ]}|jj|kr |S q W ttj |dS )z/object path of service with given name
z config.getServiceByName('%s')N)
r r r rv rV r r r r ZINVALID_SERVICE)rK rf r r rP rP rQ getServiceByNamei s
z FirewallDConfig.getServiceByNamezs(sssa(ss)asa{ss}asa(ss))c C sD t |t}t |}tjd| | j| | jj||}| j|}|S )z1add service with given name and settings
zconfig.addService('%s'))r r r rv r r Z new_servicer` )rK rf r r r r rP rP rQ
addServicev s
zFirewallDConfig.addServicezsa{sv}c C sD t |t}t |}tjd| | j| | jj||}| j|}|S )z1add service with given name and settings
zconfig.addService2('%s'))r r r rv r r Znew_service_dictr` )rK rf r r r r rP rP rQ addService2 s
zFirewallDConfig.addService2c C s t jd| d S )Nzconfig.ServiceAdded('%s'))r rv )rK rf rP rP rQ r s z FirewallDConfig.ServiceAddedc C s t jd | jS )z!list zones objects paths
zconfig.listZones())r rv rX )rK r rP rP rQ listZones s
zFirewallDConfig.listZonesc C s4 t jd g }x | jD ]}|j|jj qW t|S )zget zone names
zconfig.getZoneNames())r rv rX r r r rC )rK r rX r rP rP rQ getZoneNames s
z FirewallDConfig.getZoneNamesc C sF t |t}tjd| x | jD ]}|jj|kr |S q W ttj |dS )z,object path of zone with given name
zconfig.getZoneByName('%s')N)
r r r rv rX r r r r Z INVALID_ZONE)rK rg r r rP rP rQ
getZoneByName s
z FirewallDConfig.getZoneByNamec C sz t |t}tjd| g }x(| jD ] }||jjkr"|j|jj q"W t |dkrjdj
|d|t |f S |rv|d S dS )z4name of zone the given interface belongs to
z config.getZoneOfInterface('%s')r zE (ERROR: interface '%s' is in %s zone XML files, can be only in one)r rs ) r r r rv rX r Z
interfacesr r rk join)rK Zifacer r r rP rP rQ getZoneOfInterface s
z"FirewallDConfig.getZoneOfInterfacec C sz t |t}tjd| g }x(| jD ] }||jjkr"|j|jj q"W t |dkrjdj
|d|t |f S |rv|d S dS )z1name of zone the given source belongs to
z config.getZoneOfSource('%s')r r zB (ERROR: source '%s' is in %s zone XML files, can be only in one)r rs ) r r r rv rX r Zsourcesr r rk r )rK sourcer r r rP rP rQ getZoneOfSource s
z FirewallDConfig.getZoneOfSourcez's(sssbsasa(ss)asba(ssss)asasasasa(ss)b)c C sh t |t}t |}tjd| | j| |d dkrLt|}t|d< t|}| jj ||}| j
|}|S )z.add zone with given name and settings
zconfig.addZone('%s') default) r r r rv r rz r tupler Znew_zonera )rK rg r r Z _settingsr r rP rP rQ addZone s
zFirewallDConfig.addZonec C s` t |t}t |}tjd| | j| d|krD|d dkrDt|d< | jj||}| j|}|S )z.add zone with given name and settings
zconfig.addZone('%s')targetr ) r r r rv r r r Z
new_zone_dictra )rK rg r r r r rP rP rQ addZone2 s
zFirewallDConfig.addZone2c C s t jd| d S )Nzconfig.ZoneAdded('%s'))r rv )rK rg rP rP rQ r s zFirewallDConfig.ZoneAddedc C s t jd | jS )z$list policies objects paths
zconfig.listPolicies())r rv r\ )rK r rP rP rQ listPolicies s
z FirewallDConfig.listPoliciesc C s4 t jd g }x | jD ]}|j|jj qW t|S )zget policy names
zconfig.getPolicyNames())r rv r\ r r r rC )rK r Zpoliciesr rP rP rQ getPolicyNames s
z FirewallDConfig.getPolicyNamesc C sF t |t}tjd| x | jD ]}|jj|kr |S q W ttj |dS )z.object path of policy with given name
z config.getPolicyByName('%s')N)
r r r rv r\ r r r r ZINVALID_POLICY)rK ri r r rP rP rQ getPolicyByName" s
z FirewallDConfig.getPolicyByNamec C sD t |t}t |}tjd| | j| | jj||}| j|}|S )z0add policy with given name and settings
zconfig.addPolicy('%s'))r r r rv r r Znew_policy_object_dictrc )rK ri r r r r rP rP rQ addPolicy/ s
zFirewallDConfig.addPolicyc C s t jd| d S )Nzconfig.PolicyAdded('%s'))r rv )rK ri rP rP rQ r > s zFirewallDConfig.PolicyAddedc C s t jd | jS )z#list helpers objects paths
zconfig.listHelpers())r rv rZ )rK r rP rP rQ listHelpersG s
zFirewallDConfig.listHelpersc C s4 t jd g }x | jD ]}|j|jj qW t|S )zget helper names
zconfig.getHelperNames())r rv rZ r r r rC )rK r rZ r rP rP rQ getHelperNamesO s
z FirewallDConfig.getHelperNamesc C sF t |t}tjd| x | jD ]}|jj|kr |S q W ttj |dS )z.object path of helper with given name
z config.getHelperByName('%s')N)
r r r rv rZ r r r r ZINVALID_HELPER)rK rh r r rP rP rQ getHelperByNameZ s
z FirewallDConfig.getHelperByNamec C sD t |t}t |}tjd| | j| | jj||}| j|}|S )z0add helper with given name and settings
zconfig.addHelper('%s'))r r r rv r r Z
new_helperrb )rK rh r r r r rP rP rQ addHelperg s
zFirewallDConfig.addHelperc C s t |t}tjd| d S )Nzconfig.HelperAdded('%s'))r r r rv )rK rh rP rP rQ r v s
zFirewallDConfig.HelperAddedc C s t jd | jj j S )Nzconfig.direct.getSettings())r rv r
get_directr )rK r rP rP rQ r s
zFirewallDConfig.getSettingsc C s< t jd t|}| jj j| | jj j | j d S )Nzconfig.direct.update())r rv r r r r r r )rK r r rP rP rQ rr s
zFirewallDConfig.updatec C s t jd d S )Nzconfig.direct.Updated())r rv )rK rP rP rQ r s zFirewallDConfig.UpdatedZsssc C s t |}t |}t |}tjd|||f | j| t|||f}t| j }||d krrttj d|||f |d j
| | j | d S )Nz(config.direct.addChain('%s', '%s', '%s')r z chain '%s' already is in '%s:%s') r r rv r r rz r r r r r rr )rK ipvtablechainr idxr rP rP rQ addChain s
zFirewallDConfig.addChainc C s t |}t |}t |}tjd|||f | j| t|||f}t| j }||d krrttj d|||f |d j
| | j | d S )Nz+config.direct.removeChain('%s', '%s', '%s')r z chain '%s' is not in '%s:%s') r r rv r r rz r r r r rq rr )rK r r r r r r rP rP rQ removeChain s
zFirewallDConfig.removeChainc C sJ t |}t |}t |}tjd|||f t|||f}|| j d kS )Nz*config.direct.queryChain('%s', '%s', '%s')r )r r rv r r )rK r r r r r rP rP rQ
queryChain s zFirewallDConfig.queryChainc C sf t |}t |}tjd||f g }x:| j d D ]*}|d |kr4|d |kr4|j|d q4W |S )Nz#config.direct.getChains('%s', '%s')r r r )r r rv r r )rK r r r r r rP rP rQ getChains s zFirewallDConfig.getChainsrs za(sss)c C s t jd | j d S )Nz config.direct.getAllChains()r )r rv r )rK r rP rP rQ getAllChains s
z FirewallDConfig.getAllChainsZsssiasc C s t |}t |}t |}t |}t |}tjd||||dj|f | j| |||||f}t| j }||d krttj d||||f |d j
| | j t | d S )Nz1config.direct.addRule('%s', '%s', '%s', %d, '%s')z','r z"rule '%s' already is in '%s:%s:%s')
r r rv r r rz r r r r r rr r ) rK r r r priorityrL r r r rP rP rQ addRule s
zFirewallDConfig.addRulec C s t |}t |}t |}t |}t |}tjd||||dj|f | j| |||||f}t| j }||d krttj d||||f |d j
| | j t | d S )Nz4config.direct.removeRule('%s', '%s', '%s', %d, '%s')z','r z rule '%s' is not in '%s:%s:%s')
r r rv r r rz r r r r rq rr r ) rK r r r r rL r r r rP rP rQ
removeRule s
zFirewallDConfig.removeRulec C sd t |}t |}t |}t |}t |}tjd||||dj|f |||||f}|| j d kS )Nz3config.direct.queryRule('%s', '%s', '%s', %d, '%s')z','r )r r rv r r )rK r r r r rL r r rP rP rQ queryRule s zFirewallDConfig.queryRulec C s t |}t |}t |}tjd|||f | j| t| j }xF|d d d D ]2}|||f|d |d |d fkrT|d j| qTW | jt| d S )Nz+config.direct.removeRules('%s', '%s', '%s')r r r ) r r rv r rz r rq rr r )rK r r r r r ZrulerP rP rQ removeRules s
zFirewallDConfig.removeRulesza(ias)c C s t |}t |}t |}tjd|||f g }xN| j d D ]>}|d |kr>|d |kr>|d |kr>|j|d |d f q>W |S )Nz(config.direct.getRules('%s', '%s', '%s')r r r r r )r r rv r r )rK r r r r r r rP rP rQ getRules) s $zFirewallDConfig.getRulesz a(sssias)c C s t jd | j d S )Nzconfig.direct.getAllRules()r )r rv r )rK r rP rP rQ getAllRules8 s
zFirewallDConfig.getAllRulesZsasc C s t |}t |}tjd|dj|f | j| ||f}t| j }||d krfttj d||f |d j
| | j | d S )Nz(config.direct.addPassthrough('%s', '%s')z','r zpassthrough '%s', '%s') r r rv r r rz r r r r r rr )rK r rL r r r rP rP rQ addPassthroughA s
z FirewallDConfig.addPassthroughc C s t |}t |}tjd|dj|f | j| ||f}t| j }||d krfttj d||f |d j
| | j | d S )Nz+config.direct.removePassthrough('%s', '%s')z','r zpassthrough '%s', '%s') r r rv r r rz r r r r rq rr )rK r rL r r r rP rP rQ removePassthroughS s
z!FirewallDConfig.removePassthroughc C s@ t |}t |}tjd|dj|f ||f}|| j d kS )Nz*config.direct.queryPassthrough('%s', '%s')z','r )r r rv r r )rK r rL r r rP rP rQ queryPassthroughd s z FirewallDConfig.queryPassthroughZaasc C sN t |}tjd| g }x.| j d D ] }|d |kr(|j|d q(W |S )Nz#config.direct.getPassthroughs('%s')r r r )r r rv r r )rK r r r r rP rP rQ getPassthroughso s z FirewallDConfig.getPassthroughsza(sas)c C s t jd | j d S )Nz"config.direct.getAllPassthroughs()r )r rv r )rK r rP rP rQ getAllPassthroughs{ s
z"FirewallDConfig.getAllPassthroughs)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)__name__
__module__ __qualname____doc__Z
persistentr rI ZPK_ACTION_CONFIGZ default_polkit_auth_requiredr r. r1 rj ro r2 r_ r r r` r r ra r r rc r r r^ r r rb r r r r r r r ZPROPERTIES_IFACEr ru slipZpolkitZ require_authr rf signalr| ZPK_ACTION_INFOZINTROSPECTABLE_IFACEr r r ZDBUS_SIGNATUREr r r r r r r r r r r r r r r r r r r rJ r r r r r r r r r r r r r r r r r r r r r r r r r r r
r r r
r r r r r r r r r r rr r r r r r r r r r r r! r" r# r$ r% r& r'
__classcell__rP rP )rO rQ r > sv . D ! D
r ):Z
gi.repositoryr sysmodulesrA rI Z dbus.serviceZ slip.dbusr, Zslip.dbus.serviceZfirewallr Zfirewall.core.baser Zfirewall.core.watcherr Zfirewall.core.loggerr Zfirewall.server.decoratorsr r r Z firewall.server.config_icmptyper
Z firewall.server.config_servicer Zfirewall.server.config_zoner Z firewall.server.config_policyr
Z firewall.server.config_ipsetr Z firewall.server.config_helperr Zfirewall.core.io.icmptyper Zfirewall.core.io.ipsetr Zfirewall.core.io.helperr Z#firewall.core.io.lockdown_whitelistr Zfirewall.core.io.directr Zfirewall.dbus_utilsr r r r r r r r Zfirewall.errorsr rf ZObjectr rP rP rP rQ s6
$