Your IP : 18.219.247.59
3
@)�f�^ � @ sf d Z dgZddlZddlmZ ddlmZ ddlmZ ddl m
Z
m Z m Z m
Z
mZ G dd� de�ZdS ) z<FirewallCommand class for command line client simplification�FirewallCommand� N)�errors)�
FirewallError)�
DBusException)� checkIPnMask�
checkIP6nMask� check_mac�
check_port�check_single_addressc @ s� e Zd Zd\dd�Zdd� Zdd� Zdd � Zd
d � Zd d
� Zd]dd�Z d^dd�Z
d_dd�Z d`dd�Z dadd�Z
dbdd�Zdcd d �Zddd d �Zded d!�Zdfd"d#�Zdgd$d%�Zdhd&d'�Zdid(d)�Zdjd*d+�Zdkd,d-�Zd.d/� Zdld1d2�Zdmd3d4�Zd5d6� Zd7d8� Z d9d:� Z d;d<� Z d=d>� Z d?d@� Z dg dAfdBdC�Z!dg fdDdE�Z"dg fdFdG�Z#dHdI� Z$dJdK� Z%dLdM� Z&dNdO� Z'dPdQ� Z(dRdS� Z)dTdU� Z*dVdW� Z+dXdY� Z,dZd[� Z-dS )nr Fc C s || _ || _d| _d | _d S )NT)�quiet�verbose�'_FirewallCommand__use_exception_handler�fw)�selfr r � r � /usr/lib/python3.6/command.py�__init__# s zFirewallCommand.__init__c C s
|| _ d S )N)r )r r r r r �set_fw) s zFirewallCommand.set_fwc C s
|| _ d S )N)r )r �flagr r r � set_quiet, s zFirewallCommand.set_quietc C s | j S )N)r )r r r r � get_quiet/ s zFirewallCommand.get_quietc C s
|| _ d S )N)r )r r r r r � set_verbose2 s zFirewallCommand.set_verbosec C s | j S )N)r )r r r r � get_verbose5 s zFirewallCommand.get_verboseNc C s$ |d k r | j r tjj|d � d S )N�
)r �sys�stdout�write)r �msgr r r � print_msg8 s zFirewallCommand.print_msgc C s$ |d k r | j r tjj|d � d S )Nr )r r �stderrr )r r r r r �print_error_msg< s z FirewallCommand.print_error_msgc C s, d}d}t jj� r || | }| j|� d S )Nz[91mz[00m)r r �isattyr )r r ZFAILZENDr r r �
print_warning@ s
z FirewallCommand.print_warningr c C s, |dkr| j |� n
| j|� tj|� d S )N� )r" r r �exit)r r Z exit_coder r r �print_and_exitG s
z FirewallCommand.print_and_exitc C s | j |d� d S )N� )r% )r r r r r �failR s zFirewallCommand.failc C s" |d k r | j r tjj|d � d S )Nr )r r r r )r r r r r �print_if_verboseU s z FirewallCommand.print_if_verbosec
C s� | j d k r| j j� g }
d} g } x�|D ]�}
|d k r�y ||
�}
W nx tk
r� } z\tjt|��}t|�dkrz| jd| � n| jd| |� || kr�| j |� | d7 } w&W Y d d }~X nX |
j |
� q&W �xb|
D �]X}
g }|d k r�||7 }t
|
t � o�t
|
t � �r|j |
� n||
7 }|d k �r(||7 }| j
� y ||� W n� ttfk
�r } z�t
|t��rx| j|j� � |j� }nt|�}tj|�}|tjtjtjtjgk�r�d}t|�dk�r�| jd| � n,|dk�r�| jd| � d S | jd| |� || k�r| j |� | d7 } W Y d d }~X nX | j� q�W | �s�t|�| k�sJd| k�rNd S t| �dk�rltj| d � nt| �dk�r�tjtj� d S )Nr r# z Warning: %sz Error: %s)r Z authorizeAll� Exceptionr �get_code�str�lenr" r% �append�
isinstance�list�tuple� deactivate_exception_handlerr �fail_if_not_authorized�
get_dbus_name�get_dbus_messager �ALREADY_ENABLED� NOT_ENABLED�ZONE_ALREADY_SET� ALREADY_SET�activate_exception_handlerr r$ Z
UNKNOWN_ERROR)r Zcmd_type�option�
action_method� query_method� parse_method�message�
start_args�end_args�no_exit�itemsZ_errorsZ _error_codes�itemr �code� call_itemr r r Z__cmd_sequenceY sr
z FirewallCommand.__cmd_sequencec C s | j d||||||d� d S )N�add)rA )� _FirewallCommand__cmd_sequence)r r: r; r< r= r> rA r r r � add_sequence� s z FirewallCommand.add_sequencec
C s | j d||||||g|d� d S )NrF )r? rA )rG )r �xr: r; r< r= r> rA r r r �x_add_sequence� s z FirewallCommand.x_add_sequencec C s$ | j d||||||g|g|d� d S )NrF )r? r@ rA )rG ) r �zoner: r; r< r= r> ZtimeoutrA r r r �zone_add_timeout_sequence� s z)FirewallCommand.zone_add_timeout_sequencec C s | j d||||||d� d S )N�remove)rA )rG )r r: r; r< r= r> rA r r r �remove_sequence� s z FirewallCommand.remove_sequencec
C s | j d||||||g|d� d S )NrM )r? rA )rG )r rI r: r; r< r= r> rA r r r �x_remove_sequence� s z!FirewallCommand.x_remove_sequencec
C s g }x�|D ]�}|d k r�y ||�}W n^ t k
r� } zBt|�dkrR| jd| � w
n tjt| ��}
| jd| |
� W Y d d } ~ X nX |j|� q
W �xv|D �]l}g } |d k r�| |7 } t|t � r�t|t
� r�| j|� n| |7 } | j � y || � } W n� t k
�rj } zZ| j
| j� � tj| j� �}
t|�dk�rF| jd| j� � w�n| jd| j� |
� W Y d d } ~ X n` t k
�r� } zBtjt| ��}
t|�dk�r�| jd| � n| jd| |
� W Y d d } ~ X nX | j� t|�dk�r�| jd|| d| f � q�| j| � q�W |�stjd� d S ) Nr# z Warning: %sz Error: %sz%s: %s�no�yesr )rP rQ )r) r, r" r r* r+ r% r- r. r/ r0 r1 r r2 r3 r4 r9 r �print_query_resultr r$ )
r r: r< r= r> r? rA rB rC r rD rE �resr r r Z__query_sequence� sR
" " z FirewallCommand.__query_sequencec C s | j |||||d� d S )N)rA )� _FirewallCommand__query_sequence)r r: r< r= r> rA r r r �query_sequence� s
z FirewallCommand.query_sequencec C s | j |||||g|d� d S )N)r? rA )rT )r rI r: r< r= r> rA r r r �x_query_sequence� s
z FirewallCommand.x_query_sequencec C sJ t |� rFt|� rFt|� rF|jd�o2t|�dk rFttjd| ��|S )Nzipset:� z8'%s' is no valid IPv4, IPv6 or MAC address, nor an ipset)r r r �
startswithr, r r � INVALID_ADDR)r �valuer r r � parse_source� s
z FirewallCommand.parse_source�/c
C sl y|j |�\}}W n$ tk
r6 ttjd| ��Y nX t|�sLttj|��|dkrdttjd| ��||fS )NzTbad port (most likely missing protocol), correct syntax is portid[-portid]%sprotocol�tcp�udp�sctp�dccpz''%s' not in {'tcp'|'udp'|'sctp'|'dccp'})r] r^ r_ r` )�split�
ValueErrorr r � INVALID_PORTr �INVALID_PROTOCOL)r rZ Z separator�port�protor r r �
parse_port s zFirewallCommand.parse_portc
C s� d }d }d }d }d}x�d||d � kr�||d � j dd�d }|t|�d 7 }d||d � krx||d � j dd�d } n ||d � } |t| �d 7 }|dkr�| }q|dkr�| }q|dkr�| }q|dkr�| }q|d kr�|r�qttjd
| ��qW |�s ttjd ��|�sttjd ��|�p|�s*ttjd
��t|��s@ttj|��|dk�rZttjd| ��|�rxt|� �rxttj|��|�r�td|� �r�|�s�td|� �r�ttj |��||||fS )Nr �=r# �:re rf �toport�toaddr�ifz invalid forward port arg '%s'z missing portzmissing protocolzmissing destinationr] r^ r_ r` z''%s' not in {'tcp'|'udp'|'sctp'|'dccp'}�ipv4�ipv6)r] r^ r_ r` )
ra r, r r ZINVALID_FORWARDr rc rd r
rY )
r rZ �compatre Zprotocolrj rk �i�opt�valr r r �parse_forward_port sT
z"FirewallCommand.parse_forward_portc C sF |j d�}t|�dkr"|d dfS t|�dkr2|S ttjd| ��d S )Nrh r# r � r& zinvalid ipset option '%s')ra r, r r ZINVALID_OPTION)r rZ �argsr r r �parse_ipset_optionH s
z"FirewallCommand.parse_ipset_optionc C s. ddg}||kr*t tjd|dj|�f ��|S )Nrm rn z'invalid argument: %s (choose from '%s')z', ')r r � INVALID_IPV�join)r rZ �ipvsr r r �check_destination_ipvR s z%FirewallCommand.check_destination_ipvc C sD y|j dd�\}}W n tk
r4 ttjd��Y nX | j|�|fS )Nri r# z(destination syntax is ipv:address[/mask])ra rb r r ZINVALID_DESTINATIONrz )r rZ ZipvZ destinationr r r �parse_service_destinationZ s z)FirewallCommand.parse_service_destinationc C s0 dddg}||kr,t tjd|dj|�f ��|S )Nrm rn Zebz'invalid argument: %s (choose from '%s')z', ')r r rw rx )r rZ ry r r r � check_ipvb s
zFirewallCommand.check_ipvc C s0 dddg}||kr,t tjd|dj|�f ��|S )Nrt rm rn z'invalid argument: %s (choose from '%s')z', ')r r rw rx )r rZ ry r r r �check_helper_familyj s
z#FirewallCommand.check_helper_familyc C sB |j d�sttjd| ��t|jdd��dk r>ttjd| ��|S )NZ
nf_conntrack_z('%s' does not start with 'nf_conntrack_'rt r# zModule name '%s' too short)rX r r ZINVALID_MODULEr, �replace)r rZ r r r � check_moduler s
z FirewallCommand.check_moduleTc C s� |j � }|j� }|j� }|j� } |j� }
|j� } |j� } |j� }
|j� }|j � }|j
� }|rv|j � }|j � }|j
� }n,|j� }tt|j� | ��}|j� }|j� }dd� }g }|d k r�||kr�|jd� | r�|s�|s�|r�|r�|r�|jd� |�r|ddj|� }| j|� | j�r2| jd| � | jd| � |�rJ| jd t|� � | jd
| � |�sv| jd |�rnd nd
� |�r�| jddj|� � | jddj|� � n(| jddj|� � | jddj|� � | jddjt|�� � | jddjdd� |D �� � | jddjt| �� � |�s:| jd|�r2d nd
� | jd|
�rJd nd
� | jd| �rbdnd djd d� | D �� � | jd djd d� | D �� � | jd dj|
� � | jd!|�r�dnd djt||d"�� � d S )#Nc S sf d}d}y| j |�}W n tk
r* Y n8X |t|�7 }t| ||| |d � j d� � jdd��}|S )Nr z priority=� �"rt )�indexrb r, �intr~ )Zrule�priorityZ
search_strrp r r r �rich_rule_sorted_key� s *zDFirewallCommand.print_zone_policy_info.<locals>.rich_rule_sorted_key�defaultZactivez (%s)z, z summary: z description: z priority: z
target: z icmp-block-inversion: %srQ rP z ingress-zones: r� z egress-zones: z interfaces: z sources: z services: z ports: c S s g | ]}d |d |d f �qS )z%s/%sr r# r )�.0re r r r �
<listcomp>� s z:FirewallCommand.print_zone_policy_info.<locals>.<listcomp>z
protocols: z
forward: %sz masquerade: %sz forward-ports: z
rt c S s$ g | ] \}}}}d ||||f �qS )z$port=%s:proto=%s:toport=%s:toaddr=%sr )r� re rf rj rk r r r r� � s z source-ports: c S s g | ]}d |d |d f �qS )z%s/%sr r# r )r� re r r r r� � s z icmp-blocks: z rich rules: )�key)Z getTargetZ getServices�getPorts� getProtocolsZ
getMasqueradeZgetForwardPorts�getSourcePortsZ
getIcmpBlocksZ getRichRules�getDescription�getShortZgetIngressZonesZgetEgressZonesZ getPriorityZgetIcmpBlockInversion�sorted�setZ
getInterfacesZ
getSourcesZ
getForwardr- rx r r r+ )r rK �settings� default_zone�extra_interfaces�isPolicy�targetZservices�ports� protocolsZ
masqueradeZ
forward_ports� source_portsZ icmp_blocksZrules� description�short_descriptionZ
ingress_zonesZ egress_zonesr� Zicmp_block_inversionZ
interfacesZsourcesZforwardr� Z
attributesr r r �print_zone_policy_info| sx
z&FirewallCommand.print_zone_policy_infoc C s | j ||||dd� d S )NF)r� r� r� )r� )r rK r� r� r� r r r �print_zone_info� s z FirewallCommand.print_zone_infoc C s | j ||||dd� d S )NT)r� r� r� )r� )r Zpolicyr� r� r� r r r �print_policy_info� s z!FirewallCommand.print_policy_infoc C s. |j � }|j� }|j� }|j� }|j� }|j� }|j� } |j� }
|j� } | j |� | j
rt| j d| � | j d| � | j ddj dd� |D �� � | j ddj |� � | j ddj d d� |D �� � | j d
dj |� � | j d dj d d� |j � D �� � | j d
dj t
|
�� � | j ddj t
| �� � d S )Nz summary: z description: z ports: r� c S s g | ]}d |d |d f �qS )z%s/%sr r# r )r� re r r r r� � s z6FirewallCommand.print_service_info.<locals>.<listcomp>z
protocols: z source-ports: c S s g | ]}d |d |d f �qS )z%s/%sr r# r )r� re r r r r� � s z modules: z destination: c S s g | ]\}}d ||f �qS )z%s:%sr )r� �k�vr r r r� � s z includes: z helpers: )r� r� r� Z
getModulesr� �getDestinationsr� Z getIncludesZ
getHelpersr r rx rB r� ) r Zservicer� r� r� r� �modulesr� � destinationsr� ZincludesZhelpersr r r �print_service_info� s2
z"FirewallCommand.print_service_infoc C sp |j � }|j� }|j� }t|�dkr,ddg}| j|� | jrX| jd| � | jd| � | jddj|� � d S )Nr rm rn z summary: z description: z destination: r� )r� r� r� r, r r rx )r Zicmptyper� r� r� r� r r r �print_icmptype_info� s
z#FirewallCommand.print_icmptype_infoc C s� |j � }|j� }|j� }|j� }|j� }| j|� | jrT| jd| � | jd| � | jd| � | jddjdd� |j� D �� � | jddj|� � d S ) Nz summary: z description: z type: z options: r� c S s$ g | ] \}}|r d ||f n|�qS )z%s=%sr )r� r� r� r r r r� s z4FirewallCommand.print_ipset_info.<locals>.<listcomp>z entries: ) ZgetTypeZ
getOptionsZ
getEntriesr� r� r r rx rB )r Zipsetr� Z
ipset_typeZoptions�entriesr� r� r r r �print_ipset_info� s
z FirewallCommand.print_ipset_infoc C s� |j � }|j� }|j� }|j� }|j� }| j|� | jrT| jd| � | jd| � | jd| � | jd| � | jddjdd� |D �� � d S ) Nz summary: z description: z
family: z
module: z ports: r� c S s g | ]}d |d |d f �qS )z%s/%sr r# r )r� re r r r r� s z5FirewallCommand.print_helper_info.<locals>.<listcomp>)r� Z getModuleZ getFamilyr� r� r r rx )r �helperr� r� �moduleZfamilyr� r� r r r �print_helper_info s
z!FirewallCommand.print_helper_infoc C s |r| j d� n | j dd� d S )NrQ rP r# )r% )r rZ r r r rR s z"FirewallCommand.print_query_resultc C s\ | j s� | j|� tjt|��}|tjtjtjtj gkrH| j
d| � n| j d| |� d S )Nz Warning: %sz Error: %s) r
r2 r r* r+ r r5 r6 r7 r8 r" r% )r �exception_messagerD r r r �exception_handler s
z!FirewallCommand.exception_handlerc C s d|krd}| j |tj� d S )NZNotAuthorizedExceptionz`Authorization failed.
Make sure polkit agent is running or run the application as superuser.)r% r ZNOT_AUTHORIZED)r r� r r r r r2 ' s z&FirewallCommand.fail_if_not_authorizedc C s
d| _ d S )NF)r
)r r r r r1 - s z,FirewallCommand.deactivate_exception_handlerc C s
d| _ d S )NT)r
)r r r r r9 0 s z*FirewallCommand.activate_exception_handlerc C sp g }t � }t|�}xP|D ]H}|s"P |j� }t|�dk s|d dkrDq||kr|j|� |j|� qW |j� |S )Nr# r �#�;)r� r� )r� �open�stripr, r- rF �close)r �filenamer� Z entries_set�f�liner r r �get_ipset_entries_from_file3 s
z+FirewallCommand.get_ipset_entries_from_file)FF)N)N)N)Nr )N)N)NNF)F)F)F)F)F)NF)F)F)r\ )F).�__name__�
__module__� __qualname__r r r r r r r r r" r% r' r( rG rH rJ rL rN rO rT rU rV r[ rg rs rv rz r{ r| r} r r� r� r� r� r� r� r� rR r� r2 r1 r9 r� r r r r r " sX
J
2
2
O )�__doc__�__all__r Zfirewallr Zfirewall.errorsr Zdbus.exceptionsr Zfirewall.functionsr r r r r
�objectr r r r r �<module> s