3
Yjb @ sV d gZ ddlmZmZ ddlZeejd< ddlZddlZddlZddl Z
ddl Z
ddl m
Z
ddlmZ ddlmZ ddlmZ dd lmZ dd
lmZmZmZmZ dd lm Z dd l m Z m Z m Z m!Z!m"Z"m#Z#m$Z$ dd
l%m&Z& ddl'm(Z( ddl)m*Z* ddl+m,Z, ddl-m.Z.m/Z/m0Z0 ddl1m2Z2 ddl m3Z3 ddl4m5Z5 G dd d e
jj6j7Z8dS ) FirewallD )GLibGObjectNZgobject)config)Firewall) Rich_Rule)log)FirewallClientZoneSettings)dbus_handle_exceptionsdbus_service_methodhandle_exceptionsFirewallDBusException)FirewallDConfig)dbus_to_pythoncommand_of_sendercontext_of_sender
uid_of_sender user_of_uid%dbus_introspection_prepare_properties!dbus_introspection_add_properties) check_config)IPSet)IcmpType)Helper)nm_get_bus_name nm_get_connection_of_interfacenm_set_zone_of_connection)ifcfg_set_zone_of_interface)errors)
FirewallErrorc s" e Zd ZdZdZejjZe fddZ
dd Z e dd Z e d d
Z
ed d Zed
d Zedd Zedd Zedd ZeejdddedddZeejdd dedd d Zejjjejjeejd d edd!d"Zej j ejd#d$d%d& Z ejjjejj eej dd'ed fd(d) Z!ejjjejjeejj"d*d*dedd+d,Z#ejjjejjeejj"d*d*dedd-d.Z$ej j ejj"ed/d0 Z%ejjjejjeejj"d*d*dedd1d2Z&ejjjejjeejj"d*d*dedd3d4Z'ejjjejj(eejj)d*d*dedd5d6Z*ejjjejj(eejj)d*d*dedd7d8Z+ejjjejj,eejj)d*d9dedd:d;Z-ej j ejj)d*d$edd? Z/ejjjejj(eejj)dd*dedd@dAZ0ejjjejj(eejj)dd*deddBdCZ1ejjjejj,eejj)dd9deddDdEZ2ejjjejj,eejj)d*dFdeddGdHZ3ej j ejj)dd$edIdJ Z4ej j ejj)dd$edKdL Z5ejjjejj(eejj)dMd*deddNdOZ6ejjjejj(eejj)dMd*deddPdQZ7ejjjejj,eejj)dMd9deddRdSZ8ejjjejj,eejj)d*dTdeddUdVZ9ej j ejj)dMd$edWdX Z:ej j ejj)dMd$edYdZ Z;ejjjejj(eejj)dd*dedd[d\Zejjjejj,eejj)d*dFdeddadbZ?ej j ejj)dd$edcdd Z@ej j ejj)dd$ededf ZAejjjejj(eejj)dd*deddgdhZBejjjejj(eejj)dd*deddidjZCejjjejj,eejj)dd9deddkdlZDejjjejj,eejj)d*dFdeddmdnZEej j ejj)dd$edodp ZFej j ejj)dd$edqdr ZGejjjejjeejj"d*d*deddsdtZHejjjejjeejj"d*d*deddudvZIejjjejj eejj"d*d9deddwdxZJej j ejj"d*d$edydz ZKej j ejj"d*d$ed{d| ZLejjjejjMeejj"dd}dedd~dZNejjjejjMeejjOdd dedddZPejjjejjMeejjOdd edddZQej j ejjOdd$edd ZRejjjejjMeejjSdd dedddZTejjjejjMeejjSdd edddZUej j ejjSdd$edd ZVejjjejj eejj"d*dFdedddZWejjjejjMeejj"dddedddZXejjjejjMeejj"dd dedddZYejjjejj eejj"d*dFdedddZZejjjejjMeejj"de[j\dedddZ]ejjjejjMeejj"d*ddedddZ^ejjjejjeejj"dd*dedddZ_ej j ejj"dd$edd Z`ejjjejjMeejj"d*ddedddZaejjjejjeejj"dd*dedddZbej j ejj"dd$edd Zcejjjejj eejj"d*ddedddZdejjjejjeejj"dd*dedddZeej j ejj"dd$edd Zfejjjejj eejjSd*dFdedddZgejjjejj eejjSd*ddedddZhejjjejj eejjOd*dFdedddZiejjjejj eejjOd*ddedddZjejjjejj eejjOdddedddZkejjjejj eejjOdddedddZlejjjejjMeejjOdd9dedddZmejjjejjeejjOdddedddZnejjjejjeejjOdddedddZoejjjejjeejjOdddedddZpejjjejjeejjOdddedddZqejjjejjMeejjOdd9dedddZrejjjejjMeejjOddFdedddĄZsej j ejjOdd$eddƄ Ztej j ejjOdd$eddȄ Zuej j ejjOdd$eddʄ Zvej j ejjOdd$edd̄ ZwejjjejjeejjOdddeddd΄ZxejjjejjeejjOdddedddЄZyejjjejjeejjOdddeddd҄ZzejjjejjMeejjOdd9dedddԄZ{ejjjejjMeejjOddFdedddքZ|ej j ejjOdd$edd Z}ej j ejjOdd$eddڄ Z~ej j ejjOdd$edd܄ Zeddބ ZejjjejjeejjOdddedddZejjjejjeejjOdddedddZejjjejjMeejjOdd9dedddZejjjejjMeejjOddFdedddZej j ejjOdd$edd Zej j ejjOdd$edd Zedd ZejjjejjeejjOdddedddZejjjejjeejjOdddedddZejjjejjMeejjOdd9dedddZejjjejjMeejjOddFdedddZej j ejjOdd$edd Zej j ejjOdd$edd Zedd ZejjjejjeejjOdddedddZejjjejjeejjOdddedd dZejjjejjMeejjOdd9dedddZejjjejjMeejjOdddedddZej j ejjOdd$eddd Zej j ejjOdd$ed
d Zed d
ZejjjejjeejjOdddedddZejjjejjeejjOdddedddZejjjejjMeejjOdd9dedddZejjjejjMeejjOddFdedddZej j ejjOdd$edddZej j ejjOdd$edd Zedd ZejjjejjeejjOdddedd d ZejjjejjeejjOddded d d ZejjjejjMeejjOdd9dedd d!ZejjjejjMeejjOdddedd"d#Zej j ejjOdd$edd$d%Zej j ejjOdd$ed&d' Zed(d) ZejjjejjeejjOd*ddedd+d,ZejjjejjeejjOdddedd-d.ZejjjejjMeejjOdd9dedd/d0Zej j ejjOd*d$edd1d2Zej j ejjOdd$ed3d4 Zed5d6 ZejjjejjeejjOd7ddedd8d9ZejjjejjeejjOd:dded d;d<ZejjjejjMeejjOd:d9ded
d=d>ZejjjejjMeejjOddded d?d@Zej j ejjOd7d$ed dAdBZej j ejjOd:d$edCdD ZedEdF ZejjjejjeejjOddded
dGdHZejjjejjeejjOdddeddIdJZejjjejjMeejjOdd9deddKdLZejjjejjMeejjOddFdeddMdNZej j ejjOdd$eddOdPZej j ejjOdd$edQdR ZejjjejjeejjOdddeddSdTZejjjejjeejjOdddeddUdVZejjjejjMeejjOdd9deddWdXZej j ejjOdd$edYdZ Zej j ejjOdd$ed[d\ Zejjjejjeejjdd*dedd]d^Zejjjejjeejjdd*dedd_d`Zejjjejjeejjdd9deddadbZejjjejjeejjddFdeddcddZejjjejjeejjd*dededdfdgZej j ejjdd$edhdi Zej j ejjdd$edjdk Zejjjejjeejjdld*deddmdnZejjjejjeejjdld*deddodpZejjjejjeejjdd*ded dqdrZejjjejjeejjdld9ded dsdtZejjjejjeejjdduded dvdwZejjjejjeejjd*dxded dydzZej j ejjdld$ed{d| Zej j ejjdld$ed}d~ Zejjjejjeejjddded ddZejjjejjeejjdd*ded!ddZejjjejjeejjdd*ded"ddZejjjejjeejjdd9ded#ddZejjjejjeejjd*dded$ddZejjjejjeejjd*d*ded%ddZejjjejjeejjddded&ddZej j ejjdd$edd Zej j ejjdd$edd Zejjjejj׃eejj"d*d*ded'ddZejjjejj eejjdd9ded(ddZejjjejj eejjd*dFded)ddZejjjejjMeejjdej\ded*ddZejjjejjeejjdd*ded+ddZejjjejjeejjdd*ded,ddZejjjejj eejjdd9ded-ddZejjjejj eejjddFded.ddZejjjejjeejjِdd ed/ddZej j ejjdd$edd Zej j ejjdd$edd Zejjjejj eejj"d*dFded0ddZejjjejjMeejj"dej\ded1ddZ ZS (2 r zFirewallD main classTc s` t t| j|| t | _|d | _|d | _| j t| t j
j t | jj | jt j
j
| _ d S )Nr )superr __init__r fwbusnamepathstartr r dbusDBUS_INTERFACEr ZDBUS_PATH_CONFIG)selfargskwargs) __class__ /usr/lib/python3.6/firewalld.pyr" I s
zFirewallD.__init__c C s | j d S )N)stop)r) r- r- r. __del__T s zFirewallD.__del__c C s t jd i | _| jj S )Nzstart())r debug1 _timeoutsr# r& )r) r- r- r. r& W s
zFirewallD.startc C s t jd | jj S )Nzstop())r r1 r# r/ )r) r- r- r. r/ _ s
zFirewallD.stopc C s | j jj r|d kr"tjd d S tj }t||}| j jjd|rHd S t ||}| j jjd|rfd S t
|}| j jjd|rd S t ||}| j jjd|rd S t t
jdd S )Nz&Lockdown not possible, sender not set.contextuidusercommandzlockdown is enabled)r# policiesquery_lockdownr errorr' Z SystemBusr Z access_checkr r r r r Z
ACCESS_DENIED)r) senderZbusr3 r4 r5 r6 r- r- r. accessCheckh s$
zFirewallD.accessCheckc C s& || j kri | j |< || j | |< d S )N)r2 )r) zonextagr- r- r.
addTimeout s
zFirewallD.addTimeoutc C s< || j kr8|| j | kr8tj| j | | | j | |= d S )N)r2 r
source_remove)r) r< r= r- r- r.
removeTimeout s zFirewallD.removeTimeoutc C sT xD| j D ]:}x&| j | D ]}tj| j | | qW | j | j qW | j j d S )N)r2 r r@ clear)r) r< r= r- r- r. cleanup_timeouts s
zFirewallD.cleanup_timeoutsc C sd |dkrt jtjS |dkr6t jdtj jtj jf S |dkrNt j| jj S |dkrht j| jj dS |dkrt j
| jj dS |d krt j| jj d
S |d krt j| jj S |d krt j
| jj
dS |d
krt j| jjS |dk rt j| jjS |dkrt j
| jjdS |dkr$t jdS |dkr:t ji dS |dkrPt ji dS t jjd| d S )Nversioninterface_versionz%d.%dstateIPv4ipv4
IPv4ICMPTypessIPv6ipv6
IPv6_rpfilter
IPv6ICMPTypesBRIDGEr
IPSetTypesnf_conntrack_helper_settingFnf_conntrack_helperssasnf_nat_helperszDorg.freedesktop.DBus.Error.InvalidArgs: Property '%s' does not exist)r' Stringr VERSIONZDBUS_INTERFACE_VERSIONZDBUS_INTERFACE_REVISIONr# Z get_stateZBooleanZis_ipv_enabledZArrayZipv4_supported_icmp_typesZipv6_rpfilter_enabledZipv6_supported_icmp_typesZebtables_enabledZ
ipset_enabledZipset_supported_types
Dictionary
exceptions
DBusException)r) Zpropr- r- r.
_get_property s@
zFirewallD._get_propertyZssv) in_signature
out_signatureNc C s~ t |t}t |t}tjd|| |tjjkr8| j|S |tjjtjj tjj
tjj gkrjtj j
d| ntj j
d| d S )NzGet('%s', '%s')zDorg.freedesktop.DBus.Error.InvalidArgs: Property '%s' does not existzJorg.freedesktop.DBus.Error.UnknownInterface: Interface '%s' does not exist)r strr r1 r r' r( rZ DBUS_INTERFACE_ZONEDBUS_INTERFACE_DIRECTDBUS_INTERFACE_POLICIESDBUS_INTERFACE_IPSETrX rY )r) interface_name
property_namer: r- r- r. Get s
z
FirewallD.GetrJ za{sv}c C s t |t}tjd| i }|tjjkrDxNdD ]}| j|||< q,W n2|tjjtjj tjj
tjj gkrfntj j
d| tj|ddS )Nz GetAll('%s')rD rE rF rG rK rM rO r rP rQ rR rT rI rN zJorg.freedesktop.DBus.Error.UnknownInterface: Interface '%s' does not existZsv) signature)rD rE rF rG rK rM rO r rP rQ rR rT rI rN )r r^ r r1 r r' r( rZ r_ r` ra rb rX rY rW )r) rc r: retr= r- r- r. GetAll s&
zFirewallD.GetAllZssv)r\ c C s t |t}t |t}t |}tjd||| | j| |tjjkrn|dkr\tjj d| qtjj d| nB|tjj
tjj tjj tjj
gkrtjj d| ntjj d| d S )NzSet('%s', '%s', '%s')rD rE rF rG rK rM rO r rP rQ rR rT rI rN zGorg.freedesktop.DBus.Error.PropertyReadOnly: Property '%s' is read-onlyzDorg.freedesktop.DBus.Error.InvalidArgs: Property '%s' does not existzJorg.freedesktop.DBus.Error.UnknownInterface: Interface '%s' does not exist)rD rE rF rG rK rM rO r rP rQ rR rT rI rN )r r^ r r1 r; r r' r( rX rY r_ r` ra rb )r) rc rd Z new_valuer: r- r- r. Set s:
z
FirewallD.Setzsa{sv}as)rf c C s. t |t}t |}t |}tjd||| d S )Nz#PropertiesChanged('%s', '%s', '%s'))r r^ r r1 )r) rc Zchanged_propertiesZinvalidated_propertiesr- r- r. PropertiesChanged s
zFirewallD.PropertiesChanged)r] c s4 t jd tt| j| j| jj }t| |t j
j S )Nz Introspect()) r Zdebug2r! r
Introspectr% r$ Zget_busr r r' r( )r) r: data)r, r- r. rk & s
zFirewallD.Introspect c C s* t jd | jj | jj | j dS )z#Reload the firewall rules.
zreload()N)r r1 r# reloadr Reloaded)r) r: r- r- r. rn 4 s
zFirewallD.reloadc C s, t jd | jjd | jj | j dS )zCompletely reload the firewall.
Completely reload the firewall: Stops firewall, unloads modules and
starts the firewall again.
zcompleteReload()TN)r r1 r# rn r ro )r) r: r- r- r. completeReloadC s
zFirewallD.completeReloadc C s t jd d S )Nz
Reloaded())r r1 )r) r- r- r. ro S s zFirewallD.Reloadedc C s t jd t| j dS )z&Check permanent configuration
zcheckPermanentConfig()N)r r1 r r# )r) r: r- r- r. checkPermanentConfigX s
z FirewallD.checkPermanentConfigc
C s t jd d}| jj }x| jjj D ]}| j|}yj||kr| jj|}|j |krpt jd| |j
| qt jd| n t jd| | jj || W q& t k
r } z t j
d||f d}W Y dd}~X q&X q&W | jj }x| jjj D ]}| j|}yn||krR| jj|}|j |krBt jd | |j
| nt jd
| n t jd | | jj|| W q t k
r } z t j
d ||f d}W Y dd}~X qX qW | jj }x| jjj D ]}yx| j|}||kr&| jj|}|j |krt jd
| |j
| nt jd| n t jd| | jj|| W n: t k
r~ } z t j
d||f d}W Y dd}~X nX qW | jj }t }x| jj j D ]}| j |}t |} |dk r~d}
xH| j D ]<} | jj j!|| |krt jd|| f | j"| d}
qW xV| j D ]J} y,t#| } | rNt$|| rN| j"| d}
W n t k
rf Y nX q W |
r~~| j% }x | j D ]} t&|| qW yP||kr| jj'|}t jd| |j(| n t jd| | jj)|| W n: t k
r& } z t j
d||f d}W Y dd}~X nX qW | jj* }x| jj+j, D ]}| j-|}yB||krx| jj.|}|j
| n t jd| | jj/|| W n: t k
r } z t j
d||f d}W Y dd}~X nX qFW | jj0 }x| jj1j2 D ]}| j3|}yn||krN| jj4|}|j |kr>t jd| |j
| nt jd| n t jd| | jj5|| W n: t k
r } z t j
d||f d}W Y dd}~X nX qW | jj6j7 | jj6j8 | jj6j9 f}y6| jj |krt jd | jj
| n
t jd W n6 t k
r< } zt j
d | d}W Y dd}~X nX | jj:j;j< }y6| jj |krvt jd | jj=| n
t jd W n6 t k
r } zt j
d | d}W Y dd}~X nX |rt>t?j@dS )!z-Make runtime configuration permanent
zcopyRuntimeToPermanent()Fz Copying service '%s' settingsz$Service '%s' is identical, ignoring.zCreating service '%s'z/Runtime To Permanent failed on service '%s': %sTNz Copying icmptype '%s' settingsz%IcmpType '%s' is identical, ignoring.zCreating icmptype '%s'z0Runtime To Permanent failed on icmptype '%s': %szCopying ipset '%s' settingsz"IPSet '%s' is identical, ignoring.zCreating ipset '%s'z-Runtime To Permanent failed on ipset '%s': %szEZone '%s': interface binding for '%s' has been added by NM, ignoring.zCopying zone '%s' settingszCreating zone '%s'z,Runtime To Permanent failed on zone '%s': %szCreating policy '%s'z.Runtime To Permanent failed on policy '%s': %sz Copying helper '%s' settingsz#Helper '%s' is identical, ignoring.zCreating helper '%s'z.Runtime To Permanent failed on helper '%s': %sz Copying direct configurationz,Direct configuration is identical, ignoring.z7Runtime To Permanent failed on direct configuration: %sz Copying policies configurationz.Policies configuration is identical, ignoring.z9Runtime To Permanent failed on policies configuration: %s)Ar r1 r ZgetServiceNamesr# service get_servicesgetServiceSettingsZgetServiceByNameZ getSettingsupdate
addService ExceptionwarningZgetIcmpTypeNamesicmptype
get_icmptypesgetIcmpTypeSettingsZgetIcmpTypeByNameZ addIcmpTypeZ
getIPSetNamesipset
get_ipsetsgetIPSetSettingsZgetIPSetByNameZaddIPSetZ getZoneNamesr r< get_zonesgetZoneSettings2r
getInterfacesZinterface_get_senderremoveInterfacer r ZgetSettingsDictr Z
getZoneByNameZupdate2ZaddZone2ZgetPolicyNamespolicy"get_policies_not_derived_from_zonegetPolicySettingsZgetPolicyByNameZ addPolicyZgetHelperNameshelper get_helpersgetHelperSettingsZgetHelperByNameZ addHelperdirectget_all_chains
get_all_rulesget_all_passthroughsr7 lockdown_whitelist
export_configZsetLockdownWhitelistr r ZRT_TO_PERM_FAILED)
r) r: r9 Z config_namesnameZconfZconf_objeZ nm_bus_namesettingsZchanged interfaceZ
connectionr- r- r. runtimeToPermanentd s$
z FirewallD.runtimeToPermanentc C s, t jd | j| | jjj | j dS )z!Enable lockdown policies
zpolicies.enableLockdown()N)r r1 r; r# r7 Zenable_lockdownLockdownEnabled)r) r: r- r- r. enableLockdown2 s
zFirewallD.enableLockdownc C s, t jd | j| | jjj | j dS )z"Disable lockdown policies
zpolicies.disableLockdown()N)r r1 r; r# r7 Zdisable_lockdownLockdownDisabled)r) r: r- r- r. disableLockdown> s
zFirewallD.disableLockdownbc C s t jd | jjj S )z+Retuns True if lockdown is enabled
zpolicies.queryLockdown())r r1 r# r7 r8 )r) r: r- r- r.
queryLockdownJ s
zFirewallD.queryLockdownc C s t jd d S )NzLockdownEnabled())r r1 )r) r- r- r. r U s zFirewallD.LockdownEnabledc C s t jd d S )NzLockdownDisabled())r r1 )r) r- r- r. r Z s zFirewallD.LockdownDisabledc C s@ t |t}tjd| | j| | jjjj| | j | dS )z Add lockdown command
z*policies.addLockdownWhitelistCommand('%s')N)
r r^ r r1 r; r# r7 r Z add_command LockdownWhitelistCommandAdded)r) r6 r: r- r- r. addLockdownWhitelistCommandc s
z%FirewallD.addLockdownWhitelistCommandc C s@ t |t}tjd| | j| | jjjj| | j | dS )z Remove lockdown command
z-policies.removeLockdownWhitelistCommand('%s')N)
r r^ r r1 r; r# r7 r Zremove_command LockdownWhitelistCommandRemoved)r) r6 r: r- r- r. removeLockdownWhitelistCommandp s
z(FirewallD.removeLockdownWhitelistCommandc C s( t |t}tjd| | jjjj|S )z Query lockdown command
z,policies.queryLockdownWhitelistCommand('%s'))r r^ r r1 r# r7 r Z has_command)r) r6 r: r- r- r. queryLockdownWhitelistCommand} s
z'FirewallD.queryLockdownWhitelistCommandasc C s t jd | jjjj S )z Add lockdown command
z'policies.getLockdownWhitelistCommands())r r1 r# r7 r Z get_commands)r) r: r- r- r. getLockdownWhitelistCommands s
z&FirewallD.getLockdownWhitelistCommandsc C s t jd| d S )Nz#LockdownWhitelistCommandAdded('%s'))r r1 )r) r6 r- r- r. r s z'FirewallD.LockdownWhitelistCommandAddedc C s t jd| d S )Nz%LockdownWhitelistCommandRemoved('%s'))r r1 )r) r6 r- r- r. r s z)FirewallD.LockdownWhitelistCommandRemovedic C s@ t |t}tjd| | j| | jjjj| | j | dS )zAdd lockdown uid
z&policies.addLockdownWhitelistUid('%s')N)
r intr r1 r; r# r7 r Zadd_uidLockdownWhitelistUidAdded)r) r4 r: r- r- r. addLockdownWhitelistUid s
z!FirewallD.addLockdownWhitelistUidc C s@ t |t}tjd| | j| | jjjj| | j | dS )z Remove lockdown uid
z)policies.removeLockdownWhitelistUid('%s')N)
r r r r1 r; r# r7 r Z
remove_uidLockdownWhitelistUidRemoved)r) r4 r: r- r- r. removeLockdownWhitelistUid s
z$FirewallD.removeLockdownWhitelistUidc C s( t |t}tjd| | jjjj|S )zQuery lockdown uid
z(policies.queryLockdownWhitelistUid('%s'))r r r r1 r# r7 r Zhas_uid)r) r4 r: r- r- r. queryLockdownWhitelistUid s
z#FirewallD.queryLockdownWhitelistUidZaic C s t jd | jjjj S )zAdd lockdown uid
z#policies.getLockdownWhitelistUids())r r1 r# r7 r Zget_uids)r) r: r- r- r. getLockdownWhitelistUids s
z"FirewallD.getLockdownWhitelistUidsc C s t jd| d S )Nz LockdownWhitelistUidAdded(%d))r r1 )r) r4 r- r- r. r s z#FirewallD.LockdownWhitelistUidAddedc C s t jd| d S )Nz LockdownWhitelistUidRemoved(%d))r r1 )r) r4 r- r- r. r s z%FirewallD.LockdownWhitelistUidRemovedc C s@ t |t}tjd| | j| | jjjj| | j | dS )zAdd lockdown user
z'policies.addLockdownWhitelistUser('%s')N)
r r^ r r1 r; r# r7 r Zadd_userLockdownWhitelistUserAdded)r) r5 r: r- r- r. addLockdownWhitelistUser s
z"FirewallD.addLockdownWhitelistUserc C s@ t |t}tjd| | j| | jjjj| | j | dS )z Remove lockdown user
z*policies.removeLockdownWhitelistUser('%s')N)
r r^ r r1 r; r# r7 r Z remove_user LockdownWhitelistUserRemoved)r) r5 r: r- r- r. removeLockdownWhitelistUser s
z%FirewallD.removeLockdownWhitelistUserc C s( t |t}tjd| | jjjj|S )z Query lockdown user
z)policies.queryLockdownWhitelistUser('%s'))r r^ r r1 r# r7 r Zhas_user)r) r5 r: r- r- r. queryLockdownWhitelistUser s
z$FirewallD.queryLockdownWhitelistUserc C s t jd | jjjj S )zAdd lockdown user
z$policies.getLockdownWhitelistUsers())r r1 r# r7 r Z get_users)r) r: r- r- r. getLockdownWhitelistUsers s
z#FirewallD.getLockdownWhitelistUsersc C s t jd| d S )Nz LockdownWhitelistUserAdded('%s'))r r1 )r) r5 r- r- r. r s z$FirewallD.LockdownWhitelistUserAddedc C s t jd| d S )Nz"LockdownWhitelistUserRemoved('%s'))r r1 )r) r5 r- r- r. r s z&FirewallD.LockdownWhitelistUserRemovedc C s@ t |t}tjd| | j| | jjjj| | j | dS )z Add lockdown context
z*policies.addLockdownWhitelistContext('%s')N)
r r^ r r1 r; r# r7 r Z add_context LockdownWhitelistContextAdded)r) r3 r: r- r- r. addLockdownWhitelistContext s
z%FirewallD.addLockdownWhitelistContextc C s@ t |t}tjd| | j| | jjjj| | j | dS )z Remove lockdown context
z-policies.removeLockdownWhitelistContext('%s')N)
r r^ r r1 r; r# r7 r Zremove_context LockdownWhitelistContextRemoved)r) r3 r: r- r- r. removeLockdownWhitelistContext' s
z(FirewallD.removeLockdownWhitelistContextc C s( t |t}tjd| | jjjj|S )z Query lockdown context
z,policies.queryLockdownWhitelistContext('%s'))r r^ r r1 r# r7 r Z has_context)r) r3 r: r- r- r. queryLockdownWhitelistContext4 s
z'FirewallD.queryLockdownWhitelistContextc C s t jd | jjjj S )z Add lockdown context
z'policies.getLockdownWhitelistContexts())r r1 r# r7 r Z get_contexts)r) r: r- r- r. getLockdownWhitelistContexts@ s
z&FirewallD.getLockdownWhitelistContextsc C s t jd| d S )Nz#LockdownWhitelistContextAdded('%s'))r r1 )r) r3 r- r- r. r K s z'FirewallD.LockdownWhitelistContextAddedc C s t jd| d S )Nz%LockdownWhitelistContextRemoved('%s'))r r1 )r) r3 r- r- r. r P s z)FirewallD.LockdownWhitelistContextRemovedc C s* t jd | j| | jj | j dS )znEnable panic mode.
All ingoing and outgoing connections and packets will be blocked.
zenablePanicMode()N)r r1 r; r# Zenable_panic_modePanicModeEnabled)r) r: r- r- r. enablePanicModeY s
zFirewallD.enablePanicModec C s* t jd | j| | jj | j dS )zDisable panic mode.
Enables normal mode: Allowed ingoing and outgoing connections
will not be blocked anymore
zdisablePanicMode()N)r r1 r; r# Zdisable_panic_modePanicModeDisabled)r) r: r- r- r. disablePanicModeg s
zFirewallD.disablePanicModec C s t jd | jj S )NzqueryPanicMode())r r1 r# Zquery_panic_mode)r) r: r- r- r. queryPanicModev s
zFirewallD.queryPanicModec C s t jd d S )NzPanicModeEnabled())r r1 )r) r- r- r. r s zFirewallD.PanicModeEnabledc C s t jd d S )NzPanicModeDisabled())r r1 )r) r- r- r. r s zFirewallD.PanicModeDisabledz&(sssbsasa(ss)asba(ssss)asasasasa(ss)b)c C s$ t |t}tjd| | jjj|S )NzgetZoneSettings(%s))r r^ r r1 r# r< Zget_config_with_settings)r) r< r: r- r- r. getZoneSettings s
zFirewallD.getZoneSettingsc C s$ t |t}tjd| | jjj|S )NzgetZoneSettings2(%s))r r^ r r1 r# r< get_config_with_settings_dict)r) r< r: r- r- r. r s
zFirewallD.getZoneSettings2zsa{sv}c C sB t |t}tjd| | j| | jjj||| | j|| d S )NzsetZoneSettings2(%s)) r r^ r r1 r; r# r< set_config_with_settings_dict ZoneUpdated)r) r< r r: r- r- r. setZoneSettings2 s
zFirewallD.setZoneSettings2c C s t jd||f d S )Nz zone.ZoneUpdated('%s', '%s'))r r1 )r) r< r r- r- r. r s zFirewallD.ZoneUpdatedc C s$ t |t}tjd| | jjj|S )Nz policy.getPolicySettings(%s))r r^ r r1 r# r r )r) r r: r- r- r. r s
zFirewallD.getPolicySettingsc C sB t |t}tjd| | j| | jjj||| | j|| d S )Nz policy.setPolicySettings(%s)) r r^ r r1 r; r# r r
PolicyUpdated)r) r r r: r- r- r. setPolicySettings s
zFirewallD.setPolicySettingsc C s t jd||f d S )Nz policy.PolicyUpdated('%s', '%s'))r r1 )r) r r r- r- r. r s zFirewallD.PolicyUpdatedc C s t jd | jjj S )NzlistServices())r r1 r# rr rs )r) r: r- r- r. listServices s
zFirewallD.listServicesz(sssa(ss)asa{ss}asa(ss))c C s t |t}tjd| | jjj|}|j }g }x\tdD ]P}|j | d |krr|j
t j t
||j | d q:|j
||j | d q:W t|S )NzgetServiceSettings(%s) r )r r^ r r1 r# rr get_serviceexport_config_dictrangeZIMPORT_EXPORT_STRUCTUREappendcopydeepcopygetattrtuple)r) rr r: objZ conf_dictZ conf_listr r- r- r. rt s
" z FirewallD.getServiceSettingsc C s, t |t}tjd| | jjj|}|j S )NzgetServiceSettings2(%s))r r^ r r1 r# rr r r )r) rr r: r r- r- r. getServiceSettings2 s
z FirewallD.getServiceSettings2c C s t jd | jjj S )NzlistIcmpTypes())r r1 r# ry rz )r) r: r- r- r.
listIcmpTypes s
zFirewallD.listIcmpTypesc C s( t |t}tjd| | jjj|j S )NzgetIcmpTypeSettings(%s))r r^ r r1 r# ry Z get_icmptyper )r) ry r: r- r- r. r{ s
z FirewallD.getIcmpTypeSettingsc C s t jd | jj S )NzgetLogDenied())r r1 r# Zget_log_denied)r) r: r- r- r. getLogDenied s
zFirewallD.getLogDeniedc C sX t |t}tjd| | j| | jj| | j| | jj | j j | j
d S )NzsetLogDenied('%s')) r r^ r r1 r; r# Zset_log_deniedLogDeniedChangedrn r ro )r) valuer: r- r- r. setLogDenied s
zFirewallD.setLogDeniedc C s t jd| d S )NzLogDeniedChanged('%s'))r r1 )r) r r- r- r. r " s zFirewallD.LogDeniedChangedc C s t jd dS )NzgetAutomaticHelpers()no)r r1 )r) r: r- r- r. getAutomaticHelpers+ s
z FirewallD.getAutomaticHelpersc C s& t |t}tjd| | j| d S )NzsetAutomaticHelpers('%s'))r r^ r r1 r; )r) r r: r- r- r. setAutomaticHelpers6 s
z FirewallD.setAutomaticHelpersc C s t jd| d S )Nz AutomaticHelpersChanged('%s'))r r1 )r) r r- r- r. AutomaticHelpersChangedB s z!FirewallD.AutomaticHelpersChangedc C s t jd | jj S )NzgetDefaultZone())r r1 r# Zget_default_zone)r) r: r- r- r. getDefaultZoneK s
zFirewallD.getDefaultZonec C s< t |t}tjd| | j| | jj| | j| d S )NzsetDefaultZone('%s'))r r^ r r1 r; r# Zset_default_zoneDefaultZoneChanged)r) r< r: r- r- r. setDefaultZoneT s
zFirewallD.setDefaultZonec C s t jd| d S )NzDefaultZoneChanged('%s'))r r1 )r) r< r- r- r. r ` s z FirewallD.DefaultZoneChangedc C s t jd | jjj S )Nzpolicy.getPolicies())r r1 r# r r )r) r: r- r- r. getPoliciesk s
zFirewallD.getPoliciesz
a{sa{sas}}c C s\ t jd i }xH| jjj D ]8}i ||< | jjj||| d< | jjj||| d< q W |S )Nzpolicy.getActivePolicies()Z
ingress_zonesZ egress_zones)r r1 r# r Z)get_active_policies_not_derived_from_zoneZlist_ingress_zonesZlist_egress_zones)r) r: r7 r r- r- r. getActivePoliciess s
zFirewallD.getActivePoliciesc C s t jd | jjj S )Nzzone.getZones())r r1 r# r< r )r) r: r- r- r. getZones s
zFirewallD.getZonesc C s t jd i }x|| jjj D ]l}| jjj|}| jjj|}t|t| dkr i ||< t|dkrp||| d< t|dkr ||| d< q W |S )Nzzone.getActiveZones()r
interfacessources)r r1 r# r< r list_interfaces list_sourceslen)r) r: Zzonesr< r r r- r- r. getActiveZones s
zFirewallD.getActiveZonesc C s2 t |t}tjd| | jjj|}|r.|S dS )zReturn the zone an interface belongs to.
:Parameters:
`interface` : str
Name of the interface
:Returns: str. The name of the zone.
z zone.getZoneOfInterface('%s')rm )r r^ r r1 r# r< Zget_zone_of_interface)r) r r: r< r- r- r. getZoneOfInterface s
z FirewallD.getZoneOfInterfacec C s2 t |t}tjd| | jjj|}|r.|S dS )Nzzone.getZoneOfSource('%s')rm )r r^ r r1 r# r< Zget_zone_of_source)r) sourcer: r< r- r- r. getZoneOfSource s
zFirewallD.getZoneOfSourcec C s dS )NFr- )r) r< r: r- r- r. isImmutable s zFirewallD.isImmutablec C sR t |t}t |t}tjd||f | j| | jjj|||}| j|| |S )zPAdd an interface to a zone.
If zone is empty, use default zone.
z zone.addInterface('%s', '%s')) r r^ r r1 r; r# r< Z
add_interfaceInterfaceAdded)r) r< r r: _zoner- r- r. addInterface s
zFirewallD.addInterfacec C s" t |t}t |t}| j|||S )zChange a zone an interface is part of.
If zone is empty, use default zone.
This function is deprecated, use changeZoneOfInterface instead
)r r^ changeZoneOfInterface)r) r< r r: r- r- r.
changeZone s
zFirewallD.changeZonec C sR t |t}t |t}tjd||f | j| | jjj|||}| j|| |S )z[Change a zone an interface is part of.
If zone is empty, use default zone.
z&zone.changeZoneOfInterface('%s', '%s')) r r^ r r1 r; r# r< Zchange_zone_of_interfaceZoneOfInterfaceChanged)r) r< r r: r r- r- r. r s
z FirewallD.changeZoneOfInterfacec C sP t |t}t |t}tjd||f | j| | jjj||}| j|| |S )zkRemove interface from a zone.
If zone is empty, remove from zone the interface belongs to.
z zone.removeInterface('%s', '%s')) r r^ r r1 r; r# r< Zremove_interfaceInterfaceRemoved)r) r< r r: r r- r- r. r s
zFirewallD.removeInterfacec C s6 t |t}t |t}tjd||f | jjj||S )z^Return true if an interface is in a zone.
If zone is empty, use default zone.
z zone.queryInterface('%s', '%s'))r r^ r r1 r# r< Zquery_interface)r) r< r r: r- r- r. queryInterface s
zFirewallD.queryInterfacec C s& t |t}tjd| | jjj|S )z]Return the list of interfaces of a zone.
If zone is empty, use default zone.
zzone.getInterfaces('%s'))r r^ r r1 r# r< r )r) r< r: r- r- r. r s
zFirewallD.getInterfacesc C s t jd||f d S )Nz zone.InterfaceAdded('%s', '%s'))r r1 )r) r< r r- r- r. r + s zFirewallD.InterfaceAddedc C s t jd||f dS )z,
This signal is deprecated.
z zone.ZoneChanged('%s', '%s')N)r r1 )r) r< r r- r- r. ZoneChanged0 s zFirewallD.ZoneChangedc C s" t jd||f | j|| d S )Nz'zone.ZoneOfInterfaceChanged('%s', '%s'))r r1 r )r) r< r r- r- r. r 8 s
z FirewallD.ZoneOfInterfaceChangedc C s t jd||f d S )Nz!zone.InterfaceRemoved('%s', '%s'))r r1 )r) r< r r- r- r. r ? s zFirewallD.InterfaceRemovedc C sR t |t}t |t}tjd||f | j| | jjj|||}| j|| |S )zLAdd a source to a zone.
If zone is empty, use default zone.
zzone.addSource('%s', '%s')) r r^ r r1 r; r# r< Z
add_source SourceAdded)r) r< r r: r r- r- r. addSourceH s
zFirewallD.addSourcec C sR t |t}t |t}tjd||f | j| | jjj|||}| j|| |S )zXChange a zone an source is part of.
If zone is empty, use default zone.
z#zone.changeZoneOfSource('%s', '%s')) r r^ r r1 r; r# r< Zchange_zone_of_sourceZoneOfSourceChanged)r) r< r r: r r- r- r. changeZoneOfSourceY s
z FirewallD.changeZoneOfSourcec C sP t |t}t |t}tjd||f | j| | jjj||}| j|| |S )zeRemove source from a zone.
If zone is empty, remove from zone the source belongs to.
z zone.removeSource('%s', '%s')) r r^ r r1 r; r# r< Z
remove_source
SourceRemoved)r) r< r r: r r- r- r. removeSourcej s
zFirewallD.removeSourcec C s6 t |t}t |t}tjd||f | jjj||S )z[Return true if an source is in a zone.
If zone is empty, use default zone.
z zone.querySource('%s', '%s'))r r^ r r1 r# r< Z query_source)r) r< r r: r- r- r. querySource{ s
zFirewallD.querySourcec C s& t |t}tjd| | jjj|S )zZReturn the list of sources of a zone.
If zone is empty, use default zone.
zzone.getSources('%s'))r r^ r r1 r# r< r )r) r< r: r- r- r.
getSources s
zFirewallD.getSourcesc C s t jd||f d S )Nz zone.SourceAdded('%s', '%s'))r r1 )r) r< r r- r- r. r s zFirewallD.SourceAddedc C s t jd||f d S )Nz$zone.ZoneOfSourceChanged('%s', '%s'))r r1 )r) r< r r- r- r. r s z FirewallD.ZoneOfSourceChangedc C s t jd||f d S )Nz zone.SourceRemoved('%s', '%s'))r r1 )r) r< r r- r- r. r s zFirewallD.SourceRemovedc C sH t jd||f | j| |= t|d}| jjj|| | j|| d S )Nz%zone.disableTimedRichRule('%s', '%s'))rule_str)r r1 r2 r r# r< remove_ruleRichRuleRemoved)r) r< ruler r- r- r. disableTimedRichRule s
z FirewallD.disableTimedRichRuleZssic C s t |t}t |t}t |t}tjd||f t|d}| jjj|||}|dkrtt j
|| j ||}| j ||| | j
||| |S )Nz zone.addRichRule('%s', '%s'))r r )r r^ r r r1 r r# r< add_ruler timeout_add_secondsr r?
RichRuleAdded)r) r< r timeoutr: r r r> r- r- r. addRichRule s
zFirewallD.addRichRulec C s\ t |t}t |t}tjd||f t|d}| jjj||}| j|| | j || |S )Nz zone.removeRichRule('%s', '%s'))r )
r r^ r r1 r r# r< r rA r )r) r< r r: r r r- r- r. removeRichRule s
zFirewallD.removeRichRulec C s@ t |t}t |t}tjd||f t|d}| jjj||S )Nz zone.queryRichRule('%s', '%s'))r )r r^ r r1 r r# r<
query_rule)r) r< r r: r r- r- r.
queryRichRule s
zFirewallD.queryRichRulec C s& t |t}tjd| | jjj|S )Nzzone.getRichRules('%s'))r r^ r r1 r# r< Z
list_rules)r) r< r: r- r- r. getRichRules s
zFirewallD.getRichRulesc C s t jd|||f d S )Nz"zone.RichRuleAdded('%s', '%s', %d))r r1 )r) r< r r r- r- r. r s zFirewallD.RichRuleAddedc C s t jd||f d S )Nz zone.RichRuleRemoved('%s', '%s'))r r1 )r) r< r r- r- r. r s zFirewallD.RichRuleRemovedc C s> t jd||f | j| |= | jjj|| | j|| d S )Nz$zone.disableTimedService('%s', '%s'))r r1 r2 r# r< remove_serviceServiceRemoved)r) r< rr r- r- r. disableTimedService s z FirewallD.disableTimedServicec C s t |t}t |t}t |t}tjd|||f | j| | jjj||||}|dkrxt j
|| j ||}| j ||| | j
||| |S )Nz zone.addService('%s', '%s', %d)r )r r^ r r r1 r; r# r< Z add_servicer r r r? ServiceAdded)r) r< rr r r: r r> r- r- r. rv s
zFirewallD.addServicec C s\ t |t}t |t}tjd||f | j| | jjj||}| j|| | j || |S )Nz zone.removeService('%s', '%s'))
r r^ r r1 r; r# r< r rA r )r) r< rr r: r r- r- r.
removeService s
zFirewallD.removeServicec C s6 t |t}t |t}tjd||f | jjj||S )Nz zone.queryService('%s', '%s'))r r^ r r1 r# r< Z
query_service)r) r< rr r: r- r- r. queryService& s
zFirewallD.queryServicec C s& t |t}tjd| | jjj|S )Nzzone.getServices('%s'))r r^ r r1 r# r< Z
list_services)r) r< r: r- r- r. getServices1 s
zFirewallD.getServicesc C s t jd|||f d S )Nz!zone.ServiceAdded('%s', '%s', %d))r r1 )r) r< rr r r- r- r. r = s zFirewallD.ServiceAddedc C s t jd||f d S )Nz zone.ServiceRemoved('%s', '%s'))r r1 )r) r< rr r- r- r. r C s zFirewallD.ServiceRemovedc C sH t jd|||f | j| ||f= | jjj||| | j||| d S )Nz'zone.disableTimedPort('%s', '%s', '%s'))r r1 r2 r# r< remove_port PortRemoved)r) r< portprotocolr- r- r. disableTimedPortL s
zFirewallD.disableTimedPortZsssic C s t |t}t |t}t |t}t |t}tjd|||f | j| | jjj|||||}|dkrt j
|| j |||}| j |||f| | j
|||| |S )Nz zone.addPort('%s', '%s', '%s')r )r r^ r r r1 r; r# r< Zadd_portr r r r? PortAdded)r) r< r r r r: r r> r- r- r. addPortT s
zFirewallD.addPortZsssc C sp t |t}t |t}t |t}tjd|||f | j| | jjj|||}| j|||f | j ||| |S )Nz!zone.removePort('%s', '%s', '%s'))
r r^ r r1 r; r# r< r rA r
)r) r< r r r: r r- r- r.
removePortk s
zFirewallD.removePortc C sD t |t}t |t}t |t}tjd|||f | jjj|||S )Nz zone.queryPort('%s', '%s', '%s'))r r^ r r1 r# r< Z
query_port)r) r< r r r: r- r- r. queryPort} s
zFirewallD.queryPortZaasc C s& t |t}tjd| | jjj|S )Nzzone.getPorts('%s'))r r^ r r1 r# r< Z
list_ports)r) r< r: r- r- r. getPorts s
zFirewallD.getPortsr c C s t jd||||f d S )Nz$zone.PortAdded('%s', '%s', '%s', %d))r r1 )r) r< r r r r- r- r. r s zFirewallD.PortAddedc C s t jd|||f d S )Nz"zone.PortRemoved('%s', '%s', '%s'))r r1 )r) r< r r r- r- r. r
s zFirewallD.PortRemovedc C s> t jd||f | j| |= | jjj|| | j|| d S )Nz%zone.disableTimedProtocol('%s', '%s'))r r1 r2 r# r< remove_protocolProtocolRemoved)r) r< r r- r- r. disableTimedProtocol s z FirewallD.disableTimedProtocolc C s t |t}t |t}t |t}tjd||f | j| | jjj||||}|dkrvt j
|| j ||}| j ||| | j
||| |S )Nz zone.enableProtocol('%s', '%s')r )r r^ r r r1 r; r# r< Z add_protocolr r r r?
ProtocolAdded)r) r< r r r: r r> r- r- r. addProtocol s
zFirewallD.addProtocolc C s\ t |t}t |t}tjd||f | j| | jjj||}| j|| | j || |S )Nz zone.removeProtocol('%s', '%s'))
r r^ r r1 r; r# r< r rA r )r) r< r r: r r- r- r. removeProtocol s
zFirewallD.removeProtocolc C s6 t |t}t |t}tjd||f | jjj||S )Nz zone.queryProtocol('%s', '%s'))r r^ r r1 r# r< Zquery_protocol)r) r< r r: r- r- r.
queryProtocol s
zFirewallD.queryProtocolc C s& t |t}tjd| | jjj|S )Nzzone.getProtocols('%s'))r r^ r r1 r# r< Zlist_protocols)r) r< r: r- r- r. getProtocols s
zFirewallD.getProtocolsc C s t jd|||f d S )Nz"zone.ProtocolAdded('%s', '%s', %d))r r1 )r) r< r r r- r- r. r s zFirewallD.ProtocolAddedc C s t jd||f d S )Nz zone.ProtocolRemoved('%s', '%s'))r r1 )r) r< r r- r- r. r s zFirewallD.ProtocolRemovedc C sJ t jd|||f | j| d||f= | jjj||| | j||| d S )Nz-zone.disableTimedSourcePort('%s', '%s', '%s')sport)r r1 r2 r# r< remove_source_portSourcePortRemoved)r) r< r r r- r- r. disableTimedSourcePort s
z FirewallD.disableTimedSourcePortc C s t |t}t |t}t |t}t |t}tjd|||f | j| | jjj|||||}|dkrt j
|| j |||}| j |d||f| | j
|||| |S )Nz$zone.addSourcePort('%s', '%s', '%s')r r )r r^ r r r1 r; r# r< Zadd_source_portr r r! r? SourcePortAdded)r) r< r r r r: r r> r- r- r.
addSourcePort s
zFirewallD.addSourcePortc C sr t |t}t |t}t |t}tjd|||f | j| | jjj|||}| j|d||f | j ||| |S )Nz'zone.removeSourcePort('%s', '%s', '%s')r )
r r^ r r1 r; r# r< r rA r )r) r< r r r: r r- r- r. removeSourcePort s
zFirewallD.removeSourcePortc C sD t |t}t |t}t |t}tjd|||f | jjj|||S )Nz&zone.querySourcePort('%s', '%s', '%s'))r r^ r r1 r# r< Zquery_source_port)r) r< r r r: r- r- r. querySourcePort) s
zFirewallD.querySourcePortc C s& t |t}tjd| | jjj|S )Nzzone.getSourcePorts('%s'))r r^ r r1 r# r< Zlist_source_ports)r) r< r: r- r- r. getSourcePorts6 s
zFirewallD.getSourcePortsc C s t jd||||f d S )Nz*zone.SourcePortAdded('%s', '%s', '%s', %d))r r1 )r) r< r r r r- r- r. r" B s zFirewallD.SourcePortAddedc C s t jd|||f d S )Nz(zone.SourcePortRemoved('%s', '%s', '%s'))r r1 )r) r< r r r- r- r. r H s
zFirewallD.SourcePortRemovedc C s( | j | d= | jjj| | j| d S )N
masquerade)r2 r# r< remove_masqueradeMasqueradeRemoved)r) r< r- r- r. disableTimedMasqueradeR s z FirewallD.disableTimedMasqueradeZsic C st t |t}t |t}tjd| | j| | jjj|||}|dkrdt j
|| j |}| j |d| | j
|| |S )Nzzone.addMasquerade('%s')r r' )r r^ r r r1 r; r# r< Zadd_masquerader r r* r? MasqueradeAdded)r) r< r r: r r> r- r- r.
addMasqueradeX s
zFirewallD.addMasqueradec C sJ t |t}tjd| | j| | jjj|}| j|d | j | |S )Nzzone.removeMasquerade('%s')r' )
r r^ r r1 r; r# r< r( rA r) )r) r< r: r r- r- r. removeMasqueradel s
zFirewallD.removeMasqueradec C s& t |t}tjd| | jjj|S )Nzzone.queryMasquerade('%s'))r r^ r r1 r# r< Zquery_masquerade)r) r< r: r- r- r. queryMasquerade{ s
zFirewallD.queryMasqueradec C s t jd||f d S )Nz zone.MasqueradeAdded('%s', %d))r r1 )r) r< r r- r- r. r+ s zFirewallD.MasqueradeAddedc C s t jd| d S )Nz zone.MasqueradeRemoved('%s'))r r1 )r) r< r- r- r. r) s zFirewallD.MasqueradeRemovedc C s@ | j | ||||f= | jjj||||| | j||||| d S )N)r2 r# r< remove_forward_portForwardPortRemoved)r) r< r r toporttoaddrr- r- r. disable_forward_port s z FirewallD.disable_forward_portZsssssic
C s t |t}t |t}t |t}t |t}t |t}t |t}tjd|||||f | j| | jjj|||||||}|dkrt j
|| j |||||} | j |||||f| | j
|||||| |S )Nz1zone.addForwardPort('%s', '%s', '%s', '%s', '%s')r )r r^ r r r1 r; r# r< Zadd_forward_portr r r3 r? ForwardPortAdded)
r) r< r r r1 r2 r r: r r> r- r- r. addForwardPort s&
zFirewallD.addForwardPortZsssssc C s t |t}t |t}t |t}t |t}t |t}tjd|||||f | j| | jjj|||||}| j|||||f | j ||||| |S )Nz4zone.removeForwardPort('%s', '%s', '%s', '%s', '%s'))
r r^ r r1 r; r# r< r/ rA r0 )r) r< r r r1 r2 r: r r- r- r. removeForwardPort s
zFirewallD.removeForwardPortc C s` t |t}t |t}t |t}t |t}t |t}tjd|||||f | jjj|||||S )Nz3zone.queryForwardPort('%s', '%s', '%s', '%s', '%s'))r r^ r r1 r# r< Zquery_forward_port)r) r< r r r1 r2 r: r- r- r. queryForwardPort s
zFirewallD.queryForwardPortc C s& t |t}tjd| | jjj|S )Nzzone.getForwardPorts('%s'))r r^ r r1 r# r< Zlist_forward_ports)r) r< r: r- r- r. getForwardPorts s
zFirewallD.getForwardPortsc C s t jd||||||f d S )Nz7zone.ForwardPortAdded('%s', '%s', '%s', '%s', '%s', %d))r r1 )r) r< r r r1 r2 r r- r- r. r4 s zFirewallD.ForwardPortAddedc C s t jd|||||f d S )Nz5zone.ForwardPortRemoved('%s', '%s', '%s', '%s', '%s'))r r1 )r) r< r r r1 r2 r- r- r. r0 s z FirewallD.ForwardPortRemovedc C s> t jd||f | j| |= | jjj|| | j|| d S )Nz&zone.disableTimedIcmpBlock('%s', '%s'))r r1 r2 r# r< remove_icmp_blockIcmpBlockRemoved)r) r< icmpr: r- r- r. disableTimedIcmpBlock s z FirewallD.disableTimedIcmpBlockc C s t |t}t |t}t |t}tjd||f | j| | jjj||||}|dkrxt j
|| j |||}| j ||| | j
||| |S )Nz zone.enableIcmpBlock('%s', '%s')r )r r^ r r r1 r; r# r< Zadd_icmp_blockr r r< r? IcmpBlockAdded)r) r< r; r r: r r> r- r- r. addIcmpBlock s
zFirewallD.addIcmpBlockc C s\ t |t}t |t}tjd||f | j| | jjj||}| j|| | j || |S )Nz zone.removeIcmpBlock('%s', '%s'))
r r^ r r1 r; r# r< r9 rA r: )r) r< r; r: r r- r- r. removeIcmpBlock s
zFirewallD.removeIcmpBlockc C s6 t |t}t |t}tjd||f | jjj||S )Nz zone.queryIcmpBlock('%s', '%s'))r r^ r r1 r# r< Zquery_icmp_block)r) r< r; r: r- r- r. queryIcmpBlock& s
zFirewallD.queryIcmpBlockc C s& t |t}tjd| | jjj|S )Nzzone.getIcmpBlocks('%s'))r r^ r r1 r# r< Zlist_icmp_blocks)r) r< r: r- r- r.
getIcmpBlocks1 s
zFirewallD.getIcmpBlocksc C s t jd|||f d S )Nz#zone.IcmpBlockAdded('%s', '%s', %d))r r1 )r) r< r; r r- r- r. r= = s zFirewallD.IcmpBlockAddedc C s t jd||f d S )Nz!zone.IcmpBlockRemoved('%s', '%s'))r r1 )r) r< r; r- r- r. r: C s zFirewallD.IcmpBlockRemovedc C s@ t |t}tjd| | j| | jjj||}| j| |S )Nz zone.addIcmpBlockInversion('%s')) r r^ r r1 r; r# r< Zadd_icmp_block_inversionIcmpBlockInversionAdded)r) r< r: r r- r- r. addIcmpBlockInversionL s
z FirewallD.addIcmpBlockInversionc C s> t |t}tjd| | j| | jjj|}| j| |S )Nz#zone.removeIcmpBlockInversion('%s')) r r^ r r1 r; r# r< Zremove_icmp_block_inversionIcmpBlockInversionRemoved)r) r< r: r r- r- r. removeIcmpBlockInversionZ s
z"FirewallD.removeIcmpBlockInversionc C s& t |t}tjd| | jjj|S )Nz"zone.queryIcmpBlockInversion('%s'))r r^ r r1 r# r< Zquery_icmp_block_inversion)r) r< r: r- r- r. queryIcmpBlockInversionh s
z!FirewallD.queryIcmpBlockInversionc C s t jd| d S )Nz"zone.IcmpBlockInversionAdded('%s'))r r1 )r) r< r- r- r. rB r s z!FirewallD.IcmpBlockInversionAddedc C s t jd| d S )Nz$zone.IcmpBlockInversionRemoved('%s'))r r1 )r) r< r- r- r. rD w s z#FirewallD.IcmpBlockInversionRemovedc C s` t |t}t |t}t |t}tjd|||f | j| | jjj||| | j||| d S )Nz!direct.addChain('%s', '%s', '%s')) r r^ r r1 r; r# r Z add_chain
ChainAdded)r) ipvtablechainr: r- r- r. addChain s
zFirewallD.addChainc C s` t |t}t |t}t |t}tjd|||f | j| | jjj||| | j||| d S )Nz$direct.removeChain('%s', '%s', '%s')) r r^ r r1 r; r# r Z remove_chain ChainRemoved)r) rH rI rJ r: r- r- r. removeChain s
zFirewallD.removeChainc C sD t |t}t |t}t |t}tjd|||f | jjj|||S )Nz#direct.queryChain('%s', '%s', '%s'))r r^ r r1 r# r Z query_chain)r) rH rI rJ r: r- r- r.
queryChain s
zFirewallD.queryChainc C s6 t |t}t |t}tjd||f | jjj||S )Nz direct.getChains('%s', '%s'))r r^ r r1 r# r Z
get_chains)r) rH rI r: r- r- r. getChains s
zFirewallD.getChainsza(sss)c C s t jd | jjj S )Nzdirect.getAllChains())r r1 r# r r )r) r: r- r- r. getAllChains s
zFirewallD.getAllChainsc C s t jd|||f d S )Nz#direct.ChainAdded('%s', '%s', '%s'))r r1 )r) rH rI rJ r- r- r. rG s zFirewallD.ChainAddedc C s t jd|||f d S )Nz%direct.ChainRemoved('%s', '%s', '%s'))r r1 )r) rH rI rJ r- r- r. rL s
zFirewallD.ChainRemovedZsssiasc C s t |t}t |t}t |t}t |t}tdd |D }tjd||||dj|f | j| | jj j
||||| | j ||||| d S )Nc s s | ]}t |tV qd S )N)r r^ ).0r r- r- r. s z$FirewallD.addRule..z*direct.addRule('%s', '%s', '%s', %d, '%s')z',') r r^ r r r r1 joinr; r# r r RuleAdded)r) rH rI rJ priorityr* r: r- r- r. addRule s
zFirewallD.addRulec C s t |t}t |t}t |t}t |t}tdd |D }tjd||||dj|f | j| | jj j
||||| | j ||||| d S )Nc s s | ]}t |tV qd S )N)r r^ )rQ r r- r- r. rR s z'FirewallD.removeRule..z-direct.removeRule('%s', '%s', '%s', %d, '%s')z',') r r^ r r r r1 rS r; r# r r RuleRemoved)r) rH rI rJ rU r* r: r- r- r.
removeRule s
zFirewallD.removeRulec C s t |t}t |t}t |t}tjd|||f | j| xF| jjj|||D ]0\}}| jjj||||| | j ||||| qPW d S )Nz$direct.removeRules('%s', '%s', '%s'))
r r^ r r1 r; r# r get_rulesr rW )r) rH rI rJ r: rU r* r- r- r. removeRules s
zFirewallD.removeRulesc C sn t |t}t |t}t |t}t |t}tdd |D }tjd||||dj|f | jjj |||||S )Nc s s | ]}t |tV qd S )N)r r^ )rQ r r- r- r. rR s z&FirewallD.queryRule..z,direct.queryRule('%s', '%s', '%s', %d, '%s')z',')
r r^ r r r r1 rS r# r r )r) rH rI rJ rU r* r: r- r- r. queryRule s
zFirewallD.queryRuleza(ias)c C sD t |t}t |t}t |t}tjd|||f | jjj|||S )Nz!direct.getRules('%s', '%s', '%s'))r r^ r r1 r# r rY )r) rH rI rJ r: r- r- r. getRules
s
zFirewallD.getRulesz a(sssias)c C s t jd | jjj S )Nzdirect.getAllRules())r r1 r# r r )r) r: r- r- r. getAllRules s
zFirewallD.getAllRulesc C s" t jd||||dj|f d S )Nz,direct.RuleAdded('%s', '%s', '%s', %d, '%s')z',')r r1 rS )r) rH rI rJ rU r* r- r- r. rT " s zFirewallD.RuleAddedc C s" t jd||||dj|f d S )Nz.direct.RuleRemoved('%s', '%s', '%s', %d, '%s')z',')r r1 rS )r) rH rI rJ rU r* r- r- r. rW ( s zFirewallD.RuleRemovedrS c C s t |t}tdd |D }tjd|dj|f | j| y| jjj ||S t
k
r } zh|d krzt ddd d
g}n t d d
g}t|}|j t
jkrtt ||@ d krtj| t| W Y d d }~X nX d S )
Nc s s | ]}t |tV qd S )N)r r^ )rQ r r- r- r. rR 9 s z(FirewallD.passthrough..z direct.passthrough('%s', '%s')z','rH rL z-Cz--checkz-Lz--listr )rH rL )r r^ r r r1 rS r; r# r passthroughr setcoder ZCOMMAND_FAILEDr rx r
)r) rH r* r: r9 Z
query_argsmsgr- r- r. r^ 2 s"
zFirewallD.passthroughc C s\ t |}tdd |D }tjd|dj|f | j| | jjj|| | j || d S )Nc s s | ]}t |V qd S )N)r )rQ r r- r- r. rR T s z+FirewallD.addPassthrough..z!direct.addPassthrough('%s', '%s')z',')
r r r r1 rS r; r# r Zadd_passthroughPassthroughAdded)r) rH r* r: r- r- r. addPassthroughM s
zFirewallD.addPassthroughc C s\ t |}tdd |D }tjd|dj|f | j| | jjj|| | j || d S )Nc s s | ]}t |V qd S )N)r )rQ r r- r- r. rR b s z.FirewallD.removePassthrough..z$direct.removePassthrough('%s', '%s')z',')
r r r r1 rS r; r# r Zremove_passthroughPassthroughRemoved)r) rH r* r: r- r- r. removePassthrough[ s
zFirewallD.removePassthroughc C sB t |}tdd |D }tjd|dj|f | jjj||S )Nc s s | ]}t |V qd S )N)r )rQ r r- r- r. rR p s z-FirewallD.queryPassthrough..z#direct.queryPassthrough('%s', '%s')z',')r r r r1 rS r# r Zquery_passthrough)r) rH r* r: r- r- r. queryPassthroughi s
zFirewallD.queryPassthroughza(sas)c C s t jd | jjj S )Nzdirect.getAllPassthroughs())r r1 r# r r )r) r: r- r- r. getAllPassthroughsu s
z FirewallD.getAllPassthroughsc C s. t jd x t| j D ]}| j| qW d S )Nz direct.removeAllPassthroughs())r r1 reversedrg re )r) r: r^ r- r- r. removeAllPassthroughs~ s
z FirewallD.removeAllPassthroughsc C s" t |}tjd| | jjj|S )Nz direct.getPassthroughs('%s'))r r r1 r# r Zget_passthroughs)r) rH r: r- r- r. getPassthroughs s zFirewallD.getPassthroughsc C s t jd|dj|f d S )Nz#direct.PassthroughAdded('%s', '%s')z',')r r1 rS )r) rH r* r- r- r. rb s zFirewallD.PassthroughAddedc C s t jd|dj|f d S )Nz%direct.PassthroughRemoved('%s', '%s')z',')r r1 rS )r) rH r* r- r- r. rd s z FirewallD.PassthroughRemovedc C s dS )z PK_ACTION_ALL implies all other actions, i.e. once a subject is
authorized for PK_ACTION_ALL it's also authorized for any other action.
Use-case is GUI (RHBZ#994729).
Nr- )r) r: r- r- r. authorizeAll s zFirewallD.authorizeAllc C s$ t |}tjd| | jjj|S )Nzipset.queryIPSet('%s'))r r r1 r# r| Z query_ipset)r) r| r: r- r- r.
queryIPSet s zFirewallD.queryIPSetc C s t jd | jjj S )Nzipsets.getIPSets())r r1 r# r| r} )r) r: r- r- r. getIPSets s
zFirewallD.getIPSetsc C s( t |t}tjd| | jjj|j S )NzgetIPSetSettings(%s))r r^ r r1 r# r| Z get_ipsetr )r) r| r: r- r- r. r~ s
zFirewallD.getIPSetSettingsc C sL t |}t |}tjd||f | j| | jjj|| | j|| d S )Nzipset.addEntry('%s', '%s'))r r r1 r; r# r| Z add_entry
EntryAdded)r) r| entryr: r- r- r. addEntry s
zFirewallD.addEntryc C sL t |}t |}tjd||f | j| | jjj|| | j|| d S )Nz ipset.removeEntry('%s', '%s'))r r r1 r; r# r| Z remove_entry EntryRemoved)r) r| ro r: r- r- r. removeEntry s
zFirewallD.removeEntryc C s2 t |}t |}tjd||f | jjj||S )Nz ipset.queryEntry('%s', '%s'))r r r1 r# r| Z query_entry)r) r| ro r: r- r- r.
queryEntry s zFirewallD.queryEntryc C s$ t |}tjd| | jjj|S )Nzipset.getEntries('%s'))r r r1 r# r| get_entries)r) r| r: r- r- r.
getEntries s zFirewallD.getEntriesc C s t |}t |t}tjd|dj| | jjj|}| jjj|| t |}t |}x || D ]}| j
|| q^W x || D ]}| j || q|W d S )Nz ipset.setEntries('%s', '[%s]'),) r listr r1 rS r# r| rt Z set_entriesr_ rn rq )r) r| Zentriesr: Z old_entriesZold_entries_setZ entries_setro r- r- r.
setEntries s
zFirewallD.setEntriesc C s& t |}t |}tjd||f d S )Nz ipset.EntryAdded('%s', '%s'))r r r1 )r) r| ro r- r- r. rn
s zFirewallD.EntryAddedc C s& t |}t |}tjd||f d S )Nz ipset.EntryRemoved('%s', '%s'))r r r1 )r) r| ro r- r- r. rq
s zFirewallD.EntryRemovedc C s t jd | jjj S )Nzhelpers.getHelpers())r r1 r# r r )r) r: r- r- r.
getHelpers!
s
zFirewallD.getHelpersc C s( t |t}tjd| | jjj|j S )NzgetHelperSettings(%s))r r^ r r1 r# r Z
get_helperr )r) r r: r- r- r. r *
s
zFirewallD.getHelperSettings)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)r )N)N)N)N)r )N)N)N)N)r )N)N)N)r )N)N)N)N)r )N)N)N)N)r )N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)__name__
__module__ __qualname____doc__Z
persistentr r' ZPK_ACTION_CONFIGZ default_polkit_auth_requiredr r" r0 r& r/ r
r; r? rA rC rZ r ZPROPERTIES_IFACEre rh slipZpolkitZ require_authri rr signalrj ZPK_ACTION_INFOZINTROSPECTABLE_IFACErk r( rn rp ro rq r ZPK_ACTION_POLICIESra r r ZPK_ACTION_POLICIES_INFOr r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r ZPK_ACTION_CONFIG_INFOr r_ r r r ZDBUS_INTERFACE_POLICYr r r r rt r r r ZDBUS_SIGNATUREr{ r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r rv r r
r r r r r r r r r r
r r r r r r r r! r# r$ r% r& r" r r* r, r- r. r+ r) r3 r5 r6 r7 r8 r4 r0 r< r> r? r@ rA r= r: rC rE rF rB rD ZPK_ACTION_DIRECTr` rK rM ZPK_ACTION_DIRECT_INFOrN rO rP rG rL rV rX rZ r[ r\ r] rT rW r^ rc re rf rg ri rj rb rd Z
PK_ACTION_ALLrk rb rl rm r r~ rp rr rs ru rx rn rq ry r r
__classcell__r- r- )r, r. r A s 0 "
K
)9__all__Z
gi.repositoryr r sysmodulesr r' Z dbus.serviceZ slip.dbusr~ Zslip.dbus.serviceZfirewallr Zfirewall.core.fwr Zfirewall.core.richr Zfirewall.core.loggerr Zfirewall.clientr Zfirewall.server.decoratorsr
r r r
Zfirewall.server.configr Zfirewall.dbus_utilsr r r r r r r Zfirewall.core.io.functionsr Zfirewall.core.io.ipsetr Zfirewall.core.io.icmptyper Zfirewall.core.io.helperr Zfirewall.core.fw_nmr r r Zfirewall.core.fw_ifcfgr r Zfirewall.errorsr rr ZObjectr r- r- r- r. s2
$