Aurora
Adminer
Auto Root
WP Admin
cPanel Reset
Anti Backdoor
Root
lib
python3.9
site-packages
firewall
core
__pycache__
Upload
New Folder
New File
Name
Size
Permissions
Actions
..
-
-
-
Upload File
Select File
New Folder
Folder Name
New File
File Name
Add WordPress Admin
Database Host
Database Name
Database User
Database Password
Admin Username
Admin Password
cPanel Password Reset
Email Address
Edit: fw.cpython-39.opt-1.pyc
a F��j� � @ s� d gZ ddlZddlZddlZddlZddlZddlmZmZ ddl m Z ddl m Z ddl m Z ddl mZ ddl mZ dd l mZ dd l mZ dd lmZ dd lmZ dd lmZ ddlmZ ddlmZ ddl m Z ddl m Z ddl m!Z! ddl"m#Z# ddl$m%Z% ddl&m'Z'm(Z( ddl)m*Z* ddl+m,Z, ddl-m.Z. ddl/m0Z0 ddl1m2Z2 ddl3m4Z4 dd l5m6Z6m7Z7 dd l8m9Z9 dd l:m;Z; dd l<m=Z= dd l>m?Z? dd!l@mAZA dd"lBmCZC dd#l mDZD dd$lEmFZF G d%d � d eG�ZHdS )&�Firewall� N)�Dict�List)�config)� functions)� ipXtables)�ebtables)�nftables)�ipset)�modules)�FirewallIcmpType)�FirewallService)� FirewallZone)�FirewallDirect)�FirewallConfig)�FirewallPolicies)� FirewallIPSet)�FirewallTransaction)�FirewallHelper)�FirewallPolicy)�nm_get_bus_name�nm_get_interfaces_in_zone)�log)� IO_Object)�firewalld_conf)�Direct)�service_reader)�icmptype_reader)� zone_reader�Zone)� ipset_reader)� IPSET_TYPES)� helper_reader)� policy_reader)�check_on_disk_config)� Rich_Rule)�errors)� FirewallErrorc @ sZ e Zd Zd�dd�Zdd� Zdd� Zdd � Zi feee e f d �d d �Z d d� Z dd� Z dd� Zdd� Zdd� Zdd� Zdd� Zdd � Zd�d d �Zd d � Zd!d"� Zd�d#d$�Zd�d%d&�Zd'd(� Zd)d*� Zd+d,� Zd-d.� Z d/d0� Z d1d2� Z d3d4� Z d�d5d6�Z d7d8� Z!d9d:� Z"d;d<� Z#d=d>� Z$d?d@� Z%dAdB� Z&dCdD� Z'dEdF� Z(dGdH� Z)dIdJ� Z*dKdL� Z+d�dNdO�Z,d�dPdQ�Z-dRdS� Z.d�dTdU�Z/d�dVdW�Z0d�dXdY�Z1d�dZd[�Z2d\d]� Z3d^d_� Z4d`da� Z5dbdc� Z6ddde� Z7dfdg� Z8dhdi� Z9djdk� Z:dldm� Z;dndo� Z<dpdq� Z=drds� Z>dtdu� Z?d�dvdw�Z@dxdy� ZAdzd{� ZBd|d}� ZCd~d� ZDd�d�� ZEd�d�� ZFd�d�� ZGd�d�� ZHd�d�� ZId�d�� ZJdMS )�r Fc C s� t tj�| _|| _|sXt�| �| _t�| �| _ t � � | _ t � � | _ t�| �| _t�� | _t| �| _t| �| _t| �| _t| �| _t| �| _t� | _ t | �| _ t | �| _ t | �| _!| �"� d S �N)#r r �FIREWALLD_CONF�_firewalld_conf�_offliner � ip4tables�ip4tables_backend� ip6tables�ip6tables_backendr �ebtables_backendr � ipset_backendr �nftables_backendr �modules_backendr �icmptyper �servicer �zoner �directr r �policiesr r �helperr �policy�_Firewall__init_vars)�selfZoffline� r= �4/usr/lib/python3.9/site-packages/firewall/core/fw.py�__init__G s& zFirewall.__init__c C sD d| j | j| j| j| j| j| j| j| j| j | j | j | j | j | jf S )Nz:%s(%r, %r, %r, %r, %r, %r, %r, %r, %r, %r, %r, %r, %r, %r))� __class__�ip4tables_enabled�ip6tables_enabled�ebtables_enabled�_state�_panic� _default_zone�_module_refcount�_marks�cleanup_on_exit�cleanup_modules_on_exit�_ipv6_rpfilter� ipset_enabled�_individual_calls� _log_denied�r< r= r= r> �__repr___ s ��zFirewall.__repr__c C s� d| _ d| _tj| _g | _g | _i | _g | _tj | _ tj | _ tj | _tj| _tj| _tj| _tj| _tj| _tj| _tj| _ | j r�d| _ d| _ d| _ d| _!t"| _#d| _$n0d| _ g | _%d| _ g | _&d| _ d| _!t"| _#d| _$d S )NZINITFT)'rD rE r Z FALLBACK_ZONErF �_default_zone_interfacesZ_nm_assigned_interfacesrG rH ZFALLBACK_CLEANUP_ON_EXITrI Z FALLBACK_CLEANUP_MODULES_ON_EXITrJ ZFALLBACK_IPV6_RPFILTERrK ZFALLBACK_INDIVIDUAL_CALLSrM ZFALLBACK_LOG_DENIEDrN ZFALLBACK_FIREWALL_BACKEND�_firewall_backendZ FALLBACK_FLUSH_ALL_ON_RELOAD�_flush_all_on_reloadZFALLBACK_RFC3964_IPV4� _rfc3964_ipv4Z FALLBACK_ALLOW_ZONE_DRIFTINGZ_allow_zone_driftingZ FALLBACK_NFTABLES_TABLE_OWNER�_nftables_table_ownerr+ rA rB rC rL r! Zipset_supported_types�nftables_enabled�ipv4_supported_icmp_types�ipv6_supported_icmp_typesrO r= r= r> Z __init_varsh s@ zFirewall.__init_varsc s� i }� fdd�� j �� D �|d< � fdd�� j�� D �|d< � fdd�� j�� D �|d< � fdd�� j�� D �|d < � fd d�� j� � D �|d < � fd d�� j � � D �|d < i |d< � j � d�|d d< i |d< i |d d< t� j�� ��t� j�� ��D ] }� j�|�|d d |< q�t� j�� ��t� j�� ��D ]�}|� jv�sR|� jv�r6t�� j�|��|d d |< g |d d | _|� jv�r�|d d | j�d� |� jv�r6|d d | j�d� �q6|S )zH Returns a dict of dicts of all runtime config objects. c s i | ]}|� j �|��qS r= )r � get_ipset)�.0�_ipsetrO r= r> � <dictcomp>� � z4Firewall.get_all_io_objects_dict.<locals>.<dictcomp>�ipsetsc s i | ]}|� j �|��qS r= )r9 � get_helper)rZ r9 rO r= r> r\ � r] �helpersc s i | ]}|� j �|��qS r= )r4 � get_icmptype)rZ r4 rO r= r> r\ � r] � icmptypesc s i | ]}|� j �|��qS r= )r5 � get_service)rZ r5 rO r= r> r\ � r] �servicesc s i | ]}|� j �|��qS r= )r6 �get_zone)rZ r6 rO r= r> r\ � r] �zonesc s i | ]}|� j �|��qS r= )r: Z get_policy)rZ r: rO r= r> r\ � r] r8 Zconf�FirewallBackend�runtimeZicmptypes_unsupported�ipv4�ipv6)r � get_ipsetsr9 � get_helpersr4 � get_icmptypesr5 � get_servicesr6 � get_zonesr: Z"get_policies_not_derived_from_zoner* �get�setr � differencera � intersectionrW rX �copyZ destination�append)r< Z conf_dictr4 r= rO r> �get_all_io_objects_dict� s8 � � � z Firewall.get_all_io_objects_dict)�extra_io_objectsc C sn | � � }|D ] }|| D ]}||| |j< qq g d�}|D ].}|| }|�� D ]\}} | �| �� |� qNq:d S )N)r^ r` rb rd rf r8 )rv �name�itemsZcheck_config_dictZexport_config_dict) r< rw Zall_io_objectsZtype_key�obj�orderZ io_obj_typeZio_objsrx Zio_objr= r= r> �full_check_config� s zFirewall.full_check_configc C s� | j r$d| j�� vr$t�d� d| _ | jrHd| j�� vrHt�d� d| _| jrld| j�� vrlt�d� d| _| j s�| js�| j s�t t j d��d S )N�filterziptables is not usable.Fzip6tables is not usable.zebtables is not usable.zNo IPv4 and IPv6 firewall.) rA r- �get_available_tablesr �info1rB r/ rC r0 rV r' r& � UNKNOWN_ERRORrO r= r= r> �_start_check_tables� s& � � � �z Firewall._start_check_tablesc C s� | j �� | j jsH| j jr&t�d� n"| jr8t�d� n t�d� d| _| jr^| j � d�| _ n| jrr| j � � | _ ng | _ | j �� | j js�| j jr�t�d� n"| jr�t�d� n t�d� d| _ | jr�| j � d �| _n| j r�| j � � | _ng | _| j�� | jj�s>| jj�rt�d � n$| j�r.t�d � n t�d � d| _| j�rb| j�sb| jj�sbt�d � | j �� | j�r�| j j�s�t�d� d S )NzFiptables-restore is missing, using individual calls for IPv4 firewall.zMiptables-restore and iptables are missing, IPv4 direct rules won't be usable.zCiptables-restore and iptables are missing, disabling IPv4 firewall.Fri zGip6tables-restore is missing, using individual calls for IPv6 firewall.zOip6tables-restore and ip6tables are missing, IPv6 direct rules won't be usable.zEip6tables-restore and ip6tables are missing, disabling IPv6 firewall.rj zHebtables-restore is missing, using individual calls for bridge firewall.zKebtables-restore and ebtables are missing, eb direct rules won't be usable.zEebtables-restore and ebtables are missing, disabling bridge firewall.zSebtables-restore is not supporting the --noflush option, will therefore not be usedzpConfiguration has NftablesTableOwner=True, but it's not supported by nftables. Table ownership will be disabled.)r- Z fill_exists�restore_command_existsZcommand_existsr �warningrV r rA r2 Zsupported_icmp_typesrW r/ rB rX r0 rC rM �restore_noflush_option�debug1Z probe_supportrU Zsupports_table_ownerrO r= r= r> �_start_probe_backends� s\ � ���z Firewall._start_probe_backendsc C s� t �dtj� z| j�� W n: tyV } z"t �|� t �d� W Y d }~�n2d }~0 0 | j�d�rr| j�d�| _ | j�d�r�| j�d�}|d ur�|� � dv r�d| _ t �d| j � | j�d�r�| j�d�}|d ur�|� � d v r�d | _ t �d | j � | j�d ��rR| j�d �}|d u�rR|� � d v �rRt �d � z| j �� W n t�yP Y n0 | j�d��r�| j�d�}|d u�r�|� � dv �r�d| _nV|� � dv �r�d| _n@|� � dv �r�d| _n*|� � dv �r�d| _n|� � dv �r�d| _t �d| j� d�� | j�d��r8| j�d�}|d u�r8|� � d v �r8t �d� d | _| j�d ��r�| j�d �}|d u �sj|� � dk�rrd | _n|� � | _t �d | j� | j�d ��r�| j�d �| _t �d | j� | j�d!��r�| j�d!�}|� � dv �r�d| _nd | _t �d"| j� | j�d#��r<| j�d#�}|� � dv �r(d| _nd | _t �d$| j� | j�d%��r�| j�d%�}|� � dv �rld| _nd | _t �d&| j� | j�t�| j�� d S )'Nz"Loading firewalld config file '%s'z0Using fallback firewalld configuration settings.� DefaultZoneZ CleanupOnExit)�noZfalseFz CleanupOnExit is set to '%s'ZCleanupModulesOnExit)�yes�trueTz#CleanupModulesOnExit is set to '%s'ZLockdownzLockdown is enabledZ IPv6_rpfilterr� )r� r� �strictr� )�looser� )� loose-forwardr� )�strict-forwardr� zIPv6_rpfilter is set to '�'ZIndividualCallszIndividualCalls is enabled� LogDeniedZoffzLogDenied is set to '%s'rg z FirewallBackend is set to '%s'ZFlushAllOnReloadz FlushAllOnReload is set to '%s'Z RFC3964_IPv4zRFC3964_IPv4 is set to '%s'ZNftablesTableOwnerz!NftablesTableOwner is set to '%s')r r� r r) r* �read� Exceptionr� rp rF �lowerrI rJ r8 Zenable_lockdownr' rK rM rN rR rS rT rU �set_firewalld_confrt �deepcopy)r< �msg�valuer= r= r> �_start_load_firewalld_conf# s� " � � � � � �z#Firewall._start_load_firewalld_confc C s� t �d� z| jj�� W nX tyr } z@| j�� rJt �d| jjj|� nt �d| jjj|� W Y d }~n d }~0 0 | j � t � | j�� d S )NzLoading lockdown whitelistz*Failed to load lockdown whitelist '%s': %s) r r� r8 Zlockdown_whitelistr� r� Zquery_lockdown�error�filenamer Z set_policiesrt r� �r< r� r= r= r> � _start_load_lockdown_whitelist� s � �z'Firewall._start_load_lockdown_whitelistc C sL | � tj� | �tj� | �tj� | �tj� | � tj � | � tj � d S r( ) �_loader_ipsetsr ZFIREWALLD_IPSETS�_loader_icmptypesZFIREWALLD_ICMPTYPES�_loader_helpersZFIREWALLD_HELPERS�_loader_servicesZFIREWALLD_SERVICES� _loader_zonesZFIREWALLD_ZONES�_loader_policiesZFIREWALLD_POLICIESrO r= r= r> �_start_load_stock_config� s z!Firewall._start_load_stock_configc C sL | � tj� | �tj� | �tj� | �tj� | � tj � | � tj � d S r( ) r� r ZETC_FIREWALLD_IPSETSr� ZETC_FIREWALLD_ICMPTYPESr� ZETC_FIREWALLD_HELPERSr� ZETC_FIREWALLD_SERVICESr� ZETC_FIREWALLD_ZONESr� ZETC_FIREWALLD_POLICIESrO r= r= r> �_start_load_user_config� s z Firewall._start_load_user_configc C s� | j �� D ] }| j�t�| j �|��� q | j �� D ] }| j� t�| j � |��� q4| j � � D ] }| j � t�| j �|��� q^| j �� D ] }| j�t�| j �|��� q�| j �� D ] }| j�t�| j �|��� q�| j�t�| j �� �� i }| j �� D ]�}| j �|�}d|j v�r0| j � t�| j �|��� q�t j �!|j �} | |v�r|t"� } | | _ | �#| j � |j | _ d| _$d| _%| || < t&�'d| |j t j(|j)� || �*|� q�|D ]}| j � || � �q�d S )N�/Fz"Combining zone '%s' using '%s%s%s')+r rk r � add_ipsetrt r� rY rm r4 � add_icmptypera rl r9 � add_helperr_ rn r5 � add_servicerc �get_policy_objectsr: Z add_policy�get_policy_objectr7 Zset_permanent_configZ get_directro re rx r6 �add_zone�os�path�basenamer � check_name�defaultZforwardr r� �sepr� �combine) r< r[ r4 r9 r5 r: Zcombined_zonesr6 Zz_objZ combined_nameZ combined_zoner= r= r> � _start_copy_config_to_runtime� s\ ������ � �z&Firewall._start_copy_config_to_runtimec C sz t tj�}tj�tj�rjt�dtj � z |�� W n4 t yh } z t� dtj|� W Y d }~n d }~0 0 | j� |� d S )Nz Loading direct rules file '%s'z)Failed to load direct rules file '%s': %s) r r ZFIREWALLD_DIRECTr� r� �existsr r� r� r� r� Z set_direct)r< rz r� r= r= r> �_start_load_direct_rules� s � �z!Firewall._start_load_direct_rulesc C s t | �}|s| j|d� |r |s4| j�� rF| j�� rF|�d� |�� |rb|rbt�d� | j � � | j |d� |�d� |�� | j�� r�| j�� r�t�d� | j� � t�d� | j |d� t�d� | jj|d� | jjd | j|d� t�d� | jj|d� |�d� |�� d S )N��use_transactionTzUnloading firewall moduleszApplying ipsetszApplying default rule setzApplying used zoneszApplying used policies)r �flushr �backendsZ has_ipsets�execute�clearr r� r3 �unload_firewall_modules�apply_default_tablesZ apply_ipsets�apply_default_rulesr6 Z apply_zones�change_default_zonerF r: Zapply_policies)r< �reload�complete_reload� transactionr= r= r> �_start_apply_objects� s< �� � z Firewall._start_apply_objectsc C s� t | �}| j�� r�t�d� | j�|� z|�d� |�� W nR ty~ } z(t|j d|j rb|j nd ��W Y d }~n d }~0 t y� � Y n0 |�d� |�� d S )Nz2Applying direct chains rules and passthrough rulesTz Direct: %s� ) r r7 Zhas_configurationr r� Z apply_directr� r� r' �coder� r� )r< r� �er= r= r> �_start_apply_direct_rules s 0 z"Firewall._start_apply_direct_rulesc C s� dD ]$}|| j �� vrttjd�|���q| j| j �� vr~d| j �� v rNd}nd| j �� v rbd}nd}t�d| j|� || _nt� d| j� | j s�| � � | � � | j dkr�d }n| j }| �|�s�ttjd �| j ���d S ) N)�blockZdropZtrustedzZone '{}' is not available.ZpublicZexternalr� z+Default zone '%s' is not valid. Using '%s'.zUsing default zone '%s'Ziptablesr, z'Firewall backend '{}' is not available.)r6 ro r' r& � INVALID_ZONE�formatrF r r� r� r+ r| r� rR �is_backend_enabledr� )r< �zr6 Zbackend_to_checkr= r= r> � _start_check' s4 � ��zFirewall._start_checkc C s� | � � | �� | �| j� | js*| �� | �� | �� | �� | � � | � � | jr\d S t � � dkrpt � � }| j||d� | �� t � � dkr�t � � }t �d|| � d S )Nr �r� r� � z%Flushing and applying took %f seconds)r� r� �_select_firewall_backendrR r+ r� r� r� r� r� r� r ZgetDebugLogLevel�timer� r� Zdebug2)r< r� r� Ztm1Ztm2r= r= r> �_startJ s& zFirewall._startc C st | � � | j�� | j�t�| j�� | �| j� | j s@| � � | � � | � � | � � | j rbdS | j||d� dS )z� This is basically _start() with at least the following differences: - built-in defaults for firewalld.conf - no lockdown list - no user config (/etc/firewalld) - no direct rules Nr� )�cleanupr* � set_defaultsr r� rt r� r� rR r+ r� r� r� r� r� )r< r� r� r= r= r> �_start_failsafei s zFirewall._start_failsafec C s� z | � � W n� ty� } z�t�d� z | �� d| _| �d� W nv ty� } z^t�|� t�� t�|� t�d� z | �� W n ty� Y n0 t � t j � W Y d }~n d }~0 0 |�W Y d }~nd }~0 0 d| _| �d� d S )NzLFailed to load user configuration. Falling back to full stock configuration.�FAILED�ACCEPTz�Failed to load full stock configuration. This likely indicates a system level issue, e.g. the firewall backend (nftables, iptables) is broken. All hope is lost. Exiting.�RUNNING) r� r� r r� r� rD � set_policy� exceptionr� �sys�exitr& r� )r< Z original_exZnew_exr= r= r> �start� s* "zFirewall.startc c s: t j�|�sd S tt �|��D ]}|�d�s.q |V q d S )N�.xml)r� r� �isdir�sorted�listdir�endswith)r< r� r� r= r= r> � _loader_config_file_generator� s z&Firewall._loader_config_file_generatorc C s� | � |�D ]v}t�d|tj|� t||�}|j| j�� v r`| j� |j�}t�d|j tj|j � n|j � tj �rtd|_| j�|� q d S )Nz Loading service file '%s%s%s'�Overrides '%s%s%s'T)r� r r� r� r� r rx r rn rc r� r� � startswith� ETC_FIREWALLDr� r� �r< r� r� rz �orig_objr= r= r> r� � s �zFirewall._loader_servicesc C s� | � |�D ]v}t�d|tj|� t||�}|j| j�� v r`| j� |j�}t�d|j tj|j � n|j � tj �rtd|_| j�|� q d S )NzLoading ipset file '%s%s%s'r� T)r� r r� r� r� r rx r rk rY r� r� r� r� r� r� r� r= r= r> r� � s �zFirewall._loader_ipsetsc C s� | � |�D ]v}t�d|tj|� t||�}|j| j�� v r`| j� |j�}t�d|j tj|j � n|j � tj �rtd|_| j�|� q d S )Nz Loading helper file '%s%s%s'r� T)r� r r� r� r� r" rx r rl r_ r� r� r� r� r� r� r� r= r= r> r� � s �zFirewall._loader_helpersc C s� | � |�D ]v}t�d|tj|� t||�}|j| j�� v r`| j� |j�}t�d|j tj|j � n|j � tj �rtd|_| j�|� q d S )Nz Loading policy file '%s%s%s'r� T)r� r r� r� r� r# rx r r� r� r� r� r� r� r� Zadd_policy_objectr� r= r= r> r� � s �zFirewall._loader_policiesc C s� | � |�D ]v}t�d|tj|� t||�}|j| j�� v r`| j� |j�}t�d|j tj|j � n|j � tj �rtd|_| j�|� q d S )Nz Loading icmptype file '%s%s%s'r� T)r� r r� r� r� r rx r rm ra r� r� r� r� r� r� r� r= r= r> r� � s �zFirewall._loader_icmptypesc C s t j�|�sd S tt �|��D ]�}|�d�sd|�tj�r t j�d||f �r | j d||f dd� q d||f }t � d|� t |||d�}|r�dt j� |�t j� |�dd� f |_|�|j� |j| j�� v r�| j�|j�}t � d |jt j|j� n|j�tj��r d|_| j�|� q d S ) Nr� z%s/%sT)r� zLoading zone file '%s')Z no_check_namer ���r� )r� r� r� r� r� r� r� r r� r� r r� r r� rx r� ro re r� r� r� r� )r< r� r� r� rx rz r� r= r= r> r� � s4 � � �zFirewall._loader_zonesc C sp | j �� | j�� | j�� | j�� | j�� | j�� | j�� | j�� | j �� | j �� | � � d S r( ) r4 r� r5 r6 r r9 r r7 r8 r: r* r; rO r= r= r> r� s zFirewall.cleanupc C sN | j sB| jr(| �� | j�� | �d� | jrBt�d� | j� � | � � d S )Nr� z!Unloading firewall kernel modules) r+ rI r� r r� rJ r r� r3 r� r� rO r= r= r> �stop s z Firewall.stopc C s� d}d}t |�D ]�\}}|r.| j�|�\}}n$| j| dkrBd}n| j�|�\}}|dkrl|d7 }||7 }q|r�| j�|d� | j| d7 < q|| jv r| j| d8 < | j| dkr| j|= q||fS )Nr r� r� )� enumerater3 � load_modulerG Z unload_module� setdefault) r< Z_modules�enableZ num_failedZ error_msgs�i�module�statusr� r= r= r> �handle_modules. s( zFirewall.handle_modulesc C s |dkrd| _ d S )Nr F)rV )r< �backendr= r= r> r� H s z!Firewall._select_firewall_backendc C s4 | � � D ]}|j|kr| S qttjd| ��d S )Nz'%s' backend does not exist)� all_backendsrx r' r& r� )r< rx r� r= r= r> �get_backend_by_nameN s �z Firewall.get_backend_by_namec C s\ | j r | jS |dkr | jr | jS |dkr4| jr4| jS |dkrH| jrH| jS tt j d| ��d S �Nri rj �ebz-'%s' is not a valid backend or is unavailable) rV r2 rA r- rB r/ rC r0 r' r& � INVALID_IPV�r< �ipvr= r= r> �get_backend_by_ipvU s �zFirewall.get_backend_by_ipvc C sP |dkr| j r| jS |dkr(| jr(| jS |dkr<| jr<| jS ttjd| ��d S r� ) rA r- rB r/ rC r0 r' r& r� r� r= r= r> �get_direct_backend_by_ipva s �z"Firewall.get_direct_backend_by_ipvc C s< |dkr| j S |dkr | jS |dkr*| jS |dkr8| jS dS )Nr, r. r r F)rA rB rC rV )r< rx r= r= r> r� k s zFirewall.is_backend_enabledc C s8 | j r dS |dkr| jS |dkr&| jS |dkr4| jS dS )NTri rj r� F)rV rA rB rC r� r= r= r> �is_ipv_enabledv s zFirewall.is_ipv_enabledc C sR g }| j r|�| j� n6| jr*|�| j� | jr<|�| j� | jrN|�| j� |S r( ) rV ru r2 rA r- rB r/ rC r0 �r< r� r= r= r> �enabled_backends� s zFirewall.enabled_backendsc C sP g }| j r|�| j� | jr(|�| j� | jr:|�| j� | jrL|�| j� |S r( ) rA ru r- rB r/ rC r0 rV r2 r� r= r= r> r� � s zFirewall.all_backendsNc C sJ |d u rt | �}n|}| �� D ]}|�||�� � q |d u rF|�d� d S �NT)r r � add_rulesZbuild_default_tablesr� )r< r� r� r� r= r= r> r� � s z Firewall.apply_default_tablesc C s� |d u rt | �}n|}| �� D ] }|�| j�}|�||� q | �d�r~| �d�}d|�� v r~| jdkr~|� | j�}|�||� | �d�r�| j r�|� � }|�||� |d u r�|� d� d S )Nrj �rawr� T) r r Zbuild_default_rulesrN r r� r� r~ rK Zbuild_rpfilter_rulesrT Zbuild_rfc3964_ipv4_rulesr� )r< r� r� r� �rulesZ ipv6_backendr= r= r> r� � s" z Firewall.apply_default_rulesc C s | j r| j�� sdS dS )NTF)rV r7 Zhas_runtime_configurationrO r= r= r> � may_skip_flush_direct_backends� s z'Firewall.may_skip_flush_direct_backendsc C s\ |d u rt | �}n|}| �� D ]&}|| �� v r0q |�� }|�||� q |d u rX|�d� d S r )r r� r �build_flush_rulesr r� �r< r� r� r� r r= r= r> �flush_direct_backends� s z Firewall.flush_direct_backendsc C sl |d u rt | �}n|}t�d� | �� s4| j|d� | �� D ]}|�� }|�||� q<|d u rh|�d� d S )NzFlushing rule setr� T) r r r� r r r r r r� r r= r= r> r� � s zFirewall.flushc C s0 |d u r$|dkrdnd}|||d�}|� ||�S )Nr� �DROP)ZINPUTZOUTPUTZFORWARD)Zbuild_set_policy_rules)r< r� r: �policy_detailsZdpr= r= r> �_set_policy_build_rules� s �z Firewall._set_policy_build_rulesc C s| |d u rt | �}n|}t�d||dkr8dt�|�� d�nd� | �� D ] }| �|||�}|�||� qF|d u rx|�d� d S )NzSetting policy to '%s'%sr z (ReloadPolicy=�)r� T) r r r� r Z_unparse_reload_policyr r r r� )r< r: r r� r� r� r r= r= r> r� � s �� zFirewall.set_policyc C sB |sdS | � |�}|s&ttjd| ��| �|�s4dS |�|| j�S )Nr� �'%s' is not a valid backend)r� r' r& r� r� �set_rulerN )r< � backend_name�ruler� r= r= r> r s � z Firewall.rulec C s t td |��}| �|�}|s,ttjd| ��| �|�s:d S | jsZ|jrZ|dk�r| j j �st |�D ]�\}}z|� || j � W qb ty� } zjt�t�� � t�|� t|d |� �D ]0}z|� |�|�| j � W q� ty� Y q�0 q�|�W Y d }~qbd }~0 0 qbn|�|| j � d S )Nr r )�listr} r� r' r& r� r� rM r� r0 r� r� r rN r� r r� � traceback� format_excr� �reversedZ reverse_ruleZ set_rules) r< r r Z_rulesr� r� r r� Zrruler= r= r> r s8 � ��� zFirewall.rulesc C s | j rttj��d S r( )rE r' r& Z PANIC_MODErO r= r= r> � check_panic5 s zFirewall.check_panicc C s" |}|| j �� vr ttj|��|S r( )r: Z get_policiesr' r& ZINVALID_POLICY)r< r: Z_policyr= r= r> � check_policy9 s zFirewall.check_policyc C s6 |}|r|dkr| � � }|| j�� vr2ttj|��|S )Nr� )�get_default_zoner6 ro r' r& r� )r< r6 �_zoner= r= r> � check_zone? s zFirewall.check_zonec C s t �|�sttj|��d S r( )r ZcheckInterfacer' r& ZINVALID_INTERFACE)r< � interfacer= r= r> �check_interfaceG s zFirewall.check_interfacec C s | j �|� d S r( )r5 � check_service)r< r5 r= r= r> r K s zFirewall.check_servicec C s t �|�sttj|��d S r( )r � check_portr' r& Z INVALID_PORT)r< �portr= r= r> r N s zFirewall.check_portc C s* |st tj��|dvr&t tjd| ��d S )N)ZtcpZudpZsctpZdccpz''%s' not in {'tcp'|'udp'|'sctp'|'dccp'})r' r& ZMISSING_PROTOCOLZINVALID_PROTOCOL)r< Zprotocolr= r= r> � check_tcpudpR s ��zFirewall.check_tcpudpc C s t �|�sttj|��d S r( )r ZcheckIPr' r& � INVALID_ADDR)r< �ipr= r= r> �check_ipZ s zFirewall.check_ipc C sP |dkr t �|�sLttj|��n,|dkr@t �|�sLttj|��n ttjd��d S )Nri rj z'%s' not in {'ipv4'|'ipv6'})r Z checkIPnMaskr' r& r Z checkIP6nMaskr� )r< r� �sourcer= r= r> � check_address^ s �zFirewall.check_addressc C s | j �|� d S r( )r4 �check_icmptype)r< Zicmpr= r= r> r% i s zFirewall.check_icmptypec C s> t |t�s td|t|�f ��t|�dk r:ttjd| ��d S )Nz%s is %s, expected intr z#timeout '%d' is not positive number)� isinstance�int� TypeError�typer' r& � INVALID_VALUE)r< �timeoutr= r= r> � check_timeoutl s �zFirewall.check_timeoutc C s� t | � | j}| j�� }| j}| j}|s`i }| j�� D ]}| j�|�j ||< q6| j � � }| � � } g } | j� � D ]} | �| j�| �� qn|s�t�| j�d��} | jd| d� | �� | �� d } z| jd|d� W n( ty� } z|} W Y d }~n d }~0 0 |�r8| D ]2}| j�|j��s| j�r|�s| j � |j� �q|�s�| � � }|| k�r�||v�rbi ||< || D ]0}|| j v �rj|| | || |< || |= �qj| j�� D ]B}||v �r�|| D ]}| j� ||� �q�||= n t �!d|� �q�t"|�dk�r t#|�$� �D ]}t �!d|� ||= �q~| D ]�}| j�|j��r�|j%D ]T}z| j�&|j|� W n8 t'�y� } z |j(t)j*k�rz|�W Y d }~n d }~0 0 �q>n| j�+|� | j�,|j� �q$| j �-|� t.� }|�r| j�� d g D ](}t/|�D ]}| jj |||d � �q�q�|| _| j�s | �d � | j�s�|| jk�r�|d k�rd| �0| j1d �D ]}| j1�2|| j3� �qJnT| �0| j4d �D ]}| j4�2|| j3� �qr| j5�r�| �0| j6d �D ]}| j6�2|| j3� �q�| �r�d | _7| �nd| _7d S )NZ ReloadPolicyr )r Tr� zNew zone '%s'.r z(Lost zone '%s', zone interfaces dropped.r� )Zsenderr� r r� r� )8r$ rE r Zomit_native_ipsetrR rS r6 ro re � interfacesr7 Zget_runtime_configr rk ru rY r Z_parse_reload_policyr* rp r� r� r� r� r� Z query_ipsetrx rL r1 Z set_destroyrQ �change_zone_of_interfacer r �lenr �keys�entriesZ add_entryr' r� r& �ALREADY_ENABLEDr� Z apply_ipsetZ set_configr r r r2 r rN r- rB r/ rD )r< r� rE Z_omit_native_ipsetZold_firewall_backendZ flush_allZ_zone_interfacesr6 Z_direct_config�_old_dzZ _ipset_objs�_nameZ reload_policyZstart_exceptionr� rz Z_new_dz�ifaceZ interface_id�entryr� Z nm_bus_namer r r= r= r> r� u s� � � ���zFirewall.reloadc C s | j S r( )rD rO r= r= r> � get_state s zFirewall.get_statec C s\ | j rttjd��z| �d� W n0 tyP } zttj|��W Y d }~n d }~0 0 d| _ d S )Nzpanic mode already enabledZPANICT)rE r' r& r2 r� r� �COMMAND_FAILEDr� r= r= r> �enable_panic_mode s �"zFirewall.enable_panic_modec C s\ | j sttjd��z| �d� W n0 tyP } zttj|��W Y d }~n d }~0 0 d| _ d S )Nzpanic mode is not enabledr� F)rE r' r& Z NOT_ENABLEDr� r� r8 r� r= r= r> �disable_panic_mode s �"zFirewall.disable_panic_modec C s | j S r( )rE rO r= r= r> �query_panic_mode s zFirewall.query_panic_modec C s | j S r( )rN rO r= r= r> �get_log_denied! s zFirewall.get_log_deniedc C sb |t jvr&ttjd|d�t j�f ��|| �� krR|| _| j� d|� | j� � n ttj |��d S )Nz'%s', choose from '%s'z','r� ) r ZLOG_DENIED_VALUESr' r& r* �joinr< rN r* rq �writeZ ALREADY_SET)r< r� r= r= r> �set_log_denied$ s �� zFirewall.set_log_deniedc C s | j S r( )rF rO r= r= r> r 3 s zFirewall.get_default_zonec C s� | � |�}|| jkr~| j}|| _| j�d|� | j�� | jrBd S | j�||� | j�|�j D ] }|| j v r^| j� d|� q^n t t j|��d S )Nr� r� )r rF r* rq r> r+ r6 r� re r- rQ r. r' r& ZZONE_ALREADY_SET)r< r6 r r3 r5 r= r= r> �set_default_zone6 s zFirewall.set_default_zonec C sD |� � }|�� D ].\}}|s&t|t�r0|||< q||v r||= q|S r( )rt ry r& �bool)r< Z permanentrh Zcombined�keyr� r= r= r> �'combine_runtime_with_permanent_settingsM s z0Firewall.combine_runtime_with_permanent_settingsc C s, dD ]"}||v rdd� || D �||< qi }i }t |�� �t |�� �B D ]�}||v rHt|| t�r�t ||v rt|| ng �}tt || �| �||< t|t || �A |@ �||< qHt|| t�s�t|| t��r|| s�|| r�d||< n || �r"|| �s"d||< qHttjd� t || �|���qH||fS )N)Z rich_rulesZ rules_strc S s g | ]}t t|d ���qS ))�rule_str)�strr% )rZ rD r= r= r> � <listcomp>_ r] z;Firewall.get_added_and_removed_settings.<locals>.<listcomp>TFz Unhandled setting type {} key {}) rq r0 r& r rA r' r' r& ZINVALID_SETTINGr� r) )r< Z old_settingsZ new_settingsZrich_keyZ add_settingsZremove_settingsrB �oldr= r= r> � get_added_and_removed_settings[ s$ z'Firewall.get_added_and_removed_settings)F)FF)FF)FF)F)N)N)N)N)N)NN)F)K�__name__� __module__� __qualname__r? rP r; rv r rE r r r| r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r r� r� r� r r r� r r� r r r r r r r r r r" r$ r% r, r� r7 r9 r: r; r< r? r r@ rC rH r= r= r= r> r F s� %* Gd0 .# " )I�__all__r� r� rt r� r �typingr r Zfirewallr r Z firewall.corer r r r r Zfirewall.core.fw_icmptyper Zfirewall.core.fw_servicer Zfirewall.core.fw_zoner Zfirewall.core.fw_directr Zfirewall.core.fw_configr Zfirewall.core.fw_policiesr Zfirewall.core.fw_ipsetr Z firewall.core.fw_transactionr Zfirewall.core.fw_helperr Zfirewall.core.fw_policyr Zfirewall.core.fw_nmr r Zfirewall.core.loggerr Zfirewall.core.io.io_objectr Z firewall.core.io.firewalld_confr Zfirewall.core.io.directr Zfirewall.core.io.servicer Zfirewall.core.io.icmptyper Zfirewall.core.io.zoner r Zfirewall.core.io.ipsetr Zfirewall.core.ipsetr! Zfirewall.core.io.helperr" Zfirewall.core.io.policyr# Zfirewall.core.io.functionsr$ Zfirewall.core.richr% r& Zfirewall.errorsr' �objectr r= r= r= r> �<module> sP