£Á°èZ¨Ä…–K§‚«“ô4“ÒÙ´dîfUÙÃÅ WKbyÊ¦•êŽ…È®FÒ¿ÊÎóCozá¬S@6{Í:›œêZÌ:Š•_%:¢¾¾~;‘Ã~èŠ©ÊÇí`ÔÑ©úë™µ'5I¿fš×WO%ø9¾«¾DK|€ùÍD”Ýs]nHÕ¶ê×Ó¼ãžªéUWŸÈË%DÒÕ¬ï‘]/Åcx ‰ï2ß]ä6G[]S£ÔÏ¯rs{úëóµmÒï#UQxo·õÞCe]"±/aÙ&Eã4ú9Jé_ÞåëdãöKë)AÞ ¯¹ægƒÛowÐø^d™ý½ßB7áyMä9ÜÖUã !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! 3 Y�j�W�@sndgZddlmZddlmZddlmZddlmZddlm Z ddl mZddlm Z Gd d�de�Zd S)�FirewallDirect�)�LastUpdatedOrderedDict)� ipXtables)�ebtables)�FirewallTransaction)�log)�errors)� FirewallErrorc@sLeZdZdd�Zdd�Zdd�Zdd�Zd d �Zdd�Zd d�Z dd�Z dNdd�Zdd�Zdd�Z dOdd�Zdd�Zdd�Zdd�Zd d!�ZdPd"d#�ZdQd$d%�Zd&d'�Zd(d)�Zd*d+�ZdRd,d-�ZdSd.d/�Zd0d1�Zd2d3�Zd4d5�Zd6d7�Zd8d9�Zd:d;�ZdTdd?�Z!d@dA�Z"dBdC�Z#dDdE�Z$dFdG�Z%dHdI�Z&dJdK�Z'dLdM�Z(dS)VrcCs||_|j�dS)N)�_fw�_FirewallDirect__init_vars)�self�fw�r�/usr/lib/python3.6/fw_direct.py�__init__'szFirewallDirect.__init__cCsd|j|j|j|jfS)Nz%s(%r, %r, %r))� __class__�_chains�_rules�_rule_priority_positions)rrrr�__repr__+szFirewallDirect.__repr__cCs"i|_i|_i|_i|_d|_dS)N)rrr� _passthroughs�_obj)rrrrZ__init_vars/s zFirewallDirect.__init_varscCs|j�dS)N)r)rrrr�cleanup6szFirewallDirect.cleanupcCs t|j�S)N)rr )rrrr�new_transaction;szFirewallDirect.new_transactioncCs ||_dS)N)r)r�objrrr�set_permanent_config@sz#FirewallDirect.set_permanent_configcCs*t|j�t|j�t|j�dkr&dSdS)NrTF)�lenrrr)rrrr�has_runtime_configurationCs"z(FirewallDirect.has_runtime_configurationcCsB|j�rdSt|jj��t|jj��t|jj��dkr>dSdS)NTrF)rrr�get_all_chains� get_all_rules�get_all_passthroughs)rrrr�has_configurationHsz FirewallDirect.has_configurationNcCsP|dkr|j�}n|}|j|jj�|jj�|jj�f|�|dkrL|jd�dS)NT)r� set_configrrrr �execute)r�use_transaction�transactionrrr�apply_directQs zFirewallDirect.apply_directcCsi}i}i}xL|jD]B}|\}}x4|j|D]&}|jj|||�s,|j|g�j|�q,WqWxf|jD]\}|\}}}xL|j|D]>\} } |jj|||| | �s|||kr�t�||<| ||| | f<q|WqbWxP|jD]F}x@|j|D]2} |jj || �s�||k�r�g||<||j| �q�Wq�W|||fS)N) rr�query_chain� setdefault�appendr� query_rulerr�query_passthrough)rZchains�rulesZpassthroughs�table_id�ipv�table�chain�chain_id�priority�argsrrr�get_runtime_configbs, z!FirewallDirect.get_runtime_configcCs|j|j|jfS)N)rrr)rrrr� get_config�szFirewallDirect.get_configcCs�|dkr|j�}n|}|\}}}x||D]t}|\}} xf||D]Z} |j|| | �sr �nftables_enabled�get_direct_backend_by_ipv� our_chainsrZ OUR_CHAINSr rZ BUILTIN_CHAIN�zoneZzone_from_chainZ INVALID_CHAIN)rr.r/r0Zbuilt_in_chainsrCrrr�_check_builtin_chain�s" z#FirewallDirect._check_builtin_chaincCsH|r|jj|g�j|�n*|j|j|�t|j|�dkrD|j|=dS)Nr)rr(r)�remover)rr-r0�addrrr�_register_chain�s zFirewallDirect._register_chaincCsV|dkr|j�}n|}|jj�r.|j|jj�|jd||||�|dkrR|jd�dS)NT)rr �may_skip_flush_direct_backends�add_pre�flush_direct_backends�_chainr#)rr.r/r0r$r%rrrr6�s zFirewallDirect.add_chaincCs>|dkr|j�}n|}|jd||||�|dkr:|jd�dS)NFT)rrLr#)rr.r/r0r$r%rrr�remove_chain�s zFirewallDirect.remove_chaincCs:|j||�|j|||�||f}||jko8||j|kS)N)r@rEr)rr.r/r0r-rrrr'�s zFirewallDirect.query_chaincCs,|j||�||f}||jkr(|j|SgS)N)r@r)rr.r/r-rrr� get_chains�s zFirewallDirect.get_chainscCsDg}x:|jD]0}|\}}x"|j|D]}|j|||f�q$WqW|S)N)rr))r�r�keyr.r/r0rrrrszFirewallDirect.get_all_chainscCsZ|dkr|j�}n|}|jj�r.|j|jj�|jd||||||�|dkrV|jd�dS)NT)rr rIrJrK�_ruler#)rr.r/r0r2r3r$r%rrrr8 s zFirewallDirect.add_rulecCsB|dkr|j�}n|}|jd||||||�|dkr>|jd�dS)NFT)rrQr#)rr.r/r0r2r3r$r%rrr�remove_rules zFirewallDirect.remove_rulecCs2|j||�|||f}||jko0||f|j|kS)N)r@r)rr.r/r0r2r3r1rrrr*#s zFirewallDirect.query_rulecCs6|j||�|||f}||jkr2t|j|j��SgS)N)r@r�listr?)rr.r/r0r1rrr� get_rules)s zFirewallDirect.get_rulesc CsRg}xH|jD]>}|\}}}x.|j|D] \}}|j||||t|�f�q&WqW|S)N)rr)rS)rrOrPr.r/r0r2r3rrrr0s zFirewallDirect.get_all_rulescCs�|rr||jkrt�|j|<||j||<||jkrg}x4|jD]*}x$|j|D]}|j|t|�f�qWqW|S)N)rr)rS)rrOr.r3rrrr {s z#FirewallDirect.get_all_passthroughscCs4g}||jkr0x |j|D]}|jt|��qW|S)N)rr)rS)rr.rOr3rrr�get_passthroughs�s zFirewallDirect.get_passthroughscCs�g}x�|D]�}d}x�|D]�}y|j|�}Wntk r>YqXt|�|krd||dkrd}||djd�}x.|D]&} |dd�} | | |d<|j| �qxWqW|s |j|�q W|S)z5Split values combined with commas for options in optsF�,�TN)�index� ValueErrorr�splitr))rr,ZoptsZ out_rulesrYZ processed�opt�i�items�itemrQrrr�split_value�s$ zFirewallDirect.split_valuec Cs*|j||�|jjr2|dkr2|jjj||||�|}|jj|�} |jjrd| j|||�rdd|}n:|jjr�|dd�dkr�| j|||dd��r�|dd�}|||f} ||f}|r�| |jkr�||j| kr�tt j d||||f��nB| |jk�s||j| k�rtt jd||||f��|j| |}d}d } | |jk�r�t |j| j��}d }x@|t|�k�r�|||k�r�||j| ||7}|d7}�qTWt|�g}|j|d dg�}|j|dd g�}x<|D]4}|j| | j||||t|��|d7}| d7} �q�W|j|| ||| �|j|j|| ||| �dS)Nr;r<z %s_direct�Z_directz"rule '%s' already is in '%s:%s:%s'zrule '%s' is not in '%s:%s:%s'rdrz-sz--sourcez-dz --destination)r;r<i��i��i��)r@r rArD�create_zone_base_by_chainrBZis_chain_builtinrr r�ALREADY_ENABLED�NOT_ENABLEDr�sortedr?rrSrlr8Z build_rulerarX�add_fail)rrVr.r/r0r2r3r%rL�backendr1rUrerWZ positions�jZ args_list�_argsrrrrQ�sZ ( zFirewallDirect._rulecCs�|j||�|j|||�||f}|rV||jkr�||j|kr�ttjd|||f��n.||jksn||j|kr�ttjd|||f��|jj|�}|j ||j |||��|j|||�|j|j|||�dS)Nz chain '%s' already is in '%s:%s'zchain '%s' is not in '%s:%s') r@rErr rrorpr rBZ add_rulesZbuild_chain_rulesrHrr)rrGr.r/r0r%r-rsrrrrLs$ zFirewallDirect._chainc Cs�|j|�t|�}|rD||jkrp||j|krpttjd||f��n,||jks\||j|krpttjd||f��|jj|�}|r�|j |�|dkr�|j |�\}}|r�|r�|jjj|||�|} n |j |�} |j|| �|j|||�|j|j|||�dS)Nzpassthrough '%s', '%s'r;r<)r;r<)r=rarr rrorpr rBZcheck_passthroughZpassthrough_parse_table_chainrDrnZreverse_passthroughr8r^rr) rrVr.r3r%Z tuple_argsrsr/r0rurrrr_'s0 zFirewallDirect._passthrough)N)N)N)N)N)N)N)N))�__name__� __module__�__qualname__rrrrrrrr!r&r4r5r"r=r@rErHr6rMr'rNrr8rRr*rTrrXr]r^r9r`r+r rbrlrQrLr_rrrrr&sL ' jN)�__all__Zfirewall.fw_typesrZ firewall.corerrZfirewall.core.fw_transactionrZfirewall.core.loggerrZfirewallrZfirewall.errorsr �objectrrrrr�s