Google
Edit File: command.cpython-39.pyc
a ��i�^ � @ sf d Z dgZddlZddlmZ ddlmZ ddlmZ ddl m Z m Z m Z m Z mZ G dd� de�ZdS ) z<FirewallCommand class for command line client simplification�FirewallCommand� N)�errors)� FirewallError)� DBusException)� checkIPnMask� checkIP6nMask� check_mac� check_port�check_single_addressc @ s� e Zd Zd\dd�Zdd� Zdd� Zdd � Zd d � Zd d � Zd]dd�Z d^dd�Z d_dd�Z d`dd�Z dadd�Z dbdd�Zdcd d �Zddd d �Zded d!�Zdfd"d#�Zdgd$d%�Zdhd&d'�Zdid(d)�Zdjd*d+�Zdkd,d-�Zd.d/� Zdld1d2�Zdmd3d4�Zd5d6� Zd7d8� Z d9d:� Z d;d<� Z d=d>� Z d?d@� Z dg dAfdBdC�Z!dg fdDdE�Z"dg fdFdG�Z#dHdI� Z$dJdK� Z%dLdM� Z&dNdO� Z'dPdQ� Z(dRdS� Z)dTdU� Z*dVdW� Z+dXdY� Z,dZd[� Z-dS )nr Fc C s || _ || _d| _d | _d S �NT)�quiet�verbose�'_FirewallCommand__use_exception_handler�fw)�selfr r � r �4/usr/lib/python3.9/site-packages/firewall/command.py�__init__# s zFirewallCommand.__init__c C s || _ d S �N)r )r r r r r �set_fw) s zFirewallCommand.set_fwc C s || _ d S r �r �r �flagr r r � set_quiet, s zFirewallCommand.set_quietc C s | j S r r �r r r r � get_quiet/ s zFirewallCommand.get_quietc C s || _ d S r �r r r r r � set_verbose2 s zFirewallCommand.set_verbosec C s | j S r r r r r r � get_verbose5 s zFirewallCommand.get_verboseNc C s" |d ur | j s tj�|d � d S �N� )r �sys�stdout�write�r �msgr r r � print_msg8 s zFirewallCommand.print_msgc C s" |d ur | j s tj�|d � d S r )r r! �stderrr# r$ r r r �print_error_msg< s z FirewallCommand.print_error_msgc C s, d}d}t j�� r || | }| �|� d S )Nz[91mz[00m)r! r' �isattyr( )r r% ZFAILZENDr r r � print_warning@ s z FirewallCommand.print_warningr c C s, |dkr| � |� n | �|� t�|� d S )N� )r* r& r! �exit)r r% Z exit_coder r r �print_and_exitG s z FirewallCommand.print_and_exitc C s | � |d� d S )N� �r- r$ r r r �failR s zFirewallCommand.failc C s" |d ur | j r tj�|d � d S r )r r! r" r# r$ r r r �print_if_verboseU s z FirewallCommand.print_if_verbosec C s� | j d ur| j �� g } d} g } |D ]�} |d ur�z || �} W n� ty� } zlt�t|��}t|�dkrv| �d| � n| �d| |� || vr�| � |� | d7 } W Y d }~q$W Y d }~n d }~0 0 | � | � q$| D �]d} g }|d ur�||7 }t | t ��st | t ��s|� | � n|| 7 }|d u�r*||7 }| � � z ||� W n� ttf�y. } z�t |t��rx| �|�� � |�� }nt|�}t�|�}|tjtjtjtjfv �r�d}t|�dk�r�| �d| � n8|dk�r�| �d| � W Y d }~ d S | �d| |� || v�r| � |� | d7 } W Y d }~n d }~0 0 | �� q�| �s�t|�| k�sXd| v �r\d S t| �dk�rzt�| d � nt| �dk�r�t�tj� d S )Nr r+ � Warning: %s� Error: %s)r Z authorizeAll� Exceptionr �get_code�str�lenr* r- �append� isinstance�list�tuple� deactivate_exception_handlerr �fail_if_not_authorized� get_dbus_name�get_dbus_messager �ALREADY_ENABLED� NOT_ENABLED�ZONE_ALREADY_SET� ALREADY_SET�activate_exception_handlerr! r, Z UNKNOWN_ERROR)r Zcmd_type�option� action_method� query_method� parse_method�message� start_args�end_args�no_exit�items�_errorsZ _error_codes�itemr% �code� call_itemr r r Z__cmd_sequenceY st " � z FirewallCommand.__cmd_sequencec C s | j d||||||d� d S )N�add�rL �� _FirewallCommand__cmd_sequence�r rE rF rG rH rI rL r r r � add_sequence� s �z FirewallCommand.add_sequencec C s | j d||||||g|d� d S )NrR �rJ rL rT �r �xrE rF rG rH rI rL r r r �x_add_sequence� s �z FirewallCommand.x_add_sequencec C s$ | j d||||||g|g|d� d S )NrR )rJ rK rL rT ) r �zonerE rF rG rH rI �timeoutrL r r r �zone_add_timeout_sequence� s �z)FirewallCommand.zone_add_timeout_sequencec C s | j d||||||d� d S )N�removerS rT rV r r r �remove_sequence� s �z FirewallCommand.remove_sequencec C s | j d||||||g|d� d S )Nr_ rX rT rY r r r �x_remove_sequence� s �z!FirewallCommand.x_remove_sequencec C s* g }|D ]�}|d ur�z ||�}W nj t y� } zRt|�dkrX| �d| � W Y d } ~ qn t�t| ��} | �d| | � W Y d } ~ n d } ~ 0 0 |�|� q|D �]v}g } |d ur�| |7 } t|t �s�t|t �s�| �|� n| |7 } | � � z || � } W n� t �yv } zj| � | �� � t�| �� �} t|�dk�rN| �d| �� � W Y d } ~ q�n| �d| �� | � W Y d } ~ njd } ~ 0 t �y� } zHt�t| ��} t|�dk�r�| �d| � n| �d| | � W Y d } ~ n d } ~ 0 0 | �� t|�dk�r | �d|| d| f � q�| �| � q�|�s&t�d� d S )Nr+ r2 r3 z%s: %s)�no�yesr )r4 r7 r* r r5 r6 r- r8 r9 r: r; r< r r= r> r? rD r& �print_query_resultr! r, ) r rE rG rH rI rJ rL rM rO r% rP rQ �resr r r Z__query_sequence� sT & �& z FirewallCommand.__query_sequencec C s | j |||||d� d S )NrS �� _FirewallCommand__query_sequence)r rE rG rH rI rL r r r �query_sequence� s �z FirewallCommand.query_sequencec C s | j |||||g|d� d S )NrX rf )r rZ rE rG rH rI rL r r r �x_query_sequence� s �z FirewallCommand.x_query_sequencec C sB t |�s>t|�s>t|�s>|�d�r.t|�dks>ttjd| ��|S )Nzipset:� z8'%s' is no valid IPv4, IPv6 or MAC address, nor an ipset)r r r � startswithr7 r r � INVALID_ADDR�r �valuer r r � parse_source� s �� ��z FirewallCommand.parse_source�/c C sj z|� |�\}}W n" ty4 ttjd| ��Y n0 t|�sJttj|��|dvrbttjd| ��||fS )NzTbad port (most likely missing protocol), correct syntax is portid[-portid]%sprotocol�ZtcpZudpZsctpZdccp�''%s' not in {'tcp'|'udp'|'sctp'|'dccp'})�split� ValueErrorr r � INVALID_PORTr �INVALID_PROTOCOL)r rn � separator�port�protor r r � parse_port s � ��zFirewallCommand.parse_portc C s� d }d }d }d }d}d||d � v r�||d � � dd�d }|t|�d 7 }d||d � v rv||d � � dd�d } n ||d � } |t| �d 7 }|dkr�| }q|dkr�| }q|dkr�| }q|dkr�| }q|d kr�|r�qttjd | ��q|s�ttjd ��|�s ttjd ��|�s$|�s$ttjd ��t|��s:ttj|��|dv�rTttjd| ��|�rpt|��spttj|��|�r�td|��s�|�s�td|��s�ttj |��||||fS )Nr �=r+ �:rx ry �toport�toaddr�ifz invalid forward port arg '%s'z missing portzmissing protocolzmissing destinationrq rr �ipv4�ipv6) rs r7 r r ZINVALID_FORWARDr ru rv r rl ) r rn �compatrx Zprotocolr} r~ �i�opt�valr r r �parse_forward_port sZ � �� z"FirewallCommand.parse_forward_portc C sF |� d�}t|�dkr"|d dfS t|�dkr2|S ttjd| ��d S )Nr{ r+ r � r. zinvalid ipset option '%s')rs r7 r r ZINVALID_OPTION)r rn �argsr r r �parse_ipset_optionH s �z"FirewallCommand.parse_ipset_optionc C s. ddg}||vr*t tjd|d�|�f ��|S )Nr� r� �'invalid argument: %s (choose from '%s')�', '�r r Z INVALID_IPV�join�r rn Zipvsr r r �check_destination_ipvR s ��z%FirewallCommand.check_destination_ipvc C sB z|� dd�\}}W n ty2 ttjd��Y n0 | �|�|fS )Nr| r+ z(destination syntax is ipv:address[/mask])rs rt r r ZINVALID_DESTINATIONr� )r rn ZipvZ destinationr r r �parse_service_destinationZ s � z)FirewallCommand.parse_service_destinationc C s. g d�}||vr*t tjd|d�|�f ��|S )N)r� r� Zebr� r� r� r� r r r � check_ipvb s ��zFirewallCommand.check_ipvc C s. g d�}||vr*t tjd|d�|�f ��|S )N)r� r� r� r� r� r� r� r r r �check_helper_familyj s ��z#FirewallCommand.check_helper_familyc C sB |� d�sttjd| ��t|�dd��dk r>ttjd| ��|S )NZ nf_conntrack_z('%s' does not start with 'nf_conntrack_'r� r+ zModule name '%s' too short)rk r r ZINVALID_MODULEr7 �replacerm r r r � check_moduler s ��z FirewallCommand.check_moduleTc C s� |� � }|�� }|�� }|�� } |�� } |�� } |�� } |�� } |�� }|� � }|� � }|rv|� � }|� � }|� � }n,|�� }tt|�� | ��}|�� }|�� }dd� }g }|d ur�||kr�|�d� |s�|s�|s�|r�|r�|r�|�d� |�r|dd�|� }| �|� | j�r0| �d| � | �d| � |�rH| �d t|� � | �d | � |�st| �d |�rld nd � |�r�| �dd�|� � | �dd�|� � n(| �dd�|� � | �dd�|� � | �dd�t|�� � | �dd�dd� |D �� � | �dd�t| �� � |�s8| �d|�r0d nd � | �d| �rHd nd � | �d| �r`dnd d�d d� | D �� � | �d d�d d� | D �� � | �d d�| � � | �d!|�r�dnd d�t||d"�� � d S )#Nc S sd d}d}z| � |�}W n ty( Y n80 |t|�7 }t| ||| |d � � d� � �dd��}|S )Nr z priority=� �"r� )�indexrt r7 �intr� )Zrule�priorityZ search_strr� r r r �rich_rule_sorted_key� s *zDFirewallCommand.print_zone_policy_info.<locals>.rich_rule_sorted_key�defaultZactivez (%s)z, � summary: � description: z priority: z target: z icmp-block-inversion: %src rb z ingress-zones: r� z egress-zones: z interfaces: z sources: z services: � ports: c S s g | ]}d |d |d f �qS �z%s/%sr r+ r ��.0rx r r r � <listcomp>� s �z:FirewallCommand.print_zone_policy_info.<locals>.<listcomp>� protocols: z forward: %sz masquerade: %sz forward-ports: z r� c S s$ g | ] \}}}}d ||||f �qS )z$port=%s:proto=%s:toport=%s:toaddr=%sr )r� rx ry r} r~ r r r r� � s � �� source-ports: c S s g | ]}d |d |d f �qS r� r r� r r r r� � s �z icmp-blocks: z rich rules: )�key)Z getTargetZ getServices�getPorts� getProtocolsZ getMasqueradeZgetForwardPorts�getSourcePortsZ getIcmpBlocksZ getRichRules�getDescription�getShortZgetIngressZonesZgetEgressZonesZ getPriorityZgetIcmpBlockInversion�sorted�setZ getInterfacesZ getSourcesZ getForwardr8 r� r& r r6 )r r\ �settings� default_zone�extra_interfaces�isPolicy�targetZservices�ports� protocolsZ masqueradeZ forward_ports� source_portsZ icmp_blocksZrules� description�short_descriptionZ ingress_zonesZ egress_zonesr� Zicmp_block_inversionZ interfacesZsourcesZforwardr� Z attributesr r r �print_zone_policy_info| s� ��� �� �� ���z&FirewallCommand.print_zone_policy_infoc C s | j ||||dd� d S )NF�r� r� r� �r� )r r\ r� r� r� r r r �print_zone_info� s z FirewallCommand.print_zone_infoc C s | j ||||dd� d S )NTr� r� )r Zpolicyr� r� r� r r r �print_policy_info� s z!FirewallCommand.print_policy_infoc C s. |� � }|�� }|�� }|�� }|�� }|�� }|�� } |�� } |�� } | � |� | j rt| � d| � | � d| � | � dd� dd� |D �� � | � dd� |� � | � dd� d d� |D �� � | � d d� |� � | � d d� d d� |� � D �� � | � d d� t | �� � | � dd� t | �� � d S )Nr� r� r� r� c S s g | ]}d |d |d f �qS r� r r� r r r r� � s �z6FirewallCommand.print_service_info.<locals>.<listcomp>r� r� c S s g | ]}d |d |d f �qS r� r r� r r r r� � s �z modules: � destination: c S s g | ]\}}d ||f �qS )z%s:%sr �r� �k�vr r r r� � s �z includes: z helpers: )r� r� r� Z getModulesr� �getDestinationsr� Z getIncludesZ getHelpersr& r r� rM r� ) r Zservicer� r� r� r� �modulesr� � destinationsr� ZincludesZhelpersr r r �print_service_info� s< � �� ��z"FirewallCommand.print_service_infoc C sp |� � }|�� }|�� }t|�dkr,ddg}| �|� | jrX| �d| � | �d| � | �dd�|� � d S )Nr r� r� r� r� r� r� )r� r� r� r7 r& r r� )r Zicmptyper� r� r� r� r r r �print_icmptype_info� s z#FirewallCommand.print_icmptype_infoc C s� |� � }|�� }|�� }|�� }|�� }| �|� | jrT| �d| � | �d| � | �d| � | �dd�dd� |�� D �� � | �dd�|� � d S ) Nr� r� z type: z options: r� c S s$ g | ] \}}|r d ||f n|�qS )z%s=%sr r� r r r r� s �z4FirewallCommand.print_ipset_info.<locals>.<listcomp>z entries: ) ZgetTypeZ getOptionsZ getEntriesr� r� r& r r� rM )r Zipsetr� Z ipset_type�options�entriesr� r� r r r �print_ipset_info� s � z FirewallCommand.print_ipset_infoc C s� |� � }|�� }|�� }|�� }|�� }| �|� | jrT| �d| � | �d| � | �d| � | �d| � | �dd�dd� |D �� � d S ) Nr� r� z family: z module: r� r� c S s g | ]}d |d |d f �qS r� r r� r r r r� s �z5FirewallCommand.print_helper_info.<locals>.<listcomp>)r� Z getModuleZ getFamilyr� r� r& r r� )r �helperr� r� �moduleZfamilyr� r� r r r �print_helper_info s �z!FirewallCommand.print_helper_infoc C s |r| � d� n | � dd� d S )Nrc rb r+ r/ rm r r r rd s z"FirewallCommand.print_query_resultc C s\ | j s� | �|� t�t|��}|tjtjtjtj fv rH| � d| � n| � d| |� d S )Nr2 r3 ) r r= r r5 r6 r r@ rA rB rC r* r- )r �exception_messagerP r r r �exception_handler s �z!FirewallCommand.exception_handlerc C s d|v rd}| � |tj� d S )NZNotAuthorizedExceptionz`Authorization failed. Make sure polkit agent is running or run the application as superuser.)r- r ZNOT_AUTHORIZED)r r� r% r r r r= ' s z&FirewallCommand.fail_if_not_authorizedc C s d| _ d S )NF�r r r r r r< - s z,FirewallCommand.deactivate_exception_handlerc C s d| _ d S r r� r r r r rD 0 s z*FirewallCommand.activate_exception_handlerc C sn g }t � }t|�}|D ]J}|s" qb|�� }t|�dk s|d dv rDq||vr|�|� |�|� q|�� |S )Nr+ r )�#�;)r� �open�stripr7 r8 rR �close)r �filenamer� Z entries_set�f�liner r r �get_ipset_entries_from_file3 s z+FirewallCommand.get_ipset_entries_from_file)FF)N)N)N)Nr )N)N)NNF)F)F)F)F)F)NF)F)F)rp )F).�__name__� __module__� __qualname__r r r r r r r& r( r* r- r0 r1 rU rW r[ r^ r` ra rg rh ri ro rz r� r� r� r� r� r� r� r� r� r� r� r� r� r� rd r� r= r< rD r� r r r r r " sj � L � � � � � � 3 � � 2 O )�__doc__�__all__r! Zfirewallr Zfirewall.errorsr Zdbus.exceptionsr Zfirewall.functionsr r r r r �objectr r r r r �<module> s