a
i^ @ sf d Z dgZddlZddlmZ ddlmZ ddlmZ ddl m
Z
m Z m Z m
Z
mZ G dd deZdS ) z Z d?d@ Z dg dAfdBdCZ!dg fdDdEZ"dg fdFdGZ#dHdI Z$dJdK Z%dLdM Z&dNdO Z'dPdQ Z(dRdS Z)dTdU Z*dVdW Z+dXdY Z,dZd[ Z-dS )nr Fc C s || _ || _d| _d | _d S NT)quietverbose'_FirewallCommand__use_exception_handlerfw)selfr r
r 4/usr/lib/python3.9/site-packages/firewall/command.py__init__# s zFirewallCommand.__init__c C s
|| _ d S N)r )r r r r r set_fw) s zFirewallCommand.set_fwc C s
|| _ d S r r r flagr r r set_quiet, s zFirewallCommand.set_quietc C s | j S r r r r r r get_quiet/ s zFirewallCommand.get_quietc C s
|| _ d S r r
r r r r set_verbose2 s zFirewallCommand.set_verbosec C s | j S r r r r r r get_verbose5 s zFirewallCommand.get_verboseNc C s" |d ur | j s tj|d d S N
)r sysstdoutwriter msgr r r print_msg8 s zFirewallCommand.print_msgc C s" |d ur | j s tj|d d S r )r r! stderrr# r$ r r r print_error_msg< s z FirewallCommand.print_error_msgc C s, d}d}t j r || | }| | d S )Nz[91mz[00m)r! r' isattyr( )r r% ZFAILZENDr r r
print_warning@ s
z FirewallCommand.print_warningr c C s, |dkr| | n
| | t| d S )N )r* r& r! exit)r r% Z exit_coder r r print_and_exitG s
z FirewallCommand.print_and_exitc C s | |d d S )N r- r$ r r r failR s zFirewallCommand.failc C s" |d ur | j r tj|d d S r )r
r! r" r# r$ r r r print_if_verboseU s z FirewallCommand.print_if_verbosec
C s | j d ur| j g }
d} g } |D ]}
|d urz ||
}
W n ty } zltt|}t|dkrv| d| n| d| | || vr| | | d7 } W Y d }~q$W Y d }~n
d }~0 0 |
|
q$|
D ]d}
g }|d ur||7 }t
|
t st
|
t s| |
n||
7 }|d ur*||7 }|
z || W n ttfy. } zt
|trx| | | }nt|}t|}|tjtjtjtjfv rd}t|dkr| d| n8|dkr| d| W Y d }~ d S | d| | || vr| | | d7 } W Y d }~n
d }~0 0 | q| st|| ksXd| v r\d S t| dkrzt| d nt| dkrttj d S )Nr r+ Warning: %s Error: %s)r Z authorizeAll Exceptionr get_codestrlenr* r- append
isinstancelisttuple deactivate_exception_handlerr fail_if_not_authorized
get_dbus_nameget_dbus_messager ALREADY_ENABLED NOT_ENABLEDZONE_ALREADY_SET ALREADY_SETactivate_exception_handlerr! r, Z
UNKNOWN_ERROR)r Zcmd_typeoption
action_method query_method parse_methodmessage
start_argsend_argsno_exititems_errorsZ _error_codesitemr% code call_itemr r r Z__cmd_sequenceY st
"
z FirewallCommand.__cmd_sequencec C s | j d||||||d d S )NaddrL _FirewallCommand__cmd_sequencer rE rF rG rH rI rL r r r add_sequence s z FirewallCommand.add_sequencec
C s | j d||||||g|d d S )NrR rJ rL rT r xrE rF rG rH rI rL r r r x_add_sequence s z FirewallCommand.x_add_sequencec C s$ | j d||||||g|g|d d S )NrR )rJ rK rL rT ) r zonerE rF rG rH rI timeoutrL r r r zone_add_timeout_sequence s z)FirewallCommand.zone_add_timeout_sequencec C s | j d||||||d d S )NremoverS rT rV r r r remove_sequence s z FirewallCommand.remove_sequencec
C s | j d||||||g|d d S )Nr_ rX rT rY r r r x_remove_sequence s z!FirewallCommand.x_remove_sequencec
C s* g }|D ]}|d urz ||}W nj t y } zRt|dkrX| d| W Y d } ~ qn tt| }
| d| |
W Y d } ~ n
d } ~ 0 0 || q|D ]v}g } |d ur| |7 } t|t st|t
s| | n| |7 } | z || } W n t yv } zj|
| t| }
t|dkrN| d| W Y d } ~ qn| d| |
W Y d } ~ njd } ~ 0 t y } zHtt| }
t|dkr| d| n| d| |
W Y d } ~ n
d } ~ 0 0 | t|dkr
| d|| d| f q| | q|s&td d S )Nr+ r2 r3 z%s: %s)noyesr )r4 r7 r* r r5 r6 r- r8 r9 r: r; r< r r= r> r? rD r& print_query_resultr! r, )
r rE rG rH rI rJ rL rM rO r% rP rQ resr r r Z__query_sequence sT &
& z FirewallCommand.__query_sequencec C s | j |||||d d S )NrS _FirewallCommand__query_sequence)r rE rG rH rI rL r r r query_sequence s
z FirewallCommand.query_sequencec C s | j |||||g|d d S )NrX rf )r rZ rE rG rH rI rL r r r x_query_sequence s
z FirewallCommand.x_query_sequencec C sB t |s>t|s>t|s>|dr.t|dks>ttjd| |S )Nzipset: z8'%s' is no valid IPv4, IPv6 or MAC address, nor an ipset)r r r
startswithr7 r r INVALID_ADDRr valuer r r parse_source s
z FirewallCommand.parse_source/c C sj z| |\}}W n" ty4 ttjd| Y n0 t|sJttj||dvrbttjd| ||fS )NzTbad port (most likely missing protocol), correct syntax is portid[-portid]%sprotocolZtcpZudpZsctpZdccp''%s' not in {'tcp'|'udp'|'sctp'|'dccp'})split
ValueErrorr r INVALID_PORTr INVALID_PROTOCOL)r rn separatorportprotor r r
parse_port s zFirewallCommand.parse_portc
C s d }d }d }d }d}d||d v r||d ddd }|t|d 7 }d||d v rv||d ddd } n ||d } |t| d 7 }|dkr| }q|dkr| }q|dkr| }q|dkr| }q|d kr|rqttjd
| q|sttjd |s ttjd |s$|s$ttjd
t|s:ttj||dvrTttjd| |rpt|spttj||rtd|s|std|sttj |||||fS )Nr =r+ :rx ry toporttoaddrifz invalid forward port arg '%s'z missing portzmissing protocolzmissing destinationrq rr ipv4ipv6)
rs r7 r r ZINVALID_FORWARDr ru rv r
rl )
r rn compatrx Zprotocolr} r~ ioptvalr r r parse_forward_port sZ
z"FirewallCommand.parse_forward_portc C sF | d}t|dkr"|d dfS t|dkr2|S ttjd| d S )Nr{ r+ r r. zinvalid ipset option '%s')rs r7 r r ZINVALID_OPTION)r rn argsr r r parse_ipset_optionH s
z"FirewallCommand.parse_ipset_optionc C s. ddg}||vr*t tjd|d|f |S )Nr r 'invalid argument: %s (choose from '%s')', 'r r Z INVALID_IPVjoinr rn Zipvsr r r check_destination_ipvR s z%FirewallCommand.check_destination_ipvc C sB z| dd\}}W n ty2 ttjdY n0 | ||fS )Nr| r+ z(destination syntax is ipv:address[/mask])rs rt r r ZINVALID_DESTINATIONr )r rn ZipvZ destinationr r r parse_service_destinationZ s
z)FirewallCommand.parse_service_destinationc C s. g d}||vr*t tjd|d|f |S )N)r r Zebr r r r r r r check_ipvb s zFirewallCommand.check_ipvc C s. g d}||vr*t tjd|d|f |S )N)r r r r r r r r r r check_helper_familyj s z#FirewallCommand.check_helper_familyc C sB | dsttjd| t|dddk r>ttjd| |S )NZ
nf_conntrack_z('%s' does not start with 'nf_conntrack_'r r+ zModule name '%s' too short)rk r r ZINVALID_MODULEr7 replacerm r r r check_moduler s
z FirewallCommand.check_moduleTc C s | }| }| }| } | }
| } | } | }
| }| }|
}|rv| }| }|
}n,| }tt| | }| }| }dd }g }|d ur||kr|d |s|s|s|r|r|r|d |r|dd| }| | | jr0| d| | d| |rH| d t| | d
| |st| d |rld nd
|r| dd| | dd| n(| dd| | dd| | ddt| | dddd |D | ddt| |s8| d|r0d nd
| d|
rHd nd
| d| r`dnd dd d | D | d dd d | D | d d|
| d!|rdnd dt||d" d S )#Nc S sd d}d}z| |}W n ty( Y n80 |t|7 }t| ||| |d d dd}|S )Nr z priority= "r )indexrt r7 intr )ZrulepriorityZ
search_strr r r r rich_rule_sorted_key s *zDFirewallCommand.print_zone_policy_info..rich_rule_sorted_keydefaultZactivez (%s)z, summary: description: z priority: z
target: z icmp-block-inversion: %src rb z ingress-zones: r z egress-zones: z interfaces: z sources: z services: ports: c S s g | ]}d |d |d f qS z%s/%sr r+ r .0rx r r r
s z:FirewallCommand.print_zone_policy_info..
protocols: z
forward: %sz masquerade: %sz forward-ports: z
r c S s$ g | ] \}}}}d ||||f qS )z$port=%s:proto=%s:toport=%s:toaddr=%sr )r rx ry r} r~ r r r r s
source-ports: c S s g | ]}d |d |d f qS r r r r r r r s z icmp-blocks: z rich rules: )key)Z getTargetZ getServicesgetPorts getProtocolsZ
getMasqueradeZgetForwardPortsgetSourcePortsZ
getIcmpBlocksZ getRichRulesgetDescriptiongetShortZgetIngressZonesZgetEgressZonesZ getPriorityZgetIcmpBlockInversionsortedsetZ
getInterfacesZ
getSourcesZ
getForwardr8 r r& r
r6 )r r\ settings default_zoneextra_interfacesisPolicytargetZservicesports protocolsZ
masqueradeZ
forward_ports source_portsZ icmp_blocksZrules descriptionshort_descriptionZ
ingress_zonesZ egress_zonesr Zicmp_block_inversionZ
interfacesZsourcesZforwardr Z
attributesr r r print_zone_policy_info| s
z&FirewallCommand.print_zone_policy_infoc C s | j ||||dd d S )NFr r r r )r r\ r r r r r r print_zone_info s z FirewallCommand.print_zone_infoc C s | j ||||dd d S )NTr r )r Zpolicyr r r r r r print_policy_info s z!FirewallCommand.print_policy_infoc C s. | }| }| }| }| }| }| } | }
| } | | | j
rt| d| | d| | dd dd |D | dd | | dd d d |D | d
d | | d d d d | D | d
d t
|
| dd t
| d S )Nr r r r c S s g | ]}d |d |d f qS r r r r r r r s z6FirewallCommand.print_service_info..r r c S s g | ]}d |d |d f qS r r r r r r r s z modules: destination: c S s g | ]\}}d ||f qS )z%s:%sr r kvr r r r s z includes: z helpers: )r r r Z
getModulesr getDestinationsr Z getIncludesZ
getHelpersr& r
r rM r ) r Zservicer r r r modulesr destinationsr ZincludesZhelpersr r r print_service_info s<
z"FirewallCommand.print_service_infoc C sp | }| }| }t|dkr,ddg}| | | jrX| d| | d| | dd| d S )Nr r r r r r r )r r r r7 r& r
r )r Zicmptyper r r r r r r print_icmptype_info s
z#FirewallCommand.print_icmptype_infoc C s | }| }| }| }| }| | | jrT| d| | d| | d| | dddd | D | dd| d S ) Nr r z type: z options: r c S s$ g | ] \}}|r d ||f n|qS )z%s=%sr r r r r r s z4FirewallCommand.print_ipset_info..z entries: ) ZgetTypeZ
getOptionsZ
getEntriesr r r& r
r rM )r Zipsetr Z
ipset_typeoptionsentriesr r r r r print_ipset_info s
z FirewallCommand.print_ipset_infoc C s | }| }| }| }| }| | | jrT| d| | d| | d| | d| | dddd |D d S ) Nr r z
family: z
module: r r c S s g | ]}d |d |d f qS r r r r r r r s z5FirewallCommand.print_helper_info..)r Z getModuleZ getFamilyr r r& r
r )r helperr r moduleZfamilyr r r r r print_helper_info s
z!FirewallCommand.print_helper_infoc C s |r| d n | dd d S )Nrc rb r+ r/ rm r r r rd s z"FirewallCommand.print_query_resultc C s\ | j s | | tt|}|tjtjtjtj fv rH|
d| n| d| | d S )Nr2 r3 ) r r= r r5 r6 r r@ rA rB rC r* r- )r exception_messagerP r r r exception_handler s
z!FirewallCommand.exception_handlerc C s d|v rd}| |tj d S )NZNotAuthorizedExceptionz`Authorization failed.
Make sure polkit agent is running or run the application as superuser.)r- r ZNOT_AUTHORIZED)r r r% r r r r= ' s z&FirewallCommand.fail_if_not_authorizedc C s
d| _ d S )NFr r r r r r< - s z,FirewallCommand.deactivate_exception_handlerc C s
d| _ d S r r r r r r rD 0 s z*FirewallCommand.activate_exception_handlerc C sn g }t }t|}|D ]J}|s" qb| }t|dk s|d dv rDq||vr|| || q| |S )Nr+ r )#;)r openstripr7 r8 rR close)r filenamer Z entries_setfliner r r get_ipset_entries_from_file3 s
z+FirewallCommand.get_ipset_entries_from_file)FF)N)N)N)Nr )N)N)NNF)F)F)F)F)F)NF)F)F)rp )F).__name__
__module__ __qualname__r r r r r r r& r( r* r- r0 r1 rU rW r[ r^ r` ra rg rh ri ro rz r r r r r r r r r r r r r r rd r r= r< rD r r r r r r " sj
L
3
2
O )__doc____all__r! Zfirewallr Zfirewall.errorsr Zdbus.exceptionsr Zfirewall.functionsr r r r r
objectr r r r r s