a
«°iÜY ã @ sn d gZ ddlmZ ddlmZ ddlmZ ddlmZ ddlm Z ddl
m Z ddl m
Z
G d d „ d eƒZd
S ) ÚFirewallDirecté )ÚLastUpdatedOrderedDict)Ú ipXtables)Úebtables)ÚFirewallTransaction)Úlog)Úerrors)Ú
FirewallErrorc @ sL e Zd Zdd„ Zdd„ Zdd„ Zdd„ Zd d
„ Zd d „ Zd
d„ Z dd„ Z
dNdd„Z dd„ Z dd„ Z
dOdd„Zdd„ Zd d „ Zd d „ Zd d!„ ZdPd"d#„ZdQd$d%„Zd&d'„ Zd(d)„ Zd*d+„ ZdRd,d-„ZdSd.d/„Zd0d1„ Zd2d3„ Zd4d5„ Z d6d7„ Z d8d9„ Z d:d;„ Z dTdd?„Z!d@dA„ Z"dBdC„ Z#dDdE„ Z$dFdG„ Z%dHdI„ Z&dJdK„ Z'dLdM„ Z(dS )Vr c C s || _ | ¡ d S ©N)Ú_fwÚ_FirewallDirect__init_vars)ÚselfÚfw© r ú;/usr/lib/python3.9/site-packages/firewall/core/fw_direct.pyÚ__init__' s zFirewallDirect.__init__c C s d| j | j| j| jf S )Nz%s(%r, %r, %r))Ú __class__Ú_chainsÚ_rulesÚ_rule_priority_positions©r
r r r Ú__repr__+ s ÿzFirewallDirect.__repr__c C s" i | _ i | _i | _i | _d | _d S r
)r r r Ú
_passthroughsÚ_objr r r r Z __init_vars/ s
zFirewallDirect.__init_varsc C s | ¡ d S r
)r r r r r Úcleanup6 s zFirewallDirect.cleanupc C s
t | jƒS r
)r r r r r r Únew_transaction; s z FirewallDirect.new_transactionc C s
|| _ d S r
)r )r
Úobjr r r Úset_permanent_config@ s z#FirewallDirect.set_permanent_configc C s* t | jƒt | jƒ t | jƒ dkr&dS dS )Nr TF)Úlenr r r r r r r Úhas_runtime_configurationC s "z(FirewallDirect.has_runtime_configurationc C sB | ¡ r dS t| j ¡ ƒt| j ¡ ƒ t| j ¡ ƒ dkr>dS dS )NTr F)r r r Úget_all_chainsÚ
get_all_rulesÚget_all_passthroughsr r r r Úhas_configurationH s ÿ þþz FirewallDirect.has_configurationNc C sP |d u r| ¡ }n|}| | j ¡ | j ¡ | j ¡ f|¡ |d u rL| d¡ d S ©NT)r Ú
set_configr r r! r" Úexecute)r
Úuse_transactionÚ transactionr r r Ú apply_directQ s
þýzFirewallDirect.apply_directc C s i }i }i }| j D ]>}|\}}| j | D ]&}| j |||¡s(| |g ¡ |¡ q(q| jD ]X}|\}}}| j| D ]>\} }
| j |||| |
¡sp||vržtƒ ||< | || | |
f< qpqX| jD ]@}| j| D ]0}
| j ||
¡sÆ||vrèg ||< || |
¡ qÆq¸|||fS r
)
r r Ú query_chainÚ
setdefaultÚappendr Ú
query_ruler r Úquery_passthrough) r
ZchainsÚrulesZ passthroughsÚtable_idÚipvÚtableÚchainÚchain_idÚpriorityÚargsr r r Úget_runtime_configb s,
z!FirewallDirect.get_runtime_configc C s | j | j| jfS r
)r r r r r r r Ú
get_config s zFirewallDirect.get_configc C s¬ |d u r| ¡ }n|}|\}}}|D ]r}|\}} || D ]\}
| || |
¡s8z| j|| |
|d W q8 ty’ } zt t| ƒ¡ W Y d } ~ q8d } ~ 0 0 q8q$|D ]‚} | \}} }
|| D ]j\}
}| || |
|
|¡s²z| j|| |
|
||d W q² ty } zt t| ƒ¡ W Y d } ~ q²d } ~ 0 0 q²qœ|D ]n}|| D ]^}| ||¡s0z| j
|||d W n4 tyŠ } zt t| ƒ¡ W Y d } ~ n
d } ~ 0 0 q0q$|d u r¨| d¡ d S )N)r' T) r r* Ú add_chainr r ZwarningÚstrr- Úadd_ruler. Úadd_passthroughr& )r
Zconfr' r( r r r r0 r1 r2 r3 Úerrorr4 r5 r6 r r r r% „ sF
ÿ
(
ÿ
( ÿ
,
zFirewallDirect.set_configc C s( g d¢}||vr$t tjd||f ƒ‚d S )N)Úipv4Úipv6Zebú'%s' not in '%s')r r Z INVALID_IPV)r
r1 Zipvsr r r Ú
_check_ipv« s
ÿzFirewallDirect._check_ipvc C sF | |¡ |dv r tj ¡ ntj ¡ }||vrBttjd||f ƒ‚d S )N©r> r? r@ )rA r ÚBUILT_IN_CHAINSÚkeysr r r Z
INVALID_TABLE)r
r1 r2 Ztablesr r r Ú_check_ipv_table± s
ÿ
ÿz FirewallDirect._check_ipv_tablec C s¦ |dv r4t j| }| jjr i }qH| j |¡j| }ntj| }tj| }||v r`tt j
d| ƒ‚||v rxtt j
d| ƒ‚|dv r¢| jj |¡d ur¢tt j
d| ƒ‚d S )NrB z chain '%s' is built-in chainzchain '%s' is reservedzChain '%s' is reserved)r rC r Únftables_enabledÚget_direct_backend_by_ipvÚ
our_chainsr Z
OUR_CHAINSr r Z
BUILTIN_CHAINÚzoneZzone_from_chainZ
INVALID_CHAIN)r
r1 r2 r3 Zbuilt_in_chainsrH r r r Ú_check_builtin_chainº s(
ÿÿÿz#FirewallDirect._check_builtin_chainc C sH |r| j |g ¡ |¡ n*| j | |¡ t| j | ƒdkrD| j |= d S ©Nr )r r+ r, Úremover )r
r0 r3 Úaddr r r Ú_register_chainÐ s
z FirewallDirect._register_chainc C s‚ |d u r| ¡ }n|}| j ¡ r.| | jj¡ | jjrZ| jj ¡ rZ| | jjj| jj g¡ |
d||||¡ |d u r~| d¡ d S r$ ) r r Ú may_skip_flush_direct_backendsÚadd_preÚflush_direct_backendsÚ
ipset_enabledÚipsetÚomit_native_ipsetÚ apply_ipsetsÚ
ipset_backendÚ_chainr& ©r
r1 r2 r3 r' r( r r r r9 Ø s
zFirewallDirect.add_chainc C s> |d u r| ¡ }n|}| d||||¡ |d u r:| d¡ d S ©NFT)r rW r& rX r r r Ú remove_chainê s
zFirewallDirect.remove_chainc C s: | ||¡ | |||¡ ||f}|| jv o8|| j| v S r
)rE rJ r )r
r1 r2 r3 r0 r r r r* õ s
ÿzFirewallDirect.query_chainc C s, | ||¡ ||f}|| jv r(| j| S g S r
)rE r )r
r1 r2 r0 r r r Ú
get_chainsü s
zFirewallDirect.get_chainsc C s< g }| j D ],}|\}}| j | D ]}| |||f¡ q q
|S r
)r r, )r
ÚrÚkeyr1 r2 r3 r r r r s
z FirewallDirect.get_all_chainsc C s† |d u r| ¡ }n|}| j ¡ r.| | jj¡ | jjrZ| jj ¡ rZ| | jjj| jj g¡ |
d||||||¡ |d u r‚| d¡ d S r$ ) r r rO rP rQ rR rS rT rU rV Ú_ruler& ©r
r1 r2 r3 r5 r6 r' r( r r r r; s
zFirewallDirect.add_rulec C sB |d u r| ¡ }n|}| d||||||¡ |d u r>| d¡ d S rY )r r^ r& r_ r r r Ú remove_rule s
zFirewallDirect.remove_rulec C s2 | ||¡ |||f}|| jv o0||f| j| v S r
)rE r )r
r1 r2 r3 r5 r6 r4 r r r r- ) s
ÿzFirewallDirect.query_rulec C s6 | ||¡ |||f}|| jv r2t| j| ¡ ƒS g S r
)rE r ÚlistrD )r
r1 r2 r3 r4 r r r Ú get_rules/ s
zFirewallDirect.get_rulesc
C sJ g }| j D ]:}|\}}}| j | D ] \}}| ||||t|ƒf¡ q"q
|S r
)r r, ra )r
r\ r] r1 r2 r3 r5 r6 r r r r! 6 s
z FirewallDirect.get_all_rulesc C s² |rr|| j vrtƒ | j |< || j | |< || jvr s
z FirewallDirect._register_rulec
C sZ z| j | j |¡j|¡W S tyT } z"t |¡ ttj |ƒ‚W Y d }~n
d }~0 0 d S r
)
r ÚrulerG ÚnameÚ Exceptionr Zdebug2r r ZCOMMAND_FAILED)r
r1 r6 Úmsgr r r Ú passthroughR s
zFirewallDirect.passthroughc C sX |r*|| j vrg | j |< | j | |¡ n*| j | |¡ t| j | ƒdkrT| j |= d S rK )r r, rL r )r
r1 r6 rd r r r Ú_register_passthroughZ s
z$FirewallDirect._register_passthroughc C s„ |d u r| ¡ }n|}| j ¡ r.| | jj¡ | jjrZ| jj ¡ rZ| | jjj| jj g¡ |
d|t |ƒ|¡ |d u r€| d¡ d S r$ )
r r rO rP rQ rR rS rT rU rV Ú _passthroughra r& ©r
r1 r6 r' r( r r r r< d s
z FirewallDirect.add_passthroughc C s@ |d u r| ¡ }n|}| d|t|ƒ|¡ |d u r<| d¡ d S rY )r rm ra r& rn r r r Úremove_passthroughu s
z!FirewallDirect.remove_passthroughc C s || j v ot|ƒ| j | v S r
)r Útuple)r
r1 r6 r r r r. € s
ÿz FirewallDirect.query_passthroughc C s6 g }| j D ]&}| j | D ]}| |t|ƒf¡ qq
|S r
©r r, ra )r
r\ r1 r6 r r r r" „ s
z#FirewallDirect.get_all_passthroughsc C s0 g }|| j v r,| j | D ]}| t|ƒ¡ q|S r
rq )r
r1 r\ r6 r r r Úget_passthroughs‹ s
z FirewallDirect.get_passthroughsc
C s® g }|D ] }d}|D ]„}z| |¡}W n ty8 Y q0 t|ƒ|krd||d v rd}||d d¡}|D ]&} |dd… }
| |
|d < | |
¡ qpq|s| |¡ q|S )z5Split values combined with commas for options in optsFú,é TN)ÚindexÚ
ValueErrorr Úsplitr, ) r
r/ ZoptsZ out_rulesrg Z processedÚoptÚiÚitemsÚitemr^ r r r Ú split_value’ s$ zFirewallDirect.split_valuec C s | ||¡ | jjs0|dv r0| jj ||||¡ |}| j |¡} | jjs`| |||¡r`d| }n:| jjrš|dd … dkrš| |||d d… ¡rš|d d… }|||f}
||f} |râ|
| jv rà| | j|
v ràtt j
d||||f ƒ‚n@|
| jvsü| | j|
vrtt j d||||f ƒ‚| j|
| }d} d}
|
| j v rŠt
| j |
¡ ƒ}d}|t|ƒk rŠ||| krŠ| | j |
|| 7 } |d7 }qLt|ƒg}| |d d
g¡}| |d d g¡}|D ]4}| | | |||| t|ƒ¡¡ | d7 } |
d7 }
q¸| | |
|||
¡ | | j| |
|| |
¡ d S )
NrB z %s_directiùÿÿÿZ_directz"rule '%s' already is in '%s:%s:%s'z rule '%s' is not in '%s:%s:%s'rt r z-sz--sourcez-dz
--destination)rE r rF rI Úcreate_zone_base_by_chainrG Zis_chain_builtinr r r ÚALREADY_ENABLEDÚ NOT_ENABLEDr ÚsortedrD r ra r| r; Z
build_rulerp rf Úadd_fail)r
rd r1 r2 r3 r5 r6 r( rW Úbackendr4 rc ru re Z positionsÚjZ args_listÚ_argsr r r r^ ® sp ÿÿ ÿ
ÿ
ÿ
ÿÿ
ÿ
ÿÿ(
ÿzFirewallDirect._rulec C sÌ | ||¡ | |||¡ ||f}|rV|| jv r„|| j| v r„ttjd|||f ƒ‚n.|| jvsn|| j| vr„ttjd|||f ƒ‚| j |¡}| ||
|||¡¡ | |||¡ | | j ||| ¡ d S )Nz chain '%s' already is in '%s:%s'z chain '%s' is not in '%s:%s')
rE rJ r r r r~ r r rG Z add_rulesZbuild_chain_rulesrN r )r
rM r1 r2 r3 r( r0 r‚ r r r rW s0
ÿÿÿ
ÿÿÿ zFirewallDirect._chainc
C sü | |¡ t|ƒ}|rD|| jv rp|| j| v rpttjd||f ƒ‚n,|| jvs\|| j| vrpttjd||f ƒ‚| j |¡}|rÀ| |¡ |dv rº|
|¡\}}|rº|rº| jj |||¡ |} n
|
|¡} | || ¡ | |||¡ | | j||| ¡ d S )Nzpassthrough '%s', '%s'rB )rA rp r r r r~ r r rG Zcheck_passthroughZ passthrough_parse_table_chainrI r} Zreverse_passthroughr; rl r )
r
rd r1 r6 r( Z
tuple_argsr‚ r2 r3 r„ r r r rm 0 s:
ÿ
ÿ
ÿ
ÿ
ÿzFirewallDirect._passthrough)N)N)N)N)N)N)N)N))Ú__name__Ú
__module__Ú __qualname__r r r r r r r r# r) r7 r8 r% rA rE rJ rN r9 rZ r* r[ r r; r` r- rb r! rf rk rl r< ro r. r" rr r| r^ rW rm r r r r r & sN
'
ÿ
jN)Ú__all__Zfirewall.fw_typesr Z
firewall.corer r Z firewall.core.fw_transactionr Zfirewall.core.loggerr Zfirewallr Zfirewall.errorsr Úobjectr r r r r Ú s