????
Your IP : 3.15.3.240
a
���g�^ � @ sf d Z dgZddlZddlmZ ddlmZ ddlmZ ddl m
Z
m Z m Z m
Z
mZ G dd� de�ZdS ) z<FirewallCommand class for command line client simplification�FirewallCommand� N)�errors)�
FirewallError)�
DBusException)� checkIPnMask�
checkIP6nMask� check_mac�
check_port�check_single_addressc @ s� e Zd Zd\dd�Zdd� Zdd� Zdd � Zd
d � Zd d
� Zd]dd�Z d^dd�Z
d_dd�Z d`dd�Z dadd�Z
dbdd�Zdcd d �Zddd d �Zded d!�Zdfd"d#�Zdgd$d%�Zdhd&d'�Zdid(d)�Zdjd*d+�Zdkd,d-�Zd.d/� Zdld1d2�Zdmd3d4�Zd5d6� Zd7d8� Z d9d:� Z d;d<� Z d=d>� Z d?d@� Z dg dAfdBdC�Z!dg fdDdE�Z"dg fdFdG�Z#dHdI� Z$dJdK� Z%dLdM� Z&dNdO� Z'dPdQ� Z(dRdS� Z)dTdU� Z*dVdW� Z+dXdY� Z,dZd[� Z-dS )nr Fc C s || _ || _d| _d | _d S �NT)�quiet�verbose�'_FirewallCommand__use_exception_handler�fw)�selfr r
� r �4/usr/lib/python3.9/site-packages/firewall/command.py�__init__# s zFirewallCommand.__init__c C s
|| _ d S �N)r )r r r r r �set_fw) s zFirewallCommand.set_fwc C s
|| _ d S r �r �r �flagr r r � set_quiet, s zFirewallCommand.set_quietc C s | j S r r �r r r r � get_quiet/ s zFirewallCommand.get_quietc C s
|| _ d S r �r
r r r r � set_verbose2 s zFirewallCommand.set_verbosec C s | j S r r r r r r � get_verbose5 s zFirewallCommand.get_verboseNc C s" |d ur | j s tj�|d � d S �N�
)r �sys�stdout�write�r �msgr r r � print_msg8 s zFirewallCommand.print_msgc C s" |d ur | j s tj�|d � d S r )r r! �stderrr# r$ r r r �print_error_msg< s z FirewallCommand.print_error_msgc C s, d}d}t j�� r || | }| �|� d S )Nz[91mz[00m)r! r' �isattyr( )r r% ZFAILZENDr r r �
print_warning@ s
z FirewallCommand.print_warningr c C s, |dkr| � |� n
| �|� t�|� d S )N� )r* r& r! �exit)r r% Z exit_coder r r �print_and_exitG s
z FirewallCommand.print_and_exitc C s | � |d� d S )N� �r- r$ r r r �failR s zFirewallCommand.failc C s" |d ur | j r tj�|d � d S r )r
r! r" r# r$ r r r �print_if_verboseU s z FirewallCommand.print_if_verbosec
C s� | j d ur| j �� g }
d} g } |D ]�}
|d ur�z ||
�}
W n� ty� } zlt�t|��}t|�dkrv| �d| � n| �d| |� || vr�| � |� | d7 } W Y d }~q$W Y d }~n
d }~0 0 |
� |
� q$|
D �]d}
g }|d ur�||7 }t
|
t ��st
|
t ��s|� |
� n||
7 }|d u�r*||7 }| �
� z ||� W n� ttf�y. } z�t
|t��rx| �|�� � |�� }nt|�}t�|�}|tjtjtjtjfv �r�d}t|�dk�r�| �d| � n8|dk�r�| �d| � W Y d }~ d S | �d| |� || v�r| � |� | d7 } W Y d }~n
d }~0 0 | �� q�| �s�t|�| k�sXd| v �r\d S t| �dk�rzt�| d � nt| �dk�r�t�tj� d S )Nr r+ � Warning: %s� Error: %s)r Z authorizeAll� Exceptionr �get_code�str�lenr* r- �append�
isinstance�list�tuple� deactivate_exception_handlerr �fail_if_not_authorized�
get_dbus_name�get_dbus_messager �ALREADY_ENABLED� NOT_ENABLED�ZONE_ALREADY_SET� ALREADY_SET�activate_exception_handlerr! r, Z
UNKNOWN_ERROR)r Zcmd_type�option�
action_method� query_method� parse_method�message�
start_args�end_args�no_exit�items�_errorsZ _error_codes�itemr% �code� call_itemr r r Z__cmd_sequenceY st
"
�
z FirewallCommand.__cmd_sequencec C s | j d||||||d� d S )N�add�rL �� _FirewallCommand__cmd_sequence�r rE rF rG rH rI rL r r r � add_sequence� s �z FirewallCommand.add_sequencec
C s | j d||||||g|d� d S )NrR �rJ rL rT �r �xrE rF rG rH rI rL r r r �x_add_sequence� s �z FirewallCommand.x_add_sequencec C s$ | j d||||||g|g|d� d S )NrR )rJ rK rL rT ) r �zonerE rF rG rH rI �timeoutrL r r r �zone_add_timeout_sequence� s �z)FirewallCommand.zone_add_timeout_sequencec C s | j d||||||d� d S )N�removerS rT rV r r r �remove_sequence� s �z FirewallCommand.remove_sequencec
C s | j d||||||g|d� d S )Nr_ rX rT rY r r r �x_remove_sequence� s �z!FirewallCommand.x_remove_sequencec
C s* g }|D ]�}|d ur�z ||�}W nj t y� } zRt|�dkrX| �d| � W Y d } ~ qn t�t| ��}
| �d| |
� W Y d } ~ n
d } ~ 0 0 |�|� q|D �]v}g } |d ur�| |7 } t|t �s�t|t
�s�| �|� n| |7 } | � � z || � } W n� t �yv } zj| �
| �� � t�| �� �}
t|�dk�rN| �d| �� � W Y d } ~ q�n| �d| �� |
� W Y d } ~ njd } ~ 0 t �y� } zHt�t| ��}
t|�dk�r�| �d| � n| �d| |
� W Y d } ~ n
d } ~ 0 0 | �� t|�dk�r
| �d|| d| f � q�| �| � q�|�s&t�d� d S )Nr+ r2 r3 z%s: %s)�no�yesr )r4 r7 r* r r5 r6 r- r8 r9 r: r; r< r r= r> r? rD r& �print_query_resultr! r, )
r rE rG rH rI rJ rL rM rO r% rP rQ �resr r r Z__query_sequence� sT &
�& z FirewallCommand.__query_sequencec C s | j |||||d� d S )NrS �� _FirewallCommand__query_sequence)r rE rG rH rI rL r r r �query_sequence� s
�z FirewallCommand.query_sequencec C s | j |||||g|d� d S )NrX rf )r rZ rE rG rH rI rL r r r �x_query_sequence� s
�z FirewallCommand.x_query_sequencec C sB t |�s>t|�s>t|�s>|�d�r.t|�dks>ttjd| ��|S )Nzipset:� z8'%s' is no valid IPv4, IPv6 or MAC address, nor an ipset)r r r �
startswithr7 r r � INVALID_ADDR�r �valuer r r � parse_source� s ��
��z FirewallCommand.parse_source�/c C sj z|� |�\}}W n" ty4 ttjd| ��Y n0 t|�sJttj|��|dvrbttjd| ��||fS )NzTbad port (most likely missing protocol), correct syntax is portid[-portid]%sprotocol�ZtcpZudpZsctpZdccp�''%s' not in {'tcp'|'udp'|'sctp'|'dccp'})�split�
ValueErrorr r � INVALID_PORTr �INVALID_PROTOCOL)r rn � separator�port�protor r r �
parse_port s � ��zFirewallCommand.parse_portc
C s� d }d }d }d }d}d||d � v r�||d � � dd�d }|t|�d 7 }d||d � v rv||d � � dd�d } n ||d � } |t| �d 7 }|dkr�| }q|dkr�| }q|dkr�| }q|dkr�| }q|d kr�|r�qttjd
| ��q|s�ttjd ��|�s ttjd ��|�s$|�s$ttjd
��t|��s:ttj|��|dv�rTttjd| ��|�rpt|��spttj|��|�r�td|��s�|�s�td|��s�ttj |��||||fS )Nr �=r+ �:rx ry �toport�toaddr�ifz invalid forward port arg '%s'z missing portzmissing protocolzmissing destinationrq rr �ipv4�ipv6)
rs r7 r r ZINVALID_FORWARDr ru rv r
rl )
r rn �compatrx Zprotocolr} r~ �i�opt�valr r r �parse_forward_port sZ �
�� z"FirewallCommand.parse_forward_portc C sF |� d�}t|�dkr"|d dfS t|�dkr2|S ttjd| ��d S )Nr{ r+ r � r. zinvalid ipset option '%s')rs r7 r r ZINVALID_OPTION)r rn �argsr r r �parse_ipset_optionH s
�z"FirewallCommand.parse_ipset_optionc C s. ddg}||vr*t tjd|d�|�f ��|S )Nr� r� �'invalid argument: %s (choose from '%s')�', '�r r Z INVALID_IPV�join�r rn Zipvsr r r �check_destination_ipvR s ��z%FirewallCommand.check_destination_ipvc C sB z|� dd�\}}W n ty2 ttjd��Y n0 | �|�|fS )Nr| r+ z(destination syntax is ipv:address[/mask])rs rt r r ZINVALID_DESTINATIONr� )r rn ZipvZ destinationr r r �parse_service_destinationZ s �
z)FirewallCommand.parse_service_destinationc C s. g d�}||vr*t tjd|d�|�f ��|S )N)r� r� Zebr� r� r� r� r r r � check_ipvb s ��zFirewallCommand.check_ipvc C s. g d�}||vr*t tjd|d�|�f ��|S )N)r� r� r� r� r� r� r� r r r �check_helper_familyj s ��z#FirewallCommand.check_helper_familyc C sB |� d�sttjd| ��t|�dd��dk r>ttjd| ��|S )NZ
nf_conntrack_z('%s' does not start with 'nf_conntrack_'r� r+ zModule name '%s' too short)rk r r ZINVALID_MODULEr7 �replacerm r r r � check_moduler s
��z FirewallCommand.check_moduleTc C s� |� � }|�� }|�� }|�� } |�� }
|�� } |�� } |�� }
|�� }|� � }|�
� }|rv|� � }|� � }|�
� }n,|�� }tt|�� | ��}|�� }|�� }dd� }g }|d ur�||kr�|�d� |s�|s�|s�|r�|r�|r�|�d� |�r|dd�|� }| �|� | j�r0| �d| � | �d| � |�rH| �d t|� � | �d
| � |�st| �d |�rld nd
� |�r�| �dd�|� � | �dd�|� � n(| �dd�|� � | �dd�|� � | �dd�t|�� � | �dd�dd� |D �� � | �dd�t| �� � |�s8| �d|�r0d nd
� | �d|
�rHd nd
� | �d| �r`dnd d�d d� | D �� � | �d d�d d� | D �� � | �d d�|
� � | �d!|�r�dnd d�t||d"�� � d S )#Nc S sd d}d}z| � |�}W n ty( Y n80 |t|�7 }t| ||| |d � � d� � �dd��}|S )Nr z priority=� �"r� )�indexrt r7 �intr� )Zrule�priorityZ
search_strr� r r r �rich_rule_sorted_key� s *zDFirewallCommand.print_zone_policy_info.<locals>.rich_rule_sorted_key�defaultZactivez (%s)z, � summary: � description: z priority: z
target: z icmp-block-inversion: %src rb z ingress-zones: r� z egress-zones: z interfaces: z sources: z services: � ports: c S s g | ]}d |d |d f �qS �z%s/%sr r+ r ��.0rx r r r �
<listcomp>� s �z:FirewallCommand.print_zone_policy_info.<locals>.<listcomp>�
protocols: z
forward: %sz masquerade: %sz forward-ports: z
r� c S s$ g | ] \}}}}d ||||f �qS )z$port=%s:proto=%s:toport=%s:toaddr=%sr )r� rx ry r} r~ r r r r� � s
�
�� source-ports: c S s g | ]}d |d |d f �qS r� r r� r r r r� � s �z icmp-blocks: z rich rules: )�key)Z getTargetZ getServices�getPorts� getProtocolsZ
getMasqueradeZgetForwardPorts�getSourcePortsZ
getIcmpBlocksZ getRichRules�getDescription�getShortZgetIngressZonesZgetEgressZonesZ getPriorityZgetIcmpBlockInversion�sorted�setZ
getInterfacesZ
getSourcesZ
getForwardr8 r� r& r
r6 )r r\ �settings� default_zone�extra_interfaces�isPolicy�targetZservices�ports� protocolsZ
masqueradeZ
forward_ports� source_portsZ icmp_blocksZrules� description�short_descriptionZ
ingress_zonesZ egress_zonesr� Zicmp_block_inversionZ
interfacesZsourcesZforwardr� Z
attributesr r r �print_zone_policy_info| s�
���
��
��
���z&FirewallCommand.print_zone_policy_infoc C s | j ||||dd� d S )NF�r� r� r� �r� )r r\ r� r� r� r r r �print_zone_info� s z FirewallCommand.print_zone_infoc C s | j ||||dd� d S )NTr� r� )r Zpolicyr� r� r� r r r �print_policy_info� s z!FirewallCommand.print_policy_infoc C s. |� � }|�� }|�� }|�� }|�� }|�� }|�� } |�� }
|�� } | � |� | j
rt| � d| � | � d| � | � dd� dd� |D �� � | � dd� |� � | � dd� d d� |D �� � | � d
d� |� � | � d d� d d� |� � D �� � | � d
d� t
|
�� � | � dd� t
| �� � d S )Nr� r� r� r� c S s g | ]}d |d |d f �qS r� r r� r r r r� � s �z6FirewallCommand.print_service_info.<locals>.<listcomp>r� r� c S s g | ]}d |d |d f �qS r� r r� r r r r� � s �z modules: � destination: c S s g | ]\}}d ||f �qS )z%s:%sr �r� �k�vr r r r� � s �z includes: z helpers: )r� r� r� Z
getModulesr� �getDestinationsr� Z getIncludesZ
getHelpersr& r
r� rM r� ) r Zservicer� r� r� r� �modulesr� � destinationsr� ZincludesZhelpersr r r �print_service_info� s<
�
��
��z"FirewallCommand.print_service_infoc C sp |� � }|�� }|�� }t|�dkr,ddg}| �|� | jrX| �d| � | �d| � | �dd�|� � d S )Nr r� r� r� r� r� r� )r� r� r� r7 r& r
r� )r Zicmptyper� r� r� r� r r r �print_icmptype_info� s
z#FirewallCommand.print_icmptype_infoc C s� |� � }|�� }|�� }|�� }|�� }| �|� | jrT| �d| � | �d| � | �d| � | �dd�dd� |�� D �� � | �dd�|� � d S ) Nr� r� z type: z options: r� c S s$ g | ] \}}|r d ||f n|�qS )z%s=%sr r� r r r r� s �z4FirewallCommand.print_ipset_info.<locals>.<listcomp>z entries: ) ZgetTypeZ
getOptionsZ
getEntriesr� r� r& r
r� rM )r Zipsetr� Z
ipset_type�options�entriesr� r� r r r �print_ipset_info� s
� z FirewallCommand.print_ipset_infoc C s� |� � }|�� }|�� }|�� }|�� }| �|� | jrT| �d| � | �d| � | �d| � | �d| � | �dd�dd� |D �� � d S ) Nr� r� z
family: z
module: r� r� c S s g | ]}d |d |d f �qS r� r r� r r r r� s �z5FirewallCommand.print_helper_info.<locals>.<listcomp>)r� Z getModuleZ getFamilyr� r� r& r
r� )r �helperr� r� �moduleZfamilyr� r� r r r �print_helper_info s
�z!FirewallCommand.print_helper_infoc C s |r| � d� n | � dd� d S )Nrc rb r+ r/ rm r r r rd s z"FirewallCommand.print_query_resultc C s\ | j s� | �|� t�t|��}|tjtjtjtj fv rH| �
d| � n| � d| |� d S )Nr2 r3 ) r r= r r5 r6 r r@ rA rB rC r* r- )r �exception_messagerP r r r �exception_handler s
�z!FirewallCommand.exception_handlerc C s d|v rd}| � |tj� d S )NZNotAuthorizedExceptionz`Authorization failed.
Make sure polkit agent is running or run the application as superuser.)r- r ZNOT_AUTHORIZED)r r� r% r r r r= ' s z&FirewallCommand.fail_if_not_authorizedc C s
d| _ d S )NF�r r r r r r< - s z,FirewallCommand.deactivate_exception_handlerc C s
d| _ d S r r� r r r r rD 0 s z*FirewallCommand.activate_exception_handlerc C sn g }t � }t|�}|D ]J}|s" qb|�� }t|�dk s|d dv rDq||vr|�|� |�|� q|�� |S )Nr+ r )�#�;)r� �open�stripr7 r8 rR �close)r �filenamer� Z entries_set�f�liner r r �get_ipset_entries_from_file3 s
z+FirewallCommand.get_ipset_entries_from_file)FF)N)N)N)Nr )N)N)NNF)F)F)F)F)F)NF)F)F)rp )F).�__name__�
__module__� __qualname__r r r r r r r& r( r* r- r0 r1 rU rW r[ r^ r` ra rg rh ri ro rz r� r� r� r� r� r� r� r� r� r� r� r� r� r� rd r� r= r< rD r� r r r r r " sj
�
L �
�
�
�
�
�
3 �
�
2
O )�__doc__�__all__r! Zfirewallr Zfirewall.errorsr Zdbus.exceptionsr Zfirewall.functionsr r r r r
�objectr r r r r �<module> s