3
��g� � @ s� d gZ ddlZddlZddlZddlZddlmZ ddlmZ ddl m
Z
m Z m Z ddl
mZmZmZ ddlmZmZmZ ddlmZmZmZ dd lmZmZm Z dd
l m Z m Z m Z dd lm!Z! dd l"m#Z# G d
d � d e$�Z%dS )�FirewallConfig� N)�config)�log)�IcmpType�icmptype_reader�icmptype_writer)�Service�service_reader�service_writer)�Zone� zone_reader� zone_writer)�IPSet� ipset_reader� ipset_writer)�Helper�
helper_reader�
helper_writer)�Policy�
policy_reader�
policy_writer)�errors)�
FirewallErrorc @ s$ e Zd Zdd� Zdd� Zdd� Zdd� Zd d
� Zd d � Zd
d� Z dd� Z
dd� Z dd� Z dd� Z
dd� Zdd� Zdd � Zd d � Zd d � Zd!d"� Zd#d$� Zd%d&� Zd'd(� Zd)d*� Zd+d,� Zd-d.� Zd/d0� Zd1d2� Zd3d4� Z d5d6� Z d7d8� Z d9d:� Z d;d<� Z d=d>� Z!d?d@� Z"dAdB� Z#dCdD� Z$dEdF� Z%dGdH� Z&dIdJ� Z'dKdL� Z(dMdN� Z)dOdP� Z*dQdR� Z+dSdT� Z,dUdV� Z-dWdX� Z.dYdZ� Z/d[d\� Z0d]d^� Z1d_d`� Z2dadb� Z3dcdd� Z4dedf� Z5dgdh� Z6didj� Z7dkdl� Z8dmdn� Z9dodp� Z:dqdr� Z;dsdt� Z<dudv� Z=dwdx� Z>dydz� Z?d{d|� Z@d}d~� ZAdd�� ZBd�d�� ZCd�d�� ZDd�d�� ZEd�d�� ZFd�d�� ZGd�d�� ZHd�d�� ZId�d�� ZJd�d�� ZKd�d�� ZLd�d�� ZMd�d�� ZNd�d�� ZOd�d�� ZPd�d�� ZQd�d�� ZRd�d�� ZSd�d�� ZTd�d�� ZUd�d�� ZVd�d�� ZWd�d�� ZXd�d�� ZYd�d�� ZZd�d�� Z[d�d�� Z\d�d�� Z]d�d�� Z^d�d�� Z_d�d�� Z`d�d�� Zad�d�� Zbd�d Zcd�dĄ Zdd�dƄ Zed�S )�r c C s || _ | j� d S )N)�_fw�_FirewallConfig__init_vars)�self�fw� r � /usr/lib/python3.6/fw_config.py�__init__( s zFirewallConfig.__init__c C sH d| j | j| j| j| j| j| j| j| j| j | j
| j | j | j
| j| jf S )Nz>%s(%r, %r, %r, %r, %r, %r, %r, %r, %r, %r, %r, %r, %r, %r, %r))� __class__�_ipsets�
_icmptypes� _services�_zones�_helpersZpolicy_objects�_builtin_ipsets�_builtin_icmptypes�_builtin_services�_builtin_zones�_builtin_helpers�_builtin_policy_objects�_firewalld_conf� _policies�_direct)r r r r �__repr__, s zFirewallConfig.__repr__c C s^ i | _ i | _i | _i | _i | _i | _i | _i | _i | _i | _ i | _
i | _ d | _ d | _
d | _d S )N)r! r" r# r$ r% �_policy_objectsr& r' r( r) r* r+ r, r- r. )r r r r Z __init_vars6 s zFirewallConfig.__init_varsc C s4 x,t | jj� �D ]}| j| j� | j|= qW x,t | jj� �D ]}| j| j� | j|= q>W x,t | jj� �D ]}| j| j� | j|= qlW x,t | jj� �D ]}| j| j� | j|= q�W x,t | jj� �D ]}| j| j� | j|= q�W x,t | jj� �D ]}| j| j� | j|= q�W x.t | j j� �D ] }| j | j� | j |= �q$W x.t | j
j� �D ] }| j
| j� | j
|= �qTW x.t | j j� �D ] }| j | j� | j |= �q�W x.t | j j� �D ] }| j | j� | j |= �q�W | j
�r�| j
j� | `
d | _
| j�r | jj� | `d | _| j�r(| jj� | `d | _| j� d S )N)�listr& �keys�cleanupr! r' r" r( r# r) r$ r* r% r, r- r. r )r �xr r r r3 G sV
zFirewallConfig.cleanupc C s | j jj� S )N)r �policiesZquery_lockdown)r r r r �lockdown_enabled~ s z FirewallConfig.lockdown_enabledc C s | j jj||�S )N)r r5 � access_check)r �key�valuer r r r7 � s zFirewallConfig.access_checkc C s
|| _ d S )N)r, )r �confr r r �set_firewalld_conf� s z!FirewallConfig.set_firewalld_confc C s | j S )N)r, )r r r r �get_firewalld_conf� s z!FirewallConfig.get_firewalld_confc C s( t jjtj�s| jj� n
| jj� d S )N)�os�path�existsr ZFIREWALLD_CONFr, �clear�read)r r r r �update_firewalld_conf� s z$FirewallConfig.update_firewalld_confc C s
|| _ d S )N)r- )r r5 r r r � set_policies� s zFirewallConfig.set_policiesc C s | j S )N)r- )r r r r � get_policies� s zFirewallConfig.get_policiesc C s, t jjtj�s | jjj� n | jjj� d S )N) r= r> r? r ZLOCKDOWN_WHITELISTr- Zlockdown_whitelistr3 rA )r r r r �update_lockdown_whitelist� s z(FirewallConfig.update_lockdown_whitelistc C s
|| _ d S )N)r. )r Zdirectr r r �
set_direct� s zFirewallConfig.set_directc C s | j S )N)r. )r r r r �
get_direct� s zFirewallConfig.get_directc C s( t jjtj�s| jj� n
| jj� d S )N)r= r> r? r ZFIREWALLD_DIRECTr. r3 rA )r r r r �
update_direct� s z FirewallConfig.update_directc C s$ t tt| jj� �t| jj� � ��S )N)�sorted�setr1 r! r2 r& )r r r r �
get_ipsets� s zFirewallConfig.get_ipsetsc C s$ |j r|| j|j< n || j|j< d S )N)�builtinr& �namer! )r �objr r r � add_ipset� s zFirewallConfig.add_ipsetc C s8 || j kr| j | S || jkr(| j| S ttj|��d S )N)r! r& r r �
INVALID_IPSET)r rM r r r � get_ipset� s
zFirewallConfig.get_ipsetc C st |j | jkr ttj|j ��nB| j|j |kr@ttjd|j ��n |j | jkr^ttjd|j ��| j|� | j|j S )Nzself._ipsets[%s] != objz'%s' not a built-in ipset)rM r! r r � NO_DEFAULTSr& �
_remove_ipset)r rN r r r �load_ipset_defaults� s
z"FirewallConfig.load_ipset_defaultsc C s |j � S )N)�
export_config)r rN r r r �get_ipset_config� s z FirewallConfig.get_ipset_configc C sj |j rPtj|�}|j|� tj|_d|_ |j|jkr:d|_| j|� t|� |S |j|� t|� |S d S )NF) rL �copy�
import_configr �ETC_FIREWALLD_IPSETSr> �defaultrO r )r rN r: r4 r r r �set_ipset_config� s
z FirewallConfig.set_ipset_configc C sx || j ks|| jkr$ttjd| ��t� }|j|� |j|� ||_d| |_ t
j |_ d|_
d|_t|� | j|� |S )Nznew_ipset(): '%s'z%s.xmlFT)r! r& r r �
NAME_CONFLICTr �
check_namerX rM �filenamer rY r> rL rZ r rO )r rM r: r4 r r r � new_ipset� s
zFirewallConfig.new_ipsetc C s� t jj|�}t jj|�}t jj|�s�|tjkr�x�| jj� D ]D}| j| }|j |kr:| j|= |j
| j krvd| j |j
fS d|fS q:W nHxF| j j� D ]8}| j | }|j |kr�| j |= |j
| jkr�d|fS dS q�W dS t j
d|� yt||�}W n0 tk
�r } zt jd||� dS d }~X nX |j
| j k�rJ|j
| jk�rJ| j|� d|fS |tjk�r�|j
| jk�r�| j|j
j|_|| j|j
< d|fS |j
| j k�r�| j |j
= || j |j
< |j
| jk�r�d|fS d S d
S ) N�update�removezLoading ipset file '%s'z"Failed to load ipset file '%s': %s�new)NN)NN)NN)NN)NN)r= r> �basename�dirnamer? r rY r! r2 r^ rM r& r �debug1r � Exception�errorrO rZ )r rM r^ r> r4 rN �msgr r r �update_ipset_from_path� sP
z%FirewallConfig.update_ipset_from_pathc C s� |j | jkrttj|j ��|jtjkr>ttjd|jtjf ��d|j|j f }yt j
|d| � W n: t k
r� } z t j
d||� tj|� W Y d d }~X nX | j|j = d S )Nz '%s' != '%s'z %s/%s.xmlz%s.oldz Backup of file '%s' failed: %s)rM r! r r rP r> r rY �INVALID_DIRECTORY�shutil�moverf r rg r= ra )r rN rM rh r r r rS 8 s z FirewallConfig._remove_ipsetc C s$ |j s|j r ttjd|j ��d S )Nz'%s' is built-in ipset)rL rZ r r Z
BUILTIN_IPSETrM )r rN r r r �check_builtin_ipsetI s z"FirewallConfig.check_builtin_ipsetc C s | j |� | j|� d S )N)rm rS )r rN r r r � remove_ipsetN s
zFirewallConfig.remove_ipsetc C s$ | j |� | j||�}| j|� |S )N)rm � _copy_ipsetrS )r rN rM r_ r r r � rename_ipsetR s
zFirewallConfig.rename_ipsetc C s | j ||j� �S )N)r_ rU )r rN rM r r r ro X s zFirewallConfig._copy_ipsetc C s$ t tt| jj� �t| jj� � ��S )N)rI rJ r1 r" r2 r' )r r r r �
get_icmptypes] s z FirewallConfig.get_icmptypesc C s$ |j r|| j|j< n || j|j< d S )N)rL r' rM r" )r rN r r r � add_icmptypea s zFirewallConfig.add_icmptypec C s8 || j kr| j | S || jkr(| j| S ttj|��d S )N)r" r' r r �INVALID_ICMPTYPE)r rM r r r � get_icmptypeg s
zFirewallConfig.get_icmptypec C st |j | jkr ttj|j ��nB| j|j |kr@ttjd|j ��n |j | jkr^ttjd|j ��| j|� | j|j S )Nzself._icmptypes[%s] != objz '%s' not a built-in icmptype)rM r" r r rR r' �_remove_icmptype)r rN r r r �load_icmptype_defaultsn s
z%FirewallConfig.load_icmptype_defaultsc C s |j � S )N)rU )r rN r r r �get_icmptype_configz s z"FirewallConfig.get_icmptype_configc C sj |j rPtj|�}|j|� tj|_d|_ |j|jkr:d|_| j|� t|� |S |j|� t|� |S d S )NF) rL rW rX r �ETC_FIREWALLD_ICMPTYPESr> rZ rr r )r rN r: r4 r r r �set_icmptype_config} s
z"FirewallConfig.set_icmptype_configc C sx || j ks|| jkr$ttjd| ��t� }|j|� |j|� ||_d| |_ t
j |_ d|_
d|_t|� | j|� |S )Nznew_icmptype(): '%s'z%s.xmlFT)r" r' r r r\ r r] rX rM r^ r rx r> rL rZ r rr )r rM r: r4 r r r � new_icmptype� s
zFirewallConfig.new_icmptypec C s� t jj|�}t jj|�}t jj|�s�|tjkr�x�| jj� D ]D}| j| }|j |kr:| j|= |j
| j krvd| j |j
fS d|fS q:W nHxF| j j� D ]8}| j | }|j |kr�| j |= |j
| jkr�d|fS dS q�W dS t j
d|� yt||�}W n0 tk
�r } zt jd||� dS d }~X nX |j
| j k�rJ|j
| jk�rJ| j|� d|fS |tjk�r�|j
| jk�r�| j|j
j|_|| j|j
< d|fS |j
| j k�r�| j |j
= || j |j
< |j
| jk�r�d|fS d S d
S ) Nr` ra zLoading icmptype file '%s'z%Failed to load icmptype file '%s': %srb )NN)NN)NN)NN)NN)r= r> rc rd r? r rx r" r2 r^ rM r' r re r rf rg rr rZ )r rM r^ r> r4 rN rh r r r �update_icmptype_from_path� sP
z(FirewallConfig.update_icmptype_from_pathc C s� |j | jkrttj|j ��|jtjkr>ttjd|jtjf ��d|j|j f }yt j
|d| � W n: t k
r� } z t j
d||� tj|� W Y d d }~X nX | j|j = d S )Nz '%s' != '%s'z %s/%s.xmlz%s.oldz Backup of file '%s' failed: %s)rM r" r r rs r> r rx rj rk rl rf r rg r= ra )r rN rM rh r r r ru � s z FirewallConfig._remove_icmptypec C s$ |j s|j r ttjd|j ��d S )Nz'%s' is built-in icmp type)rL rZ r r ZBUILTIN_ICMPTYPErM )r rN r r r �check_builtin_icmptype� s z%FirewallConfig.check_builtin_icmptypec C s | j |� | j|� d S )N)r| ru )r rN r r r �remove_icmptype� s
z FirewallConfig.remove_icmptypec C s$ | j |� | j||�}| j|� |S )N)r| �_copy_icmptyperu )r rN rM rz r r r �rename_icmptype� s
z FirewallConfig.rename_icmptypec C s | j ||j� �S )N)rz rU )r rN rM r r r r~ s z FirewallConfig._copy_icmptypec C s$ t tt| jj� �t| jj� � ��S )N)rI rJ r1 r# r2 r( )r r r r � get_services
s zFirewallConfig.get_servicesc C s$ |j r|| j|j< n || j|j< d S )N)rL r( rM r# )r rN r r r � add_service s zFirewallConfig.add_servicec C s< || j kr| j | S || jkr(| j| S ttjd| ��d S )Nzget_service(): '%s')r# r( r r �INVALID_SERVICE)r rM r r r � get_service s
zFirewallConfig.get_servicec C st |j | jkr ttj|j ��nB| j|j |kr@ttjd|j ��n |j | jkr^ttjd|j ��| j|� | j|j S )Nzself._services[%s] != objz'%s' not a built-in service)rM r# r r rR r( �_remove_service)r rN r r r �load_service_defaults s
z$FirewallConfig.load_service_defaultsc C sr |j � }g }x\td�D ]P}|j| d |krN|jtjt||j| d ��� q|j||j| d � qW t|�S )N� r )�export_config_dict�range�IMPORT_EXPORT_STRUCTURE�appendrW �deepcopy�getattr�tuple)r rN � conf_dict� conf_list�ir r r �get_service_config' s " z!FirewallConfig.get_service_configc C s |j � S )N)r� )r rN r r r �get_service_config_dict3 s z&FirewallConfig.get_service_config_dictc C s� i }x&t |�D ]\}}|||j| d < qW |jr|tj|�}|j|� tj|_d|_|j|jkrfd|_| j |� t
|� |S |j|� t
|� |S d S )Nr F) � enumerater� rL rW �import_config_dictr �ETC_FIREWALLD_SERVICESr> rZ r� r
)r rN r: r� r� r9 r4 r r r �set_service_config6 s
z!FirewallConfig.set_service_configc C sj |j rPtj|�}|j|� tj|_d|_ |j|jkr:d|_| j|� t|� |S |j|� t|� |S d S )NF) rL rW r� r r� r> rZ r� r
)r rN r: r4 r r r �set_service_config_dictJ s
z&FirewallConfig.set_service_config_dictc C s� || j ks|| jkr$ttjd| ��i }x&t|�D ]\}}||tj| d < q2W t� }|j|� |j |� ||_
d| |_ t j
|_d|_d|_t|� | j|� |S )Nznew_service(): '%s'r z%s.xmlFT)r# r( r r r\ r� r r� r] r� rM r^ r r� r> rL rZ r
r� )r rM r: r� r� r9 r4 r r r � new_serviceZ s"
zFirewallConfig.new_servicec C sx || j ks|| jkr$ttjd| ��t� }|j|� |j|� ||_d| |_ t
j |_ d|_
d|_t|� | j|� |S )Nznew_service(): '%s'z%s.xmlFT)r# r( r r r\ r r] r� rM r^ r r� r> rL rZ r
r� )r rM r: r4 r r r �new_service_dictq s
z FirewallConfig.new_service_dictc C s� t jj|�}t jj|�}t jj|�s�|tjkr�x�| jj� D ]D}| j| }|j |kr:| j|= |j
| j krvd| j |j
fS d|fS q:W nHxF| j j� D ]8}| j | }|j |kr�| j |= |j
| jkr�d|fS dS q�W dS t j
d|� yt||�}W n0 tk
�r } zt jd||� dS d }~X nX |j
| j k�rJ|j
| jk�rJ| j|� d|fS |tjk�r�|j
| jk�r�| j|j
j|_|| j|j
< d|fS |j
| j k�r�| j |j
= || j |j
< |j
| jk�r�d|fS d S d
S ) Nr` ra zLoading service file '%s'z$Failed to load service file '%s': %srb )NN)NN)NN)NN)NN)r= r> rc rd r? r r� r# r2 r^ rM r( r re r rf rg r� rZ )r rM r^ r> r4 rN rh r r r �update_service_from_path� sP
z'FirewallConfig.update_service_from_pathc C s� |j | jkrttj|j ��|jtjkr>ttjd|jtjf ��d|j|j f }yt j
|d| � W n: t k
r� } z t j
d||� tj|� W Y d d }~X nX | j|j = d S )Nz '%s' != '%s'z %s/%s.xmlz%s.oldz Backup of file '%s' failed: %s)rM r# r r r� r> r r� rj rk rl rf r rg r= ra )r rN rM rh r r r r� � s z FirewallConfig._remove_servicec C s$ |j s|j r ttjd|j ��d S )Nz'%s' is built-in service)rL rZ r r ZBUILTIN_SERVICErM )r rN r r r �check_builtin_service� s z$FirewallConfig.check_builtin_servicec C s | j |� | j|� d S )N)r� r� )r rN r r r �remove_service� s
z FirewallConfig.remove_servicec C s$ | j |� | j||�}| j|� |S )N)r� �
_copy_servicer� )r rN rM r� r r r �rename_service� s
z FirewallConfig.rename_servicec C s | j ||j� �S )N)r� r� )r rN rM r r r r� � s z FirewallConfig._copy_servicec C s$ t tt| jj� �t| jj� � ��S )N)rI rJ r1 r$ r2 r) )r r r r � get_zones� s zFirewallConfig.get_zonesc C s$ |j r|| j|j< n || j|j< d S )N)rL r) rM r$ )r rN r r r �add_zone� s zFirewallConfig.add_zonec C s( || j kr| j |= || jkr$| j|= d S )N)r) r$ )r rM r r r � forget_zone� s
zFirewallConfig.forget_zonec C s< || j kr| j | S || jkr(| j| S ttjd| ��d S )Nzget_zone(): %s)r$ r) r r � INVALID_ZONE)r rM r r r �get_zone� s
zFirewallConfig.get_zonec C st |j | jkr ttj|j ��nB| j|j |kr@ttjd|j ��n |j | jkr^ttjd|j ��| j|� | j|j S )Nzself._zones[%s] != objz'%s' not a built-in zone)rM r$ r r rR r) � _remove_zone)r rN r r r �load_zone_defaults s
z!FirewallConfig.load_zone_defaultsc C sr |j � }g }x\td�D ]P}|j| d |krN|jtjt||j| d ��� q|j||j| d � qW t|�S )N� r )r� r� r� r� rW r� r� r� )r rN r� r� r� r r r �get_zone_config s " z FirewallConfig.get_zone_configc C s |j � S )N)r� )r rN r r r �get_zone_config_dict s z#FirewallConfig.get_zone_config_dictc C s� i }x&t |�D ]\}}|||j| d < qW |jr�tj|�}| |_|j|� tj|_d|_|j|jkrld|_ | j
|� t |� |S | |_|j|� t |� |S d S )Nr F) r� r� rL rW � fw_configr� r �ETC_FIREWALLD_ZONESr> rZ r� r
)r rN r: r� r� r9 r4 r r r �set_zone_config s$
z FirewallConfig.set_zone_configc C sv |j rVtj|�}| |_|j|� tj|_d|_ |j|jkr@d|_| j|� t |� |S | |_|j|� t |� |S d S )NF)
rL rW r� r� r r� r> rZ r� r
)r rN r: r4 r r r �set_zone_config_dict6 s
z#FirewallConfig.set_zone_config_dictc C s� || j ks|| jkr$ttjd| ��i }x&t|�D ]\}}||tj| d < q2W t� }| |_|j |� |j
|� ||_ d| |_ t
j|_d|_d|_t|� | j|� |S )Nznew_zone(): '%s'r z%s.xmlFT)r$ r) r r r\ r� r r� r� r] r� rM r^ r r� r> rL rZ r
r� )r rM r: r� r� r9 r4 r r r �new_zoneH s"
zFirewallConfig.new_zonec C s~ || j ks|| jkr$ttjd| ��t� }| |_|j|� |j|� ||_ d| |_
t j |_
d|_d|_t|� | j|� |S )Nznew_zone(): '%s'z%s.xmlFT)r$ r) r r r\ r r� r] r� rM r^ r r� r> rL rZ r
r� )r rM r: r4 r r r �
new_zone_dict_ s
z FirewallConfig.new_zone_dictc C s t jj|�}t jj|�}t jj|�s�|jtj�r�x�| jj � D ]D}| j| }|j
|kr<| j|= |j | j krxd| j |j fS d|fS q<W nHxF| j j � D ]8}| j | }|j
|kr�| j |= |j | jkr�d|fS d S q�W d
S t
jd|� yt||�}W n0 tk
�r } zt
jd||� d S d }~X nX | |_|jtj��rlt|�ttj�k�rldt jj|�t jj|�dd � f |_ |j | j k�r�|j | jk�r�| j|� d|fS |jtj��r�|j | jk�r�| j|j j|_|| j|j < d|fS |j | j k�r| j |j = || j |j < |j | jk�rd|fS d
S dS )Nr` ra zLoading zone file '%s'z!Failed to load zone file '%s': %sz%s/%sr � rb )NN)NN)NN���)NN)NN)r= r> rc rd r? �
startswithr r� r$ r2 r^ rM r) r re r rf rg r� �lenr� rZ )r rM r^ r> r4 rN rh r r r �update_zone_from_pathr sZ
z$FirewallConfig.update_zone_from_pathc C s� |j | jkrttj|j ��|jjtj�s@ttj d|jtjf ��d|j|j f }yt
j |d| � W n: t k
r� } z t
jd||� tj|� W Y d d }~X nX | j|j = d S )Nz '%s' doesn't start with '%s'z %s/%s.xmlz%s.oldz Backup of file '%s' failed: %s)rM r$ r r r� r> r� r r� rj rk rl rf r rg r= ra )r rN rM rh r r r r� � s zFirewallConfig._remove_zonec C s$ |j s|j r ttjd|j ��d S )Nz'%s' is built-in zone)rL rZ r r Z BUILTIN_ZONErM )r rN r r r �check_builtin_zone� s z!FirewallConfig.check_builtin_zonec C s | j |� | j|� d S )N)r� r� )r rN r r r � remove_zone� s
zFirewallConfig.remove_zonec C sN | j |� |j� }| j|� y| j||�}W n | j|j|� � Y nX |S )N)r� r� r� r� rM )r rN rM Zobj_confr� r r r � rename_zone� s
zFirewallConfig.rename_zonec C s$ t tt| jj� �t| jj� � ��S )N)rI rJ r1 r0 r2 r+ )r r r r �get_policy_objects� s z!FirewallConfig.get_policy_objectsc C s$ |j r|| j|j< n || j|j< d S )N)rL r+ rM r0 )r rN r r r �add_policy_object� s z FirewallConfig.add_policy_objectc C s< || j kr| j | S || jkr(| j| S ttjd| ��d S )Nzget_policy_object(): %s)r0 r+ r r �INVALID_POLICY)r rM r r r �get_policy_object� s
z FirewallConfig.get_policy_objectc C st |j | jkr ttj|j ��nB| j|j |kr@ttjd|j ��n |j | jkr^ttjd|j ��| j|� | j|j S )Nz self._policy_objects[%s] != objz'%s' not a built-in policy)rM r0 r r rR r+ �_remove_policy_object)r rN r r r �load_policy_object_defaults� s
z*FirewallConfig.load_policy_object_defaultsc C s |j � S )N)r� )r rN r r r � get_policy_object_config_dict s z,FirewallConfig.get_policy_object_config_dictc C sv |j rVtj|�}| |_|j|� tj|_d|_ |j|jkr@d|_| j|� t |� |S | |_|j|� t |� |S d S )NF)
rL rW r� r� r �ETC_FIREWALLD_POLICIESr> rZ r� r )r rN r: r4 r r r � set_policy_object_config_dict s
z,FirewallConfig.set_policy_object_config_dictc C s~ || j ks|| jkr$ttjd| ��t� }| |_|j|� |j|� ||_ d| |_
t j |_
d|_d|_t|� | j|� |S )Nznew_policy_object(): '%s'z%s.xmlFT)r0 r+ r r r\ r r� r] r� rM r^ r r� r> rL rZ r r� )r rM r: r4 r r r �new_policy_object_dict s
z%FirewallConfig.new_policy_object_dictc C s t jj|�}t jj|�}t jj|�s�|jtj�r�x�| jj � D ]D}| j| }|j
|kr<| j|= |j | j krxd| j |j fS d|fS q<W nHxF| j j � D ]8}| j | }|j
|kr�| j |= |j | jkr�d|fS d S q�W d
S t
jd|� yt||�}W n0 tk
�r } zt
jd||� d S d }~X nX | |_|jtj��rlt|�ttj�k�rldt jj|�t jj|�dd � f |_ |j | j k�r�|j | jk�r�| j|� d|fS |jtj��r�|j | jk�r�| j|j j|_|| j|j < d|fS |j | j k�r| j |j = || j |j < |j | jk�rd|fS d
S dS )Nr` ra zLoading policy file '%s'z#Failed to load policy file '%s': %sz%s/%sr r� rb )NN)NN)NNr� )NN)NN)r= r> rc rd r? r� r r� r0 r2 r^ rM r+ r re r rf rg r� r� r� rZ )r rM r^ r> r4 rN rh r r r � update_policy_object_from_path, sZ
z-FirewallConfig.update_policy_object_from_pathc C s� |j | jkrttj|j ��|jjtj�s@ttj d|jtjf ��d|j|j f }yt
j |d| � W n: t k
r� } z t
jd||� tj|� W Y d d }~X nX | j|j = d S )Nz '%s' doesn't start with '%s'z %s/%s.xmlz%s.oldz Backup of file '%s' failed: %s)rM r0 r r r� r> r� r r� rj rk rl rf r rg r= ra )r rN rM rh r r r r� y s z$FirewallConfig._remove_policy_objectc C s$ |j s|j r ttjd|j ��d S )Nz'%s' is built-in policy)rL rZ r r ZBUILTIN_POLICYrM )r rN r r r �check_builtin_policy_object� s z*FirewallConfig.check_builtin_policy_objectc C s | j |� | j|� d S )N)r� r� )r rN r r r �remove_policy_object� s
z#FirewallConfig.remove_policy_objectc C s$ | j |� | j||�}| j|� |S )N)r� �_copy_policy_objectr� )r rN rM Znew_policy_objectr r r �rename_policy_object� s
z#FirewallConfig.rename_policy_objectc C s | j ||j� �S )N)r� r� )r rN rM r r r r� � s z"FirewallConfig._copy_policy_objectc C s$ t tt| jj� �t| jj� � ��S )N)rI rJ r1 r% r2 r* )r r r r � get_helpers� s zFirewallConfig.get_helpersc C s$ |j r|| j|j< n || j|j< d S )N)rL r* rM r% )r rN r r r �
add_helper� s zFirewallConfig.add_helperc C s8 || j kr| j | S || jkr(| j| S ttj|��d S )N)r% r* r r �INVALID_HELPER)r rM r r r �
get_helper� s
zFirewallConfig.get_helperc C st |j | jkr ttj|j ��nB| j|j |kr@ttjd|j ��n |j | jkr^ttjd|j ��| j|� | j|j S )Nzself._helpers[%s] != objz'%s' not a built-in helper)rM r% r r rR r* �_remove_helper)r rN r r r �load_helper_defaults� s
z#FirewallConfig.load_helper_defaultsc C s |j � S )N)rU )r rN r r r �get_helper_config� s z FirewallConfig.get_helper_configc C sj |j rPtj|�}|j|� tj|_d|_ |j|jkr:d|_| j|� t|� |S |j|� t|� |S d S )NF) rL rW rX r �ETC_FIREWALLD_HELPERSr> rZ r� r )r rN r: r4 r r r �set_helper_config� s
z FirewallConfig.set_helper_configc C sx || j ks|| jkr$ttjd| ��t� }|j|� |j|� ||_d| |_ t
j |_ d|_
d|_t|� | j|� |S )Nznew_helper(): '%s'z%s.xmlFT)r% r* r r r\ r r] rX rM r^ r r� r> rL rZ r r� )r rM r: r4 r r r �
new_helper� s
zFirewallConfig.new_helperc C s� t jj|�}t jj|�}t jj|�s�|tjkr�x�| jj� D ]D}| j| }|j |kr:| j|= |j
| j krvd| j |j
fS d|fS q:W nHxF| j j� D ]8}| j | }|j |kr�| j |= |j
| jkr�d|fS dS q�W dS t j
d|� yt||�}W n0 tk
�r } zt jd||� dS d }~X nX |j
| j k�rJ|j
| jk�rJ| j|� d|fS |tjk�r�|j
| jk�r�| j|j
j|_|| j|j
< d|fS |j
| j k�r�| j |j
= || j |j
< |j
| jk�r�d|fS d S d
S ) Nr` ra zLoading helper file '%s'z#Failed to load helper file '%s': %srb )NN)NN)NN)NN)NN)r= r> rc rd r? r r� r% r2 r^ rM r* r re r rf rg r� rZ )r rM r^ r> r4 rN rh r r r �update_helper_from_path� sP
z&FirewallConfig.update_helper_from_pathc C s� |j | jkrttj|j ��|jtjkr>ttjd|jtjf ��d|j|j f }yt j
|d| � W n: t k
r� } z t j
d||� tj|� W Y d d }~X nX | j|j = d S )Nz '%s' != '%s'z %s/%s.xmlz%s.oldz Backup of file '%s' failed: %s)rM r% r r r� r> r r� rj rk rl rf r rg r= ra )r rN rM rh r r r r� & s z FirewallConfig._remove_helperc C s$ |j s|j r ttjd|j ��d S )Nz'%s' is built-in helper)rL rZ r r ZBUILTIN_HELPERrM )r rN r r r �check_builtin_helper7 s z#FirewallConfig.check_builtin_helperc C s | j |� | j|� d S )N)r� r� )r rN r r r �
remove_helper< s
z FirewallConfig.remove_helperc C s$ | j |� | j||�}| j|� |S )N)r� � _copy_helperr� )r rN rM r� r r r �
rename_helper@ s
z FirewallConfig.rename_helperc C s | j ||j� �S )N)r� rU )r rN rM r r r r� F s zFirewallConfig._copy_helperN)f�__name__�
__module__� __qualname__r r/ r r3 r6 r7 r; r< rB rC rD rE rF rG rH rK rO rQ rT rV r[ r_ ri rS rm rn rp ro rq rr rt rv rw ry rz r{ ru r| r} r r~ r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r r r r r ' s�
7 E E E M M E)&�__all__rW r= Zos.pathrk Zfirewallr Zfirewall.core.loggerr Zfirewall.core.io.icmptyper r r Zfirewall.core.io.servicer r r
Zfirewall.core.io.zoner r r
Zfirewall.core.io.ipsetr r r Zfirewall.core.io.helperr r r Zfirewall.core.io.policyr r r r Zfirewall.errorsr �objectr r r r r �<module> s