Edit File: fw_direct.cpython-36.pyc
3 Y e V � @ sn d gZ ddlmZ ddlmZ ddlmZ ddlmZ ddlm Z ddl m Z ddl m Z G d d � d e�Zd S ) �FirewallDirect� )�LastUpdatedOrderedDict)� ipXtables)�ebtables)�FirewallTransaction)�log)�errors)� FirewallErrorc @ sD e Zd Zdd� Zdd� Zdd� Zdd� Zd d � Zd d � Zd d� Z dLdd�Z dd� Z dd� Z dMdd�Z dd� Zdd� Zd d � Zd d � ZdNd d!�ZdOd"d#�Zd$d%� Zd&d'� Zd(d)� ZdPd*d+�ZdQd,d-�Zd.d/� Zd0d1� Zd2d3� Zd4d5� Z d6d7� Z d8d9� Z dRd:d;�Z dSd<d=�Z d>d?� Z!d@dA� Z"dBdC� Z#dDdE� Z$dFdG� Z%dHdI� Z&dJdK� Z'dS )Tr c C s || _ | j� d S )N)�_fw�_FirewallDirect__init_vars)�self�fw� r � /usr/lib/python3.6/fw_direct.py�__init__' s zFirewallDirect.__init__c C s d| j | j| j| jf S )Nz%s(%r, %r, %r))� __class__�_chains�_rules�_rule_priority_positions)r r r r �__repr__+ s zFirewallDirect.__repr__c C s" i | _ i | _i | _i | _d | _d S )N)r r r � _passthroughs�_obj)r r r r Z __init_vars/ s zFirewallDirect.__init_varsc C s | j � d S )N)r )r r r r �cleanup6 s zFirewallDirect.cleanupc C s t | j�S )N)r r )r r r r �new_transaction; s z FirewallDirect.new_transactionc C s || _ d S )N)r )r �objr r r �set_permanent_config@ s z#FirewallDirect.set_permanent_configc C s\ t | j�t | j� t | j� dkr&dS t | jj� �t | jj� � t | jj� � dkrXdS dS )Nr TF)�lenr r r r �get_all_chains� get_all_rules�get_all_passthroughs)r r r r �has_configurationC s "z FirewallDirect.has_configurationNc C sP |d kr| j � }n|}| j| jj� | jj� | jj� f|� |d krL|jd� d S )NT)r � set_configr r r r �execute)r �use_transaction� transactionr r r � apply_directL s zFirewallDirect.apply_directc C s i }i }i }xL| j D ]B}|\}}x4| j | D ]&}| jj|||�s,|j|g �j|� q,W qW xf| jD ]\}|\}}}xL| j| D ]>\} } | jj|||| | �s|||kr�t� ||< | || | | f< q|W qbW xP| jD ]F}x@| j| D ]2} | jj || �s�||k� r�g ||< || j| � q�W q�W |||fS )N) r r � query_chain� setdefault�appendr � query_ruler r �query_passthrough) r Zchains�rulesZ passthroughs�table_id�ipv�table�chain�chain_id�priority�argsr r r �get_runtime_config] s, z!FirewallDirect.get_runtime_configc C s | j | j| jfS )N)r r r )r r r r � get_config| s zFirewallDirect.get_configc C s� |d kr| j � }n|}|\}}}x||D ]t}|\}} xf|| D ]Z} | j|| | �s<y| j|| | |d� W q< tk r� } ztjt| �� W Y d d } ~ X q<X q<W q&W x�|D ]�} | \}} } xt|| D ]h\} }| j|| | | |�s�y| j|| | | ||d� W q� tk �r" } ztjt| �� W Y d d } ~ X q�X q�W q�W xx|D ]p}xh|| D ]\}| j ||��s@y| j |||d� W n2 tk �r� } ztjt| �� W Y d d } ~ X nX �q@W �q2W |d k�r�|j d� d S )N)r# T) r r& � add_chainr r Zwarning�strr) �add_ruler* �add_passthroughr" )r Zconfr# r$ r r r r, r- r. r/ �errorr0 r1 r2 r r r r! s@ ( ( , zFirewallDirect.set_configc C s* dddg}||kr&t tjd||f ��d S )N�ipv4�ipv6Zebz'%s' not in '%s')r r Z INVALID_IPV)r r- Zipvsr r r � _check_ipv� s zFirewallDirect._check_ipvc C sF | j |� |dkr tjj� ntjj� }||krBttjd||f ��d S )Nr: r; z'%s' not in '%s')r: r; )r< r �BUILT_IN_CHAINS�keysr r r Z INVALID_TABLE)r r- r. Ztablesr r r �_check_ipv_table� s z FirewallDirect._check_ipv_tablec C s� |dkr4t j| }| jjr i }qH| jj|�j| }ntj| }tj| }||kr`tt j d| ��||krxtt j d| ��|dkr�| jj j |�d k r�tt j d| ��d S )Nr: r; z chain '%s' is built-in chainzchain '%s' is reservedzChain '%s' is reserved)r: r; )r: r; )r r= r �nftables_enabled�get_direct_backend_by_ipv� our_chainsr Z OUR_CHAINSr r Z BUILTIN_CHAIN�zoneZzone_from_chainZ INVALID_CHAIN)r r- r. r/ Zbuilt_in_chainsrB r r r �_check_builtin_chain� s" z#FirewallDirect._check_builtin_chainc C sH |r| j j|g �j|� n*| j | j|� t| j | �dkrD| j |= d S )Nr )r r' r( �remover )r r, r/ �addr r r �_register_chain� s z FirewallDirect._register_chainc C s> |d kr| j � }n|}| jd||||� |d kr:|jd� d S )NT)r �_chainr" )r r- r. r/ r# r$ r r r r5 � s zFirewallDirect.add_chainc C s> |d kr| j � }n|}| jd||||� |d kr:|jd� d S )NFT)r rH r" )r r- r. r/ r# r$ r r r � remove_chain� s zFirewallDirect.remove_chainc C s: | j ||� | j|||� ||f}|| jko8|| j| kS )N)r? rD r )r r- r. r/ r, r r r r& � s zFirewallDirect.query_chainc C s, | j ||� ||f}|| jkr(| j| S g S )N)r? r )r r- r. r, r r r � get_chains� s zFirewallDirect.get_chainsc C sD g }x:| j D ]0}|\}}x"| j | D ]}|j|||f� q$W q W |S )N)r r( )r �r�keyr- r. r/ r r r r � s z FirewallDirect.get_all_chainsc C sB |d kr| j � }n|}| jd||||||� |d kr>|jd� d S )NT)r �_ruler" )r r- r. r/ r1 r2 r# r$ r r r r7 s zFirewallDirect.add_rulec C sB |d kr| j � }n|}| jd||||||� |d kr>|jd� d S )NFT)r rM r" )r r- r. r/ r1 r2 r# r$ r r r � remove_rule s zFirewallDirect.remove_rulec C s2 | j ||� |||f}|| jko0||f| j| kS )N)r? r )r r- r. r/ r1 r2 r0 r r r r) s zFirewallDirect.query_rulec C s6 | j ||� |||f}|| jkr2t| j| j� �S g S )N)r? r �listr> )r r- r. r/ r0 r r r � get_rules s zFirewallDirect.get_rulesc C sR g }xH| j D ]>}|\}}}x.| j | D ] \}}|j||||t|�f� q&W q W |S )N)r r( rO )r rK rL r- r. r/ r1 r2 r r r r % s z FirewallDirect.get_all_rulesc C s� |rr|| j krt� | j |< || j | |< || jkr<i | j|< || j| krb| j| | |7 < q�|| j| |< n<| j | |= t| j | �dkr�| j |= | j| | |8 < d S )Nr )r r r r )r �rule_idr0 r1 �enable�countr r r �_register_rule- s z FirewallDirect._register_rulec C sV y| j j| j j|�j|�S tk rP } z tj|� ttj |��W Y d d }~X nX d S )N) r �rulerA �name� Exceptionr Zdebug2r r ZCOMMAND_FAILED)r r- r2 �msgr r r � passthroughA s zFirewallDirect.passthroughc C sX |r*|| j krg | j |< | j | j|� n*| j | j|� t| j | �dkrT| j |= d S )Nr )r r( rE r )r r- r2 rR r r r �_register_passthroughI s z$FirewallDirect._register_passthroughc C s@ |d kr| j � }n|}| jd|t|�|� |d kr<|jd� d S )NT)r � _passthroughrO r" )r r- r2 r# r$ r r r r8 S s z FirewallDirect.add_passthroughc C s@ |d kr| j � }n|}| jd|t|�|� |d kr<|jd� d S )NFT)r r[ rO r" )r r- r2 r# r$ r r r �remove_passthrough^ s z!FirewallDirect.remove_passthroughc C s || j kot|�| j | kS )N)r �tuple)r r- r2 r r r r* i s z FirewallDirect.query_passthroughc C s> g }x4| j D ]*}x$| j | D ]}|j|t|�f� q W q W |S )N)r r( rO )r rK r- r2 r r r r m s z#FirewallDirect.get_all_passthroughsc C s4 g }|| j kr0x | j | D ]}|jt|�� qW |S )N)r r( rO )r r- rK r2 r r r �get_passthroughst s z FirewallDirect.get_passthroughsc C s� g }x�|D ]�}d}x�|D ]�}y|j |�}W n tk r> Y qX t|�|krd||d krd}||d jd�}x.|D ]&} |dd� } | | |d < |j| � qxW qW |s |j|� q W |S )z5Split values combined with commas for options in optsF�,� TN)�index� ValueErrorr �splitr( ) r r+ ZoptsZ out_rulesrU Z processed�opt�i�items�itemrM r r r � split_value{ s$ zFirewallDirect.split_valuec C s* | j ||� | jj r2|dkr2| jjj||||� |}| jj|�} | jj rd| j|||�rdd| }n:| jjr�|dd � dkr�| j|||d d� �r�|d d� }|||f} ||f} |r�| | jkr�| | j| kr�tt j d||||f ��nB| | jk�s| | j| k�rtt j d||||f ��| j| | }d} d } | | j k�r�t | j | j� �}d }x@|t|�k �r�||| k�r�| | j | || 7 } |d7 }�qTW t|�g}| j|d d g�}| j|d d g�}x<|D ]4}|j| | j|||| t|��� | d7 } | d7 } �q�W | j| | ||| � |j| j| | || | � d S )Nr: r; z %s_direct� Z_directz"rule '%s' already is in '%s:%s:%s'z rule '%s' is not in '%s:%s:%s'r` r z-sz--sourcez-dz --destination)r: r; i����i����i����)r? r r@ rC �create_zone_base_by_chainrA Zis_chain_builtinr r r �ALREADY_ENABLED� NOT_ENABLEDr �sortedr> r rO rh r7 Z build_ruler] rT �add_fail)r rR r- r. r/ r1 r2 r$ rH �backendr0 rQ ra rS Z positions�jZ args_list�_argsr r r rM � sZ ( zFirewallDirect._rulec C s� | j ||� | j|||� ||f}|rV|| jkr�|| j| kr�ttjd|||f ��n.|| jksn|| j| kr�ttjd|||f ��| jj|�}|j ||j |||�� | j |||� |j | j ||| � d S )Nz chain '%s' already is in '%s:%s'z chain '%s' is not in '%s:%s') r? rD r r r rk rl r rA Z add_rulesZbuild_chain_rulesrG rn )r rF r- r. r/ r$ r, ro r r r rH s$ zFirewallDirect._chainc C s� | j |� t|�}|rD|| jkrp|| j| krpttjd||f ��n,|| jks\|| j| krpttjd||f ��| jj|�}|r�|j |� |dkr�|j |�\}}|r�|r�| jj j |||� |} n |j |�} |j|| � | j|||� |j| j||| � d S )Nzpassthrough '%s', '%s'r: r; )r: r; )r< r] r r r rk rl r rA Zcheck_passthroughZ passthrough_parse_table_chainrC rj Zreverse_passthroughr7 rZ rn ) r rR r- r2 r$ Z tuple_argsro r. r/ rq r r r r[ s0 zFirewallDirect._passthrough)N)N)N)N)N)N)N)N)(�__name__� __module__� __qualname__r r r r r r r r% r3 r4 r! r< r? rD rG r5 rI r& rJ r r7 rN r) rP r rT rY rZ r8 r\ r* r r^ rh rM rH r[ r r r r r & sJ ' jN)�__all__Zfirewall.fw_typesr Z firewall.corer r Z firewall.core.fw_transactionr Zfirewall.core.loggerr Zfirewallr Zfirewall.errorsr �objectr r r r r �<module> s