????
Your IP : 3.147.67.34
a
���g+J � @ s� g d �Z ddlZddlZddlZddlZddlZddlZddlZddlm Z ddl
m Z m Z dd� e
dd�D �Zdd � Zd
d � ZdUd
d�Zdd� Zdd� Zdd� Zdd� Zdd� Zdd� Zdd � Zd d � Zd d � Zd!d"� Zd#d$� Z d%d&� Z d'd(� Z d)d*� Z d+d,� Z d-d.� Z!d/d0� Z"d1d2� Z#d3d4� Z$d5d6� Z%d7d8� Z&d9d:� Z'd;d<� Z(d=d>� Z)d?d@� Z*dAdB� Z+dCdD� Z,dEdF� Z-dGdH� Z.dIdJ� Z/dKdL� Z0dMdN� Z1dOdP� Z2dQdR� Z3dSdT� Z4dS )V)!� getPortID� getPortRange�portStr�getServiceName�checkIP�checkIP6� checkIPnMask�
checkIP6nMask�
checkProtocol�checkInterface� checkUINT16� checkUINT32�firewalld_is_active�tempFile�readfile� writefile�enable_ip_forwarding�
check_port�
check_address�check_single_address� check_mac�uniqify� ppid_of_pid�max_zone_name_len� checkUser�checkUid� checkCommand� checkContext�joinArgs� splitArgs�max_policy_name_len�checkTcpMssClamp�stripNonPrintableCharacters� N)�log)�FIREWALLD_TEMPDIR�FIREWALLD_PIDFILEc C s" i | ]}|d kr|dk s|d�qS )� � N� )�.0�ir( r( �6/usr/lib/python3.9/site-packages/firewall/functions.py�
<dictcomp>+ s r, � c C st t | t�r| }nT| r | �� } z t| �}W n: tyb zt�| �}W n tjy\ Y Y dS 0 Y n0 |dkrpdS |S )z� Check and Get port id from port string or port id using socket.getservbyname
@param port port string or port id
@return Port id if valid, -1 if port can not be found and -2 if port is too big
���� ���)�
isinstance�int�strip�
ValueError�socketZ
getservbyname�error)�portZ_idr( r( r+ r 4 s
r c C s� t | t�st | t�r| S t | t�s*| �� rDt| �}|dkr@|fS |S | �d�}t|�dkr�|d �� r�|d �� r�t|d �}t|d �}|dkr�|dkr�||k r�||fS ||kr�||fS |fS g }tt|�dd�D ]�}td� |d|� ��}d� ||d� �}t|�dk�rlt|�}|dk�r�|dk�r�||k �rD|�
||f� n&||k�r^|�
||f� n |�
|f� q�|dkr�|�
|f� |t|�kr� �q�q�t|�dk �r�dS t|�dk�r�dS |d S )aI Get port range for port range string or single port id
@param ports an integer or port string or port range string
@return Array containing start and end port id for a valid range or -1 if port can not be found and -2 if port is too big for integer input or -1 for invalid ranges or None if the range is ambiguous.
r" �-� � r. N) r1 �tuple�listr2 �isdigitr �split�len�range�join�append)ZportsZid1�splitsZid2Zmatchedr* Zport2r( r( r+ r K sL
$
r �:c C sX | dkr dS t | �}t|t�r*|dk r*dS t|�dkr>d| S d|d ||d f S dS )a Create port and port range string
@param port port or port range int or [int, int]
@param delimiter of the output string for port ranges, default ':'
@return Port or port range string, empty string if port isn't specified, None if port or port range is not valid
� r" Nr: z%sz%s%s%s)r r1 r2 r? )r7 Z delimiter�_ranger( r( r+ r � s r c C s t | �}t |�}t|�dkr�t|�dkr@t|d �t|d �kS t|�dkr�t|d �t|d �kr�t|d �t|d �kr�dS n|t|�dkr�t|�dkr�t|d �t|d �kr�t|d �t|d �kr�t|d �t|d �kr�t|d �t|d �kr�dS dS )Nr: r" r9 TF)r r? r )r7 r@ Z_portrF r( r( r+ �portInPortRange� s. �� ����rG c C sP t | �}t|�dkr$|d |d f}tt |�}ttdd� |�dd� d�}g }|D ]�}|d |d kr�|d |d kr�|�|� qP|d |d kr�|d |d k r�|d |d kr�|�|� |d |d f}qP|d |d krP|d |d krP|d |d krP|�|� |d |d f}qPttdd� |��}|d |d k�rF|d f}|g|fS )z� Coalesce a port range with existing list of port ranges
@param new_range tuple/list/string
@param ranges list of tuple/list/string
@return tuple of (list of ranges added after coalescing, list of removed original ranges)
r: r" c S s t | �dkr | d | d fS | S �Nr: r" �r? ��xr( r( r+ �<lambda>� � z#coalescePortRange.<locals>.<lambda>c S s | d S �Nr" r( rJ r( r( r+ rL � rM ��keyc S s | d | d kr| d fS | S �Nr" r: r( rJ r( r( r+ rL � rM �r r? �map�sortedrB r< )Z new_range�rangesZcoalesced_range�_ranges�removed_rangesr@ r( r( r+ �coalescePortRange� s.
�
�
rX c C s� t | �} t| �dkr$| d | d f} tt |�}ttdd� |�dd� d�}g }g }|D �]@}| d |d kr�| d |d kr�|�|� qT| d |d kr�| d |d k r�| d |d kr�|�|� |�| d d |d f� qT| d |d k�r8| d |d k�r8| d |d k�r8|�|� |�|d | d d f� qT| d |d krT| d |d k rT|�|� |�|d | d d f� |�| d d |d f� qTttdd� |��}ttdd� |��}||fS ) z� break a port range from existing list of port ranges
@param remove_range tuple/list/string
@param ranges list of tuple/list/string
@return tuple of (list of ranges added after breaking up, list of removed original ranges)
r: r" c S s t | �dkr | d | d fS | S rH rI rJ r( r( r+ rL � rM z breakPortRange.<locals>.<lambda>c S s | d S rN r( rJ r( r( r+ rL � rM rO c S s | d | d kr| d fS | S rQ r( rJ r( r( r+ rL � rM c S s | d | d kr| d fS | S rQ r( rJ r( r( r+ rL � rM rR )Z remove_rangerU rV rW Z added_rangesr@ r( r( r+ �breakPortRange� s6
�
$�
rY c C s0 zt �t| �|�}W n t jy* Y dS 0 |S )z� Check and Get service name from port and proto string combination using socket.getservbyport
@param port string or id
@param protocol string
@return Service name if port and protocol are valid, else None
N)r5 Z
getservbyportr2 r6 )r7 �proto�namer( r( r+ r � s
r c C s. zt �t j| � W n t jy( Y dS 0 dS )zh Check IPv4 address.
@param ip address string
@return True if address is valid, else False
FT)r5 � inet_ptonZAF_INETr6 ��ipr( r( r+ r s
r c C s
| � d�S )z� Normalize the IPv6 address
This is mostly about converting URL-like IPv6 address to normal ones.
e.g. [1234::4321] --> 1234:4321
z[])r3 r] r( r( r+ � normalizeIP6 s r_ c C s2 zt �t jt| �� W n t jy, Y dS 0 dS )zh Check IPv6 address.
@param ip address string
@return True if address is valid, else False
FT)r5 r\ ZAF_INET6r_ r6 r] r( r( r+ r s
r c C s� | � d�}|dkr<| d |� }| |d d � }|r6|sDdS n| }d }t|�sPdS |r�d|v rdt|�S z t|�}W n ty� Y dS 0 |dk s�|dkr�dS dS ) N�/r. r: F�.r" � T)�findr r2 r4 �r^ �index�addr�maskr* r( r( r+ r * s(
r c C s
| � t�S �N)� translate�NOPRINT_TRANS_TABLE)Zrule_strr( r( r+ r! B s r! c C s� | � d�}|dkr<| d |� }| |d d � }|r6|sDdS n| }d }t|�sPdS |r�z t|�}W n tyt Y dS 0 |dk s�|dkr�dS dS )Nr` r. r: Fr" � T)rc r r2 r4 rd r( r( r+ r E s$
r c C s` z t | �}W n: tyF zt�| � W n tjy@ Y Y dS 0 Y n0 |dk sX|dkr\dS dS )NFr" � T)r2 r4 r5 Zgetprotobynamer6 )Zprotocolr* r( r( r+ r [ s r c C s: | r6| � � r t| �dk r6dS n| dkr*dS | dkr6dS dS )Ni F�NoneTZpmtu)r= r2 )Ztcp_mss_clamp_valuer( r( r+ r j s r c C s0 | rt | �dkrdS dD ]}|| v r dS qdS )z� Check interface string
@param interface string
@return True if interface is valid (maximum 16 chars and does not contain ' ', '/', '!', ':', '*'), else False
� F)� r` �!�*TrI )Ziface�chr( r( r+ r
u s r
c C s< zt | d�}W n ty" Y dS 0 |dkr8|dkr8dS dS )Nr" Fr/ T�r2 r4 ��valrK r( r( r+ r � s r c C s< zt | d�}W n ty" Y dS 0 |dkr8|dkr8dS dS )Nr" Fl �� Trs rt r( r( r+ r � s r c C s� t j�t�sdS z6ttd��} | �� }W d � n1 s:0 Y W n tyZ Y dS 0 t j�d| �spdS z:td| d��} | �� }W d � n1 s�0 Y W n ty� Y dS 0 d|v r�dS dS )zv Check if firewalld is active
@return True if there is a firewalld pid file and the pid is used by firewalld
F�rNz/proc/%sz/proc/%s/cmdlineZ firewalldT)�os�path�existsr% �open�readline� Exception)�fd�pidZcmdliner( r( r+ r
� s" * * r
c
C sf z,t j�t�st �td� tjddtdd�W S ty` } z t� d| � � W Y d } ~ n
d } ~ 0 0 d S )Ni� Zwtztemp.F)�mode�prefix�dir�deletez#Failed to create temporary file: %s)
rw rx ry r$ �mkdir�tempfileZNamedTemporaryFiler| r# r6 )�msgr( r( r+ r � s �r c
C st z8t | d��}|�� W d � W S 1 s,0 Y W n6 tyn } z t�d| |f � W Y d }~n
d }~0 0 d S )Nrv z Failed to read file "%s": %s)rz � readlinesr| r# r6 )�filename�f�er( r( r+ r � s ,(r c
C sv z8t | d��}|�|� W d � n1 s,0 Y W n8 typ } z t�d| |f � W Y d }~dS d }~0 0 dS )N�wz Failed to write to file "%s": %sFT)rz �writer| r# r6 )r� �liner� r� r( r( r+ r � s ,r c C s( | dkrt dd�S | dkr$t dd�S dS )N�ipv4z /proc/sys/net/ipv4/ip_forwardz1
�ipv6z&/proc/sys/net/ipv6/conf/all/forwardingF)r )�ipvr( r( r+ r � s
r c C s | � dd�� dd�S )N�_r8 z
nf-conntrack-rE )�replace)�moduler( r( r+ �get_nf_conntrack_short_name� s r� c C s� t | �}|dks<|dks<|d u s<t|�dkr�|d |d kr�|dkrTt�d| � nZ|dkrlt�d| � nB|d u r�t�d| � n*t|�dkr�|d |d kr�t�d | � d
S d S ) Nr0 r. r9 r" r: z'%s': port > 65535z'%s': port is invalidz'%s': port is ambiguousz'%s': range start >= endFT)r r? r# Zdebug2)r7 rF r( r( r+ r � s
�� r c C s( | dkrt |�S | dkr t|�S dS d S �Nr� r� F)r r �r� �sourcer( r( r+ r � s
r c C s( | dkrt |�S | dkr t|�S dS d S r� )r r r� r( r( r+ r � s
r c C sN t | �dkrJdD ]}| | dkr dS qdD ]}| | tjvr, dS q,dS dS )N� )r9 � � � � rD F) r" r: � � � � � �
� �
� rn T)r? �stringZ hexdigits)Zmacr* r( r( r+ r � s r c C s$ g }| D ]}||vr|� |� q|S rh )rB )Z_list�outputrK r( r( r+ r
s
r c C sH z.t �d| �}t|�� d �� �} |�� W n tyB Y dS 0 | S )z Get parent for pid z ps -o ppid -h -p %d 2>/dev/nullr" N)rw �popenr2 r� r3 �closer| )r~ r� r( r( r+ r s r c C sB ddl m} ddlm} ttt|�� ��}d|t| � td� S )z�
iptables limits length of chain to (currently) 28 chars.
The longest chain we create is POST_<policy>_allow,
which leaves 28 - 11 = 17 chars for <policy>.
r" )�POLICY_CHAIN_PREFIX�� SHORTCUTS� Z_allow)Zfirewall.core.ipXtablesr� �firewall.core.baser� �maxrS r? �values)r� r� �longest_shortcutr( r( r+ r s r c C s. ddl m} ttt| �� ��}d|td� S )z�
Netfilter limits length of chain to (currently) 28 chars.
The longest chain we create is POST_<zone>_allow,
which leaves 28 - 11 = 17 chars for <zone>.
r" r� r� Z__allow)r� r� r� rS r? r� )r� r� r( r( r+ r ' s r c C sR t | �dk s t | �t�d�kr"dS | D ]&}|tjvr&|tjvr&|dvr& dS q&dS )Nr: �SC_LOGIN_NAME_MAXF)ra r8 r� �$T)r? rw �sysconfr� �
ascii_letters�digits)�user�cr( r( r+ r 1 s
��r c C sD t | t�r,z t| �} W n ty* Y dS 0 | dkr@| dkr@dS dS )NFr" i���T)r1 �strr2 r4 )�uidr( r( r+ r ; s
r c C sH t | �dk st | �dkr dS dD ]}|| v r dS q | d dkrDdS dS )Nr: i F)�|�
� r" r` TrI )Zcommandrr r( r( r+ r E s r c C s� | � d�}t|�dvrdS |d dkr>|d dd � dkr>dS |d dd � d krVdS |d
dd � d krndS t|d �dk r�dS d
S )NrD )r� r� Fr" �rootr0 Z_ur: Z_rr9 Z_tr� T)r> r? )�contextrC r( r( r+ r O s
r c C s8 dt t�v r d�dd� | D ��S d�dd� | D ��S d S )N�quotero c s s | ]}t �|�V qd S rh )�shlexr� �r) �ar( r( r+ � <genexpr>c rM zjoinArgs.<locals>.<genexpr>c s s | ]}t �|�V qd S rh )�pipesr� r� r( r( r+ r� e rM )r� r� rA )�argsr( r( r+ r a s r c C s
t �| �S rh )r� r> )Z_stringr( r( r+ r g s r )rD )5�__all__r5 rw Zos.pathr� r� r� r� Zfirewall.core.loggerr# Zfirewall.configr$ r% r@ rj r r r rG rX rY r r r_ r r r! r r r r
r r r
r r r r r� r r r r r r r r r r r r r r r( r( r( r+ �<module> sd � :
&+