a
«°i¸À ã @ sþ d gZ ddlZddlZddlZddlZddlmZmZ ddlm Z ddl
m Z ddl m
Z
ddlmZmZmZ ddlmZmZmZ dd lmZmZmZ dd
lmZm Z m Z dd l m Z m Z m!Z! dd l"m#Z#m$Z$m%Z% dd
lm&Z& ddl'm(Z( G dd „ d e)ƒZ*dS )ÚFirewallConfigé N)ÚDictÚList)Úconfig)Úlog)Ú IO_Object)ÚIcmpTypeÚicmptype_readerÚicmptype_writer)ÚServiceÚservice_readerÚservice_writer)ÚZoneÚ zone_readerÚ zone_writer)ÚIPSetÚ ipset_readerÚ ipset_writer)ÚHelperÚ
helper_readerÚ
helper_writer)ÚPolicyÚ
policy_readerÚ
policy_writer)Úerrors)Ú
FirewallErrorc @ sR e Zd Zdd„ Zdd„ Zdd„ Zdd„ Zd d
„ Zi fee e
e f d œd d
„Z dd„ Z
dd„ Zdd„ Zdd„ Zdd„ Zdd„ Zdd„ Zd d „ Zd d „ Zd d!„ Zd"d#„ Zd$d%„ Zd&d'„ Zd(d)„ Zd*d+„ Zd,d-„ Z d.d/„ Z d0d1„ Z d2d3„ Z d4d5„ Z d6d7„ Z!d8d9„ Z"d:d;„ Z#dd?„ Z%d@dA„ Z&dBdC„ Z'dDdE„ Z(dFdG„ Z)dHdI„ Z*dJdK„ Z+dLdM„ Z,dNdO„ Z-dPdQ„ Z.dRdS„ Z/dTdU„ Z0dVdW„ Z1dXdY„ Z2dZd[„ Z3d\d]„ Z4d^d_„ Z5d`da„ Z6dbdc„ Z7ddde„ Z8dfdg„ Z9dhdi„ Z:djdk„ Z;dldm„ Zdrds„ Z?dtdu„ Z@dvdw„ ZAdxdy„ ZBdzd{„ ZCd|d}„ ZDd~d„ ZEd€d„ ZFd‚dƒ„ ZGd„d…„ ZHd†d‡„ ZIdˆd‰„ ZJdŠd‹„ ZKdŒd„ ZLdŽd„ ZMdd‘„ ZNd’d“„ ZOd”d•„ ZPd–d—„ ZQd˜d™„ ZRdšd›„ ZSdœd„ ZTdždŸ„ ZUd d¡„ ZVd¢d£„ ZWd¤d¥„ ZXd¦d§„ ZYd¨d©„ ZZdªd«„ Z[d¬d„ Z\d®d¯„ Z]d°d±„ Z^d²d³„ Z_d´dµ„ Z`d¶d·„ Zad¸d¹„ Zbdºd»„ Zcd¼d½„ Zdd¾d¿„ ZedÀdÁ„ ZfdÂdÄ ZgdÄdÅ„ ZhdÆdÇ„ ZidÈdÉ„ ZjdÊdË„ ZkdÌdÍ„ ZldÎS )Ïr c C s || _ | ¡ d S ©N)Ú_fwÚ_FirewallConfig__init_vars)ÚselfÚfw© r! ú;/usr/lib/python3.9/site-packages/firewall/core/fw_config.pyÚ__init__* s zFirewallConfig.__init__c C sH d| j | j| j| j| j| j| j| j| j| j | j
| j | j | j
| j| jf S )Nz>%s(%r, %r, %r, %r, %r, %r, %r, %r, %r, %r, %r, %r, %r, %r, %r))Ú __class__Ú_ipsetsÚ
_icmptypesÚ _servicesÚ_zonesÚ_helpersZpolicy_objectsÚ_builtin_ipsetsÚ_builtin_icmptypesÚ_builtin_servicesÚ_builtin_zonesÚ_builtin_helpersÚ_builtin_policy_objectsÚ_firewalld_confÚ _policiesÚ_direct©r r! r! r" Ú__repr__. s úÿzFirewallConfig.__repr__c C s^ i | _ i | _i | _i | _i | _i | _i | _i | _i | _i | _ i | _
i | _ d | _ d | _
d | _d S r )r% r& r' r( r) Ú_policy_objectsr* r+ r, r- r. r/ r0 r1 r2 r3 r! r! r" Z __init_vars8 s zFirewallConfig.__init_varsc C s t | j ¡ ƒD ]}| j| ¡ | j|= qt | j ¡ ƒD ]}| j| ¡ | j|= q8t | j ¡ ƒD ]}| j| ¡ | j|= qbt | j ¡ ƒD ]}| j| ¡ | j|= qŒt | j ¡ ƒD ]}| j| ¡ | j|= q¶t | j ¡ ƒD ]}| j| ¡ | j|= qàt | j ¡ ƒD ] }| j | ¡ | j |= q
t | j
¡ ƒD ] }| j
| ¡ | j
|= q6t | j ¡ ƒD ] }| j | ¡ | j |= qbt | j ¡ ƒD ] }| j | ¡ | j |= qŽ| j
rÈ| j
¡ | `
d | _
| jrä| j ¡ | `d | _| jr | j ¡ | `d | _| ¡ d S r )Úlistr* ÚkeysÚcleanupr% r+ r& r, r' r- r( r. r) r0 r1 r2 r )r Úxr! r! r" r8 I sV
zFirewallConfig.cleanupc sÀ i }‡ fdd„ˆ ¡ D ƒ|d< ‡ fdd„ˆ ¡ D ƒ|d< ‡ fdd„ˆ ¡ D ƒ|d< ‡ fdd„ˆ ¡ D ƒ|d < ‡ fd
d„ˆ ¡ D ƒ|d < ‡ fd d„ˆ ¡ D ƒ|d
< i |d< ˆ j d¡|d d< |S )zJ
Returns a dict of dicts of all permanent config objects.
c s i | ]}|ˆ |¡“qS r! )Ú get_ipset)Ú.0Zipsetr3 r! r" Ú
ƒ ó z:FirewallConfig.get_all_io_objects_dict..Úipsetsc s i | ]}|ˆ |¡“qS r! )Ú
get_helper)r; Úhelperr3 r! r" r< „ r= Úhelpersc s i | ]}|ˆ |¡“qS r! )Ú get_icmptype)r; Zicmptyper3 r! r" r< … r= Ú icmptypesc s i | ]}|ˆ |¡“qS r! )Ú get_service)r; Zservicer3 r! r" r< † r= Úservicesc s i | ]}|ˆ |¡“qS r! )Úget_zone)r; Úzoner3 r! r" r< ‡ r= Úzonesc s i | ]}|ˆ |¡“qS r! )Úget_policy_object)r; Zpolicyr3 r! r" r< ˆ r= ÚpoliciesÚconfZFirewallBackend)Ú
get_ipsetsÚ get_helpersÚ
get_icmptypesÚ get_servicesÚ get_zonesÚget_policy_objectsr0 Úget)r Ú conf_dictr! r3 r" Úget_all_io_objects_dict~ s z&FirewallConfig.get_all_io_objects_dict)Úextra_io_objectsc
C sn | ¡ }|D ] }|| D ]}||| |j< qq g d¢}|D ].}|| }| ¡ D ]\}} | | ¡ |¡ qNq:d S )N)r> rA rC rE rH rJ )rT ÚnameÚitemsZcheck_config_dictÚexport_config_dict)
r rU Zall_io_objectsZtype_keyÚobjÚorderZ io_obj_typeZio_objsrV Zio_objr! r! r" Úfull_check_config s z FirewallConfig.full_check_configc C s | j j ¡ S r )r rJ Zquery_lockdownr3 r! r! r" Úlockdown_enabled s z FirewallConfig.lockdown_enabledc C s | j j ||¡S r )r rJ Ú access_check)r ÚkeyÚvaluer! r! r" r] £ s zFirewallConfig.access_checkc C s
|| _ d S r ©r0 )r rK r! r! r" Úset_firewalld_conf¨ s z!FirewallConfig.set_firewalld_confc C s | j S r r` r3 r! r! r" Úget_firewalld_conf« s z!FirewallConfig.get_firewalld_confc C s( t j tj¡s| j ¡ n
| j ¡ d S r )ÚosÚpathÚexistsr ZFIREWALLD_CONFr0 ÚclearÚreadr3 r! r! r" Úupdate_firewalld_conf® s z$FirewallConfig.update_firewalld_confc C sÄ | j | j| j| j| j| jg}|D ]Š}t |¡}|D ]v}|| }tj |j|j
¡}zt |d| ¡ W n< t
y } z$t d||¡ t |¡ W Y d }~n
d }~0 0 ||= q2q | j ¡ | j ¡ d S )Nú%s.oldú Backup of file '%s' failed: %s)r( r5 r% r' r) r& Úcopyrc rd ÚjoinÚfilenameÚshutilÚmoveÚ Exceptionr ÚerrorÚremover0 Ú set_defaultsÚwrite)r rZ Z io_obj_dictZ dict_copyZobj_namerY rV Úmsgr! r! r" Úreset_defaults´ s þ
z FirewallConfig.reset_defaultsc C s
|| _ d S r ©r1 )r rJ r! r! r" Ú set_policiesÉ s zFirewallConfig.set_policiesc C s | j S r rw r3 r! r! r" Ú get_policiesÌ s zFirewallConfig.get_policiesc C s, t j tj¡s | jj ¡ n | jj ¡ d S r ) rc rd re r ZLOCKDOWN_WHITELISTr1 Zlockdown_whitelistr8 rg r3 r! r! r" Úupdate_lockdown_whitelistÏ s z(FirewallConfig.update_lockdown_whitelistc C s
|| _ d S r ©r2 )r Zdirectr! r! r" Ú
set_direct× s zFirewallConfig.set_directc C s | j S r r{ r3 r! r! r" Ú
get_directÚ s zFirewallConfig.get_directc C s( t j tj¡s| j ¡ n
| j ¡ d S r )rc rd re r ZFIREWALLD_DIRECTr2 r8 rg r3 r! r! r" Ú
update_directÝ s z FirewallConfig.update_directc C s$ t tt| j ¡ ƒt| j ¡ ƒ ƒƒS r )ÚsortedÚsetr6 r% r7 r* r3 r! r! r" rL å s ÿzFirewallConfig.get_ipsetsc C s$ |j r|| j|j< n || j|j< d S r )Úbuiltinr* rV r% ©r rY r! r! r" Ú add_ipseté s zFirewallConfig.add_ipsetc C s8 || j v r| j | S || jv r(| j| S ttj|ƒ‚d S r )r% r* r r Ú
INVALID_IPSET©r rV r! r! r" r: ï s
zFirewallConfig.get_ipsetc C st |j | jvr ttj|j ƒ‚nB| j|j |kr@ttjd|j ƒ‚n |j | jvr^ttjd|j ƒ‚| |¡ | j|j S )Nzself._ipsets[%s] != objz'%s' not a built-in ipset)rV r% r r Ú NO_DEFAULTSr* Ú
_remove_ipsetr‚ r! r! r" Úload_ipset_defaultsö s ÿ ÿ
z"FirewallConfig.load_ipset_defaultsc C s | ¡ S r ©Ú
export_configr‚ r! r! r" Úget_ipset_config s z FirewallConfig.get_ipset_configc C sf t |¡}|jr0tj|_d|_|j|jkr0d|_| || ¡ ¡ | d|gi¡ | |¡ t
|ƒ |S )NFr> ) rk r r ÚETC_FIREWALLD_IPSETSrd ÚdefaultÚ
import_configrT r[ rƒ r ©r rY rK r9 r! r! r" Úset_ipset_config s
z FirewallConfig.set_ipset_configc C sŽ || j v s|| jv r$ttjd| ƒ‚tƒ }| |¡ ||_d| |_t j
|_ d|_ d|_
| || ¡ ¡ | d|gi¡ | |¡ t|ƒ |S )Nznew_ipset(): '%s'ú%s.xmlFTr> )r% r* r r Ú
NAME_CONFLICTr Ú
check_namerV rm r rŒ rd r r rŽ rT r[ rƒ r ©r rV rK r9 r! r! r" Ú new_ipset s ÿ
zFirewallConfig.new_ipsetc
C sÖ t j |¡}t j |¡}t j |¡sÖ|tjkrˆ| j ¡ D ]L}| j| }|j |kr8| j|= |j
| j v rxd| j |j
f S d|f S q8nJ| j ¡ D ]>}| j | }|j |kr’| j |= |j
| jvrÊd|f S dS q’dS t
d|¡ zt||ƒ}W n6 ty& } z t d||¡ W Y d }~dS d }~0 0 |j
| j vrV|j
| jvrV| |¡ d|fS |tjkr”|j
| jv rŒ| j|j
j|_|| j|j
< d|fS |j
| j v rÒ| j |j
= || j |j
< |j
| jvrÎd|fS dS dS )NÚupdaterr ©NNzLoading ipset file '%s'z"Failed to load ipset file '%s': %sÚnew)rc rd ÚbasenameÚdirnamere r rŒ r% r7 rm rV r* r Údebug1r rp rq rƒ r ©r rV rm rd r9 rY ru r! r! r" Úupdate_ipset_from_path' sP
z%FirewallConfig.update_ipset_from_pathc
C s® |j | jvrttj|j ƒ‚|jtjkr>ttjd|jtjf ƒ‚d|j|j f }zt
|d| ¡ W n< t yž } z$t
d||¡ t |¡ W Y d }~n
d }~0 0 | j|j = d S ©Nz '%s' != '%s'ú %s/%s.xmlri rj )rV r% r r r„ rd r rŒ ÚINVALID_DIRECTORYrn ro rp r rq rc rr ©r rY rV ru r! r! r" r‡ l s ÿÿ z FirewallConfig._remove_ipsetc C s" |j s |js ttjd|j ƒ‚d S )Nz'%s' is built-in ipset)r r r r Z
BUILTIN_IPSETrV r‚ r! r! r" Úcheck_builtin_ipset} s ÿz"FirewallConfig.check_builtin_ipsetc C s | |¡ | |¡ d S r )r¢ r‡ r‚ r! r! r" Ú remove_ipset‚ s
zFirewallConfig.remove_ipsetc C s$ | |¡ | ||¡}| |¡ |S r )r¢ Ú _copy_ipsetr‡ )r rY rV r• r! r! r" Ú rename_ipset† s
zFirewallConfig.rename_ipsetc C s | || ¡ ¡S r )r• rŠ ©r rY rV r! r! r" r¤ Œ s zFirewallConfig._copy_ipsetc C s$ t tt| j ¡ ƒt| j ¡ ƒ ƒƒS r )r r€ r6 r& r7 r+ r3 r! r! r" rN ‘ s ÿz FirewallConfig.get_icmptypesc C s$ |j r|| j|j< n || j|j< d S r )r r+ rV r& r‚ r! r! r" Ú add_icmptype• s zFirewallConfig.add_icmptypec C s8 || j v r| j | S || jv r(| j| S ttj|ƒ‚d S r )r& r+ r r ÚINVALID_ICMPTYPEr… r! r! r" rB › s
zFirewallConfig.get_icmptypec C st |j | jvr ttj|j ƒ‚nB| j|j |kr@ttjd|j ƒ‚n |j | jvr^ttjd|j ƒ‚| |¡ | j|j S )Nzself._icmptypes[%s] != objz '%s' not a built-in icmptype)rV r& r r r† r+ Ú_remove_icmptyper‚ r! r! r" Úload_icmptype_defaults¢ s ÿ ÿ
z%FirewallConfig.load_icmptype_defaultsc C s | ¡ S r r‰ r‚ r! r! r" Úget_icmptype_config® s z"FirewallConfig.get_icmptype_configc C sf t |¡}|jr0tj|_d|_|j|jkr0d|_| || ¡ ¡ | d|gi¡ | |¡ t
|ƒ |S )NFrC ) rk r r ÚETC_FIREWALLD_ICMPTYPESrd r rŽ rT r[ r§ r
r r! r! r" Úset_icmptype_config± s
z"FirewallConfig.set_icmptype_configc C sŽ || j v s|| jv r$ttjd| ƒ‚tƒ }| |¡ ||_d| |_t j
|_ d|_ d|_
| || ¡ ¡ | d|gi¡ | |¡ t|ƒ |S )Nznew_icmptype(): '%s'r‘ FTrC )r& r+ r r r’ r r“ rV rm r r¬ rd r r rŽ rT r[ r§ r
r” r! r! r" Ú new_icmptype¿ s ÿ
zFirewallConfig.new_icmptypec
C sÖ t j |¡}t j |¡}t j |¡sÖ|tjkrˆ| j ¡ D ]L}| j| }|j |kr8| j|= |j
| j v rxd| j |j
f S d|f S q8nJ| j ¡ D ]>}| j | }|j |kr’| j |= |j
| jvrÊd|f S dS q’dS t
d|¡ zt||ƒ}W n6 ty& } z t d||¡ W Y d }~dS d }~0 0 |j
| j vrV|j
| jvrV| |¡ d|fS |tjkr”|j
| jv rŒ| j|j
j|_|| j|j
< d|fS |j
| j v rÒ| j |j
= || j |j
< |j
| jvrÎd|fS dS dS )Nr– rr r— zLoading icmptype file '%s'z%Failed to load icmptype file '%s': %sr˜ )rc rd r™ rš re r r¬ r& r7 rm rV r+ r r› r rp rq r§ r rœ r! r! r" Úupdate_icmptype_from_pathÓ sP
z(FirewallConfig.update_icmptype_from_pathc
C s® |j | jvrttj|j ƒ‚|jtjkr>ttjd|jtjf ƒ‚d|j|j f }zt
|d| ¡ W n< t yž } z$t
d||¡ t |¡ W Y d }~n
d }~0 0 | j|j = d S rž )rV r& r r r¨ rd r r¬ r rn ro rp r rq rc rr r¡ r! r! r" r© s
ÿÿ z FirewallConfig._remove_icmptypec C s" |j s |js ttjd|j ƒ‚d S )Nz'%s' is built-in icmp type)r r r r ZBUILTIN_ICMPTYPErV r‚ r! r! r" Úcheck_builtin_icmptype) s ÿz%FirewallConfig.check_builtin_icmptypec C s | |¡ | |¡ d S r )r° r© r‚ r! r! r" Úremove_icmptype. s
z FirewallConfig.remove_icmptypec C s$ | |¡ | ||¡}| |¡ |S r )r° Ú_copy_icmptyper© )r rY rV r® r! r! r" Úrename_icmptype2 s
z FirewallConfig.rename_icmptypec C s | || ¡ ¡S r )r® rŠ r¦ r! r! r" r² 8 s z FirewallConfig._copy_icmptypec C s$ t tt| j ¡ ƒt| j ¡ ƒ ƒƒS r )r r€ r6 r' r7 r, r3 r! r! r" rO = s ÿzFirewallConfig.get_servicesc C s$ |j r|| j|j< n || j|j< d S r )r r, rV r' r‚ r! r! r" Ú add_serviceA s zFirewallConfig.add_servicec C s< || j v r| j | S || jv r(| j| S ttjd| ƒ‚d S )Nzget_service(): '%s')r' r, r r ÚINVALID_SERVICEr… r! r! r" rD G s
zFirewallConfig.get_servicec C st |j | jvr ttj|j ƒ‚nB| j|j |kr@ttjd|j ƒ‚n |j | jvr^ttjd|j ƒ‚| |¡ | j|j S )Nzself._services[%s] != objz'%s' not a built-in service)rV r' r r r† r, Ú_remove_servicer‚ r! r! r" Úload_service_defaultsN s ÿ ÿ
z$FirewallConfig.load_service_defaultsc C sn | ¡ }g }tdƒD ]P}|j| d |vrL| t t||j| d ƒ¡¡ q| ||j| d ¡ qt|ƒS )Né r ©rX ÚrangeÚIMPORT_EXPORT_STRUCTUREÚappendrk ÚdeepcopyÚgetattrÚtuple©r rY rS Z conf_listÚir! r! r" Úget_service_configZ s "z!FirewallConfig.get_service_configc C s | ¡ S r ©rX r‚ r! r! r" Úget_service_config_dictf s z&FirewallConfig.get_service_config_dictc C s4 i }t |ƒD ]\}}|||j| d < q | ||¡S ©Nr )Ú enumerater» Úset_service_config_dict©r rY rK rS rÁ r_ r! r! r" Úset_service_configi s z!FirewallConfig.set_service_configc C sf t |¡}|jr0tj|_d|_|j|jkr0d|_| || ¡ ¡ | d|gi¡ | |¡ t
|ƒ |S )NFrE ) rk r r ÚETC_FIREWALLD_SERVICESrd r Úimport_config_dictrT r[ r´ r
r r! r! r" rÇ p s
z&FirewallConfig.set_service_config_dictc C sX || j v s|| jv r$ttjd| ƒ‚i }t|ƒD ]\}}||tj| d < q0| ||¡S )Núnew_service(): '%s'r ) r' r, r r r’ rÆ r r» Únew_service_dict©r rV rK rS rÁ r_ r! r! r" Ú new_service~ s ÿzFirewallConfig.new_servicec C sŽ || j v s|| jv r$ttjd| ƒ‚tƒ }| |¡ ||_d| |_t j
|_ d|_ d|_
| || ¡ ¡ | d|gi¡ | |¡ t|ƒ |S )NrÌ r‘ FTrE )r' r, r r r’ r r“ rV rm r rÊ rd r r rË rT r[ r´ r
r” r! r! r" rÍ ‰ s ÿ
z FirewallConfig.new_service_dictc
C sÖ t j |¡}t j |¡}t j |¡sÖ|tjkrˆ| j ¡ D ]L}| j| }|j |kr8| j|= |j
| j v rxd| j |j
f S d|f S q8nJ| j ¡ D ]>}| j | }|j |kr’| j |= |j
| jvrÊd|f S dS q’dS t
d|¡ zt||ƒ}W n6 ty& } z t d||¡ W Y d }~dS d }~0 0 |j
| j vrV|j
| jvrV| |¡ d|fS |tjkr”|j
| jv rŒ| j|j
j|_|| j|j
< d|fS |j
| j v rÒ| j |j
= || j |j
< |j
| jvrÎd|fS dS dS )Nr– rr r— zLoading service file '%s'z$Failed to load service file '%s': %sr˜ )rc rd r™ rš re r rÊ r' r7 rm rV r, r r› r rp rq r´ r rœ r! r! r" Úupdate_service_from_path sP
z'FirewallConfig.update_service_from_pathc
C s® |j | jvrttj|j ƒ‚|jtjkr>ttjd|jtjf ƒ‚d|j|j f }zt
|d| ¡ W n< t yž } z$t
d||¡ t |¡ W Y d }~n
d }~0 0 | j|j = d S rž )rV r' r r rµ rd r rÊ r rn ro rp r rq rc rr r¡ r! r! r" r¶ â s
ÿÿ z FirewallConfig._remove_servicec C s" |j s |js ttjd|j ƒ‚d S )Nz'%s' is built-in service)r r r r ZBUILTIN_SERVICErV r‚ r! r! r" Úcheck_builtin_serviceó s ÿz$FirewallConfig.check_builtin_servicec C s | |¡ | |¡ d S r )rÑ r¶ r‚ r! r! r" Úremove_serviceø s
z FirewallConfig.remove_servicec C s$ | |¡ | ||¡}| |¡ |S r )rÑ Ú
_copy_servicer¶ )r rY rV rÏ r! r! r" Úrename_serviceü s
z FirewallConfig.rename_servicec C s | || ¡ ¡S r )rÍ rX r¦ r! r! r" rÓ s z FirewallConfig._copy_servicec C s$ t tt| j ¡ ƒt| j ¡ ƒ ƒƒS r )r r€ r6 r( r7 r- r3 r! r! r" rP s ÿzFirewallConfig.get_zonesc C s$ |j r|| j|j< n || j|j< d S r )r r- rV r( r‚ r! r! r" Úadd_zone s zFirewallConfig.add_zonec C s( || j v r| j |= || jv r$| j|= d S r )r- r( r… r! r! r" Ú forget_zone s
zFirewallConfig.forget_zonec C s< || j v r| j | S || jv r(| j| S ttjd| ƒ‚d S )Nzget_zone(): %s)r( r- r r Ú INVALID_ZONEr… r! r! r" rF s
zFirewallConfig.get_zonec C st |j | jvr ttj|j ƒ‚nB| j|j |kr@ttjd|j ƒ‚n |j | jvr^ttjd|j ƒ‚| |¡ | j|j S )Nzself._zones[%s] != objz'%s' not a built-in zone)rV r( r r r† r- Ú _remove_zoner‚ r! r! r" Úload_zone_defaults s ÿ ÿ
z!FirewallConfig.load_zone_defaultsc C sn | ¡ }g }tdƒD ]P}|j| d |vrL| t t||j| d ƒ¡¡ q| ||j| d ¡ qt|ƒS )Né r r¹ rÀ r! r! r" Úget_zone_config* s "z FirewallConfig.get_zone_configc C s | ¡ S r rà r‚ r! r! r" Úget_zone_config_dict6 s z#FirewallConfig.get_zone_config_dictc C s4 i }t |ƒD ]\}}|||j| d < q | ||¡S rÅ )rÆ r» Úset_zone_config_dictrÈ r! r! r" Úset_zone_config9 s z FirewallConfig.set_zone_configc C sf t |¡}|jr0tj|_d|_|j|jkr0d|_| || ¡ ¡ | d|gi¡ | |¡ t
|ƒ |S )NFrH ) rk r r ÚETC_FIREWALLD_ZONESrd r rË rT r[ rÕ r r r! r! r" rÝ @ s
z#FirewallConfig.set_zone_config_dictc C sX || j v s|| jv r$ttjd| ƒ‚i }t|ƒD ]\}}||tj| d < q0| ||¡S )Núnew_zone(): '%s'r ) r( r- r r r’ rÆ r r» Ú
new_zone_dictrÎ r! r! r" Únew_zoneN s zFirewallConfig.new_zonec C sŽ || j v s|| jv r$ttjd| ƒ‚tƒ }| |¡ ||_d| |_t j
|_ d|_ d|_
| || ¡ ¡ | d|gi¡ | |¡ t|ƒ |S )Nrà r‘ FTrH )r( r- r r r’ r r“ rV rm r rß rd r r rË rT r[ rÕ r r” r! r! r" rá X s
z FirewallConfig.new_zone_dictc
C s" t j |¡}t j |¡}t j |¡sØ| tj¡rŠ| j ¡ D ]L}| j| }|j
|kr:| j|= |j | j v rzd| j |j f S d|f S q:nJ| j ¡ D ]>}| j | }|j
|kr”| j |= |j | jvrÌd|f S dS q”dS t
d|¡ zt||ƒ}W n6 ty( } z t
d||¡ W Y d }~dS d }~0 0 | tj¡rrt|ƒttjƒkrrdt j |¡t j |¡dd… f |_ |j | j vr |j | jvr | |¡ d |fS | tj¡rà|j | jv rØ| j|j j|_|| j|j < d|fS |j | j v r | j |j = || j |j < |j | jvrd|fS dS dS )
Nr– rr r— zLoading zone file '%s'z!Failed to load zone file '%s': %sú%s/%sr éüÿÿÿr˜ )rc rd r™ rš re Ú
startswithr rß r( r7 rm rV r- r r› r rp rq ÚlenrÕ r rœ r! r! r" Úupdate_zone_from_pathk s\
ÿ ÿ
z$FirewallConfig.update_zone_from_pathc
C s° |j | jvrttj|j ƒ‚|j tj¡s@ttj d|jtjf ƒ‚d|j|j f }zt
|d| ¡ W n< t y } z$t
d||¡ t |¡ W Y d }~n
d }~0 0 | j|j = d S ©Nz '%s' doesn't start with '%s'rŸ ri rj )rV r( r r r× rd rå r rß r rn ro rp r rq rc rr r¡ r! r! r" rØ ¶ s
ÿÿ zFirewallConfig._remove_zonec C s" |j s |js ttjd|j ƒ‚d S )Nz'%s' is built-in zone)r r r r Z BUILTIN_ZONErV r‚ r! r! r" Úcheck_builtin_zoneÇ s ÿz!FirewallConfig.check_builtin_zonec C s | |¡ | |¡ d S r )ré rØ r‚ r! r! r" Ú remove_zoneÌ s
zFirewallConfig.remove_zonec C sN | |¡ | ¡ }| |¡ z| ||¡}W n | |j|¡ ‚ Y n0 |S r )ré rX rØ rá rV )r rY rV Zobj_confrâ r! r! r" Ú rename_zoneÐ s
zFirewallConfig.rename_zonec C s$ t tt| j ¡ ƒt| j ¡ ƒ ƒƒS r )r r€ r6 r5 r7 r/ r3 r! r! r" rQ Þ s ÿz!FirewallConfig.get_policy_objectsc C s$ |j r|| j|j< n || j|j< d S r )r r/ rV r5 r‚ r! r! r" Úadd_policy_objectâ s z FirewallConfig.add_policy_objectc C s< || j v r| j | S || jv r(| j| S ttjd| ƒ‚d S )Nzget_policy_object(): %s)r5 r/ r r ÚINVALID_POLICYr… r! r! r" rI è s
z FirewallConfig.get_policy_objectc C st |j | jvr ttj|j ƒ‚nB| j|j |kr@ttjd|j ƒ‚n |j | jvr^ttjd|j ƒ‚| |¡ | j|j S )Nz self._policy_objects[%s] != objz'%s' not a built-in policy)rV r5 r r r† r/ Ú_remove_policy_objectr‚ r! r! r" Úload_policy_object_defaultsï s ÿ ÿ
z*FirewallConfig.load_policy_object_defaultsc C s | ¡ S r rà r‚ r! r! r" Ú get_policy_object_config_dictû s z,FirewallConfig.get_policy_object_config_dictc C sf t |¡}|jr0tj|_d|_|j|jkr0d|_| || ¡ ¡ | d|gi¡ | |¡ t
|ƒ |S )NFrJ ) rk r r ÚETC_FIREWALLD_POLICIESrd r rË rT r[ rì r r r! r! r" Ú set_policy_object_config_dictþ s
z,FirewallConfig.set_policy_object_config_dictc C sŽ || j v s|| jv r$ttjd| ƒ‚tƒ }| |¡ ||_d| |_t j
|_ d|_ d|_
| || ¡ ¡ | d|gi¡ | |¡ t|ƒ |S )Nznew_policy_object(): '%s'r‘ FTrJ )r5 r/ r r r’ r r“ rV rm r rñ rd r r rË rT r[ rì r r” r! r! r" Únew_policy_object_dict s
z%FirewallConfig.new_policy_object_dictc
C s" t j |¡}t j |¡}t j |¡sØ| tj¡rŠ| j ¡ D ]L}| j| }|j
|kr:| j|= |j | j v rzd| j |j f S d|f S q:nJ| j ¡ D ]>}| j | }|j
|kr”| j |= |j | jvrÌd|f S dS q”dS t
d|¡ zt||ƒ}W n6 ty( } z t
d||¡ W Y d }~dS d }~0 0 | tj¡rrt|ƒttjƒkrrdt j |¡t j |¡dd… f |_ |j | j vr |j | jvr | |¡ d |fS | tj¡rà|j | jv rØ| j|j j|_|| j|j < d|fS |j | j v r | j |j = || j |j < |j | jvrd|fS dS dS )
Nr– rr r— zLoading policy file '%s'z#Failed to load policy file '%s': %srã r rä r˜ )rc rd r™ rš re rå r rñ r5 r7 rm rV r/ r r› r rp rq ræ rì r rœ r! r! r" Ú update_policy_object_from_path s\
ÿ ÿ
z-FirewallConfig.update_policy_object_from_pathc
C s° |j | jvrttj|j ƒ‚|j tj¡s@ttj d|jtjf ƒ‚d|j|j f }zt
|d| ¡ W n< t y } z$t
d||¡ t |¡ W Y d }~n
d }~0 0 | j|j = d S rè )rV r5 r r rí rd rå r rñ r rn ro rp r rq rc rr r¡ r! r! r" rî j s
ÿÿ z$FirewallConfig._remove_policy_objectc C s" |j s |js ttjd|j ƒ‚d S )Nz'%s' is built-in policy)r r r r ZBUILTIN_POLICYrV r‚ r! r! r" Úcheck_builtin_policy_object{ s ÿz*FirewallConfig.check_builtin_policy_objectc C s | |¡ | |¡ d S r )rõ rî r‚ r! r! r" Úremove_policy_object€ s
z#FirewallConfig.remove_policy_objectc C s$ | |¡ | ||¡}| |¡ |S r )rõ Ú_copy_policy_objectrî )r rY rV Znew_policy_objectr! r! r" Úrename_policy_object„ s
z#FirewallConfig.rename_policy_objectc C s | || ¡ ¡S r )ró rX r¦ r! r! r" r÷ Š s z"FirewallConfig._copy_policy_objectc C s$ t tt| j ¡ ƒt| j ¡ ƒ ƒƒS r )r r€ r6 r) r7 r. r3 r! r! r" rM s ÿzFirewallConfig.get_helpersc C s$ |j r|| j|j< n || j|j< d S r )r r. rV r) r‚ r! r! r" Ú
add_helper“ s zFirewallConfig.add_helperc C s8 || j v r| j | S || jv r(| j| S ttj|ƒ‚d S r )r) r. r r ÚINVALID_HELPERr… r! r! r" r? ™ s
zFirewallConfig.get_helperc C st |j | jvr ttj|j ƒ‚nB| j|j |kr@ttjd|j ƒ‚n |j | jvr^ttjd|j ƒ‚| |¡ | j|j S )Nzself._helpers[%s] != objz'%s' not a built-in helper)rV r) r r r† r. Ú_remove_helperr‚ r! r! r" Úload_helper_defaults s ÿ ÿ
z#FirewallConfig.load_helper_defaultsc C s | ¡ S r r‰ r‚ r! r! r" Úget_helper_config¬ s z FirewallConfig.get_helper_configc C sf t |¡}|jr0tj|_d|_|j|jkr0d|_| || ¡ ¡ | d|gi¡ | |¡ t
|ƒ |S )NFrA ) rk r r ÚETC_FIREWALLD_HELPERSrd r rŽ rT r[ rù r r r! r! r" Úset_helper_config¯ s
z FirewallConfig.set_helper_configc C sŽ || j v s|| jv r$ttjd| ƒ‚tƒ }| |¡ ||_d| |_t j
|_ d|_ d|_
| || ¡ ¡ | d|gi¡ | |¡ t|ƒ |S )Nznew_helper(): '%s'r‘ FTrA )r) r. r r r’ r r“ rV rm r rþ rd r r rŽ rT r[ rù r r” r! r! r" Ú
new_helper½ s ÿ
zFirewallConfig.new_helperc
C sÖ t j |¡}t j |¡}t j |¡sÖ|tjkrˆ| j ¡ D ]L}| j| }|j |kr8| j|= |j
| j v rxd| j |j
f S d|f S q8nJ| j ¡ D ]>}| j | }|j |kr’| j |= |j
| jvrÊd|f S dS q’dS t
d|¡ zt||ƒ}W n6 ty& } z t d||¡ W Y d }~dS d }~0 0 |j
| j vrV|j
| jvrV| |¡ d|fS |tjkr”|j
| jv rŒ| j|j
j|_|| j|j
< d|fS |j
| j v rÒ| j |j
= || j |j
< |j
| jvrÎd|fS dS dS )Nr– rr r— zLoading helper file '%s'z#Failed to load helper file '%s': %sr˜ )rc rd r™ rš re r rþ r) r7 rm rV r. r r› r rp rq rù r rœ r! r! r" Úupdate_helper_from_pathÑ sP
z&FirewallConfig.update_helper_from_pathc
C s® |j | jvrttj|j ƒ‚|jtjkr>ttjd|jtjf ƒ‚d|j|j f }zt
|d| ¡ W n< t yž } z$t
d||¡ t |¡ W Y d }~n
d }~0 0 | j|j = d S rž )rV r) r r rú rd r rþ r rn ro rp r rq rc rr r¡ r! r! r" rû s ÿÿ z FirewallConfig._remove_helperc C s" |j s |js ttjd|j ƒ‚d S )Nz'%s' is built-in helper)r r r r ZBUILTIN_HELPERrV r‚ r! r! r" Úcheck_builtin_helper' s ÿz#FirewallConfig.check_builtin_helperc C s | |¡ | |¡ d S r )r rû r‚ r! r! r" Ú
remove_helper, s
z FirewallConfig.remove_helperc C s$ | |¡ | ||¡}| |¡ |S r )r Ú _copy_helperrû )r rY rV r r! r! r" Ú
rename_helper0 s
z FirewallConfig.rename_helperc C s | || ¡ ¡S r )r rŠ r¦ r! r! r" r 6 s zFirewallConfig._copy_helperN)mÚ__name__Ú
__module__Ú __qualname__r# r4 r r8 rT r Ústrr r r[ r\ r] ra rb rh rv rx ry rz r| r} r~ rL rƒ r: rˆ r‹ r r• r r‡ r¢ r£ r¥ r¤ rN r§ rB rª r« r r® r¯ r© r° r± r³ r² rO r´ rD r· r rÄ rÉ rÇ rÏ rÍ rÐ r¶ rÑ rÒ rÔ rÓ rP rÕ rÖ rF rÙ rÛ rÜ rÞ rÝ râ rá rç rØ ré rê rë rQ rì rI rï rð rò ró rô rî rõ rö rø r÷ rM rù r? rü rý rÿ r r rû r r r r r! r! r! r" r ) sÌ
5 E E E
K K E)+Ú__all__rk rc Zos.pathrn Útypingr r Zfirewallr Zfirewall.core.loggerr Zfirewall.core.io.io_objectr Zfirewall.core.io.icmptyper r r
Zfirewall.core.io.servicer r r
Zfirewall.core.io.zoner r r Zfirewall.core.io.ipsetr r r Zfirewall.core.io.helperr r r Zfirewall.core.io.policyr r r r Zfirewall.errorsr Úobjectr r! r! r! r" Ú s"