a
i+J @ s g d Z ddlZddlZddlZddlZddlZddlZddlZddlm Z ddl
m Z m Z dd e
ddD Zdd Zd
d ZdUd
dZdd Zdd Zdd Zdd Zdd Zdd Zdd Zd d Zd d Zd!d" Zd#d$ Z d%d& Z d'd( Z d)d* Z d+d, Z d-d. Z!d/d0 Z"d1d2 Z#d3d4 Z$d5d6 Z%d7d8 Z&d9d: Z'd;d< Z(d=d> Z)d?d@ Z*dAdB Z+dCdD Z,dEdF Z-dGdH Z.dIdJ Z/dKdL Z0dMdN Z1dOdP Z2dQdR Z3dSdT Z4dS )V)! getPortID getPortRangeportStrgetServiceNamecheckIPcheckIP6 checkIPnMask
checkIP6nMask
checkProtocolcheckInterface checkUINT16 checkUINT32firewalld_is_activetempFilereadfile writefileenable_ip_forwarding
check_port
check_addresscheck_single_address check_macuniqify ppid_of_pidmax_zone_name_len checkUsercheckUid checkCommand checkContextjoinArgs splitArgsmax_policy_name_lencheckTcpMssClampstripNonPrintableCharacters N)log)FIREWALLD_TEMPDIRFIREWALLD_PIDFILEc C s" i | ]}|d kr|dk s|dqS ) N ).0ir( r( 6/usr/lib/python3.9/site-packages/firewall/functions.py
+ s r, c C st t | tr| }nT| r | } z t| }W n: tyb zt| }W n tjy\ Y Y dS 0 Y n0 |dkrpdS |S )z Check and Get port id from port string or port id using socket.getservbyname
@param port port string or port id
@return Port id if valid, -1 if port can not be found and -2 if port is too big
)
isinstanceintstrip
ValueErrorsocketZ
getservbynameerror)portZ_idr( r( r+ r 4 s
r c C s t | tst | tr| S t | ts*| rDt| }|dkr@|fS |S | d}t|dkr|d r|d rt|d }t|d }|dkr|dkr||k r||fS ||kr||fS |fS g }tt|ddD ]}td |d| }d ||d }t|dkrlt|}|dkr|dkr||k rD|
||f n&||kr^|
||f n |
|f q|dkr|
|f |t|kr qqt|dk rdS t|dkrdS |d S )aI Get port range for port range string or single port id
@param ports an integer or port string or port range string
@return Array containing start and end port id for a valid range or -1 if port can not be found and -2 if port is too big for integer input or -1 for invalid ranges or None if the range is ambiguous.
r" - r. N) r1 tuplelistr2 isdigitr splitlenrangejoinappend)ZportsZid1splitsZid2Zmatchedr* Zport2r( r( r+ r K sL
$
r :c C sX | dkr dS t | }t|tr*|dk r*dS t|dkr>d| S d|d ||d f S dS )a Create port and port range string
@param port port or port range int or [int, int]
@param delimiter of the output string for port ranges, default ':'
@return Port or port range string, empty string if port isn't specified, None if port or port range is not valid
r" Nr: z%sz%s%s%s)r r1 r2 r? )r7 Z delimiter_ranger( r( r+ r s r c C s t | }t |}t|dkrt|dkr@t|d t|d kS t|dkrt|d t|d krt|d t|d krdS n|t|dkrt|dkrt|d t|d krt|d t|d krt|d t|d krt|d t|d krdS dS )Nr: r" r9 TF)r r? r )r7 r@ Z_portrF r( r( r+ portInPortRange s. rG c C sP t | }t|dkr$|d |d f}tt |}ttdd |dd d}g }|D ]}|d |d kr|d |d kr|| qP|d |d kr|d |d k r|d |d kr|| |d |d f}qP|d |d krP|d |d krP|d |d krP|| |d |d f}qPttdd |}|d |d krF|d f}|g|fS )z Coalesce a port range with existing list of port ranges
@param new_range tuple/list/string
@param ranges list of tuple/list/string
@return tuple of (list of ranges added after coalescing, list of removed original ranges)
r: r" c S s t | dkr | d | d fS | S Nr: r" r? xr( r( r+ z#coalescePortRange..c S s | d S Nr" r( rJ r( r( r+ rL rM keyc S s | d | d kr| d fS | S Nr" r: r( rJ r( r( r+ rL rM r r? mapsortedrB r< )Z new_rangerangesZcoalesced_range_rangesremoved_rangesr@ r( r( r+ coalescePortRange s.
rX c C s t | } t| dkr$| d | d f} tt |}ttdd |dd d}g }g }|D ]@}| d |d kr| d |d kr|| qT| d |d kr| d |d k r| d |d kr|| || d d |d f qT| d |d kr8| d |d kr8| d |d kr8|| ||d | d d f qT| d |d krT| d |d k rT|| ||d | d d f || d d |d f qTttdd |}ttdd |}||fS ) z break a port range from existing list of port ranges
@param remove_range tuple/list/string
@param ranges list of tuple/list/string
@return tuple of (list of ranges added after breaking up, list of removed original ranges)
r: r" c S s t | dkr | d | d fS | S rH rI rJ r( r( r+ rL rM z breakPortRange..c S s | d S rN r( rJ r( r( r+ rL rM rO c S s | d | d kr| d fS | S rQ r( rJ r( r( r+ rL rM c S s | d | d kr| d fS | S rQ r( rJ r( r( r+ rL rM rR )Z remove_rangerU rV rW Z added_rangesr@ r( r( r+ breakPortRange s6
$
rY c C s0 zt t| |}W n t jy* Y dS 0 |S )z Check and Get service name from port and proto string combination using socket.getservbyport
@param port string or id
@param protocol string
@return Service name if port and protocol are valid, else None
N)r5 Z
getservbyportr2 r6 )r7 protonamer( r( r+ r s
r c C s. zt t j| W n t jy( Y dS 0 dS )zh Check IPv4 address.
@param ip address string
@return True if address is valid, else False
FT)r5 inet_ptonZAF_INETr6 ipr( r( r+ r s
r c C s
| dS )z Normalize the IPv6 address
This is mostly about converting URL-like IPv6 address to normal ones.
e.g. [1234::4321] --> 1234:4321
z[])r3 r] r( r( r+ normalizeIP6 s r_ c C s2 zt t jt| W n t jy, Y dS 0 dS )zh Check IPv6 address.
@param ip address string
@return True if address is valid, else False
FT)r5 r\ ZAF_INET6r_ r6 r] r( r( r+ r s
r c C s | d}|dkr<| d | }| |d d }|r6|sDdS n| }d }t|sPdS |rd|v rdt|S z t|}W n ty Y dS 0 |dk s|dkrdS dS ) N/r. r: F.r" T)findr r2 r4 r^ indexaddrmaskr* r( r( r+ r * s(
r c C s
| tS N) translateNOPRINT_TRANS_TABLE)Zrule_strr( r( r+ r! B s r! c C s | d}|dkr<| d | }| |d d }|r6|sDdS n| }d }t|sPdS |rz t|}W n tyt Y dS 0 |dk s|dkrdS dS )Nr` r. r: Fr" T)rc r r2 r4 rd r( r( r+ r E s$
r c C s` z t | }W n: tyF zt| W n tjy@ Y Y dS 0 Y n0 |dk sX|dkr\dS dS )NFr" T)r2 r4 r5 Zgetprotobynamer6 )Zprotocolr* r( r( r+ r [ s r c C s: | r6| r t| dk r6dS n| dkr*dS | dkr6dS dS )Ni FNoneTZpmtu)r= r2 )Ztcp_mss_clamp_valuer( r( r+ r j s r c C s0 | rt | dkrdS dD ]}|| v r dS qdS )z Check interface string
@param interface string
@return True if interface is valid (maximum 16 chars and does not contain ' ', '/', '!', ':', '*'), else False
F) r` !*TrI )Zifacechr( r( r+ r
u s r
c C s< zt | d}W n ty" Y dS 0 |dkr8|dkr8dS dS )Nr" Fr/ Tr2 r4 valrK r( r( r+ r s r c C s< zt | d}W n ty" Y dS 0 |dkr8|dkr8dS dS )Nr" Fl Trs rt r( r( r+ r s r c C s t jtsdS z6ttd} | }W d n1 s:0 Y W n tyZ Y dS 0 t jd| spdS z:td| d} | }W d n1 s0 Y W n ty Y dS 0 d|v rdS dS )zv Check if firewalld is active
@return True if there is a firewalld pid file and the pid is used by firewalld
FrNz/proc/%sz/proc/%s/cmdlineZ firewalldT)ospathexistsr% openreadline Exception)fdpidZcmdliner( r( r+ r
s" * * r
c
C sf z,t jtst td tjddtddW S ty` } z t d| W Y d } ~ n
d } ~ 0 0 d S )Ni Zwtztemp.F)modeprefixdirdeletez#Failed to create temporary file: %s)
rw rx ry r$ mkdirtempfileZNamedTemporaryFiler| r# r6 )msgr( r( r+ r s r c
C st z8t | d}| W d W S 1 s,0 Y W n6 tyn } z td| |f W Y d }~n
d }~0 0 d S )Nrv z Failed to read file "%s": %s)rz readlinesr| r# r6 )filenamefer( r( r+ r s ,(r c
C sv z8t | d}|| W d n1 s,0 Y W n8 typ } z td| |f W Y d }~dS d }~0 0 dS )Nwz Failed to write to file "%s": %sFT)rz writer| r# r6 )r liner r r( r( r+ r s ,r c C s( | dkrt ddS | dkr$t ddS dS )Nipv4z /proc/sys/net/ipv4/ip_forwardz1
ipv6z&/proc/sys/net/ipv6/conf/all/forwardingF)r )ipvr( r( r+ r s
r c C s | dd ddS )N_r8 z
nf-conntrack-rE )replace)moduler( r( r+ get_nf_conntrack_short_name s r c C s t | }|dks<|dks<|d u s 65535z'%s': port is invalidz'%s': port is ambiguousz'%s': range start >= endFT)r r? r# Zdebug2)r7 rF r( r( r+ r s
r c C s( | dkrt |S | dkr t|S dS d S Nr r F)r r r sourcer( r( r+ r s
r c C s( | dkrt |S | dkr t|S dS d S r )r r r r( r( r+ r s
r c C sN t | dkrJdD ]}| | dkr dS qdD ]}| | tjvr, dS q,dS dS )N )r9 rD F) r" r:
rn T)r? stringZ hexdigits)Zmacr* r( r( r+ r s r c C s$ g }| D ]}||vr| | q|S rh )rB )Z_listoutputrK r( r( r+ r
s
r c C sH z.t d| }t| d } | W n tyB Y dS 0 | S )z Get parent for pid z ps -o ppid -h -p %d 2>/dev/nullr" N)rw popenr2 r r3 closer| )r~ r r( r( r+ r s r c C sB ddl m} ddlm} ttt| }d|t| td S )z
iptables limits length of chain to (currently) 28 chars.
The longest chain we create is POST__allow,
which leaves 28 - 11 = 17 chars for .
r" )POLICY_CHAIN_PREFIX SHORTCUTS Z_allow)Zfirewall.core.ipXtablesr firewall.core.baser maxrS r? values)r r longest_shortcutr( r( r+ r s r c C s. ddl m} ttt| }d|td S )z
Netfilter limits length of chain to (currently) 28 chars.
The longest chain we create is POST__allow,
which leaves 28 - 11 = 17 chars for .
r" r r Z__allow)r r r rS r? r )r r r( r( r+ r ' s r c C sR t | dk s t | tdkr"dS | D ]&}|tjvr&|tjvr&|dvr& dS q&dS )Nr: SC_LOGIN_NAME_MAXF)ra r8 r $T)r? rw sysconfr Z
ascii_lettersdigits)usercr( r( r+ r 1 s
r c C sD t | tr,z t| } W n ty* Y dS 0 | dkr@| dkr@dS dS )NFr" iT)r1 strr2 r4 )uidr( r( r+ r ; s
r c C sH t | dk st | dkr dS dD ]}|| v r dS q | d dkrDdS dS )Nr: i F)|
r" r` TrI )Zcommandrr r( r( r+ r E s r c C s | d}t|dvrdS |d dkr>|d dd dkr>dS |d dd d krVdS |d
dd d krndS t|d dk rdS d
S )NrD )r r Fr" rootr0 Z_ur: Z_rr9 Z_tr T)r> r? )contextrC r( r( r+ r O s
r c C s8 dt tv r ddd | D S ddd | D S d S )Nquotero c s s | ]}t |V qd S rh )shlexr r) ar( r( r+ c rM zjoinArgs..c s s | ]}t |V qd S rh )pipesr r r( r( r+ r e rM )r r rA )argsr( r( r+ r a s r c C s
t | S rh )r r> )Z_stringr( r( r+ r g s r )rD )5__all__r5 rw Zos.pathr r r r Zfirewall.core.loggerr# Zfirewall.configr$ r% r@ rj r r r rG rX rY r r r_ r r r! r r r r
r r r
r r r r r r r r r r r r r r r r r r r r( r( r( r+ sd :
&+