관리-도구
편집 파일: fw.cpython-39.pyc
a ���gs� � @ s� d gZ ddlZddlZddlZddlZddlZddlmZmZ ddl m Z ddl m Z ddl m Z ddl mZ ddl mZ dd l mZ dd l mZ dd lmZ dd lmZ dd lmZ ddlmZ ddlmZ ddl m Z ddl m Z ddl m!Z! ddl"m#Z# ddl$m%Z% ddl&m'Z'm(Z( ddl)m*Z* ddl+m,Z, ddl-m.Z. ddl/m0Z0 ddl1m2Z2 ddl3m4Z4 dd l5m6Z6m7Z7 dd l8m9Z9 dd l:m;Z; dd l<m=Z= dd l>m?Z? dd!l@mAZA dd"lBmCZC dd#l mDZD dd$lEmFZF G d%d � d eG�ZHdS )&�Firewall� N)�Dict�List)�config)� functions)� ipXtables)�ebtables)�nftables)�ipset)�modules)�FirewallIcmpType)�FirewallService)� FirewallZone)�FirewallDirect)�FirewallConfig)�FirewallPolicies)� FirewallIPSet)�FirewallTransaction)�FirewallHelper)�FirewallPolicy)�nm_get_bus_name�nm_get_interfaces_in_zone)�log)� IO_Object)�firewalld_conf)�Direct)�service_reader)�icmptype_reader)� zone_reader�Zone)� ipset_reader)� IPSET_TYPES)� helper_reader)� policy_reader)�check_on_disk_config)� Rich_Rule)�errors)� FirewallErrorc @ sZ e Zd Zd�dd�Zdd� Zdd� Zdd � Zi feee e f d �d d �Z d d� Z dd� Z dd� Zdd� Zdd� Zdd� Zdd� Zdd � Zd�d d �Zd d � Zd!d"� Zd�d#d$�Zd�d%d&�Zd'd(� Zd)d*� Zd+d,� Zd-d.� Z d/d0� Z d1d2� Z d3d4� Z d�d5d6�Z d7d8� Z!d9d:� Z"d;d<� Z#d=d>� Z$d?d@� Z%dAdB� Z&dCdD� Z'dEdF� Z(dGdH� Z)dIdJ� Z*dKdL� Z+d�dNdO�Z,d�dPdQ�Z-dRdS� Z.d�dTdU�Z/d�dVdW�Z0d�dXdY�Z1d�dZd[�Z2d\d]� Z3d^d_� Z4d`da� Z5dbdc� Z6ddde� Z7dfdg� Z8dhdi� Z9djdk� Z:dldm� Z;dndo� Z<dpdq� Z=drds� Z>dtdu� Z?d�dvdw�Z@dxdy� ZAdzd{� ZBd|d}� ZCd~d� ZDd�d�� ZEd�d�� ZFd�d�� ZGd�d�� ZHd�d�� ZId�d�� ZJdMS )�r Fc C s� t tj�| _|| _|sXt�| �| _t�| �| _ t � � | _ t � � | _ t�| �| _t�� | _t| �| _t| �| _t| �| _t| �| _t| �| _t� | _ t | �| _ t | �| _ t | �| _!| �"� d S �N)#r r �FIREWALLD_CONF�_firewalld_conf�_offliner � ip4tables�ip4tables_backend� ip6tables�ip6tables_backendr �ebtables_backendr � ipset_backendr �nftables_backendr �modules_backendr �icmptyper �servicer �zoner �directr r �policiesr r �helperr �policy�_Firewall__init_vars)�selfZoffline� r= �4/usr/lib/python3.9/site-packages/firewall/core/fw.py�__init__G s& zFirewall.__init__c C sD d| j | j| j| j| j| j| j| j| j| j | j | j | j | j | jf S )Nz:%s(%r, %r, %r, %r, %r, %r, %r, %r, %r, %r, %r, %r, %r, %r))� __class__�ip4tables_enabled�ip6tables_enabled�ebtables_enabled�_state�_panic� _default_zone�_module_refcount�_marks�cleanup_on_exit�cleanup_modules_on_exit�_ipv6_rpfilter� ipset_enabled�_individual_calls� _log_denied�r< r= r= r> �__repr___ s ��zFirewall.__repr__c C s� d| _ d| _tj| _g | _g | _i | _g | _tj | _ tj | _ tj | _tj| _tj| _tj| _tj| _tj| _tj| _tj| _ | j r�d| _ d| _ d| _ d| _!t"| _#d| _$n0d| _ g | _%d| _ g | _&d| _ d| _!t"| _#d| _$d S )NZINITFT)'rD rE r Z FALLBACK_ZONErF �_default_zone_interfacesZ_nm_assigned_interfacesrG rH ZFALLBACK_CLEANUP_ON_EXITrI Z FALLBACK_CLEANUP_MODULES_ON_EXITrJ ZFALLBACK_IPV6_RPFILTERrK ZFALLBACK_INDIVIDUAL_CALLSrM ZFALLBACK_LOG_DENIEDrN ZFALLBACK_FIREWALL_BACKEND�_firewall_backendZ FALLBACK_FLUSH_ALL_ON_RELOAD�_flush_all_on_reloadZFALLBACK_RFC3964_IPV4� _rfc3964_ipv4Z FALLBACK_ALLOW_ZONE_DRIFTINGZ_allow_zone_driftingZ FALLBACK_NFTABLES_TABLE_OWNER�_nftables_table_ownerr+ rA rB rC rL r! �ipset_supported_types�nftables_enabled�ipv4_supported_icmp_types�ipv6_supported_icmp_typesrO r= r= r> Z __init_varsh s@ zFirewall.__init_varsc s� i }� fdd�� j �� D �|d< � fdd�� j�� D �|d< � fdd�� j�� D �|d< � fdd�� j�� D �|d < � fd d�� j� � D �|d < � fd d�� j � � D �|d < i |d< � j � d�|d d< i |d< i |d d< t� j�� ��t� j�� ��D ] }� j�|�|d d |< q�t� j�� ��t� j�� ��D ]�}|� jv�sR|� jv�r6t�� j�|��|d d |< g |d d | _|� jv�r�|d d | j�d� |� jv�r6|d d | j�d� �q6|S )zH Returns a dict of dicts of all runtime config objects. c s i | ]}|� j �|��qS r= )r � get_ipset)�.0�_ipsetrO r= r> � <dictcomp>� � z4Firewall.get_all_io_objects_dict.<locals>.<dictcomp>�ipsetsc s i | ]}|� j �|��qS r= )r9 � get_helper)r[ r9 rO r= r> r] � r^ �helpersc s i | ]}|� j �|��qS r= )r4 � get_icmptype)r[ r4 rO r= r> r] � r^ � icmptypesc s i | ]}|� j �|��qS r= )r5 � get_service)r[ r5 rO r= r> r] � r^ �servicesc s i | ]}|� j �|��qS r= )r6 �get_zone)r[ r6 rO r= r> r] � r^ �zonesc s i | ]}|� j �|��qS r= )r: Z get_policy)r[ r: rO r= r> r] � r^ r8 Zconf�FirewallBackend�runtimeZicmptypes_unsupported�ipv4�ipv6)r � get_ipsetsr9 � get_helpersr4 � get_icmptypesr5 � get_servicesr6 � get_zonesr: Z"get_policies_not_derived_from_zoner* �get�setr � differencerb � intersectionrX rY �copyZ destination�append)r< Z conf_dictr4 r= rO r> �get_all_io_objects_dict� s8 � � � z Firewall.get_all_io_objects_dict)�extra_io_objectsc C sn | � � }|D ] }|| D ]}||| |j< qq g d�}|D ].}|| }|�� D ]\}} | �| �� |� qNq:d S )N)r_ ra rc re rg r8 )rw �name�itemsZcheck_config_dictZexport_config_dict) r< rx Zall_io_objectsZtype_key�obj�orderZ io_obj_typeZio_objsry Zio_objr= r= r> �full_check_config� s zFirewall.full_check_configc C s� | j r$d| j�� vr$t�d� d| _ | jrHd| j�� vrHt�d� d| _| jrld| j�� vrlt�d� d| _| j s�| js�| j s�t t j d��d S )N�filterziptables is not usable.Fzip6tables is not usable.zebtables is not usable.zNo IPv4 and IPv6 firewall.) rA r- �get_available_tablesr �info1rB r/ rC r0 rW r' r& � UNKNOWN_ERRORrO r= r= r> �_start_check_tables� s& � � � �z Firewall._start_check_tablesc C s� z| j �� W n: tyH | jr.t�d� nt�d� g | _d| _Y n0 | j � � | _| j � � | j j s�| j j r|t�d� n"| jr�t�d� n t�d� d| _| jr�| j�d�| _n| jr�| j �� | _ng | _| j� � | jj �s| jj r�t�d� n$| j�r t�d � n t�d � d| _| j�r2| j�d �| _n | j�rH| j�� | _ng | _| j� � | jj �s�| jj �rxt�d � n$| j�r�t�d � n t�d� d| _| j�r�| j�s�| jj�s�t�d� | j�� | j�r�| jj �s�t�d� d S )Nzaipset not usable, disabling ipset usage in firewall. Other set backends (nftables) remain usable.z4ipset not usable, disabling ipset usage in firewall.FzFiptables-restore is missing, using individual calls for IPv4 firewall.zMiptables-restore and iptables are missing, IPv4 direct rules won't be usable.zCiptables-restore and iptables are missing, disabling IPv4 firewall.rj zGip6tables-restore is missing, using individual calls for IPv6 firewall.zOip6tables-restore and ip6tables are missing, IPv6 direct rules won't be usable.zEip6tables-restore and ip6tables are missing, disabling IPv6 firewall.rk zHebtables-restore is missing, using individual calls for bridge firewall.zKebtables-restore and ebtables are missing, eb direct rules won't be usable.zEebtables-restore and ebtables are missing, disabling bridge firewall.zSebtables-restore is not supporting the --noflush option, will therefore not be usedzpConfiguration has NftablesTableOwner=True, but it's not supported by nftables. Table ownership will be disabled.) r1 Zset_list� ValueErrorrW r r� �warningrV rL Zset_supported_typesr- Z fill_exists�restore_command_existsZcommand_existsrA r2 Zsupported_icmp_typesrX r/ rB rY r0 rC rM �restore_noflush_option�debug1Z probe_supportrU Zsupports_table_ownerrO r= r= r> �_start_probe_backends� sn � ���z Firewall._start_probe_backendsc C s� t �dtj� z| j�� W n: tyV } z"t �|� t �d� W Y d }~�n2d }~0 0 | j�d�rr| j�d�| _ | j�d�r�| j�d�}|d ur�|� � dv r�d| _ t �d| j � | j�d�r�| j�d�}|d ur�|� � d v r�d | _ t �d | j � | j�d ��rR| j�d �}|d u�rR|� � d v �rRt �d � z| j �� W n t�yP Y n0 | j�d��r�| j�d�}|d u�r�|� � dv �r�d| _nV|� � dv �r�d| _n@|� � dv �r�d| _n*|� � dv �r�d| _n|� � dv �r�d| _t �d| j� d�� | j�d��r8| j�d�}|d u�r8|� � d v �r8t �d� d | _| j�d ��r�| j�d �}|d u �sj|� � dk�rrd | _n|� � | _t �d | j� | j�d ��r�| j�d �| _t �d | j� | j�d!��r�| j�d!�}|� � dv �r�d| _nd | _t �d"| j� | j�d#��r<| j�d#�}|� � dv �r(d| _nd | _t �d$| j� | j�d%��r�| j�d%�}|� � dv �rld| _nd | _t �d&| j� | j�t�| j�� d S )'Nz"Loading firewalld config file '%s'z0Using fallback firewalld configuration settings.� DefaultZoneZ CleanupOnExit)�noZfalseFz CleanupOnExit is set to '%s'ZCleanupModulesOnExit)�yes�trueTz#CleanupModulesOnExit is set to '%s'ZLockdownzLockdown is enabledZ IPv6_rpfilterr� )r� r� �strictr� )�looser� )� loose-forwardr� )�strict-forwardr� zIPv6_rpfilter is set to '�'ZIndividualCallszIndividualCalls is enabled� LogDeniedZoffzLogDenied is set to '%s'rh z FirewallBackend is set to '%s'ZFlushAllOnReloadz FlushAllOnReload is set to '%s'Z RFC3964_IPv4zRFC3964_IPv4 is set to '%s'ZNftablesTableOwnerz!NftablesTableOwner is set to '%s')r r� r r) r* �read� Exceptionr� rq rF �lowerrI rJ r8 Zenable_lockdownr' rK rM rN rR rS rT rU �set_firewalld_confru �deepcopy)r< �msg�valuer= r= r> �_start_load_firewalld_conf1 s� " � � � � � �z#Firewall._start_load_firewalld_confc C s� t �d� z| jj�� W nX tyr } z@| j�� rJt �d| jjj|� nt �d| jjj|� W Y d }~n d }~0 0 | j � t � | j�� d S )NzLoading lockdown whitelistz*Failed to load lockdown whitelist '%s': %s) r r� r8 Zlockdown_whitelistr� r� Zquery_lockdown�error�filenamer Z set_policiesru r� �r< r� r= r= r> � _start_load_lockdown_whitelist� s � �z'Firewall._start_load_lockdown_whitelistc C sL | � tj� | �tj� | �tj� | �tj� | � tj � | � tj � d S r( ) �_loader_ipsetsr ZFIREWALLD_IPSETS�_loader_icmptypesZFIREWALLD_ICMPTYPES�_loader_helpersZFIREWALLD_HELPERS�_loader_servicesZFIREWALLD_SERVICES� _loader_zonesZFIREWALLD_ZONES�_loader_policiesZFIREWALLD_POLICIESrO r= r= r> �_start_load_stock_config� s z!Firewall._start_load_stock_configc C sL | � tj� | �tj� | �tj� | �tj� | � tj � | � tj � d S r( ) r� r ZETC_FIREWALLD_IPSETSr� ZETC_FIREWALLD_ICMPTYPESr� ZETC_FIREWALLD_HELPERSr� ZETC_FIREWALLD_SERVICESr� ZETC_FIREWALLD_ZONESr� ZETC_FIREWALLD_POLICIESrO r= r= r> �_start_load_user_config� s z Firewall._start_load_user_configc C s� | j �� D ] }| j�t�| j �|��� q | j �� D ] }| j� t�| j � |��� q4| j � � D ] }| j � t�| j �|��� q^| j �� D ] }| j�t�| j �|��� q�| j �� D ] }| j�t�| j �|��� q�| j�t�| j �� �� i }| j �� D ]�}| j �|�}d|j v�r0| j � t�| j �|��� q�t j �!|j �} | |v�r|t"� } | | _ | �#| j � |j | _ d| _$d| _%| || < t&�'d| |j t j(|j)� || �*|� q�|D ]}| j � || � �q�d S )N�/Fz"Combining zone '%s' using '%s%s%s')+r rl r � add_ipsetru r� rZ rn r4 � add_icmptyperb rm r9 � add_helperr` ro r5 � add_servicerd �get_policy_objectsr: Z add_policy�get_policy_objectr7 Zset_permanent_configZ get_directrp rf ry r6 �add_zone�os�path�basenamer � check_name�defaultZforwardr r� �sepr� �combine) r< r\ r4 r9 r5 r: Zcombined_zonesr6 Zz_objZ combined_nameZ combined_zoner= r= r> � _start_copy_config_to_runtime� s\ ������ � �z&Firewall._start_copy_config_to_runtimec C sz t tj�}tj�tj�rjt�dtj � z |�� W n4 t yh } z t� dtj|� W Y d }~n d }~0 0 | j� |� d S )Nz Loading direct rules file '%s'z)Failed to load direct rules file '%s': %s) r r ZFIREWALLD_DIRECTr� r� �existsr r� r� r� r� Z set_direct)r< r{ r� r= r= r> �_start_load_direct_rules� s � �z!Firewall._start_load_direct_rulesc C s t | �}|s| j|d� |r |s4| j�� rF| j�� rF|�d� |�� |rb|rbt�d� | j � � | j |d� |�d� |�� | j�� r�| j�� r�t�d� | j� � t�d� | j |d� t�d� | jj|d� | jjd | j|d� t�d� | jj|d� |�d� |�� d S )N��use_transactionTzUnloading firewall moduleszApplying ipsetszApplying default rule setzApplying used zoneszApplying used policies)r �flushr �backendsZ has_ipsets�execute�clearr r� r3 �unload_firewall_modules�apply_default_tablesZ apply_ipsets�apply_default_rulesr6 Z apply_zones�change_default_zonerF r: Zapply_policies)r< �reload�complete_reload� transactionr= r= r> �_start_apply_objects� s< �� � z Firewall._start_apply_objectsc C s� t | �}| j�� r�t�d� | j�|� z|�d� |�� W nR ty~ } z(t|j d|j rb|j nd ��W Y d }~n d }~0 t y� � Y n0 |�d� |�� d S )Nz2Applying direct chains rules and passthrough rulesTz Direct: %s� ) r r7 Zhas_configurationr r� Z apply_directr� r� r' �coder� r� )r< r� �er= r= r> �_start_apply_direct_rules s 0 z"Firewall._start_apply_direct_rulesc C s� dD ]$}|| j �� vrttjd�|���q| j| j �� vr~d| j �� v rNd}nd| j �� v rbd}nd}t�d| j|� || _nt� d| j� | j s�| � � | � � | j dkr�d }n| j }| �|�s�ttjd �| j ���d S ) N)�blockZdropZtrustedzZone '{}' is not available.ZpublicZexternalr� z+Default zone '%s' is not valid. Using '%s'.zUsing default zone '%s'Ziptablesr, z'Firewall backend '{}' is not available.)r6 rp r' r& � INVALID_ZONE�formatrF r r� r� r+ r} r� rR �is_backend_enabledr� )r< �zr6 Zbackend_to_checkr= r= r> � _start_check5 s4 � ��zFirewall._start_checkc C s� | � � | �� | �| j� | js*| �� | �� | �� | �� | � � | � � | jr\d S t � � dkrpt � � }| j||d� | �� t � � dkr�t � � }t �d|| � d S )Nr �r� r� � z%Flushing and applying took %f seconds)r� r� �_select_firewall_backendrR r+ r� r� r� r� r� r� r ZgetDebugLogLevel�timer� r� Zdebug2)r< r� r� Ztm1Ztm2r= r= r> �_startX s& zFirewall._startc C st | � � | j�� | j�t�| j�� | �| j� | j s@| � � | � � | � � | � � | j rbdS | j||d� dS )z� This is basically _start() with at least the following differences: - built-in defaults for firewalld.conf - no lockdown list - no user config (/etc/firewalld) - no direct rules Nr� )�cleanupr* � set_defaultsr r� ru r� r� rR r+ r� r� r� r� r� )r< r� r� r= r= r> �_start_failsafew s zFirewall._start_failsafec C s� z | � � W n� ty� } z�t�d� z | �� d| _| �d� W nv ty� } z^t�|� t�� t�|� t�d� z | �� W n ty� Y n0 t � t j � W Y d }~n d }~0 0 |�W Y d }~nd }~0 0 d| _| �d� d S )NzLFailed to load user configuration. Falling back to full stock configuration.�FAILED�ACCEPTz�Failed to load full stock configuration. This likely indicates a system level issue, e.g. the firewall backend (nftables, iptables) is broken. All hope is lost. Exiting.�RUNNING) r� r� r r� r� rD � set_policy� exceptionr� �sys�exitr& r� )r< Z original_exZnew_exr= r= r> �start� s* "zFirewall.startc c s: t j�|�sd S tt �|��D ]}|�d�s.q |V q d S )N�.xml)r� r� �isdir�sorted�listdir�endswith)r< r� r� r= r= r> � _loader_config_file_generator� s z&Firewall._loader_config_file_generatorc C s� | � |�D ]v}t�d|tj|� t||�}|j| j�� v r`| j� |j�}t�d|j tj|j � n|j � tj �rtd|_| j�|� q d S )Nz Loading service file '%s%s%s'�Overrides '%s%s%s'T)r� r r� r� r� r ry r ro rd r� r� � startswith� ETC_FIREWALLDr� r� �r< r� r� r{ �orig_objr= r= r> r� � s �zFirewall._loader_servicesc C s� | � |�D ]v}t�d|tj|� t||�}|j| j�� v r`| j� |j�}t�d|j tj|j � n|j � tj �rtd|_| j�|� q d S )NzLoading ipset file '%s%s%s'r� T)r� r r� r� r� r ry r rl rZ r� r� r� r� r� r� r� r= r= r> r� � s �zFirewall._loader_ipsetsc C s� | � |�D ]v}t�d|tj|� t||�}|j| j�� v r`| j� |j�}t�d|j tj|j � n|j � tj �rtd|_| j�|� q d S )Nz Loading helper file '%s%s%s'r� T)r� r r� r� r� r" ry r rm r` r� r� r� r� r� r� r� r= r= r> r� � s �zFirewall._loader_helpersc C s� | � |�D ]v}t�d|tj|� t||�}|j| j�� v r`| j� |j�}t�d|j tj|j � n|j � tj �rtd|_| j�|� q d S )Nz Loading policy file '%s%s%s'r� T)r� r r� r� r� r# ry r r� r� r� r� r� r� r� Zadd_policy_objectr� r= r= r> r� � s �zFirewall._loader_policiesc C s� | � |�D ]v}t�d|tj|� t||�}|j| j�� v r`| j� |j�}t�d|j tj|j � n|j � tj �rtd|_| j�|� q d S )Nz Loading icmptype file '%s%s%s'r� T)r� r r� r� r� r ry r rn rb r� r� r� r� r� r� r� r= r= r> r� � s �zFirewall._loader_icmptypesc C s t j�|�sd S tt �|��D ]�}|�d�sd|�tj�r t j�d||f �r | j d||f dd� q d||f }t � d|� t |||d�}|r�dt j� |�t j� |�dd� f |_|�|j� |j| j�� v r�| j�|j�}t � d |jt j|j� n|j�tj��r d|_| j�|� q d S ) Nr� z%s/%sT)r� zLoading zone file '%s')Z no_check_namer ���r� )r� r� r� r� r� r� r� r r� r� r r� r r� ry r� rp rf r� r� r� r� )r< r� r� r� ry r{ r� r= r= r> r� � s4 � � �zFirewall._loader_zonesc C sp | j �� | j�� | j�� | j�� | j�� | j�� | j�� | j�� | j �� | j �� | � � d S r( ) r4 r� r5 r6 r r9 r r7 r8 r: r* r; rO r= r= r> r� s zFirewall.cleanupc C sN | j sB| jr(| �� | j�� | �d� | jrBt�d� | j� � | � � d S )Nr� z!Unloading firewall kernel modules) r+ rI r� r r� rJ r r� r3 r� r� rO r= r= r> �stop- s z Firewall.stopc C s� d}d}t |�D ]�\}}|r.| j�|�\}}n$| j| dkrBd}n| j�|�\}}|dkrl|d7 }||7 }q|r�| j�|d� | j| d7 < q|| jv r| j| d8 < | j| dkr| j|= q||fS )Nr r� r� )� enumerater3 � load_modulerG Z unload_module� setdefault) r< Z_modules�enableZ num_failedZ error_msgs�i�module�statusr� r= r= r> �handle_modules< s( zFirewall.handle_modulesc C s |dkrd| _ d S )Nr F)rW )r< �backendr= r= r> r� V s z!Firewall._select_firewall_backendc C s4 | � � D ]}|j|kr| S qttjd| ��d S )Nz'%s' backend does not exist)� all_backendsry r' r& r� )r< ry r� r= r= r> �get_backend_by_name\ s �z Firewall.get_backend_by_namec C s\ | j r | jS |dkr | jr | jS |dkr4| jr4| jS |dkrH| jrH| jS tt j d| ��d S �Nrj rk �ebz-'%s' is not a valid backend or is unavailable) rW r2 rA r- rB r/ rC r0 r' r& � INVALID_IPV�r< �ipvr= r= r> �get_backend_by_ipvc s �zFirewall.get_backend_by_ipvc C sP |dkr| j r| jS |dkr(| jr(| jS |dkr<| jr<| jS ttjd| ��d S r� ) rA r- rB r/ rC r0 r' r& r� r� r= r= r> �get_direct_backend_by_ipvo s �z"Firewall.get_direct_backend_by_ipvc C s< |dkr| j S |dkr | jS |dkr*| jS |dkr8| jS dS )Nr, r. r r F)rA rB rC rW )r< ry r= r= r> r� y s zFirewall.is_backend_enabledc C s8 | j r dS |dkr| jS |dkr&| jS |dkr4| jS dS )NTrj rk r� F)rW rA rB rC r� r= r= r> �is_ipv_enabled� s zFirewall.is_ipv_enabledc C sR g }| j r|�| j� n6| jr*|�| j� | jr<|�| j� | jrN|�| j� |S r( ) rW rv r2 rA r- rB r/ rC r0 �r< r� r= r= r> �enabled_backends� s zFirewall.enabled_backendsc C sP g }| j r|�| j� | jr(|�| j� | jr:|�| j� | jrL|�| j� |S r( ) rA rv r- rB r/ rC r0 rW r2 r r= r= r> r� � s zFirewall.all_backendsNc C sJ |d u rt | �}n|}| �� D ]}|�||�� � q |d u rF|�d� d S �NT)r r � add_rulesZbuild_default_tablesr� )r< r� r� r� r= r= r> r� � s z Firewall.apply_default_tablesc C s� |d u rt | �}n|}| �� D ] }|�| j�}|�||� q | �d�r~| �d�}d|�� v r~| jdkr~|� | j�}|�||� | �d�r�| j r�|� � }|�||� |d u r�|� d� d S )Nrk �rawr� T) r r Zbuild_default_rulesrN r r r� r rK Zbuild_rpfilter_rulesrT Zbuild_rfc3964_ipv4_rulesr� )r< r� r� r� �rulesZ ipv6_backendr= r= r> r� � s" z Firewall.apply_default_rulesc C s | j r| j�� sdS dS )NTF)rW r7 Zhas_runtime_configurationrO r= r= r> � may_skip_flush_direct_backends� s z'Firewall.may_skip_flush_direct_backendsc C s\ |d u rt | �}n|}| �� D ]&}|| �� v r0q |�� }|�||� q |d u rX|�d� d S r )r r� r �build_flush_rulesr r� �r< r� r� r� r r= r= r> �flush_direct_backends� s z Firewall.flush_direct_backendsc C sl |d u rt | �}n|}t�d� | �� s4| j|d� | �� D ]}|�� }|�||� q<|d u rh|�d� d S )NzFlushing rule setr� T) r r r� r r r r r r� r r= r= r> r� � s zFirewall.flushc C s< |dv s J �|d u r0|dkr dnd}|||d�}|� ||�S )N)r� �DROP�PANICr� r )ZINPUTZOUTPUTZFORWARD)Zbuild_set_policy_rules)r< r� r: �policy_detailsZdpr= r= r> �_set_policy_build_rules� s �z Firewall._set_policy_build_rulesc C s| |d u rt | �}n|}t�d||dkr8dt�|�� d�nd� | �� D ] }| �|||�}|�||� qF|d u rx|�d� d S )NzSetting policy to '%s'%sr z (ReloadPolicy=�)r� T) r r r� r Z_unparse_reload_policyr r r r� )r< r: r r� r� r� r r= r= r> r� � s �� zFirewall.set_policyc C sB |sdS | � |�}|s&ttjd| ��| �|�s4dS |�|| j�S )Nr� �'%s' is not a valid backend)r� r' r& r� r� �set_rulerN )r< � backend_name�ruler� r= r= r> r s � z Firewall.rulec C s t td |��}| �|�}|s,ttjd| ��| �|�s:d S | jsZ|jrZ|dk�r| j j �st |�D ]�\}}z|� || j � W qb ty� } zjt�t�� � t�|� t|d |� �D ]0}z|� |�|�| j � W q� ty� Y q�0 q�|�W Y d }~qbd }~0 0 qbn|�|| j � d S )Nr r )�listr~ r� r' r& r� r� rM r� r0 r� r� r rN r� r r� � traceback� format_excr� �reversedZ reverse_ruleZ set_rules) r< r r Z_rulesr� r� r r� Zrruler= r= r> r # s8 � ��� zFirewall.rulesc C s | j rttj��d S r( )rE r' r& Z PANIC_MODErO r= r= r> � check_panicC s zFirewall.check_panicc C s" |}|| j �� vr ttj|��|S r( )r: Z get_policiesr' r& ZINVALID_POLICY)r< r: Z_policyr= r= r> � check_policyG s zFirewall.check_policyc C s6 |}|r|dkr| � � }|| j�� vr2ttj|��|S )Nr� )�get_default_zoner6 rp r' r& r� )r< r6 �_zoner= r= r> � check_zoneM s zFirewall.check_zonec C s t �|�sttj|��d S r( )r ZcheckInterfacer' r& ZINVALID_INTERFACE)r< � interfacer= r= r> �check_interfaceU s zFirewall.check_interfacec C s | j �|� d S r( )r5 � check_service)r< r5 r= r= r> r Y s zFirewall.check_servicec C s t �|�sttj|��d S r( )r � check_portr' r& Z INVALID_PORT)r< �portr= r= r> r \ s zFirewall.check_portc C s* |st tj��|dvr&t tjd| ��d S )N)ZtcpZudpZsctpZdccpz''%s' not in {'tcp'|'udp'|'sctp'|'dccp'})r' r& ZMISSING_PROTOCOLZINVALID_PROTOCOL)r< Zprotocolr= r= r> � check_tcpudp` s ��zFirewall.check_tcpudpc C s t �|�sttj|��d S r( )r ZcheckIPr' r& � INVALID_ADDR)r< �ipr= r= r> �check_iph s zFirewall.check_ipc C sP |dkr t �|�sLttj|��n,|dkr@t �|�sLttj|��n ttjd��d S )Nrj rk z'%s' not in {'ipv4'|'ipv6'})r Z checkIPnMaskr' r& r# Z checkIP6nMaskr� )r< r� �sourcer= r= r> � check_addressl s �zFirewall.check_addressc C s | j �|� d S r( )r4 �check_icmptype)r< Zicmpr= r= r> r( w s zFirewall.check_icmptypec C s> t |t�s td|t|�f ��t|�dk r:ttjd| ��d S )Nz%s is %s, expected intr z#timeout '%d' is not positive number)� isinstance�int� TypeError�typer' r& � INVALID_VALUE)r< �timeoutr= r= r> � check_timeoutz s �zFirewall.check_timeoutc C s� t | � | j}| j�� }| j}| j}|s`i }| j�� D ]}| j�|�j ||< q6| j � � }| � � } g } | j� � D ]} | �| j�| �� qn|s�t�| j�d��} | jd| d� | �� | �� d } z| jd|d� W n( ty� } z|} W Y d }~n d }~0 0 |�r8| D ]2}| j�|j��s| j�r|�s| j � |j� �q|�s�| � � }|| k�r�||v�rbi ||< || D ]0}|| j v �rj|| | || |< || |= �qj| j�� D ]B}||v �r�|| D ]}| j� ||� �q�||= n t �!d|� �q�t"|�dk�r t#|�$� �D ]}t �!d|� ||= �q~| D ]�}| j�|j��r�|j%D ]T}z| j�&|j|� W n8 t'�y� } z |j(t)j*k�rz|�W Y d }~n d }~0 0 �q>n| j�+|� | j�,|j� �q$| j �-|� t.� }|�r| j�� d g D ](}t/|�D ]}| jj |||d � �q�q�|| _| j�s | �d � | j�s�|| jk�r�|d k�rd| �0| j1d �D ]}| j1�2|| j3� �qJnT| �0| j4d �D ]}| j4�2|| j3� �qr| j5�r�| �0| j6d �D ]}| j6�2|| j3� �q�| �r�d | _7| �nd| _7d S )NZ ReloadPolicyr )r Tr� zNew zone '%s'.r z(Lost zone '%s', zone interfaces dropped.r� )Zsenderr� r r� r� )8r$ rE r Zomit_native_ipsetrR rS r6 rp rf � interfacesr7 Zget_runtime_configr rl rv rZ r Z_parse_reload_policyr* rq r� r� r� r� r� Z query_ipsetry rL r1 Z set_destroyrQ �change_zone_of_interfacer r� �lenr �keys�entriesZ add_entryr' r� r& �ALREADY_ENABLEDr� Z apply_ipsetZ set_configr r r r2 r rN r- rB r/ rD )r< r� rE Z_omit_native_ipsetZold_firewall_backendZ flush_allZ_zone_interfacesr6 Z_direct_config�_old_dzZ _ipset_objs�_nameZ reload_policyZstart_exceptionr� r{ Z_new_dz�ifaceZ interface_id�entryr� Z nm_bus_namer r r= r= r> r� � s� � � ���zFirewall.reloadc C s | j S r( )rD rO r= r= r> � get_state s zFirewall.get_statec C s\ | j rttjd��z| �d� W n0 tyP } zttj|��W Y d }~n d }~0 0 d| _ d S )Nzpanic mode already enabledr T)rE r' r& r5 r� r� �COMMAND_FAILEDr� r= r= r> �enable_panic_mode s �"zFirewall.enable_panic_modec C s\ | j sttjd��z| �d� W n0 tyP } zttj|��W Y d }~n d }~0 0 d| _ d S )Nzpanic mode is not enabledr� F)rE r' r& Z NOT_ENABLEDr� r� r; r� r= r= r> �disable_panic_mode s �"zFirewall.disable_panic_modec C s | j S r( )rE rO r= r= r> �query_panic_mode* s zFirewall.query_panic_modec C s | j S r( )rN rO r= r= r> �get_log_denied/ s zFirewall.get_log_deniedc C sb |t jvr&ttjd|d�t j�f ��|| �� krR|| _| j� d|� | j� � n ttj |��d S )Nz'%s', choose from '%s'z','r� ) r ZLOG_DENIED_VALUESr' r& r- �joinr? rN r* rr �writeZ ALREADY_SET)r< r� r= r= r> �set_log_denied2 s �� zFirewall.set_log_deniedc C s | j S r( )rF rO r= r= r> r A s zFirewall.get_default_zonec C s� | � |�}|| jkr~| j}|| _| j�d|� | j�� | jrBd S | j�||� | j�|�j D ] }|| j v r^| j� d|� q^n t t j|��d S )Nr� r� )r rF r* rr rA r+ r6 r� rf r0 rQ r1 r' r& ZZONE_ALREADY_SET)r< r6 r r6 r8 r= r= r> �set_default_zoneD s zFirewall.set_default_zonec C sD |� � }|�� D ].\}}|s&t|t�r0|||< q||v r||= q|S r( )ru rz r) �bool)r< Z permanentri Zcombined�keyr� r= r= r> �'combine_runtime_with_permanent_settings[ s z0Firewall.combine_runtime_with_permanent_settingsc C s, dD ]"}||v rdd� || D �||< qi }i }t |�� �t |�� �B D ]�}||v rHt|| t�r�t ||v rt|| ng �}tt || �| �||< t|t || �A |@ �||< qHt|| t�s�t|| t��r|| s�|| r�d||< n || �r"|| �s"d||< qHttjd� t || �|���qH||fS )N)Z rich_rulesZ rules_strc S s g | ]}t t|d ���qS ))�rule_str)�strr% )r[ rG r= r= r> � <listcomp>m r^ z;Firewall.get_added_and_removed_settings.<locals>.<listcomp>TFz Unhandled setting type {} key {}) rr r3 r) r rD r* r' r& ZINVALID_SETTINGr� r, )r< Z old_settingsZ new_settingsZrich_keyZ add_settingsZremove_settingsrE �oldr= r= r> � get_added_and_removed_settingsi s$ z'Firewall.get_added_and_removed_settings)F)FF)FF)FF)F)N)N)N)N)N)NN)F)K�__name__� __module__� __qualname__r? rP r; rw r rH r r r} r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r r r� r� r� r r r� r r� r r r r r r r r r" r% r' r( r/ r� r: r< r= r> r? rB r rC rF rK r= r= r= r> r F s� %* Ud0 .# " )I�__all__r� r� ru r� r �typingr r Zfirewallr r Z firewall.corer r r r r Zfirewall.core.fw_icmptyper Zfirewall.core.fw_servicer Zfirewall.core.fw_zoner Zfirewall.core.fw_directr Zfirewall.core.fw_configr Zfirewall.core.fw_policiesr Zfirewall.core.fw_ipsetr Z firewall.core.fw_transactionr Zfirewall.core.fw_helperr Zfirewall.core.fw_policyr Zfirewall.core.fw_nmr r Zfirewall.core.loggerr Zfirewall.core.io.io_objectr Z firewall.core.io.firewalld_confr Zfirewall.core.io.directr Zfirewall.core.io.servicer Zfirewall.core.io.icmptyper Zfirewall.core.io.zoner r Zfirewall.core.io.ipsetr Zfirewall.core.ipsetr! Zfirewall.core.io.helperr" Zfirewall.core.io.policyr# Zfirewall.core.io.functionsr$ Zfirewall.core.richr% r& Zfirewall.errorsr' �objectr r= r= r= r> �<module> sP