Your IP : 3.147.51.81
3
@)�f� � @ sd d dl mZ d dlZeejd< d dlZd dlZd dlZd dlZd dl Zd dl
m Z d dl m
Z
d dlmZ d dlmZ d dlmZmZmZ d d lmZ d d
lmZ d d lmZ d d l m Z d d
l m Z d dl m!Z! d dl"m#Z# d dl$m%Z% d dl&m'Z' d dl(m)Z) d dl*m+Z+ d dl,m-Z-m.Z.m/Z/m0Z0m1Z1m2Z2m3Z3 d dl
m4Z4 d dl5m6Z6 G dd� dejj7j8�Z9dS )� )�GObjectNZgobject)�config)�DEFAULT_ZONE_TARGET)�Watcher)�log)�handle_exceptions�dbus_handle_exceptions�dbus_service_method)�FirewallDConfigIcmpType)�FirewallDConfigService)�FirewallDConfigZone)�FirewallDConfigPolicy)�FirewallDConfigIPSet)�FirewallDConfigHelper)�IcmpType)�IPSet)�Helper)�LockdownWhitelist)�Direct)�dbus_to_python�command_of_sender�context_of_sender�
uid_of_sender� user_of_uid�%dbus_introspection_prepare_properties�!dbus_introspection_add_properties)�errors)�
FirewallErrorc s@ e Zd ZdZdZejjZe � fdd��Z
e dd� �Z e dd� �Z e d d
� �Z
e d d � �Ze d
d� �Ze dd� �Ze dd� �Ze dd� �Ze dd� �Ze dd� �Ze dd� �Ze dd � �Ze d d � �Ze d d � �Ze d!d"� �Ze d#d$� �Ze d%d&� �Ze d'd(� �Z e d)d*� �Z e d+d,� �Z e d-d.� �Z e d/d0� �Z e!d1d2� �Z"e!d3d4� �Z#e!d5d6� �Z$e%ej&d7d8d9�e!d�d;d<���Z'e%ej&d=d>d9�e!d�d?d@���Z(e)jj*j+ejj�e%ej&dAdB�e!d�dCdD����Z,ej-j.ej&dEdF�dGdH� �Z/e)jj*j+ejj0�e%ej1d=dI�e!d� fdJdK� ���Z2e%ejj3e4j5dI�e!d�dLdM���Z6e%ejj3e4j5dB�e!d�dNdO���Z7ej-j.ejj3�e!dPdQ� ��Z8e%ejj3d=dB�e!d�dRdS���Z9e%ejj3d=dB�e!d�dTdU���Z:e%ejj3d=dVd9�e!d�dWdX���Z;e%ejj3dYdI�e!d�dZd[���Z<e%ejj3d=dB�e!d�d\d]���Z=e%ejj3d=dB�e!d�d^d_���Z>e%ejj3d=dVd9�e!d�d`da���Z?e%ejj3dYdI�e!d�dbdc���Z@e%ejj3d=dB�e!d�ddde���ZAe%ejj3d=dB�e!d�dfdg���ZBe%ejj3d=dVd9�e!d�dhdi���ZCe%ejj3dYdI�e!d�djdk���ZDe%ejj3dldB�e!�d dmdn���ZEe%ejj3dldB�e!�ddodp���ZFe%ejj3dldVd9�e!�ddqdr���ZGe%ejj3dsdI�e!�ddtdu���ZHe%ejjIdvdI�e!�ddwdx���ZJe%ejjIdYdI�e!�ddydz���ZKe%ejjId=d{d9�e!�dd|d}���ZLe%ejjId=eMj5 d{d9�e!�dd~d���ZNej-j.ejjId=dF�e!d�d�� ��ZOe%ejjIdvdI�e!�dd�d����ZPe%ejjIdYdI�e!�d d�d����ZQe%ejjId=d{d9�e!�d
d�d����ZRe%ejjId=eSj5 d{d9�e!�d d�d����ZTej-j.ejjId=dF�e!d�d�� ��ZUe%ejjIdvdI�e!�d d�d����ZVe%ejjIdYdI�e!�d
d�d����ZWe%ejjId=d{d9�e!�dd�d����ZXe%ejjId�d{d9�e!�dd�d����ZYe%ejjId�d{d9�e!�dd�d����ZZej-j.ejjId=dF�e!d�d�� ��Z[e%ejjIdvdI�e!�dd�d����Z\e%ejjIdYdI�e!�dd�d����Z]e%ejjId=d{d9�e!�dd�d����Z^e%ejjId=d=d9�e!�dd�d����Z_e%ejjId=d=d9�e!�dd�d����Z`e%ejjId�d{d9�e!�dd�d����Zae%ejjId�d{d9�e!�dd�d����Zbej-j.ejjId=dF�e!d�d�� ��Zce%ejjIdvdI�e!�dd�d����Zde%ejjIdYdI�e!�dd�d����Zee%ejjId=d{d9�e!�dd�d����Zfe%ejjId�d{d9�e!�dd�d����Zgej-j.ejjId=dF�e!d�d�� ��Zhe%ejjIdvdI�e!�d d�d����Zie%ejjIdYdI�e!�d d�d����Zje%ejjId=d{d9�e!�d d�d����Zke%ejjId=elj5 d{d9�e!�d d�d����Zmej-j.ejjId=dF�e!d�d�� ��Zne%ejjoepj5dI�e!�d d�d����Zqe%ejjoepj5dB�e!�d!d�d��Zrej-j.ejjo�e!d�dĄ ��Zse%ejjod�dB�e!�d"d�dDŽ��Zte%ejjod�dB�e!�d#d�dɄ��Zue%ejjod�dVd9�e!�d$d�d˄��Zve%ejjod7dYd9�e!�d%d�d̈́��Zwe%ejjod�d�d9�e!�d&d�dф��Zxe%ejjod�dB�e!�d'd�dԄ��Zye%ejjod�dB�e!�d(d�dք��Zze%ejjod�dVd9�e!�d)d�d��Z{e%ejjod�dB�e!�d*d�dڄ��Z|e%ejjod�d�d9�e!�d+d�d݄��Z}e%ejjod�d�d9�e!�d,d�d���Z~e%ejjod�dB�e!�d-d�d���Ze%ejjod�dB�e!�d.d�d���Z�e%ejjod�dVd9�e!�d/d�d���Z�e%ejjod=d�d9�e!�d0d�d���Z�e%ejjod�dI�e!�d1d�d���Z�� Z�S (2 �FirewallDConfigzFirewallD main classTc s� t t| �j||� || _|d | _|d | _| j� t| jd�| _ | j j
tj � | j j
tj � | j j
tj
� | j j
tj� | j j
tj� | j j
tj� | j j
tj� | j j
tj� | j j
tj� | j j
tj� | j j
tj� | j j
tj� tjjtj��r>xBttjtj��D ].}dtj|f }tjj|��r | j j
|� �q W | j j tj � | j j tj � | j j tj � t | tj!j"ddddddddddddd� � d S )Nr � � z%s/%sZ readwrite) �
CleanupOnExit�CleanupModulesOnExit�
IPv6_rpfilter�Lockdown� MinimalMark�IndividualCalls� LogDenied�AutomaticHelpers�FirewallBackend�FlushAllOnReload� RFC3964_IPv4�AllowZoneDrifting)#�superr �__init__r �busname�path�
_init_varsr �
watch_updater�watcher�
add_watch_dir�FIREWALLD_IPSETS�ETC_FIREWALLD_IPSETS�FIREWALLD_ICMPTYPES�ETC_FIREWALLD_ICMPTYPES�FIREWALLD_HELPERS�ETC_FIREWALLD_HELPERS�FIREWALLD_SERVICES�ETC_FIREWALLD_SERVICES�FIREWALLD_ZONES�ETC_FIREWALLD_ZONES�FIREWALLD_POLICIES�ETC_FIREWALLD_POLICIES�os�exists�sorted�listdir�isdirZadd_watch_file�LOCKDOWN_WHITELIST�FIREWALLD_DIRECT�FIREWALLD_CONFr �dbus�DBUS_INTERFACE_CONFIG)�selfZconf�args�kwargs�filenamer0 )� __class__� � /usr/lib/python3.6/config.pyr. F sP
zFirewallDConfig.__init__c C s2 g | _ d| _g | _d| _g | _d| _g | _d| _g | _d| _ g | _
d| _ x$| j j
� D ]}| j| j j|�� qTW x$| j j� D ]}| j| j j|�� qzW x$| j j� D ]}| j| j j|�� q�W x$| j j� D ]}| j| j j|�� q�W x$| j j� D ]}| j| j j|�� q�W x&| j j � D ]}| j | j j |�� �qW d S )Nr ) �ipsets� ipset_idx� icmptypes� icmptype_idx�services� service_idx�zones�zone_idx�helpers�
helper_idx�policy_objects�policy_object_idxr Z
get_ipsets� _addIPSetZ get_ipsetZ
get_icmptypes� _addIcmpTypeZ get_icmptypeZ get_services� _addServiceZ get_serviceZ get_zones�_addZoneZget_zoneZ get_helpers�
_addHelperZ
get_helperZget_policy_objects�
_addPolicyZget_policy_object)rK �ipset�icmptype�service�zone�helper�policyrP rP rQ r1 t s0 zFirewallDConfig._init_varsc C s d S )NrP )rK rP rP rQ �__del__� s zFirewallDConfig.__del__c C s� x&t | j�dkr&| jj� }|j� ~qW x&t | j�dkrN| jj� }|j� ~q*W x&t | j�dkrv| jj� }|j� ~qRW x&t | j�dkr�| jj� }|j� ~qzW x&t | j�dkr�| jj� }|j� ~q�W x&t | j�dkr�| jj� }|j� ~q�W | j � d S )Nr )
�lenrR �pop�
unregisterrT rV rX rZ r\ r1 )rK �itemrP rP rQ �reload� s2
zFirewallDConfig.reloadc C sJ |t jkr�| jt jj�}tjdt j� y| j j� W n2 tk
rf } ztj d||f � d S d }~X nX | jt jj�j
� }x2t |j � �D ]"}||kr�|| || kr�||= q�W t
|�dkr�| jt jj|g � d S |jt j�s�|jt j�o�|jd��r�y| j j|�\}}W n4 tk
�r< } ztj d||f � d S d }~X nX |dk�rT| j|� n*|dk�rj| j|� n|dk�rF| j|� �n�|jt j��s�|jt j��r8|jd��r8y| j j|�\}}W n4 tk
�r� } ztj d ||f � d S d }~X nX |dk�r
| j|� n*|dk�r | j|� n|dk�rF| j |� �n|jt j ��sT|jt j ��rr|jd��r�y| j j |�\}}W n4 tk
�r� } ztj d
||f � d S d }~X nX |dk�r�| j |� n*|dk�r�| j!|� n|dk�rn| j"|� n�|jt j ��rF|j#t j d �j$d �}t
|�d
k �s&d |k�r*d S t%j&j'|��rT| j(j)|��sn| j(j*|� n| j(j)|��rF| j(j+|� �n�|jt j,��s�|jt j-��r(|jd��r(y| j j.|�\}}W n4 tk
�r� } ztj d||f � d S d }~X nX |dk�r�| j/|� n*|dk�r| j0|� n|dk�rF| j1|� �n |jt j2��sD|jt j3��r�|jd��r�y| j j4|�\}}W n4 tk
�r� } ztj d||f � d S d }~X nX |dk�r�| j5|� n*|dk�r�| j6|� n|dk�rF| j7|� �nh|t j8k�r:y| j j9� W n4 tk
�r, } ztj d||f � d S d }~X nX | j:� �n |t j;k�r�y| j j<� W n4 tk
�r� } ztj d||f � d S d }~X nX | j=� n�|jt j>��s�|jt j?��rF|jd��rFy| j j@|�\}}W n4 tk
�r } ztj d||f � d S d }~X nX |dk�r | jA|� n*|dk�r2| jB|� n|dk�rF| jC|� d S )Nz,config: Reloading firewalld config file '%s'z+Failed to load firewalld.conf file '%s': %sr z.xmlz%Failed to load icmptype file '%s': %s�new�remove�updatez$Failed to load service file '%s': %sz!Failed to load zone file '%s': %s� �/r z"Failed to load ipset file '%s': %sz#Failed to load helper file '%s': %sz/Failed to load lockdown whitelist file '%s': %sz)Failed to load direct rules file '%s': %sz#Failed to load policy file '%s': %s)Dr rH �GetAllrI rJ r �debug1Zupdate_firewalld_conf� Exception�error�copy�list�keysrk �PropertiesChanged�
startswithr7 r8 �endswithZupdate_icmptype_from_pathr_ �removeIcmpType�_updateIcmpTyper; r< Zupdate_service_from_pathr` �
removeService�_updateServicer= r> Zupdate_zone_from_pathra �
removeZone� _updateZone�replace�striprA r0 rE r3 Z has_watchr4 Z remove_watchr5 r6 Zupdate_ipset_from_pathr^ � removeIPSet� _updateIPSetr9 r: Zupdate_helper_from_pathrb � removeHelper�
_updateHelperrF Zupdate_lockdown_whitelist�LockdownWhitelistUpdatedrG Z
update_direct�Updatedr? r@ Z update_policy_object_from_pathrc � removePolicy�
_updatePolicy) rK �nameZ old_props�msgZprops�keyZwhat�obj�_namerP rP rQ r2 � s
z FirewallDConfig.watch_updaterc C sP t | | j|| j| jdtjj| jf �}| jj|� | jd7 _| j|j � |S )Nz%s/%dr )
r
r rU r/ rI ZDBUS_PATH_CONFIG_ICMPTYPErT �append�
IcmpTypeAddedr� )rK r� �config_icmptyperP rP rQ r_ A s z FirewallDConfig._addIcmpTypec C sP xJ| j D ]@}|jj|jkr|jj|jkr|jj|jkr||_|j|j� qW d S )N)rT r� r� r0 rN r� )rK r� re rP rP rQ r� M s z FirewallDConfig._updateIcmpTypec C s� d}xT| j D ]J}|j� }|j|| kr || j|j� | jj|j|�|_|j|jj� q W x\| jD ]R}|j� }d|krb|j|d krb|d j|j� | jj |j|�|_|j|jj� qbW x:| j
D ]0}|j|kr�|j |j� |j � | j
j|� ~q�W d S )N� Z icmp_blocks)
rX � getSettingsr� rq r �set_zone_configr� r� r\ � set_policy_object_config_dictrT �Removedrm )rK r� �indexrg �settingsri re rP rP rQ r V s&
z FirewallDConfig.removeIcmpTypec C sP t | | j|| j| jdtjj| jf �}| jj|� | jd7 _| j|j � |S )Nz%s/%dr )
r r rW r/ rI ZDBUS_PATH_CONFIG_SERVICErV r� � ServiceAddedr� )rK r� �config_servicerP rP rQ r` p s zFirewallDConfig._addServicec C sP xJ| j D ]@}|jj|jkr|jj|jkr|jj|jkr||_|j|j� qW d S )N)rV r� r� r0 rN r� )rK r� rf rP rP rQ r� { s z FirewallDConfig._updateServicec C s� d}xT| j D ]J}|j� }|j|| kr || j|j� | jj|j|�|_|j|jj� q W x\| jD ]R}|j� }d|krb|j|d krb|d j|j� | jj |j|�|_|j|jj� qbW x:| j
D ]0}|j|kr�|j |j� |j � | j
j|� ~q�W d S )Nr rV )
rX r� r� rq r r� r� r� r\ r� rV r� rm )rK r� r� rg r� ri rf rP rP rQ r� � s&
z FirewallDConfig.removeServicec C sP t | | j|| j| jdtjj| jf �}| jj|� | jd7 _| j|j � |S )Nz%s/%dr )
r r rY r/ rI ZDBUS_PATH_CONFIG_ZONErX r� � ZoneAddedr� )rK r� � config_zonerP rP rQ ra � s zFirewallDConfig._addZonec C sP xJ| j D ]@}|jj|jkr|jj|jkr|jj|jkr||_|j|j� qW d S )N)rX r� r� r0 rN r� )rK r� rg rP rP rQ r� � s
zFirewallDConfig._updateZonec C s@ x:| j D ]0}|j|kr|j|j� |j� | j j|� ~qW d S )N)rX r� r� r� rm rq )rK r� rg rP rP rQ r� � s
zFirewallDConfig.removeZonec C sP t | | j|| j| jdtjj| jf �}| jj|� | jd7 _| j|j � |S )Nz%s/%dr )
r
r r] r/ rI ZDBUS_PATH_CONFIG_POLICYr\ r� � PolicyAddedr� )rK r� �
config_policyrP rP rQ rc � s zFirewallDConfig._addPolicyc C sP xJ| j D ]@}|jj|jkr|jj|jkr|jj|jkr||_|j|j� qW d S )N)r\ r� r� r0 rN r� )rK r� ri rP rP rQ r� � s
z FirewallDConfig._updatePolicyc C s@ x:| j D ]0}|j|kr|j|j� |j� | j j|� ~qW d S )N)r\ r� r� r� rm rq )rK r� ri rP rP rQ r� � s
z FirewallDConfig.removePolicyc C sP t | | j|| j| jdtjj| jf �}| jj|� | jd7 _| j|j � |S )Nz%s/%dr )
r r rS r/ rI ZDBUS_PATH_CONFIG_IPSETrR r� �
IPSetAddedr� )rK r� � config_ipsetrP rP rQ r^ � s zFirewallDConfig._addIPSetc C sP xJ| j D ]@}|jj|jkr|jj|jkr|jj|jkr||_|j|j� qW d S )N)rR r� r� r0 rN r� )rK r� rd rP rP rQ r� � s
z FirewallDConfig._updateIPSetc C s@ x:| j D ]0}|j|kr|j|j� |j� | j j|� ~qW d S )N)rR r� r� r� rm rq )rK r� rd rP rP rQ r� � s
zFirewallDConfig.removeIPSetc C sP t | | j|| j| jdtjj| jf �}| jj|� | jd7 _| j|j � |S )Nz%s/%dr )
r r r[ r/ rI ZDBUS_PATH_CONFIG_HELPERrZ r� � HelperAddedr� )rK r� �
config_helperrP rP rQ rb � s zFirewallDConfig._addHelperc C sP xJ| j D ]@}|jj|jkr|jj|jkr|jj|jkr||_|j|j� qW d S )N)rZ r� r� r0 rN r� )rK r� rh rP rP rQ r� � s
z FirewallDConfig._updateHelperc C s@ x:| j D ]0}|j|kr|j|j� |j� | j j|� ~qW d S )N)rZ r� r� r� rm rq )rK r� rh rP rP rQ r� s
z FirewallDConfig.removeHelperc C s� | j j� r�|d kr tjd� d S tj� }t||�}| j jd|�rDd S t||�}| j jd|�r`d S t |�}| j jd|�rzd S t
||�}| j jd|�r�d S t t j
d��d S )Nz&Lockdown not possible, sender not set.�context�uid�user�commandzlockdown is enabled)r Zlockdown_enabledr rx rI Z SystemBusr Z access_checkr r r r r Z
ACCESS_DENIED)rK �senderZbusr� r� r� r� rP rP rQ � accessCheck s$
zFirewallDConfig.accessCheckc C sF |dkrt jjd| ��| jj� j|�}|dkrH|d kr>tj}t j|�S |dkrr|d kr`tj}nt |�}t j
|�S |dkr�|d kr�tj r�dnd}t j|�S |dkr�|d kr�tj r�dnd}t j|�S |dk� r�|d k� r�tj
� r�dnd}t j|�S |dk�r |d k�rtj�rdnd}t j|�S |dk�rL|d k�rBtj�r>dnd}t j|�S |dk�rp|d k�rftj}t j|�S |d k�r�|d k�r�tj}t j|�S |d
k�r�|d k�r�tj}t j|�S |d k�r�|d k�r�tj�r�dnd}t j|�S |d k�r|d k�r
tj�rdnd}t j|�S |d
k�rB|d k�r8tj�r4dnd}t j|�S d S )N� DefaultZoner% r! r" r$ r# r& r' r( r) r* r+ r, zDorg.freedesktop.DBus.Error.InvalidArgs: Property '%s' does not exist�yes�no)
r� r% r! r" r$ r# r& r' r( r) r* r+ r, )rI �
exceptions�
DBusExceptionr �get_firewalld_conf�getZ
FALLBACK_ZONE�StringZFALLBACK_MINIMAL_MARK�int�Int32ZFALLBACK_CLEANUP_ON_EXITZ FALLBACK_CLEANUP_MODULES_ON_EXITZFALLBACK_LOCKDOWNZFALLBACK_IPV6_RPFILTERZFALLBACK_INDIVIDUAL_CALLSZFALLBACK_LOG_DENIEDZFALLBACK_AUTOMATIC_HELPERSZFALLBACK_FIREWALL_BACKENDZ FALLBACK_FLUSH_ALL_ON_RELOADZFALLBACK_RFC3964_IPV4Z FALLBACK_ALLOW_ZONE_DRIFTING)rK �prop�valuerP rP rQ �
_get_property+ s|
z FirewallDConfig._get_propertyc C sT |dkrt j| j|��S |dkr0t j| j|��S |dkrHt j| j|��S |dkr`t j| j|��S |dkrxt j| j|��S |dkr�t j| j|��S |dkr�t j| j|��S |dkr�t j| j|��S |d kr�t j| j|��S |d
k� r�t j| j|��S |d k�r t j| j|��S |d k�r&t j| j|��S |d
k�r@t j| j|��S t jjd| ��d S )Nr� r% r! r" r$ r# r& r' r( r) r* r+ r, zDorg.freedesktop.DBus.Error.InvalidArgs: Property '%s' does not exist)rI r� r� r� r� r� )rK r� rP rP rQ �_get_dbus_propertyo s:
z"FirewallDConfig._get_dbus_propertyZss�v)� in_signature�
out_signatureNc C sx t |t�}t |t�}tjd||� |tjjkr8| j|�S |tjjtjj gkr^tj
j d| ��ntj
j d| ��| j|�S )Nzconfig.Get('%s', '%s')zDorg.freedesktop.DBus.Error.InvalidArgs: Property '%s' does not existzJorg.freedesktop.DBus.Error.UnknownInterface: Interface '%s' does not exist) r �strr rv r rI rJ r� � DBUS_INTERFACE_CONFIG_DIRECT� DBUS_INTERFACE_CONFIG_POLICIESr� r� )rK �interface_name�
property_namer� rP rP rQ �Get� s
zFirewallDConfig.Get�sza{sv}c
C sx t |t�}tjd|� i }|tjjkrDxBdD ]}| j|�||< q,W n&|tjjtjj gkrZntj
j d| ��tj |dd�S )Nzconfig.GetAll('%s')r� r% r! r" r$ r# r& r' r( r) r* r+ r, zJorg.freedesktop.DBus.Error.UnknownInterface: Interface '%s' does not existZsv)� signature)
r� r% r! r" r$ r# r& r' r( r) r* r+ r, )
r r� r rv r rI rJ r� r� r� r� r� Z
Dictionary)rK r� r� �ret�xrP rP rQ ru � s"
zFirewallDConfig.GetAllZssv)r� c C s� t |t�}t |t�}t |�}tjd|||� | j|� |tjjk�r�|dk�rz|dkrv|j� dkrvt t
j d||f ��|dkr�|tj kr�t t
j d||f ��|dkr�|tj
kr�t t
j d||f ��|d k� r�|j� dk� r�t t
j d||f ��|d
k�r|j� dk�rt t
j d||f ��|d k�rF|j� dk�rFt t
j d||f ��| jj� j||� | jj� j� | j|||ig � n |dk�r�ntjjd| ��n8|tjjtjjgk�r�tjjd| ��ntjjd| ��d S ) Nz config.Set('%s', '%s', '%s')r! r$ r" r# r& r' r) r* r+ r, r� r� �true�falsez '%s' for %sr% r( zDorg.freedesktop.DBus.Error.InvalidArgs: Property '%s' does not existzJorg.freedesktop.DBus.Error.UnknownInterface: Interface '%s' does not exist)
r! r$ r" r# r& r' r) r* r+ r, )r! r$ r" r# r& )r� r� r� r� )r� r� r� r� )r� r� r� r� )r� r� r� r� )r% r( )r r� r rv r� r rI rJ �lowerr r Z
INVALID_VALUEZLOG_DENIED_VALUESZFIREWALL_BACKEND_VALUESr� �set�writer| r� r� r� r� )rK r� r� Z new_valuer� rP rP rQ �Set� sz
zFirewallDConfig.Setzsa{sv}as)r� c C s. t |t�}t |�}t |�}tjd|||� d S )Nz*config.PropertiesChanged('%s', '%s', '%s'))r r� r rv )rK r� Zchanged_propertiesZinvalidated_propertiesrP rP rQ r| s
z!FirewallDConfig.PropertiesChanged)r� c s4 t jd� tt| �j| j| jj� �}t| |t j
j �S )Nzconfig.Introspect()) r Zdebug2r- r �
Introspectr0 r/ Zget_busr r rI rJ )rK r� �data)rO rP rQ r� s
zFirewallDConfig.Introspectc C s t jd� | jj� jj� S )Nz&config.policies.getLockdownWhitelist())r rv r � get_policies�lockdown_whitelist�
export_config)rK r� rP rP rQ �getLockdownWhitelist s
z$FirewallDConfig.getLockdownWhitelistc C s@ t jd� t|�}| jj� jj|� | jj� jj� | j� d S )Nz)config.policies.setLockdownWhitelist(...)) r rv r r r� r� �
import_configr� r� )rK r� r� rP rP rQ �setLockdownWhitelist& s
z$FirewallDConfig.setLockdownWhitelistc C s t jd� d S )Nz*config.policies.LockdownWhitelistUpdated())r rv )rK rP rP rQ r� 0 s z(FirewallDConfig.LockdownWhitelistUpdatedc C s^ t |�}tjd|� | j|� t| j� �}||d krBttj|��|d j |� | j
|� d S )Nz1config.policies.addLockdownWhitelistCommand('%s')r ) r r rv r� rz r� r r �ALREADY_ENABLEDr� r� )rK r� r� r� rP rP rQ �addLockdownWhitelistCommand7 s
z+FirewallDConfig.addLockdownWhitelistCommandc C s^ t |�}tjd|� | j|� t| j� �}||d krBttj|��|d j |� | j
|� d S )Nz4config.policies.removeLockdownWhitelistCommand('%s')r ) r r rv r� rz r� r r � NOT_ENABLEDrq r� )rK r� r� r� rP rP rQ � removeLockdownWhitelistCommandD s
z.FirewallDConfig.removeLockdownWhitelistCommand�bc C s$ t |�}tjd|� || j� d kS )Nz3config.policies.queryLockdownWhitelistCommand('%s')r )r r rv r� )rK r� r� rP rP rQ � queryLockdownWhitelistCommandR s z-FirewallDConfig.queryLockdownWhitelistCommand�asc C s t jd� | j� d S )Nz.config.policies.getLockdownWhitelistCommands()r )r rv r� )rK r� rP rP rQ � getLockdownWhitelistCommands[ s
z,FirewallDConfig.getLockdownWhitelistCommandsc C s^ t |�}tjd|� | j|� t| j� �}||d krBttj|��|d j |� | j
|� d S )Nz1config.policies.addLockdownWhitelistContext('%s')r ) r r rv r� rz r� r r r� r� r� )rK r� r� r� rP rP rQ �addLockdownWhitelistContextd s
z+FirewallDConfig.addLockdownWhitelistContextc C s^ t |�}tjd|� | j|� t| j� �}||d krBttj|��|d j |� | j
|� d S )Nz4config.policies.removeLockdownWhitelistContext('%s')r ) r r rv r� rz r� r r r� rq r� )rK r� r� r� rP rP rQ � removeLockdownWhitelistContextq s
z.FirewallDConfig.removeLockdownWhitelistContextc C s$ t |�}tjd|� || j� d kS )Nz3config.policies.queryLockdownWhitelistContext('%s')r )r r rv r� )rK r� r� rP rP rQ � queryLockdownWhitelistContext s z-FirewallDConfig.queryLockdownWhitelistContextc C s t jd� | j� d S )Nz.config.policies.getLockdownWhitelistContexts()r )r rv r� )rK r� rP rP rQ � getLockdownWhitelistContexts� s
z,FirewallDConfig.getLockdownWhitelistContextsc C s^ t |�}tjd|� | j|� t| j� �}||d krBttj|��|d j |� | j
|� d S )Nz.config.policies.addLockdownWhitelistUser('%s')� ) r r rv r� rz r� r r r� r� r� )rK r� r� r� rP rP rQ �addLockdownWhitelistUser� s
z(FirewallDConfig.addLockdownWhitelistUserc C s^ t |�}tjd|� | j|� t| j� �}||d krBttj|��|d j |� | j
|� d S )Nz1config.policies.removeLockdownWhitelistUser('%s')r� ) r r rv r� rz r� r r r� rq r� )rK r� r� r� rP rP rQ �removeLockdownWhitelistUser� s
z+FirewallDConfig.removeLockdownWhitelistUserc C s$ t |�}tjd|� || j� d kS )Nz0config.policies.queryLockdownWhitelistUser('%s')r� )r r rv r� )rK r� r� rP rP rQ �queryLockdownWhitelistUser� s z*FirewallDConfig.queryLockdownWhitelistUserc C s t jd� | j� d S )Nz+config.policies.getLockdownWhitelistUsers()r� )r rv r� )rK r� rP rP rQ �getLockdownWhitelistUsers� s
z)FirewallDConfig.getLockdownWhitelistUsers�ic C s^ t |�}tjd|� | j|� t| j� �}||d krBttj|��|d j |� | j
|� d S )Nz+config.policies.addLockdownWhitelistUid(%d)� ) r r rv r� rz r� r r r� r� r� )rK r� r� r� rP rP rQ �addLockdownWhitelistUid� s
z'FirewallDConfig.addLockdownWhitelistUidc C s^ t |�}tjd|� | j|� t| j� �}||d krBttj|��|d j |� | j
|� d S )Nz.config.policies.removeLockdownWhitelistUid(%d)r� ) r r rv r� rz r� r r r� rq r� )rK r� r� r� rP rP rQ �removeLockdownWhitelistUid� s
z*FirewallDConfig.removeLockdownWhitelistUidc C s$ t |�}tjd|� || j� d kS )Nz-config.policies.queryLockdownWhitelistUid(%d)r� )r r rv r� )rK r� r� rP rP rQ �queryLockdownWhitelistUid� s z)FirewallDConfig.queryLockdownWhitelistUidZaic C s t jd� | j� d S )Nz*config.policies.getLockdownWhitelistUids()r� )r rv r� )rK r� rP rP rQ �getLockdownWhitelistUids� s
z(FirewallDConfig.getLockdownWhitelistUidsZaoc C s t jd� | jS )z"list ipsets objects paths
zconfig.listIPSets())r rv rR )rK r� rP rP rQ �
listIPSets� s
zFirewallDConfig.listIPSetsc C s4 t jd� g }x | jD ]}|j|jj� qW t|�S )zget ipset names
zconfig.getIPSetNames())r rv rR r� r� r� rC )rK r� rR r� rP rP rQ �
getIPSetNames� s
z FirewallDConfig.getIPSetNames�oc C sF t |t�}tjd|� x | jD ]}|jj|kr |S q W ttj |��dS )z-object path of ipset with given name
zconfig.getIPSetByName('%s')N)
r r� r rv rR r� r� r r Z
INVALID_IPSET)rK rd r� r� rP rP rQ �getIPSetByName� s
z FirewallDConfig.getIPSetByNamec C sD t |t�}t |�}tjd|� | j|� | jj||�}| j|�}|S )z/add ipset with given name and settings
zconfig.addIPSet('%s'))r r� r rv r� r Z new_ipsetr^ )rK rd r� r� r� r� rP rP rQ �addIPSet s
zFirewallDConfig.addIPSetc C s t |t�}tjd| � d S )Nzconfig.IPSetAdded('%s'))r r� r rv )rK rd rP rP rQ r� s
zFirewallDConfig.IPSetAddedc C s t jd� | jS )z%list icmptypes objects paths
zconfig.listIcmpTypes())r rv rT )rK r� rP rP rQ �
listIcmpTypes s
z FirewallDConfig.listIcmpTypesc C s4 t jd� g }x | jD ]}|j|jj� qW t|�S )zget icmptype names
zconfig.getIcmpTypeNames())r rv rT r� r� r� rC )rK r� rT r� rP rP rQ �getIcmpTypeNames( s
z FirewallDConfig.getIcmpTypeNamesc C sF t |t�}tjd|� x | jD ]}|jj|kr |S q W ttj |��dS )z0object path of icmptype with given name
z config.getIcmpTypeByName('%s')N)
r r� r rv rT r� r� r r ZINVALID_ICMPTYPE)rK re r� r� rP rP rQ �getIcmpTypeByName3 s
z!FirewallDConfig.getIcmpTypeByNamec C sD t |t�}t |�}tjd|� | j|� | jj||�}| j|�}|S )z2add icmptype with given name and settings
zconfig.addIcmpType('%s'))r r� r rv r� r Z new_icmptyper_ )rK re r� r� r� r� rP rP rQ � addIcmpType@ s
zFirewallDConfig.addIcmpTypec C s t jd| � d S )Nzconfig.IcmpTypeAdded('%s'))r rv )rK re rP rP rQ r� O s z FirewallDConfig.IcmpTypeAddedc C s t jd� | jS )z$list services objects paths
zconfig.listServices())r rv rV )rK r� rP rP rQ � listServicesV s
z FirewallDConfig.listServicesc C s4 t jd� g }x | jD ]}|j|jj� qW t|�S )zget service names
zconfig.getServiceNames())r rv rV r� r� r� rC )rK r� rV r� rP rP rQ �getServiceNames^ s
z FirewallDConfig.getServiceNamesc C sF t |t�}tjd|� x | jD ]}|jj|kr |S q W ttj |��dS )z/object path of service with given name
z config.getServiceByName('%s')N)
r r� r rv rV r� r� r r ZINVALID_SERVICE)rK rf r� r� rP rP rQ �getServiceByNamei s
z FirewallDConfig.getServiceByNamezs(sssa(ss)asa{ss}asa(ss))c C sD t |t�}t |�}tjd|� | j|� | jj||�}| j|�}|S )z1add service with given name and settings
zconfig.addService('%s'))r r� r rv r� r Z new_servicer` )rK rf r� r� r� r� rP rP rQ �
addServicev s
zFirewallDConfig.addServicezsa{sv}c C sD t |t�}t |�}tjd|� | j|� | jj||�}| j|�}|S )z1add service with given name and settings
zconfig.addService2('%s'))r r� r rv r� r Znew_service_dictr` )rK rf r� r� r� r� rP rP rQ � addService2� s
zFirewallDConfig.addService2c C s t jd| � d S )Nzconfig.ServiceAdded('%s'))r rv )rK rf rP rP rQ r� � s z FirewallDConfig.ServiceAddedc C s t jd� | jS )z!list zones objects paths
zconfig.listZones())r rv rX )rK r� rP rP rQ � listZones� s
zFirewallDConfig.listZonesc C s4 t jd� g }x | jD ]}|j|jj� qW t|�S )zget zone names
zconfig.getZoneNames())r rv rX r� r� r� rC )rK r� rX r� rP rP rQ � getZoneNames� s
z FirewallDConfig.getZoneNamesc C sF t |t�}tjd|� x | jD ]}|jj|kr |S q W ttj |��dS )z,object path of zone with given name
zconfig.getZoneByName('%s')N)
r r� r rv rX r� r� r r Z INVALID_ZONE)rK rg r� r� rP rP rQ �
getZoneByName� s
z FirewallDConfig.getZoneByNamec C sz t |t�}tjd|� g }x(| jD ] }||jjkr"|j|jj� q"W t |�dkrjdj
|�d|t |�f S |rv|d S dS )z4name of zone the given interface belongs to
z config.getZoneOfInterface('%s')r � zE (ERROR: interface '%s' is in %s zone XML files, can be only in one)r rs ) r r� r rv rX r� Z
interfacesr� r� rk �join)rK Zifacer� r� r� rP rP rQ �getZoneOfInterface� s
z"FirewallDConfig.getZoneOfInterfacec C sz t |t�}tjd|� g }x(| jD ] }||jjkr"|j|jj� q"W t |�dkrjdj
|�d|t |�f S |rv|d S dS )z1name of zone the given source belongs to
z config.getZoneOfSource('%s')r r� zB (ERROR: source '%s' is in %s zone XML files, can be only in one)r rs ) r r� r rv rX r� Zsourcesr� r� rk r )rK �sourcer� r� r� rP rP rQ �getZoneOfSource� s
z FirewallDConfig.getZoneOfSourcez's(sssbsasa(ss)asba(ssss)asasasasa(ss)b)c C sh t |t�}t |�}tjd|� | j|� |d dkrLt|�}t|d< t|�}| jj ||�}| j
|�}|S )z.add zone with given name and settings
zconfig.addZone('%s')� �default) r r� r rv r� rz r �tupler Znew_zonera )rK rg r� r� Z _settingsr� r� rP rP rQ �addZone� s
zFirewallDConfig.addZonec C s` t |t�}t |�}tjd|� | j|� d|krD|d dkrDt|d< | jj||�}| j|�}|S )z.add zone with given name and settings
zconfig.addZone('%s')�targetr ) r r� r rv r� r r Z
new_zone_dictra )rK rg r� r� r� r� rP rP rQ �addZone2� s
zFirewallDConfig.addZone2c C s t jd| � d S )Nzconfig.ZoneAdded('%s'))r rv )rK rg rP rP rQ r� s zFirewallDConfig.ZoneAddedc C s t jd� | jS )z$list policies objects paths
zconfig.listPolicies())r rv r\ )rK r� rP rP rQ � listPolicies s
z FirewallDConfig.listPoliciesc C s4 t jd� g }x | jD ]}|j|jj� qW t|�S )zget policy names
zconfig.getPolicyNames())r rv r\ r� r� r� rC )rK r� Zpoliciesr� rP rP rQ �getPolicyNames s
z FirewallDConfig.getPolicyNamesc C sF t |t�}tjd|� x | jD ]}|jj|kr |S q W ttj |��dS )z.object path of policy with given name
z config.getPolicyByName('%s')N)
r r� r rv r\ r� r� r r ZINVALID_POLICY)rK ri r� r� rP rP rQ �getPolicyByName" s
z FirewallDConfig.getPolicyByNamec C sD t |t�}t |�}tjd|� | j|� | jj||�}| j|�}|S )z0add policy with given name and settings
zconfig.addPolicy('%s'))r r� r rv r� r Znew_policy_object_dictrc )rK ri r� r� r� r� rP rP rQ � addPolicy/ s
zFirewallDConfig.addPolicyc C s t jd| � d S )Nzconfig.PolicyAdded('%s'))r rv )rK ri rP rP rQ r� > s zFirewallDConfig.PolicyAddedc C s t jd� | jS )z#list helpers objects paths
zconfig.listHelpers())r rv rZ )rK r� rP rP rQ � listHelpersG s
zFirewallDConfig.listHelpersc C s4 t jd� g }x | jD ]}|j|jj� qW t|�S )zget helper names
zconfig.getHelperNames())r rv rZ r� r� r� rC )rK r� rZ r� rP rP rQ �getHelperNamesO s
z FirewallDConfig.getHelperNamesc C sF t |t�}tjd|� x | jD ]}|jj|kr |S q W ttj |��dS )z.object path of helper with given name
z config.getHelperByName('%s')N)
r r� r rv rZ r� r� r r ZINVALID_HELPER)rK rh r� r� rP rP rQ �getHelperByNameZ s
z FirewallDConfig.getHelperByNamec C sD t |t�}t |�}tjd|� | j|� | jj||�}| j|�}|S )z0add helper with given name and settings
zconfig.addHelper('%s'))r r� r rv r� r Z
new_helperrb )rK rh r� r� r� r� rP rP rQ � addHelperg s
zFirewallDConfig.addHelperc C s t |t�}tjd| � d S )Nzconfig.HelperAdded('%s'))r r� r rv )rK rh rP rP rQ r� v s
zFirewallDConfig.HelperAddedc C s t jd� | jj� j� S )Nzconfig.direct.getSettings())r rv r �
get_directr� )rK r� rP rP rQ r� s
zFirewallDConfig.getSettingsc C s< t jd� t|�}| jj� j|� | jj� j� | j� d S )Nzconfig.direct.update())r rv r r r r� r� r� )rK r� r� rP rP rQ rr � s
zFirewallDConfig.updatec C s t jd� d S )Nzconfig.direct.Updated())r rv )rK rP rP rQ r� � s zFirewallDConfig.UpdatedZsssc C s� t |�}t |�}t |�}tjd|||f � | j|� t|||f�}t| j� �}||d krrttj d|||f ��|d j
|� | j |� d S )Nz(config.direct.addChain('%s', '%s', '%s')r z chain '%s' already is in '%s:%s') r r rv r� r rz r� r r r� r� rr )rK �ipv�table�chainr� �idxr� rP rP rQ �addChain� s
zFirewallDConfig.addChainc C s� t |�}t |�}t |�}tjd|||f � | j|� t|||f�}t| j� �}||d krrttj d|||f ��|d j
|� | j |� d S )Nz+config.direct.removeChain('%s', '%s', '%s')r z chain '%s' is not in '%s:%s') r r rv r� r rz r� r r r� rq rr )rK r r r r� r r� rP rP rQ � removeChain� s
zFirewallDConfig.removeChainc C sJ t |�}t |�}t |�}tjd|||f � t|||f�}|| j� d kS )Nz*config.direct.queryChain('%s', '%s', '%s')r )r r rv r r� )rK r r r r� r rP rP rQ �
queryChain� s zFirewallDConfig.queryChainc C sf t |�}t |�}tjd||f � g }x:| j� d D ]*}|d |kr4|d |kr4|j|d � q4W |S )Nz#config.direct.getChains('%s', '%s')r r r� )r r rv r� r� )rK r r r� r� r rP rP rQ � getChains� s zFirewallDConfig.getChainsrs za(sss)c C s t jd� | j� d S )Nz config.direct.getAllChains()r )r rv r� )rK r� rP rP rQ � getAllChains� s
z FirewallDConfig.getAllChainsZsssiasc C s� t |�}t |�}t |�}t |�}t |�}tjd||||dj|�f � | j|� |||||f}t| j� �}||d kr�ttj d||||f ��|d j
|� | j t |�� d S )Nz1config.direct.addRule('%s', '%s', '%s', %d, '%s')z','r z"rule '%s' already is in '%s:%s:%s')
r r rv r r� rz r� r r r� r� rr r ) rK r r r �priorityrL r� r r� rP rP rQ �addRule� s
zFirewallDConfig.addRulec C s� t |�}t |�}t |�}t |�}t |�}tjd||||dj|�f � | j|� |||||f}t| j� �}||d kr�ttj d||||f ��|d j
|� | j t |�� d S )Nz4config.direct.removeRule('%s', '%s', '%s', %d, '%s')z','r z rule '%s' is not in '%s:%s:%s')
r r rv r r� rz r� r r r� rq rr r ) rK r r r r rL r� r r� rP rP rQ �
removeRule� s
zFirewallDConfig.removeRulec C sd t |�}t |�}t |�}t |�}t |�}tjd||||dj|�f � |||||f}|| j� d kS )Nz3config.direct.queryRule('%s', '%s', '%s', %d, '%s')z','r )r r rv r r� )rK r r r r rL r� r rP rP rQ � queryRule s zFirewallDConfig.queryRulec C s� t |�}t |�}t |�}tjd|||f � | j|� t| j� �}xF|d d d � D ]2}|||f|d |d |d fkrT|d j|� qTW | jt|�� d S )Nz+config.direct.removeRules('%s', '%s', '%s')r r r� ) r r rv r� rz r� rq rr r )rK r r r r� r� ZrulerP rP rQ � removeRules s
zFirewallDConfig.removeRulesza(ias)c C s� t |�}t |�}t |�}tjd|||f � g }xN| j� d D ]>}|d |kr>|d |kr>|d |kr>|j|d |d f� q>W |S )Nz(config.direct.getRules('%s', '%s', '%s')r r r� r� r )r r rv r� r� )rK r r r r� r� r rP rP rQ �getRules) s $zFirewallDConfig.getRulesz a(sssias)c C s t jd� | j� d S )Nzconfig.direct.getAllRules()r )r rv r� )rK r� rP rP rQ � getAllRules8 s
zFirewallDConfig.getAllRulesZsasc C s� t |�}t |�}tjd|dj|�f � | j|� ||f}t| j� �}||d krfttj d||f ��|d j
|� | j |� d S )Nz(config.direct.addPassthrough('%s', '%s')z','r� zpassthrough '%s', '%s') r r rv r r� rz r� r r r� r� rr )rK r rL r� r r� rP rP rQ �addPassthroughA s
z FirewallDConfig.addPassthroughc C s� t |�}t |�}tjd|dj|�f � | j|� ||f}t| j� �}||d krfttj d||f ��|d j
|� | j |� d S )Nz+config.direct.removePassthrough('%s', '%s')z','r� zpassthrough '%s', '%s') r r rv r r� rz r� r r r� rq rr )rK r rL r� r r� rP rP rQ �removePassthroughS s
z!FirewallDConfig.removePassthroughc C s@ t |�}t |�}tjd|dj|�f � ||f}|| j� d kS )Nz*config.direct.queryPassthrough('%s', '%s')z','r� )r r rv r r� )rK r rL r� r rP rP rQ �queryPassthroughd s z FirewallDConfig.queryPassthroughZaasc C sN t |�}tjd| � g }x.| j� d D ] }|d |kr(|j|d � q(W |S )Nz#config.direct.getPassthroughs('%s')r� r r )r r rv r� r� )rK r r� r� r rP rP rQ �getPassthroughso s z FirewallDConfig.getPassthroughsza(sas)c C s t jd� | j� d S )Nz"config.direct.getAllPassthroughs()r� )r rv r� )rK r� rP rP rQ �getAllPassthroughs{ s
z"FirewallDConfig.getAllPassthroughs)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)��__name__�
__module__� __qualname__�__doc__Z
persistentr rI ZPK_ACTION_CONFIGZ default_polkit_auth_requiredr r. r1 rj ro r2 r_ r� r r` r� r� ra r� r� rc r� r� r^ r� r� rb r� r� r r� r� r� r ZPROPERTIES_IFACEr� ru �slipZpolkitZ require_authr� rf �signalr| ZPK_ACTION_INFOZINTROSPECTABLE_IFACEr� r� r ZDBUS_SIGNATUREr� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� rJ r� r� r� r r� r� r� r� r� r r� r� r� r� r� r� r� r� r� r� r� r r r r r� r
r r r
r� r r r r r r� r� r r� rr r� r r r r r r r r r r! r" r# r$ r% r& r' �
__classcell__rP rP )rO rQ r > sv . D ! D
r ):Z
gi.repositoryr �sys�modulesrA rI Z dbus.serviceZ slip.dbusr, Zslip.dbus.serviceZfirewallr Zfirewall.core.baser Zfirewall.core.watcherr Zfirewall.core.loggerr Zfirewall.server.decoratorsr r r Z firewall.server.config_icmptyper
Z firewall.server.config_servicer Zfirewall.server.config_zoner Z firewall.server.config_policyr
Z firewall.server.config_ipsetr Z firewall.server.config_helperr Zfirewall.core.io.icmptyper Zfirewall.core.io.ipsetr Zfirewall.core.io.helperr Z#firewall.core.io.lockdown_whitelistr Zfirewall.core.io.directr Zfirewall.dbus_utilsr r r r r r r r Zfirewall.errorsr rf ZObjectr rP rP rP rQ �<module> s6
$