| Server IP : 216.107.137.15 / Your IP : 216.73.216.24 Web Server : LiteSpeed System : Linux srv877165910.host 5.15.0-126-generic #136-Ubuntu SMP Wed Nov 6 10:38:22 UTC 2024 x86_64 User : batas6485 ( 1035) PHP Version : 8.1.33 Disable Function : NONE MySQL : OFF | cURL : ON | WGET : ON | Perl : ON | Python : OFF | Sudo : ON | Pkexec : ON Directory : /lib/python3/dist-packages/firewall/__pycache__/ |
Upload File : |
o
bhAb�^ � @ sf d Z dgZddlZddlmZ ddlmZ ddlmZ ddl m
Z
m Z m Z m
Z
mZ G dd� de�ZdS ) z<FirewallCommand class for command line client simplification�FirewallCommand� N)�errors)�
FirewallError)�
DBusException)� checkIPnMask�
checkIP6nMask� check_mac�
check_port�check_single_addressc @ s� e Zd Zd\dd�Zdd� Zdd� Zdd � Zd
d � Zd d
� Zd]dd�Z d]dd�Z
d]dd�Z d^dd�Z d]dd�Z
d]dd�Z d_d d �Z d`d d �Z d`d d!�Z d`d"d#�Z d`d$d%�Z d`d&d'�Z dad(d)�Z d`d*d+�Z d`d,d-�Zd.d/� Zdbd1d2�Zd`d3d4�Zd5d6� Zd7d8� Z d9d:� Z d;d<� Z d=d>� Z d?d@� Z dg dAfdBdC�Z!dg fdDdE�Z"dg fdFdG�Z#dHdI� Z$dJdK� Z%dLdM� Z&dNdO� Z'dPdQ� Z(dRdS� Z)dTdU� Z*dVdW� Z+dXdY� Z,dZd[� Z-dS )cr Fc C s || _ || _d| _d | _d S �NT)�quiet�verbose�'_FirewallCommand__use_exception_handler�fw)�selfr r
� r �2/usr/lib/python3/dist-packages/firewall/command.py�__init__# s
zFirewallCommand.__init__c C �
|| _ d S �N)r )r r r r r �set_fw) �
zFirewallCommand.set_fwc C r r �r �r �flagr r r � set_quiet, r zFirewallCommand.set_quietc C � | j S r r �r r r r � get_quiet/ � zFirewallCommand.get_quietc C r r �r
r r r r � set_verbose2 r zFirewallCommand.set_verbosec C r r r r r r r � get_verbose5 r zFirewallCommand.get_verboseNc C �* |d ur| j stj�|d � d S d S d S �N�
)r �sys�stdout�write�r �msgr r r � print_msg8 � �zFirewallCommand.print_msgc C r# r$ )r r& �stderrr( r) r r r �print_error_msg< r, z FirewallCommand.print_error_msgc C s, d}d}t j�� r|| | }| �|� d S )Nz[91mz[00m)r& r- �isattyr. )r r* �FAIL�ENDr r r �
print_warning@ s
z FirewallCommand.print_warningr c C s, |dkr
| � |� n| �|� t�|� d S )N� )r2 r+ r& �exit)r r* � exit_coder r r �print_and_exitG s
z FirewallCommand.print_and_exitc C s | � |d� d S )N� �r6 r) r r r �failR s zFirewallCommand.failc C s* |d ur| j rtj�|d � d S d S d S r$ )r
r& r' r( r) r r r �print_if_verboseU r, z FirewallCommand.print_if_verbosec
C s� | j d ur
| j �� g }
d} g } |D ]N}
|d ur[z||
�}
W n< tyZ } z0t�t|��}t|�dkr;| �d| � n| �d| |� || vrL| � |� | d7 } W Y d }~qd }~ww |
� |
� q|
D ]�}
g }|d uro||7 }t
|
t �st
|
t �s|� |
� n||
7 }|d ur�||7 }| �
� z||� W ns ttf�y } zdt
|t�r�| �|�� � |�� }nt|�}t�|�}|tjtjtjtjfv r�d}t|�dkr�| �d| � n|dkr�| �d| � W Y d }~ d S | �d| |� || vr�| � |� | d7 } W Y d }~nd }~ww | �� qc| �s>t|�| k�s d| v �r d S t| �dk�r/t�| d � d S t| �dk�r@t�tj� d S d S d S )Nr r3 � Warning: %s� Error: %s)r � authorizeAll� Exceptionr �get_code�str�lenr2 r6 �append�
isinstance�list�tuple� deactivate_exception_handlerr �fail_if_not_authorized�
get_dbus_name�get_dbus_messager �ALREADY_ENABLED� NOT_ENABLED�ZONE_ALREADY_SET� ALREADY_SET�activate_exception_handlerr& r4 �
UNKNOWN_ERROR)r �cmd_type�option�
action_method� query_method� parse_method�message�
start_args�end_args�no_exit�items�_errors� _error_codes�itemr* �code� call_itemr r r �__cmd_sequenceY s�
��
�
��
�z FirewallCommand.__cmd_sequencec C � | j d||||||d� d S )N�add�rX �� _FirewallCommand__cmd_sequence�r rQ rR rS rT rU rX r r r � add_sequence� �
�z FirewallCommand.add_sequencec
C � | j d||||||g|d� d S )Nra �rV rX rc �r �xrQ rR rS rT rU rX r r r �x_add_sequence� �
�z FirewallCommand.x_add_sequencec C s$ | j d||||||g|g|d� d S )Nra )rV rW rX rc ) r �zonerQ rR rS rT rU �timeoutrX r r r �zone_add_timeout_sequence� s
�z)FirewallCommand.zone_add_timeout_sequencec C r` )N�removerb rc re r r r �remove_sequence� rg z FirewallCommand.remove_sequencec
C rh )Nrq ri rc rj r r r �x_remove_sequence� rm z!FirewallCommand.x_remove_sequencec
C s g }|D ]F}|d urEz||�}W n4 t yD } z(t|�dkr+| �d| � W Y d } ~ qt�t| ��}
| �d| |
� W Y d } ~ nd } ~ ww |�|� q|D ]�}g } |d urY| |7 } t|t �sit|t
�si| �|� n| |7 } | � � z|| � } W nm t y� } z3| �
| �� � t�| �� �}
t|�dkr�| �d| �� � W Y d } ~ qM| �d| �� |
� W Y d } ~ n3d } ~ w t y� } z#t�t| ��}
t|�dkr�| �d| � n| �d| |
� W Y d } ~ nd } ~ ww | �� t|�dkr�| �d|| d| f � qM| �| � qM|�s
t�d� d S d S )Nr3 r; r< z%s: %s)�no�yesr )r> rA r2 r r? r@ r6 rB rC rD rE rF r rG rH rI rN r+ �print_query_resultr& r4 )
r rQ rS rT rU rV rX rY r\ r* r] r^ �resr r r �__query_sequence� s` �� �� �� �z FirewallCommand.__query_sequencec C s | j |||||d� d S )Nrb �� _FirewallCommand__query_sequence)r rQ rS rT rU rX r r r �query_sequence� s
�z FirewallCommand.query_sequencec C s | j |||||g|d� d S )Nri ry )r rk rQ rS rT rU rX r r r �x_query_sequence� s
�z FirewallCommand.x_query_sequencec C sB t |�s t|�s t|�s |�d�rt|�dks ttjd| ��|S )Nzipset:� z8'%s' is no valid IPv4, IPv6 or MAC address, nor an ipset)r r r �
startswithrA r r � INVALID_ADDR�r �valuer r r � parse_source� s �� �z FirewallCommand.parse_source�/c C sf z |� |�\}}W n ty ttjd| ��w t|�s#ttj|��|dvr/ttjd| ��||fS )NzTbad port (most likely missing protocol), correct syntax is portid[-portid]%sprotocol��tcp�udp�sctp�dccp�''%s' not in {'tcp'|'udp'|'sctp'|'dccp'})�split�
ValueErrorr r � INVALID_PORTr �INVALID_PROTOCOL)r r� � separator�port�protor r r �
parse_port s �� ��zFirewallCommand.parse_portc
C s� d }d }d }d }d}d||d � v r|||d � � dd�d }|t|�d 7 }d||d � v r;||d � � dd�d } n||d � } |t| �d 7 }|dkrP| }n$|dkrW| }n |dkr^| }n|dkre| }n|d krl|rlnttjd
| ��d||d � v s|s�ttjd ��|s�ttjd ��|s�|s�ttjd
��t|�s�ttj|��|dvr�ttjd| ��|r�t|�s�ttj|��|r�td|�s�|s�td|�s�ttj |��||||fS )Nr �=r3 �:r� r� �toport�toaddr�ifz invalid forward port arg '%s'z missing portzmissing protocolzmissing destinationr� r� �ipv4�ipv6)
r� rA r r �INVALID_FORWARDr r� r� r
r )
r r� �compatr� �protocolr� r� �i�opt�valr r r �parse_forward_port s\ �� �� z"FirewallCommand.parse_forward_portc C sB |� d�}t|�dkr|d dfS t|�dkr|S ttjd| ��)Nr� r3 r � r7 zinvalid ipset option '%s')r� rA r r �INVALID_OPTION)r r� �argsr r r �parse_ipset_optionH s
�z"FirewallCommand.parse_ipset_optionc C s. ddg}||vrt tjd|d�|�f ��|S )Nr� r� �'invalid argument: %s (choose from '%s')�', '�r r � INVALID_IPV�join�r r� �ipvsr r r �check_destination_ipvR � ��z%FirewallCommand.check_destination_ipvc C s> z
|� dd�\}}W n
ty ttjd��w | �|�|fS )Nr� r3 z(destination syntax is ipv:address[/mask])r� r� r r �INVALID_DESTINATIONr� )r r� �ipv� destinationr r r �parse_service_destinationZ s ��z)FirewallCommand.parse_service_destinationc C �. g d�}||vrt tjd|d�|�f ��|S )N)r� r� �ebr� r� r� r� r r r � check_ipvb r� zFirewallCommand.check_ipvc C r� )N)r� r� r� r� r� r� r� r r r �check_helper_familyj r� z#FirewallCommand.check_helper_familyc C sB |� d�s
ttjd| ��t|�dd��dk r ttjd| ��|S )N�
nf_conntrack_z('%s' does not start with 'nf_conntrack_'r� r3 zModule name '%s' too short)r~ r r �INVALID_MODULErA �replacer� r r r � check_moduler s
��z FirewallCommand.check_moduleTc C s� |� � }|�� }|�� }|�� } |�� }
|�� } |�� } |�� }
|�� }|� � }|�
� }|r;|� � }|� � }|�
� }n|�� }tt|�� | ��}|�� }|�� }dd� }g }|d urd||krd|�d� |sj|sp|sp|ru|ru|ru|�d� |r�|dd�|� }| �|� | jr�| �d| � | �d| � |r�| �d t|� � | �d
| � |s�| �d |r�d nd
� |r�| �dd�|� � | �dd�|� � n| �dd�|� � | �dd�|� � | �dd�t|�� � | �dd�dd� |D �� � | �dd�t| �� � |�s| �d|�rd nd
� | �d|
�r d nd
� | �d| �r*dnd d�d d� | D �� � | �d d�d d� | D �� � | �d d�|
� � | �d!|�rYdnd d�t||d"�� � d S )#Nc S sf d}d}z| � |�}W n
ty Y |S w |t|�7 }t| ||| |d � � d� � �dd��}|S )Nr z priority=� �"r� )�indexr� rA �intr� )�rule�priority�
search_strr� r r r �rich_rule_sorted_key� s � *zDFirewallCommand.print_zone_policy_info.<locals>.rich_rule_sorted_key�default�activez (%s)z, � summary: � description: z priority: z
target: z icmp-block-inversion: %sru rt z ingress-zones: r� z egress-zones: z interfaces: z sources: z services: � ports: c S � g | ] }d |d |d f �qS �z%s/%sr r3 r ��.0r� r r r �
<listcomp>� � �z:FirewallCommand.print_zone_policy_info.<locals>.<listcomp>�
protocols: z
forward: %sz masquerade: %sz forward-ports: z
r� c S s$ g | ]\}}}}d ||||f �qS )z$port=%s:proto=%s:toport=%s:toaddr=%sr )r� r� r� r� r� r r r r� � s
�
�� source-ports: c S r� r� r r� r r r r� � r� z icmp-blocks: z rich rules: )�key)� getTarget� getServices�getPorts� getProtocols�
getMasquerade�getForwardPorts�getSourcePorts�
getIcmpBlocks� getRichRules�getDescription�getShort�getIngressZones�getEgressZones� getPriority�getIcmpBlockInversion�sorted�set�
getInterfaces�
getSources�
getForwardrB r� r+ r
r@ )r rn �settings� default_zone�extra_interfaces�isPolicy�target�services�ports� protocols�
masquerade�
forward_ports� source_ports� icmp_blocks�rules� description�short_description�
ingress_zones� egress_zonesr� �icmp_block_inversion�
interfaces�sources�forwardr� �
attributesr r r �print_zone_policy_info| s�
���
� �
��
��
�z&FirewallCommand.print_zone_policy_infoc C � | j ||||dd� d S )NF�r� r� r� �r� )r rn r� r� r� r r r �print_zone_info� � z FirewallCommand.print_zone_infoc C r� )NTr� r� )r �policyr� r� r� r r r �print_policy_info� r� z!FirewallCommand.print_policy_infoc C s. |� � }|�� }|�� }|�� }|�� }|�� }|�� } |�� }
|�� } | � |� | j
r:| � d| � | � d| � | � dd� dd� |D �� � | � dd� |� � | � dd� d d� |D �� � | � d
d� |� � | � d d� d d� |� � D �� � | � d
d� t
|
�� � | � dd� t
| �� � d S )Nr� r� r� r� c S r� r� r r� r r r r� � r� z6FirewallCommand.print_service_info.<locals>.<listcomp>r� r� c S r� r� r r� r r r r� � r� z modules: � destination: c S s g | ]
\}}d ||f �qS )z%s:%sr �r� �k�vr r r r� � s �z includes: z helpers: )r� r� r� �
getModulesr� �getDestinationsr� � getIncludes�
getHelpersr+ r
r� rY r� ) r �servicer� r� r� r� �modulesr� � destinationsr� �includes�helpersr r r �print_service_info� s<
�
��
�� z"FirewallCommand.print_service_infoc C sp |� � }|�� }|�� }t|�dkrddg}| �|� | jr,| �d| � | �d| � | �dd�|� � d S )Nr r� r� r� r� r r� )r r� r� rA r+ r
r� )r �icmptyper� r r� r� r r r �print_icmptype_info� s
z#FirewallCommand.print_icmptype_infoc C s� |� � }|�� }|�� }|�� }|�� }| �|� | jr*| �d| � | �d| � | �d| � | �dd�dd� |�� D �� � | �dd�|� � d S ) Nr� r� z type: z options: r� c S s$ g | ]\}}|rd ||f n|�qS )z%s=%sr r r r r r� s �z4FirewallCommand.print_ipset_info.<locals>.<listcomp>z entries: ) �getType�
getOptions�
getEntriesr� r� r+ r
r� rY )r �ipsetr� �
ipset_type�options�entriesr� r� r r r �print_ipset_info� s
�z FirewallCommand.print_ipset_infoc C s� |� � }|�� }|�� }|�� }|�� }| �|� | jr*| �d| � | �d| � | �d| � | �d| � | �dd�dd� |D �� � d S ) Nr� r� z
family: z
module: r� r� c S r� r� r r� r r r r� r� z5FirewallCommand.print_helper_info.<locals>.<listcomp>)r� � getModule� getFamilyr� r� r+ r
r� )r �helperr� r� �module�familyr� r� r r r �print_helper_info s
�z!FirewallCommand.print_helper_infoc C s" |r | � d� d S | � dd� d S )Nru rt r3 r8 r� r r r rv s z"FirewallCommand.print_query_resultc C s^ | j s� | �|� t�t|��}|tjtjtjtj fv r%| �
d| � d S | � d| |� d S )Nr; r< ) r rG r r? r@ r rJ rK rL rM r2 r6 )r �exception_messager] r r r �exception_handler s
�z!FirewallCommand.exception_handlerc C s" d|v rd}| � |tj� d S d S )N�NotAuthorizedExceptionz`Authorization failed.
Make sure polkit agent is running or run the application as superuser.)r6 r �NOT_AUTHORIZED)r r r* r r r rG ' s �z&FirewallCommand.fail_if_not_authorizedc C �
d| _ d S �NF�r r r r r rF - r z,FirewallCommand.deactivate_exception_handlerc C r# r r% r r r r rN 0 r z*FirewallCommand.activate_exception_handlerc C sn g }t � }t|�}|D ]%}|s n |�� }t|�dk s!|d dv r"q ||vr0|�|� |�|� q |�� |S )Nr3 r )�#�;)r� �open�striprA rB ra �close)r �filenamer � entries_set�f�liner r r �get_ipset_entries_from_file3 s
�z+FirewallCommand.get_ipset_entries_from_file)FFr )Nr )NNF)Fr$ )r� ).�__name__�
__module__� __qualname__r r r r r! r" r+ r. r2 r6 r9 r: rd rf rl rp rr rs rz r{ r| r� r� r� r� r� r� r� r� r� r� r� r r r r r rv r rG rF rN r/ r r r r r " sl
�L
�
�
�
�
�
�3
�
�
2
O )�__doc__�__all__r& �firewallr �firewall.errorsr �dbus.exceptionsr �firewall.functionsr r r r r
�objectr r r r r �<module> s