3
��g�W � @ sn d gZ ddlmZ ddlmZ ddlmZ ddlmZ ddlm Z ddl
m Z ddl m
Z
G d d � d e�Zd
S ) �FirewallDirect� )�LastUpdatedOrderedDict)� ipXtables)�ebtables)�FirewallTransaction)�log)�errors)�
FirewallErrorc @ sL e Zd Zdd� Zdd� Zdd� Zdd� Zd d
� Zd d � Zd
d� Z dd� Z
dNdd�Z dd� Z dd� Z
dOdd�Zdd� Zd d � Zd d � Zd d!� ZdPd"d#�ZdQd$d%�Zd&d'� Zd(d)� Zd*d+� ZdRd,d-�ZdSd.d/�Zd0d1� Zd2d3� Zd4d5� Z d6d7� Z d8d9� Z d:d;� Z dTd<d=�Z dUd>d?�Z!d@dA� Z"dBdC� Z#dDdE� Z$dFdG� Z%dHdI� Z&dJdK� Z'dLdM� Z(dS )Vr c C s || _ | j� d S )N)�_fw�_FirewallDirect__init_vars)�self�fw� r � /usr/lib/python3.6/fw_direct.py�__init__' s zFirewallDirect.__init__c C s d| j | j| j| jf S )Nz%s(%r, %r, %r))� __class__�_chains�_rules�_rule_priority_positions)r r r r �__repr__+ s zFirewallDirect.__repr__c C s" i | _ i | _i | _i | _d | _d S )N)r r r �
_passthroughs�_obj)r r r r Z __init_vars/ s
zFirewallDirect.__init_varsc C s | j � d S )N)r )r r r r �cleanup6 s zFirewallDirect.cleanupc C s
t | j�S )N)r r
)r r r r �new_transaction; s z FirewallDirect.new_transactionc C s
|| _ d S )N)r )r �objr r r �set_permanent_config@ s z#FirewallDirect.set_permanent_configc C s* t | j�t | j� t | j� dkr&dS dS )Nr TF)�lenr r r )r r r r �has_runtime_configurationC s "z(FirewallDirect.has_runtime_configurationc C sB | j � r dS t| jj� �t| jj� � t| jj� � dkr>dS dS )NTr F)r r r �get_all_chains�
get_all_rules�get_all_passthroughs)r r r r �has_configurationH s z FirewallDirect.has_configurationNc C sP |d kr| j � }n|}| j| jj� | jj� | jj� f|� |d krL|jd� d S )NT)r �
set_configr r r r �execute)r �use_transaction� transactionr r r � apply_directQ s
zFirewallDirect.apply_directc C s i }i }i }xL| j D ]B}|\}}x4| j | D ]&}| jj|||�s,|j|g �j|� q,W qW xf| jD ]\}|\}}}xL| j| D ]>\} }
| jj|||| |
�s|||kr�t� ||< | || | |
f< q|W qbW xP| jD ]F}x@| j| D ]2}
| jj ||
�s�||k� r�g ||< || j|
� q�W q�W |||fS )N)
r r � query_chain�
setdefault�appendr �
query_ruler r �query_passthrough) r Zchains�rulesZ passthroughs�table_id�ipv�table�chain�chain_id�priority�argsr r r �get_runtime_configb s,
z!FirewallDirect.get_runtime_configc C s | j | j| jfS )N)r r r )r r r r �
get_config� s zFirewallDirect.get_configc C s� |d kr| j � }n|}|\}}}x||D ]t}|\}} xf|| D ]Z}
| j|| |
�s<y| j|| |
|d� W q< tk
r� } ztjt| �� W Y d d } ~ X q<X q<W q&W x�|D ]�} | \}} }
xt|| D ]h\}
}| j|| |
|
|�s�y| j|| |
|
||d� W q� tk
�r" } ztjt| �� W Y d d } ~ X q�X q�W q�W xx|D ]p}xh|| D ]\}| j ||��s@y| j
|||d� W n2 tk
�r� } ztjt| �� W Y d d } ~ X nX �q@W �q2W |d k�r�|j d� d S )N)r$ T) r r' � add_chainr r Zwarning�strr* �add_ruler+ �add_passthroughr# )r Zconfr$ r% r r r r- r. r/ r0 �errorr1 r2 r3 r r r r" � s@
(
(
,
zFirewallDirect.set_configc C s* dddg}||kr&t tjd||f ��d S )N�ipv4�ipv6Zebz'%s' not in '%s')r r Z INVALID_IPV)r r. Zipvsr r r �
_check_ipv� s
zFirewallDirect._check_ipvc C sF | j |� |dkr tjj� ntjj� }||krBttjd||f ��d S )Nr; r< z'%s' not in '%s')r; r< )r= r �BUILT_IN_CHAINS�keysr r r Z
INVALID_TABLE)r r. r/ Ztablesr r r �_check_ipv_table� s
z FirewallDirect._check_ipv_tablec C s� |dkr4t j| }| jjr i }qH| jj|�j| }ntj| }tj| }||kr`tt j
d| ��||krxtt j
d| ��|dkr�| jj j |�d k r�tt j
d| ��d S )Nr; r< z chain '%s' is built-in chainzchain '%s' is reservedzChain '%s' is reserved)r; r< )r; r< )r r> r
�nftables_enabled�get_direct_backend_by_ipv�
our_chainsr Z
OUR_CHAINSr r Z
BUILTIN_CHAIN�zoneZzone_from_chainZ
INVALID_CHAIN)r r. r/ r0 Zbuilt_in_chainsrC r r r �_check_builtin_chain� s"
z#FirewallDirect._check_builtin_chainc C sH |r| j j|g �j|� n*| j | j|� t| j | �dkrD| j |= d S )Nr )r r( r) �remover )r r- r0 �addr r r �_register_chain� s
z FirewallDirect._register_chainc C sV |d kr| j � }n|}| jj� r.|j| jj� | jd||||� |d krR|jd� d S )NT)r r
� may_skip_flush_direct_backends�add_pre�flush_direct_backends�_chainr# )r r. r/ r0 r$ r% r r r r6 � s
zFirewallDirect.add_chainc C s> |d kr| j � }n|}| jd||||� |d kr:|jd� d S )NFT)r rL r# )r r. r/ r0 r$ r% r r r � remove_chain� s
zFirewallDirect.remove_chainc C s: | j ||� | j|||� ||f}|| jko8|| j| kS )N)r@ rE r )r r. r/ r0 r- r r r r' � s
zFirewallDirect.query_chainc C s, | j ||� ||f}|| jkr(| j| S g S )N)r@ r )r r. r/ r- r r r �
get_chains� s
zFirewallDirect.get_chainsc C sD g }x:| j D ]0}|\}}x"| j | D ]}|j|||f� q$W q W |S )N)r r) )r �r�keyr. r/ r0 r r r r s z FirewallDirect.get_all_chainsc C sZ |d kr| j � }n|}| jj� r.|j| jj� | jd||||||� |d krV|jd� d S )NT)r r
rI rJ rK �_ruler# )r r. r/ r0 r2 r3 r$ r% r r r r8 s
zFirewallDirect.add_rulec C sB |d kr| j � }n|}| jd||||||� |d kr>|jd� d S )NFT)r rQ r# )r r. r/ r0 r2 r3 r$ r% r r r � remove_rule s
zFirewallDirect.remove_rulec C s2 | j ||� |||f}|| jko0||f| j| kS )N)r@ r )r r. r/ r0 r2 r3 r1 r r r r* # s
zFirewallDirect.query_rulec C s6 | j ||� |||f}|| jkr2t| j| j� �S g S )N)r@ r �listr? )r r. r/ r0 r1 r r r � get_rules) s
zFirewallDirect.get_rulesc C sR g }xH| j D ]>}|\}}}x.| j | D ] \}}|j||||t|�f� q&W q W |S )N)r r) rS )r rO rP r. r/ r0 r2 r3 r r r r 0 s
z FirewallDirect.get_all_rulesc C s� |rr|| j krt� | j |< || j | |< || jkr<i | j|< || j| krb| j| | |7 < q�|| j| |< n<| j | |= t| j | �dkr�| j |= | j| | |8 < d S )Nr )r r r r )r �rule_idr1 r2 �enable�countr r r �_register_rule8 s
z FirewallDirect._register_rulec C sV y| j j| j j|�j|�S tk
rP } z tj|� ttj |��W Y d d }~X nX d S )N)
r
�rulerB �name� Exceptionr Zdebug2r r ZCOMMAND_FAILED)r r. r3 �msgr r r � passthroughL s
zFirewallDirect.passthroughc C sX |r*|| j krg | j |< | j | j|� n*| j | j|� t| j | �dkrT| j |= d S )Nr )r r) rF r )r r. r3 rV r r r �_register_passthroughT s
z$FirewallDirect._register_passthroughc C sX |d kr| j � }n|}| jj� r.|j| jj� | jd|t|�|� |d krT|jd� d S )NT)r r
rI rJ rK � _passthroughrS r# )r r. r3 r$ r% r r r r9 ^ s
z FirewallDirect.add_passthroughc C s@ |d kr| j � }n|}| jd|t|�|� |d kr<|jd� d S )NFT)r r_ rS r# )r r. r3 r$ r% r r r �remove_passthroughl s
z!FirewallDirect.remove_passthroughc C s || j kot|�| j | kS )N)r �tuple)r r. r3 r r r r+ w s
z FirewallDirect.query_passthroughc C s> g }x4| j D ]*}x$| j | D ]}|j|t|�f� q W q W |S )N)r r) rS )r rO r. r3 r r r r { s
z#FirewallDirect.get_all_passthroughsc C s4 g }|| j kr0x | j | D ]}|jt|�� qW |S )N)r r) rS )r r. rO r3 r r r �get_passthroughs� s
z FirewallDirect.get_passthroughsc C s� g }x�|D ]�}d}x�|D ]�}y|j |�}W n tk
r> Y qX t|�|krd||d krd}||d jd�}x.|D ]&} |dd� }
| |
|d < |j|
� qxW qW |s
|j|� q
W |S )z5Split values combined with commas for options in optsF�,� TN)�index�
ValueErrorr �splitr) ) r r, ZoptsZ out_rulesrY Z processed�opt�i�items�itemrQ r r r � split_value� s$
zFirewallDirect.split_valuec
C s* | j ||� | jj r2|dkr2| jjj||||� |}| jj|�} | jj rd| j|||�rdd| }n:| jjr�|dd � dkr�| j|||d d� �r�|d d� }|||f}
||f} |r�|
| jkr�| | j|
kr�tt j
d||||f ��nB|
| jk�s| | j|
k�rtt j d||||f ��| j|
| }d} d }
|
| j k�r�t
| j |
j� �}d }x@|t|�k �r�||| k�r�| | j |
|| 7 } |d7 }�qTW t|�g}| j|d
d g�}| j|d d
g�}x<|D ]4}|j| | j|||| t|��� | d7 } |
d7 }
�q�W | j| |
|||
� |j| j| |
|| |
� d S )Nr; r< z %s_direct� Z_directz"rule '%s' already is in '%s:%s:%s'z rule '%s' is not in '%s:%s:%s'rd r z-sz--sourcez-dz
--destination)r; r< i����i����i����)r@ r
rA rD �create_zone_base_by_chainrB Zis_chain_builtinr r r �ALREADY_ENABLED� NOT_ENABLEDr �sortedr? r rS rl r8 Z
build_rulera rX �add_fail)r rV r. r/ r0 r2 r3 r% rL �backendr1 rU re rW Z positions�jZ args_list�_argsr r r rQ � sZ
(
zFirewallDirect._rulec C s� | j ||� | j|||� ||f}|rV|| jkr�|| j| kr�ttjd|||f ��n.|| jksn|| j| kr�ttjd|||f ��| jj|�}|j ||j
|||�� | j |||� |j | j ||| � d S )Nz chain '%s' already is in '%s:%s'z chain '%s' is not in '%s:%s')
r@ rE r r r ro rp r
rB Z add_rulesZbuild_chain_rulesrH rr )r rG r. r/ r0 r% r- rs r r r rL s$
zFirewallDirect._chainc
C s� | j |� t|�}|rD|| jkrp|| j| krpttjd||f ��n,|| jks\|| j| krpttjd||f ��| jj|�}|r�|j |� |dkr�|j
|�\}}|r�|r�| jj j |||� |} n
|j
|�} |j|| � | j|||� |j| j||| � d S )Nzpassthrough '%s', '%s'r; r< )r; r< )r= ra r r r ro rp r
rB Zcheck_passthroughZ passthrough_parse_table_chainrD rn Zreverse_passthroughr8 r^ rr )
r rV r. r3 r% Z
tuple_argsrs r/ r0 ru r r r r_ ' s0
zFirewallDirect._passthrough)N)N)N)N)N)N)N)N))�__name__�
__module__� __qualname__r r r r r r r r! r& r4 r5 r" r= r@ rE rH r6 rM r' rN r r8 rR r* rT r rX r] r^ r9 r` r+ r rb rl rQ rL r_ r r r r r & sL
'
jN)�__all__Zfirewall.fw_typesr Z
firewall.corer r Z firewall.core.fw_transactionr Zfirewall.core.loggerr Zfirewallr Zfirewall.errorsr �objectr r r r r �<module> s