a
«°ià ã @ sæ d gZ ddlZddlZddlZddlZddlZddlmZmZ ddl m
Z
ddl m Z ddl m
Z
ddl mZ ddl mZ dd l mZ dd
l mZ dd lmZ dd lmZ dd
lmZ ddlmZ ddlmZ ddl m Z ddl m Z ddl m!Z! ddl"m#Z# ddl$m%Z% ddl&m'Z'm(Z( ddl)m*Z* ddl+m,Z, ddl-m.Z. ddl/m0Z0 ddl1m2Z2 ddl3m4Z4 dd l5m6Z6m7Z7 dd l8m9Z9 dd l:m;Z; dd lm?Z? dd!l@mAZA dd"lBmCZC dd#l mDZD dd$lEmFZF G d%d „ d eGƒZHdS )&ÚFirewallé N)ÚDictÚList)Úconfig)Ú functions)Ú ipXtables)Úebtables)Únftables)Úipset)Úmodules)ÚFirewallIcmpType)ÚFirewallService)Ú FirewallZone)ÚFirewallDirect)ÚFirewallConfig)ÚFirewallPolicies)Ú
FirewallIPSet)ÚFirewallTransaction)ÚFirewallHelper)ÚFirewallPolicy)Únm_get_bus_nameÚnm_get_interfaces_in_zone)Úlog)Ú IO_Object)Úfirewalld_conf)ÚDirect)Úservice_reader)Úicmptype_reader)Ú zone_readerÚZone)Ú ipset_reader)Ú IPSET_TYPES)Ú
helper_reader)Ú
policy_reader)Úcheck_on_disk_config)Ú Rich_Rule)Úerrors)Ú
FirewallErrorc @ sZ e Zd ZdŒdd„Zdd„ Zdd„ Zdd „ Zi feee e
f d
œd d „Z d
d„ Z dd„ Z
dd„ Zdd„ Zdd„ Zdd„ Zdd„ Zdd „ Zdd d „Zd d „ Zd!d"„ ZdŽd#d$„Zdd%d&„Zd'd(„ Zd)d*„ Zd+d,„ Zd-d.„ Z d/d0„ Z d1d2„ Z d3d4„ Z dd5d6„Z d7d8„ Z!d9d:„ Z"d;d<„ Z#d=d>„ Z$d?d@„ Z%dAdB„ Z&dCdD„ Z'dEdF„ Z(dGdH„ Z)dIdJ„ Z*dKdL„ Z+d‘dNdO„Z,d’dPdQ„Z-dRdS„ Z.d“dTdU„Z/d”dVdW„Z0d•dXdY„Z1d–dZd[„Z2d\d]„ Z3d^d_„ Z4d`da„ Z5dbdc„ Z6ddde„ Z7dfdg„ Z8dhdi„ Z9djdk„ Z:dldm„ Z;dndo„ Zdtdu„ Z?d—dvdw„Z@dxdy„ ZAdzd{„ ZBd|d}„ ZCd~d„ ZDd€d„ ZEd‚dƒ„ ZFd„d…„ ZGd†d‡„ ZHdˆd‰„ ZIdŠd‹„ ZJdMS )˜r Fc C s¼ t tjƒ| _|| _|sXt | ¡| _t | ¡| _ t
¡ | _ t ¡ | _
t | ¡| _t ¡ | _t| ƒ| _t| ƒ| _t| ƒ| _t| ƒ| _t| ƒ| _tƒ | _ t | ƒ| _ t | ƒ| _ t | ƒ| _!| "¡ d S ©N)#r r ÚFIREWALLD_CONFÚ_firewalld_confÚ_offliner Ú ip4tablesÚip4tables_backendÚ ip6tablesÚip6tables_backendr Úebtables_backendr
Ú
ipset_backendr Únftables_backendr Úmodules_backendr Úicmptyper
Úservicer Úzoner Údirectr r Úpoliciesr r Úhelperr ÚpolicyÚ_Firewall__init_vars)ÚselfZoffline© r= ú4/usr/lib/python3.9/site-packages/firewall/core/fw.pyÚ__init__G s&
zFirewall.__init__c C sD d| j | j| j| j| j| j| j| j| j| j | j
| j | j | j
| jf S )Nz:%s(%r, %r, %r, %r, %r, %r, %r, %r, %r, %r, %r, %r, %r, %r))Ú __class__Úip4tables_enabledÚip6tables_enabledÚebtables_enabledÚ_stateÚ_panicÚ
_default_zoneÚ_module_refcountÚ_marksÚcleanup_on_exitÚcleanup_modules_on_exitÚ_ipv6_rpfilterÚ
ipset_enabledÚ_individual_callsÚ _log_denied©r< r= r= r> Ú__repr___ s ûÿzFirewall.__repr__c C sÜ d| _ d| _tj| _g | _g | _i | _g | _tj | _
tj | _ tj
| _tj| _tj| _tj| _tj| _tj| _tj| _tj| _ | j r¨d| _ d| _ d| _ d| _!t"| _#d| _$n0d| _ g | _%d| _ g | _&d| _ d| _!t"| _#d| _$d S )NZINITFT)'rD rE r Z
FALLBACK_ZONErF Ú_default_zone_interfacesZ_nm_assigned_interfacesrG rH ZFALLBACK_CLEANUP_ON_EXITrI Z FALLBACK_CLEANUP_MODULES_ON_EXITrJ ZFALLBACK_IPV6_RPFILTERrK ZFALLBACK_INDIVIDUAL_CALLSrM ZFALLBACK_LOG_DENIEDrN ZFALLBACK_FIREWALL_BACKENDÚ_firewall_backendZ FALLBACK_FLUSH_ALL_ON_RELOADÚ_flush_all_on_reloadZFALLBACK_RFC3964_IPV4Ú
_rfc3964_ipv4Z FALLBACK_ALLOW_ZONE_DRIFTINGZ_allow_zone_driftingZ FALLBACK_NFTABLES_TABLE_OWNERÚ_nftables_table_ownerr+ rA rB rC rL r! Zipset_supported_typesÚnftables_enabledÚipv4_supported_icmp_typesÚipv6_supported_icmp_typesrO r= r= r> Z __init_varsh s@ zFirewall.__init_varsc sÒ i }‡ fdd„ˆ j ¡ D ƒ|d< ‡ fdd„ˆ j ¡ D ƒ|d< ‡ fdd„ˆ j ¡ D ƒ|d< ‡ fdd„ˆ j ¡ D ƒ|d < ‡ fd
d„ˆ j ¡ D ƒ|d < ‡ fd d„ˆ j
¡ D ƒ|d
< i |d< ˆ j
d¡|d d< i |d< i |d d< tˆ j ¡ ƒ tˆ j ¡ ƒ¡D ] }ˆ j |¡|d d |< qútˆ j ¡ ƒ tˆ j ¡ ƒ¡D ]–}|ˆ jvsR|ˆ jvr6t ˆ j |¡¡|d d |< g |d d | _|ˆ jvr¦|d d | j d¡ |ˆ jvr6|d d | j d¡ q6|S )zH
Returns a dict of dicts of all runtime config objects.
c s i | ]}|ˆ j |¡“qS r= )r
Ú get_ipset)Ú.0Ú_ipsetrO r= r> Ú
’ ó z4Firewall.get_all_io_objects_dict..Úipsetsc s i | ]}|ˆ j |¡“qS r= )r9 Ú
get_helper)rZ r9 rO r= r> r\ “ r] Úhelpersc s i | ]}|ˆ j |¡“qS r= )r4 Ú get_icmptype)rZ r4 rO r= r> r\ ” r] Ú icmptypesc s i | ]}|ˆ j |¡“qS r= )r5 Ú get_service)rZ r5 rO r= r> r\ • r] Úservicesc s i | ]}|ˆ j |¡“qS r= )r6 Úget_zone)rZ r6 rO r= r> r\ – r] Úzonesc s i | ]}|ˆ j |¡“qS r= )r: Z
get_policy)rZ r: rO r= r> r\ — r] r8 ZconfÚFirewallBackendÚruntimeZicmptypes_unsupportedÚipv4Úipv6)r
Ú
get_ipsetsr9 Ú get_helpersr4 Ú
get_icmptypesr5 Ú get_servicesr6 Ú get_zonesr: Z"get_policies_not_derived_from_zoner* ÚgetÚsetr Ú
differencera Ú intersectionrW rX ÚcopyZ destinationÚappend)r< Z conf_dictr4 r= rO r> Úget_all_io_objects_dict s8 ÿ ÿ ÿ z Firewall.get_all_io_objects_dict)Úextra_io_objectsc
C sn | ¡ }|D ] }|| D ]}||| |j< qq g d¢}|D ].}|| }| ¡ D ]\}} | | ¡ |¡ qNq:d S )N)r^ r` rb rd rf r8 )rv ÚnameÚitemsZcheck_config_dictZexport_config_dict)
r< rw Zall_io_objectsZtype_keyÚobjÚorderZ io_obj_typeZio_objsrx Zio_objr= r= r> Úfull_check_config· s zFirewall.full_check_configc C sŽ | j r$d| j ¡ vr$t d¡ d| _ | jrHd| j ¡ vrHt d¡ d| _| jrld| j ¡ vrlt d¡ d| _| j sŠ| jsŠ| j sŠt
t j dƒ‚d S )NÚfilterziptables is not usable.Fzip6tables is not usable.zebtables is not usable.zNo IPv4 and IPv6 firewall.)
rA r- Úget_available_tablesr Úinfo1rB r/ rC r0 rV r' r& Ú
UNKNOWN_ERRORrO r= r= r> Ú_start_check_tablesÆ s& ÿ
ÿ
ÿ
ÿz Firewall._start_check_tablesc C sŒ | j ¡ | j jsH| j jr&t d¡ n"| jr8t d¡ n
t d¡ d| _| jr^| j
d¡| _ n| jrr| j
¡ | _ ng | _ | j ¡ | j jsÀ| j jržt d¡ n"| jr°t d¡ n
t d¡ d| _
| jrÖ| j
d ¡| _n| j
rê| j
¡ | _ng | _| j ¡ | jjs>| jjrt d
¡ n$| jr.t d ¡ n
t d ¡ d| _| jrb| jsb| jjsbt d
¡ | j ¡ | jrˆ| j jsˆt d¡ d S )NzFiptables-restore is missing, using individual calls for IPv4 firewall.zMiptables-restore and iptables are missing, IPv4 direct rules won't be usable.zCiptables-restore and iptables are missing, disabling IPv4 firewall.Fri zGip6tables-restore is missing, using individual calls for IPv6 firewall.zOip6tables-restore and ip6tables are missing, IPv6 direct rules won't be usable.zEip6tables-restore and ip6tables are missing, disabling IPv6 firewall.rj zHebtables-restore is missing, using individual calls for bridge firewall.zKebtables-restore and ebtables are missing, eb direct rules won't be usable.zEebtables-restore and ebtables are missing, disabling bridge firewall.zSebtables-restore is not supporting the --noflush option, will therefore not be usedzpConfiguration has NftablesTableOwner=True, but it's not supported by nftables. Table ownership will be disabled.)r- Z fill_existsÚrestore_command_existsZcommand_existsr ÚwarningrV r rA r2 Zsupported_icmp_typesrW r/ rB rX r0 rC rM Úrestore_noflush_optionÚdebug1Z
probe_supportrU Zsupports_table_ownerrO r= r= r> Ú_start_probe_backendsÜ s\
ÿ
ÿþÿz Firewall._start_probe_backendsc
C s˜ t dtj¡ z| j ¡ W n: tyV } z"t |¡ t d¡ W Y d }~n2d }~0 0 | j d¡rr| j d¡| _ | j d¡r²| j d¡}|d ur¤|
¡ dv r¤d| _ t d| j ¡ | j d¡rò| j d¡}|d urä|
¡ d v räd
| _ t d | j ¡ | j d ¡rR| j d ¡}|d urR|
¡ d v rRt d
¡ z| j
¡ W n tyP Y n0 | j d¡rö| j d¡}|d urâ|
¡ dv rŒd| _nV|
¡ dv r¢d| _n@|
¡ dv r¸d| _n*|
¡ dv rÎd| _n|
¡ dv râd| _t d| j› d¡ | j d¡r8| j d¡}|d ur8|
¡ d v r8t d¡ d
| _| j d ¡rŠ| j d ¡}|d u sj|
¡ dkrrd | _n|
¡ | _t d | j¡ | j d ¡r´| j d ¡| _t d | j¡ | j d!¡rø| j d!¡}|
¡ dv räd| _nd
| _t d"| j¡ | j d#¡r<| j d#¡}|
¡ dv r(d| _nd
| _t d$| j¡ | j d%¡r€| j d%¡}|
¡ dv rld| _nd
| _t d&| j¡ | j t | j¡¡ d S )'Nz"Loading firewalld config file '%s'z0Using fallback firewalld configuration settings.Ú DefaultZoneZ
CleanupOnExit)ÚnoZfalseFz CleanupOnExit is set to '%s'ZCleanupModulesOnExit)ÚyesÚtrueTz#CleanupModulesOnExit is set to '%s'ZLockdownzLockdown is enabledZ
IPv6_rpfilterrˆ )r‰ rŠ Ústrictr‹ )ÚlooserŒ )ú
loose-forwardr )ústrict-forwardrŽ zIPv6_rpfilter is set to 'ú'ZIndividualCallszIndividualCalls is enabledÚ LogDeniedZoffzLogDenied is set to '%s'rg z FirewallBackend is set to '%s'ZFlushAllOnReloadz FlushAllOnReload is set to '%s'Z RFC3964_IPv4zRFC3964_IPv4 is set to '%s'ZNftablesTableOwnerz!NftablesTableOwner is set to '%s')r r… r r) r* ÚreadÚ Exceptionrƒ rp rF ÚlowerrI rJ r8 Zenable_lockdownr' rK rM rN rR rS rT rU Úset_firewalld_confrt Údeepcopy)r< ÚmsgÚvaluer= r= r> Ú_start_load_firewalld_conf# sª
" ÿ ÿ
ÿ ÿ ÿ ÿz#Firewall._start_load_firewalld_confc
C sŒ t d¡ z| jj ¡ W nX tyr } z@| j ¡ rJt d| jjj|¡ nt d| jjj|¡ W Y d }~n
d }~0 0 | j
t | j¡¡ d S )NzLoading lockdown whitelistz*Failed to load lockdown whitelist '%s': %s)
r r… r8 Zlockdown_whitelistr‘ r’ Zquery_lockdownÚerrorÚfilenamer Z set_policiesrt r• ©r< r– r= r= r> Ú _start_load_lockdown_whitelist‡ s
ÿ
ÿz'Firewall._start_load_lockdown_whitelistc C sL | tj¡ | tj¡ | tj¡ | tj¡ | tj
¡ | tj ¡ d S r( )
Ú_loader_ipsetsr ZFIREWALLD_IPSETSÚ_loader_icmptypesZFIREWALLD_ICMPTYPESÚ_loader_helpersZFIREWALLD_HELPERSÚ_loader_servicesZFIREWALLD_SERVICESÚ
_loader_zonesZFIREWALLD_ZONESÚ_loader_policiesZFIREWALLD_POLICIESrO r= r= r> Ú_start_load_stock_config— s z!Firewall._start_load_stock_configc C sL | tj¡ | tj¡ | tj¡ | tj¡ | tj
¡ | tj ¡ d S r( )
r r ZETC_FIREWALLD_IPSETSrž ZETC_FIREWALLD_ICMPTYPESrŸ ZETC_FIREWALLD_HELPERSr ZETC_FIREWALLD_SERVICESr¡ ZETC_FIREWALLD_ZONESr¢ ZETC_FIREWALLD_POLICIESrO r= r= r> Ú_start_load_user_configŸ s z Firewall._start_load_user_configc C sÄ | j ¡ D ] }| j t | j |¡¡¡ q
| j ¡ D ] }| j t | j
|¡¡¡ q4| j ¡ D ] }| j
t | j |¡¡¡ q^| j ¡ D ] }| j t | j |¡¡¡ qˆ| j ¡ D ] }| j t | j |¡¡¡ q²| j t | j ¡ ¡¡ i }| j ¡ D ]ª}| j |¡}d|j vr0| j t | j |¡¡¡ qøt j !|j ¡} | |vr|t"ƒ }
| |
_ |
#|
j ¡ |j |
_ d|
_$d|
_%|
|| < t& 'd| |j t j(|j)¡ || *|¡ qø|D ]}| j || ¡ q¨d S )Nú/Fz"Combining zone '%s' using '%s%s%s')+r rk r
Ú add_ipsetrt r• rY rm r4 Ú add_icmptypera rl r9 Ú
add_helperr_ rn r5 Ú add_servicerc Úget_policy_objectsr: Z
add_policyÚget_policy_objectr7 Zset_permanent_configZ
get_directro re rx r6 Úadd_zoneÚosÚpathÚbasenamer Ú
check_nameÚdefaultZforwardr r… Úseprš Úcombine) r< r[ r4 r9 r5 r: Zcombined_zonesr6 Zz_objZ
combined_nameZ
combined_zoner= r= r> Ú _start_copy_config_to_runtime§ s\ ÿÿÿÿÿÿ ÿ
ÿz&Firewall._start_copy_config_to_runtimec
C sz t tjƒ}tj tj¡rjt dtj ¡ z | ¡ W n4 t yh } z t
dtj|¡ W Y d }~n
d }~0 0 | j |¡ d S )Nz Loading direct rules file '%s'z)Failed to load direct rules file '%s': %s) r r ZFIREWALLD_DIRECTr r® Úexistsr r… r‘ r’ r™ Z
set_direct)r< rz r– r= r= r> Ú_start_load_direct_rules× s
ÿ ÿz!Firewall._start_load_direct_rulesc C s t | ƒ}|s| j|d |r |s4| j ¡ rF| j ¡ rF| d¡ | ¡ |rb|rbt d¡ | j
¡ | j |d | d¡ | ¡ | j ¡ r¨| j ¡ r¨t d¡ | j ¡ t d¡ | j
|d t d¡ | jj|d | jjd | j|d t d¡ | jj|d | d¡ | ¡ d S )N©Úuse_transactionTzUnloading firewall moduleszApplying ipsetszApplying default rule setzApplying used zoneszApplying used policies)r Úflushr
ÚbackendsZ
has_ipsetsÚexecuteÚclearr r… r3 Úunload_firewall_modulesÚapply_default_tablesZ apply_ipsetsÚapply_default_rulesr6 Z apply_zonesÚchange_default_zonerF r: Zapply_policies)r< ÚreloadÚcomplete_reloadÚ transactionr= r= r> Ú_start_apply_objectsä s< ÿÿ
ÿ
z Firewall._start_apply_objectsc
C s¨ t | ƒ}| j ¡ r’t d¡ | j |¡ z| d¡ | ¡ W nR ty~ } z(t|j d|j
rb|j
nd ƒ‚W Y d }~n d }~0 t y ‚ Y n0 | d¡ | ¡ d S )Nz2Applying direct chains rules and passthrough rulesTz
Direct: %sÚ ) r r7 Zhas_configurationr r… Z apply_directr» r¼ r' Úcoder– r’ )r< rà Úer= r= r> Ú_start_apply_direct_rules s
0
z"Firewall._start_apply_direct_rulesc C sÚ dD ]$}|| j ¡ vrttjd |¡ƒ‚q| j| j ¡ vr~d| j ¡ v rNd}nd| j ¡ v rbd}nd}t d| j|¡ || _nt d| j¡ | j
sÖ| ¡ | ¡ | j
dkr²d }n| j
}| |¡sÖttjd
| j
¡ƒ‚d S ) N)ÚblockZdropZtrustedzZone '{}' is not available.ZpublicZexternalrÉ z+Default zone '%s' is not valid. Using '%s'.zUsing default zone '%s'Ziptablesr, z'Firewall backend '{}' is not available.)r6 ro r' r& Ú INVALID_ZONEÚformatrF r r™ r… r+ r| r rR Úis_backend_enabledr€ )r< Úzr6 Zbackend_to_checkr= r= r> Ú _start_check' s4 ÿ
ÿÿzFirewall._start_checkc C s° | ¡ | ¡ | | j¡ | js*| ¡ | ¡ | ¡ | ¡ | ¡ |
¡ | jr\d S t ¡ dkrpt
¡ }| j||d | ¡ t ¡ dkr¬t
¡ }t d|| ¡ d S )Nr ©rÁ r é z%Flushing and applying took %f seconds)r˜ rœ Ú_select_firewall_backendrR r+ r† r£ r¤ r¶ r´ rÎ r ZgetDebugLogLevelÚtimerÄ rÈ Zdebug2)r< rÁ r Ztm1Ztm2r= r= r> Ú_startJ s& zFirewall._startc C st | ¡ | j ¡ | j t | j¡¡ | | j¡ | j s@|
¡ | ¡ | ¡ |
¡ | j rbdS | j||d dS )zó
This is basically _start() with at least the following differences:
- built-in defaults for firewalld.conf
- no lockdown list
- no user config (/etc/firewalld)
- no direct rules
NrÏ )Úcleanupr* Ú set_defaultsr r” rt r• rÑ rR r+ r† r£ r´ rÎ rÄ )r< rÁ r r= r= r> Ú_start_failsafei s
zFirewall._start_failsafec C sè z | ¡ W nÆ tyÒ } z®t d¡ z | ¡ d| _| d¡ W nv ty¸ } z^t |¡ t ¡ t |¡ t d¡ z | ¡ W n ty– Y n0 t
t j ¡ W Y d }~n
d }~0 0 |‚W Y d }~nd }~0 0 d| _| d¡ d S )NzLFailed to load user configuration. Falling back to full stock configuration.ÚFAILEDÚACCEPTz©Failed to load full stock configuration. This likely indicates a system level issue, e.g. the firewall backend (nftables, iptables) is broken. All hope is lost. Exiting.ÚRUNNING)
rÓ r’ r r™ rÖ rD Ú
set_policyÚ exceptionr¹ ÚsysÚexitr& r€ )r< Z original_exZnew_exr= r= r> Ústartƒ s*
"zFirewall.startc c s: t j |¡sd S tt |¡ƒD ]}| d¡s.q |V q d S )Nú.xml)r r® ÚisdirÚsortedÚlistdirÚendswith)r< r® rš r= r= r> Ú _loader_config_file_generator¡ s
z&Firewall._loader_config_file_generatorc C s† | |¡D ]v}t d|tj|¡ t||ƒ}|j| j ¡ v r`| j |j¡}t d|j
tj|j ¡ n|j
tj
¡rtd|_| j |¡ q
d S )Nz Loading service file '%s%s%s'úOverrides '%s%s%s'T)rä r r… r r² r rx r rn rc r® rš Ú
startswithÚ
ETC_FIREWALLDr± r© ©r< r® rš rz Úorig_objr= r= r> r ª s
ÿzFirewall._loader_servicesc C s† | |¡D ]v}t d|tj|¡ t||ƒ}|j| j ¡ v r`| j |j¡}t d|j
tj|j ¡ n|j
tj
¡rtd|_| j |¡ q
d S )NzLoading ipset file '%s%s%s'rå T)rä r r… r r² r rx r rk rY r® rš ræ rç r± r¦ rè r= r= r> r ¸ s
ÿzFirewall._loader_ipsetsc C s† | |¡D ]v}t d|tj|¡ t||ƒ}|j| j ¡ v r`| j |j¡}t d|j
tj|j ¡ n|j
tj
¡rtd|_| j |¡ q
d S )Nz Loading helper file '%s%s%s'rå T)rä r r… r r² r" rx r rl r_ r® rš ræ rç r± r¨ rè r= r= r> rŸ Æ s
ÿzFirewall._loader_helpersc C s† | |¡D ]v}t d|tj|¡ t||ƒ}|j| j ¡ v r`| j |j¡}t d|j
tj|j ¡ n|j
tj
¡rtd|_| j |¡ q
d S )Nz Loading policy file '%s%s%s'rå T)rä r r… r r² r# rx r rª r« r® rš ræ rç r± Zadd_policy_objectrè r= r= r> r¢ Ô s
ÿzFirewall._loader_policiesc C s† | |¡D ]v}t d|tj|¡ t||ƒ}|j| j ¡ v r`| j |j¡}t d|j
tj|j ¡ n|j
tj
¡rtd|_| j |¡ q
d S )Nz Loading icmptype file '%s%s%s'rå T)rä r r… r r² r rx r rm ra r® rš ræ rç r± r§ rè r= r= r> rž â s
ÿzFirewall._loader_icmptypesc C s t j |¡sd S tt |¡ƒD ]ú}| d¡sd| tj¡r t j d||f ¡r | j d||f dd q d||f }t
d|¡ t |||d}|rÀdt j
|¡t j
|¡dd… f |_| |j¡ |j| j ¡ v rö| j |j¡}t
d |jt j|j¡ n|j tj¡r d|_| j |¡ q d S )
Nrß z%s/%sT)r³ zLoading zone file '%s')Z
no_check_namer éüÿÿÿrå )r r® rà rá râ rã ræ r rç r¡ r r… r r¯ rx r° ro re r² rš r± r¬ )r< r® r³ rš rx rz ré r= r= r> r¡ ð s4
ÿ
þ ÿzFirewall._loader_zonesc C sp | j ¡ | j ¡ | j ¡ | j ¡ | j ¡ | j ¡ | j ¡ | j ¡ | j ¡ | j
¡ | ¡ d S r( ) r4 rÔ r5 r6 r
r9 r r7 r8 r: r* r; rO r= r= r> rÔ s
zFirewall.cleanupc C sN | j sB| jr(| ¡ | j ¡ | d¡ | jrBt d¡ | j ¡ |
¡ d S )NrØ z!Unloading firewall kernel modules) r+ rI r¹ r
rÚ rJ r r… r3 r½ rÔ rO r= r= r> Ústop s
z
Firewall.stopc C sÎ d}d}t |ƒD ]´\}}|r.| j |¡\}}n$| j| dkrBd}n| j |¡\}}|dkrl|d7 }||7 }q|r’| j |d¡ | j| d7 < q|| jv r| j| d8 < | j| dkr| j|= q||fS )Nr rÅ rÐ )Ú enumerater3 Ú load_modulerG Z
unload_moduleÚ
setdefault) r< Z_modulesÚenableZ
num_failedZ
error_msgsÚiÚmoduleÚstatusr– r= r= r> Úhandle_modules. s(
zFirewall.handle_modulesc C s |dkrd| _ d S )Nr F)rV )r< Úbackendr= r= r> rÑ H s z!Firewall._select_firewall_backendc C s4 | ¡ D ]}|j|kr| S qttjd| ƒ‚d S )Nz'%s' backend does not exist)Ú all_backendsrx r' r& r€ )r< rx rô r= r= r> Úget_backend_by_nameN s
ÿz Firewall.get_backend_by_namec C s\ | j r | jS |dkr | jr | jS |dkr4| jr4| jS |dkrH| jrH| jS tt j
d| ƒ‚d S ©Nri rj Úebz-'%s' is not a valid backend or is unavailable) rV r2 rA r- rB r/ rC r0 r' r& Ú INVALID_IPV©r< Úipvr= r= r> Úget_backend_by_ipvU s ÿzFirewall.get_backend_by_ipvc C sP |dkr| j r| jS |dkr(| jr(| jS |dkr<| jr<| jS ttjd| ƒ‚d S r÷ ) rA r- rB r/ rC r0 r' r& rù rú r= r= r> Úget_direct_backend_by_ipva s ÿz"Firewall.get_direct_backend_by_ipvc C s< |dkr| j S |dkr | jS |dkr*| jS |dkr8| jS dS )Nr, r. r r F)rA rB rC rV )r< rx r= r= r> rÌ k s zFirewall.is_backend_enabledc C s8 | j r
dS |dkr| jS |dkr&| jS |dkr4| jS dS )NTri rj rø F)rV rA rB rC rú r= r= r> Úis_ipv_enabledv s zFirewall.is_ipv_enabledc C sR g }| j r| | j¡ n6| jr*| | j¡ | jr<| | j¡ | jrN| | j¡ |S r( ) rV ru r2 rA r- rB r/ rC r0 ©r< rº r= r= r> Úenabled_backends s zFirewall.enabled_backendsc C sP g }| j r| | j¡ | jr(| | j¡ | jr:| | j¡ | jrL| | j¡ |S r( ) rA ru r- rB r/ rC r0 rV r2 rÿ r= r= r> rõ Ž s zFirewall.all_backendsNc C sJ |d u rt | ƒ}n|}| ¡ D ]}| || ¡ ¡ q |d u rF| d¡ d S ©NT)r r Ú add_rulesZbuild_default_tablesr» )r< r¸ rà rô r= r= r> r¾ š s
z Firewall.apply_default_tablesc C s¸ |d u rt | ƒ}n|}| ¡ D ] }| | j¡}| ||¡ q | d¡r~| d¡}d| ¡ v r~| jdkr~| | j¡}| ||¡ | d¡r¢| j
r¢| ¡ }| ||¡ |d u r´| d¡ d S )Nrj Úrawrˆ T)
r r Zbuild_default_rulesrN r rþ rü r~ rK Zbuild_rpfilter_rulesrT Zbuild_rfc3964_ipv4_rulesr» )r< r¸ rà rô ÚrulesZ ipv6_backendr= r= r> r¿ ¦ s"
z Firewall.apply_default_rulesc C s | j r| j ¡ sdS dS )NTF)rV r7 Zhas_runtime_configurationrO r= r= r> Ú may_skip_flush_direct_backends¾ s z'Firewall.may_skip_flush_direct_backendsc C s\ |d u rt | ƒ}n|}| ¡ D ]&}|| ¡ v r0q | ¡ }| ||¡ q |d u rX| d¡ d S r )r rõ r Úbuild_flush_rulesr r» ©r< r¸ rà rô r r= r= r> Úflush_direct_backendsÄ s
z Firewall.flush_direct_backendsc C sl |d u rt | ƒ}n|}t d¡ | ¡ s4| j|d | ¡ D ]}| ¡ }| ||¡ q<|d u rh| d¡ d S )NzFlushing rule setr· T) r r r… r r r r r r» r r= r= r> r¹ Ó s
zFirewall.flushc C s< |dv s J ‚|d u r0|dkr dnd}|||dœ}| ||¡S )N)rØ ÚDROPÚPANICrØ r )ZINPUTZOUTPUTZFORWARD)Zbuild_set_policy_rules)r< rô r: Úpolicy_detailsZdpr= r= r> Ú_set_policy_build_ruleså s ýz Firewall._set_policy_build_rulesc C s| |d u rt | ƒ}n|}t d||dkr8dt |¡› dnd¡ | ¡ D ] }| |||¡}| ||¡ qF|d u rx| d¡ d S )NzSetting policy to '%s'%sr z (ReloadPolicy=ú)rÅ T) r r r… r Z_unparse_reload_policyr r r r» )r< r: r r¸ rà rô r r= r= r> rÚ ð s
ÿû zFirewall.set_policyc C sB |sdS | |¡}|s&ttjd| ƒ‚| |¡s4dS | || j¡S )NrÅ ú'%s' is not a valid backend)rö r' r& rù rÌ Úset_rulerN )r< Ú backend_nameÚrulerô r= r= r> r s
ÿ
z
Firewall.rulec
C s t td |ƒƒ}| |¡}|s,ttjd| ƒ‚| |¡s:d S | jsZ|jrZ|dkr| j j
st |ƒD ]ž\}}z| || j
¡ W qb tyþ } zjt t ¡ ¡ t |¡ t|d |… ƒD ]0}z| | |¡| j
¡ W q´ tyâ Y q´0 q´|‚W Y d }~qbd }~0 0 qbn| || j
¡ d S )Nr r )Úlistr} rö r' r& rù rÌ rM r‚ r0 r„ rì r rN r’ r r… Ú tracebackÚ
format_excr™ ÚreversedZ reverse_ruleZ set_rules) r< r r Z_rulesrô rð r r– Zrruler= r= r> r s8
ÿ
ÿþþ
zFirewall.rulesc C s | j rttjƒ‚d S r( )rE r' r& Z
PANIC_MODErO r= r= r> Ú check_panic5 s zFirewall.check_panicc C s" |}|| j ¡ vr ttj|ƒ‚|S r( )r: Z get_policiesr' r& ZINVALID_POLICY)r< r: Z_policyr= r= r> Ú check_policy9 s zFirewall.check_policyc C s6 |}|r|dkr| ¡ }|| j ¡ vr2ttj|ƒ‚|S )NrÅ )Úget_default_zoner6 ro r' r& rÊ )r< r6 Ú_zoner= r= r> Ú
check_zone? s zFirewall.check_zonec C s t |¡sttj|ƒ‚d S r( )r ZcheckInterfacer' r& ZINVALID_INTERFACE)r< Ú interfacer= r= r> Úcheck_interfaceG s
zFirewall.check_interfacec C s | j |¡ d S r( )r5 Ú
check_service)r< r5 r= r= r> r K s zFirewall.check_servicec C s t |¡sttj|ƒ‚d S r( )r Ú
check_portr' r& Z INVALID_PORT)r< Úportr= r= r> r N s
zFirewall.check_portc C s* |st tjƒ‚|dvr&t tjd| ƒ‚d S )N)ZtcpZudpZsctpZdccpz''%s' not in {'tcp'|'udp'|'sctp'|'dccp'})r' r& ZMISSING_PROTOCOLZINVALID_PROTOCOL)r< Zprotocolr= r= r> Ú check_tcpudpR s
ÿÿzFirewall.check_tcpudpc C s t |¡sttj|ƒ‚d S r( )r ZcheckIPr' r& Ú INVALID_ADDR)r< Úipr= r= r> Úcheck_ipZ s
zFirewall.check_ipc C sP |dkr t |¡sLttj|ƒ‚n,|dkr@t |¡sLttj|ƒ‚n ttjdƒ‚d S )Nri rj z'%s' not in {'ipv4'|'ipv6'})r Z checkIPnMaskr' r& r! Z
checkIP6nMaskrù )r< rû Úsourcer= r= r> Ú
check_address^ s
ÿzFirewall.check_addressc C s | j |¡ d S r( )r4 Úcheck_icmptype)r< Zicmpr= r= r> r& i s zFirewall.check_icmptypec C s> t |tƒs td|t|ƒf ƒ‚t|ƒdk r:ttjd| ƒ‚d S )Nz%s is %s, expected intr z#timeout '%d' is not positive number)Ú
isinstanceÚintÚ TypeErrorÚtyper' r& Ú
INVALID_VALUE)r< Útimeoutr= r= r> Ú
check_timeoutl s
ÿzFirewall.check_timeoutc C sÔ t | ƒ | j}| j ¡ }| j}| j}|s`i }| j ¡ D ]}| j |¡j ||< q6| j
¡ }| ¡ } g }
| j
¡ D ]} |
| j | ¡¡ qn|sªt | j d¡¡} | jd| d | ¡ | ¡ d }
z| jd|d W n( tyø } z|}
W Y d }~n
d }~0 0 |r8|
D ]2}| j |j¡s| jr|s| j |j¡ q|sÀ| ¡ }|| krœ||vrbi ||< || D ]0}|| j v rj|| | || |< || |= qj| j ¡ D ]B}||v rÚ|| D ]}| j ||¡ q¼||= n t !d|¡ q¦t"|ƒdkr t#| $¡ ƒD ]}t !d|¡ ||= q~|
D ]Ž}| j |j¡r–|j%D ]T}z| j &|j|¡ W n8 t'yŽ } z |j(t)j*krz|‚W Y d }~n
d }~0 0 q>n| j +|¡ | j ,|j¡ q$| j
-|¡ t.ƒ }|r| j ¡ d g D ](}t/|ƒD ]}| jj |||d
qèqÜ|| _| js | d ¡ | js¸|| jkr¸|d krd| 0| j1d ¡D ]}| j1 2|| j3¡ qJnT| 0| j4d ¡D ]}| j4 2|| j3¡ qr| j5r¸| 0| j6d ¡D ]}| j6 2|| j3¡ q |
rÊd
| _7|
‚nd| _7d S )NZ ReloadPolicyr )r TrÏ zNew zone '%s'.r z(Lost zone '%s', zone interfaces dropped.rÅ )ZsenderrØ r r× rÙ )8r$ rE r
Zomit_native_ipsetrR rS r6 ro re Ú
interfacesr7 Zget_runtime_configr rk ru rY r Z_parse_reload_policyr* rp rÚ r¹ rÔ rÓ r’ Z query_ipsetrx rL r1 Z set_destroyrQ Úchange_zone_of_interfacer r Úlenr ÚkeysÚentriesZ add_entryr' rÆ r& ÚALREADY_ENABLEDr¦ Z apply_ipsetZ
set_configr r r r2 r rN r- rB r/ rD )r< rë rE Z_omit_native_ipsetZold_firewall_backendZ flush_allZ_zone_interfacesr6 Z_direct_configÚ_old_dzZ _ipset_objsÚ_nameZ
reload_policyZstart_exceptionrÇ rz Z_new_dzÚifaceZ interface_idÚentryr– Z nm_bus_namer r r= r= r> rÁ u s´
ÿ
ÿ
ÿÿÿzFirewall.reloadc C s | j S r( )rD rO r= r= r> Ú get_state s zFirewall.get_statec
C s\ | j rttjdƒ‚z| d¡ W n0 tyP } zttj|ƒ‚W Y d }~n
d }~0 0 d| _ d S )Nzpanic mode already enabledr
T)rE r' r& r3 rÚ r’ ÚCOMMAND_FAILEDr› r= r= r> Úenable_panic_mode s ÿ"zFirewall.enable_panic_modec
C s\ | j sttjdƒ‚z| d¡ W n0 tyP } zttj|ƒ‚W Y d }~n
d }~0 0 d| _ d S )Nzpanic mode is not enabledrØ F)rE r' r& Z NOT_ENABLEDrÚ r’ r9 r› r= r= r> Údisable_panic_mode s ÿ"zFirewall.disable_panic_modec C s | j S r( )rE rO r= r= r> Úquery_panic_mode s zFirewall.query_panic_modec C s | j S r( )rN rO r= r= r> Úget_log_denied! s zFirewall.get_log_deniedc C sb |t jvr&ttjd|d t j¡f ƒ‚|| ¡ krR|| _| j d|¡ | j
¡ n ttj |ƒ‚d S )Nz'%s', choose from '%s'z','r ) r ZLOG_DENIED_VALUESr' r& r+ Újoinr= rN r* rq ÚwriteZ ALREADY_SET)r< r— r= r= r> Úset_log_denied$ s
ÿÿ zFirewall.set_log_deniedc C s | j S r( )rF rO r= r= r> r 3 s zFirewall.get_default_zonec C sŽ | |¡}|| jkr~| j}|| _| j d|¡ | j ¡ | jrBd S | j ||¡ | j |¡j D ] }|| j
v r^| j d|¡ q^n t t
j|ƒ‚d S )Nr‡ rÅ )r rF r* rq r? r+ r6 rÀ re r. rQ r/ r' r& ZZONE_ALREADY_SET)r< r6 r r4 r6 r= r= r> Úset_default_zone6 s
zFirewall.set_default_zonec C sD | ¡ }| ¡ D ].\}}|s&t|tƒr0|||< q||v r||= q|S r( )rt ry r' Úbool)r< Z permanentrh ZcombinedÚkeyr— r= r= r> Ú'combine_runtime_with_permanent_settingsM s
z0Firewall.combine_runtime_with_permanent_settingsc C s, dD ]"}||v rdd„ || D ƒ||< qi }i }t | ¡ ƒt | ¡ ƒB D ]Ú}||v rHt|| tƒr°t ||v rt|| ng ƒ}tt || ƒ| ƒ||< t|t || ƒA |@ ƒ||< qHt|| tƒsÎt|| tƒr|| sè|| rèd||< n || r"|| s"d||< qHttjd t
|| ƒ|¡ƒ‚qH||fS )N)Z
rich_rulesZ rules_strc S s g | ]}t t|d ƒ‘qS ))Úrule_str)Ústrr% )rZ rE r= r= r> Ú
_ r] z;Firewall.get_added_and_removed_settings..TFz Unhandled setting type {} key {}) rq r1 r' r rB r( r' r& ZINVALID_SETTINGrË r* )r< Z old_settingsZ new_settingsZrich_keyZ add_settingsZremove_settingsrC Úoldr= r= r> Ú get_added_and_removed_settings[ s$
z'Firewall.get_added_and_removed_settings)F)FF)FF)FF)F)N)N)N)N)N)NN)F)KÚ__name__Ú
__module__Ú __qualname__r? rP r; rv r rF r r r| r r† r˜ rœ r£ r¤ r´ r¶ rÄ rÈ rÎ rÓ rÖ rÞ rä r r rŸ r¢ rž r¡ rÔ rë ró rÑ rö rü rý rÌ rþ r rõ r¾ r¿ r r r¹ r rÚ r r r r r r r r r r# r% r& r- rÁ r8 r: r; r< r= r@ r rA rD rI r= r= r= r> r F sŠ
%* Gd0
.#
"
)IÚ__all__r rÜ rt rÒ r Útypingr r Zfirewallr r Z
firewall.corer r r r
r Zfirewall.core.fw_icmptyper Zfirewall.core.fw_servicer
Zfirewall.core.fw_zoner Zfirewall.core.fw_directr Zfirewall.core.fw_configr Zfirewall.core.fw_policiesr Zfirewall.core.fw_ipsetr Z firewall.core.fw_transactionr Zfirewall.core.fw_helperr Zfirewall.core.fw_policyr Zfirewall.core.fw_nmr r Zfirewall.core.loggerr Zfirewall.core.io.io_objectr Z firewall.core.io.firewalld_confr Zfirewall.core.io.directr Zfirewall.core.io.servicer Zfirewall.core.io.icmptyper Zfirewall.core.io.zoner r Zfirewall.core.io.ipsetr Zfirewall.core.ipsetr! Zfirewall.core.io.helperr" Zfirewall.core.io.policyr# Zfirewall.core.io.functionsr$ Zfirewall.core.richr% r& Zfirewall.errorsr' Úobjectr r= r= r= r> Ú sP