JFIF $
d d 7
Viewing File: /usr/lib/python3.9/site-packages/firewall/core/__pycache__/fw_direct.cpython-39.pyc
a
� i�Y � @ sn d gZ ddlmZ ddlmZ ddlmZ ddlmZ ddlm Z ddl
m Z ddl m
Z
G d d � d e�Zd
S ) �FirewallDirect� )�LastUpdatedOrderedDict)� ipXtables)�ebtables)�FirewallTransaction)�log)�errors)�
FirewallErrorc @ sL e Zd Zdd� Zdd� Zdd� Zdd� Zd d
� Zd d � Zd
d� Z dd� Z
dNdd�Z dd� Z dd� Z
dOdd�Zdd� Zd d � Zd d � Zd d!� ZdPd"d#�ZdQd$d%�Zd&d'� Zd(d)� Zd*d+� ZdRd,d-�ZdSd.d/�Zd0d1� Zd2d3� Zd4d5� Z d6d7� Z d8d9� Z d:d;� Z dTd<d=�Z dUd>d?�Z!d@dA� Z"dBdC� Z#dDdE� Z$dFdG� Z%dHdI� Z&dJdK� Z'dLdM� Z(dS )Vr c C s || _ | �� d S �N)�_fw�_FirewallDirect__init_vars)�self�fw� r �;/usr/lib/python3.9/site-packages/firewall/core/fw_direct.py�__init__' s zFirewallDirect.__init__c C s d| j | j| j| jf S )Nz%s(%r, %r, %r))� __class__�_chains�_rules�_rule_priority_positions�r
r r r �__repr__+ s �zFirewallDirect.__repr__c C s" i | _ i | _i | _i | _d | _d S r
)r r r �
_passthroughs�_objr r r r Z __init_vars/ s
zFirewallDirect.__init_varsc C s | � � d S r
)r r r r r �cleanup6 s zFirewallDirect.cleanupc C s
t | j�S r
)r r r r r r �new_transaction; s z FirewallDirect.new_transactionc C s
|| _ d S r
)r )r
�objr r r �set_permanent_config@ s z#FirewallDirect.set_permanent_configc C s* t | j�t | j� t | j� dkr&dS dS )Nr TF)�lenr r r r r r r �has_runtime_configurationC s "z(FirewallDirect.has_runtime_configurationc C sB | � � r dS t| j�� �t| j�� � t| j�� � dkr>dS dS )NTr F)r r r �get_all_chains�
get_all_rules�get_all_passthroughsr r r r �has_configurationH s � ��z FirewallDirect.has_configurationNc C sP |d u r| � � }n|}| �| j�� | j�� | j�� f|� |d u rL|�d� d S �NT)r �
set_configr r r! r" �execute)r
�use_transaction� transactionr r r � apply_directQ s
��zFirewallDirect.apply_directc C s i }i }i }| j D ]>}|\}}| j | D ]&}| j�|||�s(|�|g ��|� q(q| jD ]X}|\}}}| j| D ]>\} }
| j�|||| |
�sp||vr�t� ||< | || | |
f< qpqX| jD ]@}| j| D ]0}
| j� ||
�s�||vr�g ||< || �|
� q�q�|||fS r
)
r r � query_chain�
setdefault�appendr �
query_ruler r �query_passthrough) r
Zchains�rulesZ passthroughs�table_id�ipv�table�chain�chain_id�priority�argsr r r �get_runtime_configb s,
z!FirewallDirect.get_runtime_configc C s | j | j| jfS r
)r r r r r r r �
get_config� s zFirewallDirect.get_configc C s� |d u r| � � }n|}|\}}}|D ]r}|\}} || D ]\}
| �|| |
�s8z| j|| |
|d� W q8 ty� } zt�t| �� W Y d } ~ q8d } ~ 0 0 q8q$|D ]�} | \}} }
|| D ]j\}
}| �|| |
|
|�s�z| j|| |
|
||d� W q� t�y } zt�t| �� W Y d } ~ q�d } ~ 0 0 q�q�|D ]n}|| D ]^}| � ||��s0z| j
|||d� W n4 t�y� } zt�t| �� W Y d } ~ n
d } ~ 0 0 �q0�q$|d u �r�|� d� d S )N)r' T) r r* � add_chainr r Zwarning�strr- �add_ruler. �add_passthroughr& )r
Zconfr' r( r r r r0 r1 r2 r3 �errorr4 r5 r6 r r r r% � sF
�
(
�
( �
,
zFirewallDirect.set_configc C s( g d�}||vr$t tjd||f ��d S )N)�ipv4�ipv6Zeb�'%s' not in '%s')r r Z INVALID_IPV)r
r1 Zipvsr r r �
_check_ipv� s
�zFirewallDirect._check_ipvc C sF | � |� |dv r tj�� ntj�� }||vrBttjd||f ��d S )N�r> r? r@ )rA r �BUILT_IN_CHAINS�keysr r r Z
INVALID_TABLE)r
r1 r2 Ztablesr r r �_check_ipv_table� s
�
�z FirewallDirect._check_ipv_tablec C s� |dv r4t j| }| jjr i }qH| j�|�j| }ntj| }tj| }||v r`tt j
d| ��||v rxtt j
d| ��|dv r�| jj � |�d ur�tt j
d| ��d S )NrB z chain '%s' is built-in chainzchain '%s' is reservedzChain '%s' is reserved)r rC r �nftables_enabled�get_direct_backend_by_ipv�
our_chainsr Z
OUR_CHAINSr r Z
BUILTIN_CHAIN�zoneZzone_from_chainZ
INVALID_CHAIN)r
r1 r2 r3 Zbuilt_in_chainsrH r r r �_check_builtin_chain� s(
���z#FirewallDirect._check_builtin_chainc C sH |r| j �|g ��|� n*| j | �|� t| j | �dkrD| j |= d S �Nr )r r+ r, �remover )r
r0 r3 �addr r r �_register_chain� s
z FirewallDirect._register_chainc C s� |d u r| � � }n|}| j�� r.|�| jj� | jjrZ| jj�� rZ|�| jjj| jj g� | �
d||||� |d u r~|� d� d S r$ ) r r � may_skip_flush_direct_backends�add_pre�flush_direct_backends�
ipset_enabled�ipset�omit_native_ipset� apply_ipsets�
ipset_backend�_chainr& �r
r1 r2 r3 r' r( r r r r9 � s
zFirewallDirect.add_chainc C s> |d u r| � � }n|}| �d||||� |d u r:|�d� d S �NFT)r rW r& rX r r r � remove_chain� s
zFirewallDirect.remove_chainc C s: | � ||� | �|||� ||f}|| jv o8|| j| v S r
)rE rJ r )r
r1 r2 r3 r0 r r r r* � s
�zFirewallDirect.query_chainc C s, | � ||� ||f}|| jv r(| j| S g S r
)rE r )r
r1 r2 r0 r r r �
get_chains� s
zFirewallDirect.get_chainsc C s< g }| j D ],}|\}}| j | D ]}|�|||f� q q
|S r
)r r, )r
�r�keyr1 r2 r3 r r r r s
z FirewallDirect.get_all_chainsc C s� |d u r| � � }n|}| j�� r.|�| jj� | jjrZ| jj�� rZ|�| jjj| jj g� | �
d||||||� |d u r�|� d� d S r$ ) r r rO rP rQ rR rS rT rU rV �_ruler& �r
r1 r2 r3 r5 r6 r' r( r r r r; s
zFirewallDirect.add_rulec C sB |d u r| � � }n|}| �d||||||� |d u r>|�d� d S rY )r r^ r& r_ r r r � remove_rule s
zFirewallDirect.remove_rulec C s2 | � ||� |||f}|| jv o0||f| j| v S r
)rE r )r
r1 r2 r3 r5 r6 r4 r r r r- ) s
�zFirewallDirect.query_rulec C s6 | � ||� |||f}|| jv r2t| j| �� �S g S r
)rE r �listrD )r
r1 r2 r3 r4 r r r � get_rules/ s
zFirewallDirect.get_rulesc
C sJ g }| j D ]:}|\}}}| j | D ] \}}|�||||t|�f� q"q
|S r
)r r, ra )r
r\ r] r1 r2 r3 r5 r6 r r r r! 6 s
z FirewallDirect.get_all_rulesc C s� |rr|| j vrt� | j |< || j | |< || jvr<i | j|< || j| v rb| j| | |7 < q�|| j| |< n<| j | |= t| j | �dkr�| j |= | j| | |8 < d S rK )r r r r )r
�rule_idr4 r5 �enable�countr r r �_register_rule> s
z FirewallDirect._register_rulec
C sZ z| j �| j �|�j|�W S tyT } z"t�|� ttj |��W Y d }~n
d }~0 0 d S r
)
r �rulerG �name� Exceptionr Zdebug2r r ZCOMMAND_FAILED)r
r1 r6 �msgr r r � passthroughR s
zFirewallDirect.passthroughc C sX |r*|| j vrg | j |< | j | �|� n*| j | �|� t| j | �dkrT| j |= d S rK )r r, rL r )r
r1 r6 rd r r r �_register_passthroughZ s
z$FirewallDirect._register_passthroughc C s� |d u r| � � }n|}| j�� r.|�| jj� | jjrZ| jj�� rZ|�| jjj| jj g� | �
d|t |�|� |d u r�|� d� d S r$ )
r r rO rP rQ rR rS rT rU rV � _passthroughra r& �r
r1 r6 r' r( r r r r< d s
z FirewallDirect.add_passthroughc C s@ |d u r| � � }n|}| �d|t|�|� |d u r<|�d� d S rY )r rm ra r& rn r r r �remove_passthroughu s
z!FirewallDirect.remove_passthroughc C s || j v ot|�| j | v S r
)r �tuple)r
r1 r6 r r r r. � s
�z FirewallDirect.query_passthroughc C s6 g }| j D ]&}| j | D ]}|�|t|�f� qq
|S r
�r r, ra )r
r\ r1 r6 r r r r" � s
z#FirewallDirect.get_all_passthroughsc C s0 g }|| j v r,| j | D ]}|�t|�� q|S r
rq )r
r1 r\ r6 r r r �get_passthroughs� s
z FirewallDirect.get_passthroughsc
C s� g }|D ]�}d}|D ]�}z|� |�}W n ty8 Y q0 t|�|krd||d v rd}||d �d�}|D ]&} |dd� }
| |
|d < |�|
� qpq|s|�|� q|S )z5Split values combined with commas for options in optsF�,� TN)�index�
ValueErrorr �splitr, ) r
r/ ZoptsZ out_rulesrg Z processed�opt�i�items�itemr^ r r r � split_value� s$ zFirewallDirect.split_valuec C s | � ||� | jjs0|dv r0| jj�||||� |}| j�|�} | jjs`| �|||�r`d| }n:| jjr�|dd � dkr�| �|||d d� �r�|d d� }|||f}
||f} |r�|
| jv r�| | j|
v r�tt j
d||||f ��n@|
| jvs�| | j|
v�rtt j d||||f ��| j|
| }d} d}
|
| j v �r�t
| j |
�� �}d}|t|�k �r�||| k�r�| | j |
|| 7 } |d7 }�qLt|�g}| �|d d
g�}| �|d d g�}|D ]4}|�| | �|||| t|��� | d7 } |
d7 }
�q�| �| |
|||
� |�| j| |
|| |
� d S )
NrB z %s_directi����Z_directz"rule '%s' already is in '%s:%s:%s'z rule '%s' is not in '%s:%s:%s'rt r z-sz--sourcez-dz
--destination)rE r rF rI �create_zone_base_by_chainrG Zis_chain_builtinr r r �ALREADY_ENABLED� NOT_ENABLEDr �sortedrD r ra r| r; Z
build_rulerp rf �add_fail)r
rd r1 r2 r3 r5 r6 r( rW �backendr4 rc ru re Z positions�jZ args_list�_argsr r r r^ � sp �� �
�
�
��
�
��(
�zFirewallDirect._rulec C s� | � ||� | �|||� ||f}|rV|| jv r�|| j| v r�ttjd|||f ��n.|| jvsn|| j| vr�ttjd|||f ��| j�|�}|� ||�
|||�� | � |||� |� | j ||| � d S )Nz chain '%s' already is in '%s:%s'z chain '%s' is not in '%s:%s')
rE rJ r r r r~ r r rG Z add_rulesZbuild_chain_rulesrN r� )r
rM r1 r2 r3 r( r0 r� r r r rW s0
���
��� zFirewallDirect._chainc
C s� | � |� t|�}|rD|| jv rp|| j| v rpttjd||f ��n,|| jvs\|| j| vrpttjd||f ��| j�|�}|r�|� |� |dv r�|�
|�\}}|r�|r�| jj � |||� |} n
|�
|�} |�|| � | �|||� |�| j||| � d S )Nzpassthrough '%s', '%s'rB )rA rp r r r r~ r r rG Zcheck_passthroughZ passthrough_parse_table_chainrI r} Zreverse_passthroughr; rl r� )
r
rd r1 r6 r( Z
tuple_argsr� r2 r3 r� r r r rm 0 s:
�
�
�
�
�zFirewallDirect._passthrough)N)N)N)N)N)N)N)N))�__name__�
__module__� __qualname__r r r r r r r r# r) r7 r8 r% rA rE rJ rN r9 rZ r* r[ r r; r` r- rb r! rf rk rl r< ro r. r" rr r| r^ rW rm r r r r r & sN
'
�
jN)�__all__Zfirewall.fw_typesr Z
firewall.corer r Z firewall.core.fw_transactionr Zfirewall.core.loggerr Zfirewallr Zfirewall.errorsr �objectr r r r r �<module> s Back to Directory
nL+D550H?Mx ,D"v]qv;6*Zqn)ZP 0 !1 A "#a$2Qr D8 a Ri[f\mIykIw0 cuFcRı?lO7к_f˓[C$殷WF<_W ԣs KcëIzyQy /_LKℂ;C",pFA: /]=H ~,ls/9ć:[=/#f;)x {ٛEQ )~ =𘙲r*2~ a _V=' kumF D}KYYC)({ *g&f`툪ry`=^cJ.I](*`wq 1dđ#̩͑0;H]u搂@:~וKL Nsh}OIR*8:2 !lDJVo( 3=M(zȰ+i*NA r6KnSl )!JJӁ* %݉?|D}d5:eP0R;{$X'xF@.ÊB {,WJuQɲRI;9QE琯62fT.DUJ;*cP A\ILNj!J۱+O\ ͔]ޒ SJȧc%ANolՎprULZԛerE2=XDXgVQeӓk yP7U*omQIs,K`)6\G3t?pgjrmۛجwluGtf h9uyP0D;Uڽ"OXlif$)&|ML0Zrm1[HXPlPR0'G=i2N +0e2]] 9VTPO7h(F*癈 '=QVZDF,d߬~TX
G[`le69CR(!S2!P
<0x < !1AQ "Raq02Br#SCTb
?Ζ"]mH5WR7k.ۛ!}Q~+yԏz|@T20S~Kek *zFf^2X*(@8r?CIuI|֓>^ExLgNUY+{.RѪ
τVYTD I62'8Y2 7'\TP.6d&˦@Vqi|8- OΕ]ʔ U=TL8=;6c| !qfF3aů&~$l}'NWUs$Uk^SV:U# 6w++s&r+nڐ{@29 gL
u"TÙM=6 (^"7r} =6YݾlCuhquympǦ
G jhsǜNlɻ}o7 #S6aw4!OSrD57%|?x>L
|/nD6?/8w#[)L7+6〼T ATg ! %5MmZ/c-{1_Je"|^$'O&ޱմ Trb$ w)R$&
N1EtdU3Uȉ1pM" N*(DN yd96.(jQ)X
5cQɎMyW? Q*!R>6=7)Xj5`J]e 8%t!+'!1Q 5 !1 AQaqё#2"0BRb ? Gt^## .llQT $v,,m 㵜5 ubV =sY+@d{N! dnO< .-B; _wJt6;QJd.Qc%p{ 1,sNDdFHI0ГoXшe黅XۢF:)[FGXƹ/w_cMeD,ʡcc. WDtA$j@:) -# u
c1<@ۗ9F)KJ-hpP]_x[qBlbp ʖw q"LFGd ƶ*s+ډ_Zc"? %t[IP 6J]#=ɺVvvCGsGh1 >)6|ey?Lӣm,4GWUi` ]uJVoV DG< SB 6ϏQ@ TiUly OU0kfV~~}SZ@*WUUi##; s/[ =!7}" WN]'(L! ~y5g9T̅JkbM' +s:S + B)v@Mj
e Cf jE 0Y\QnzG1д~Wo{T 9?`Rmyhsy3!HAD]mc1~2L Su7xT;j$`}4->L#vzŏ ILS ֭ T { rjGKC; bpU= -`BsK.SFw4Mq]ZdHS0)tLg